@jaguilar87/gaia-ops 4.4.0 → 4.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (371) hide show
  1. package/.claude-plugin/marketplace.json +1 -1
  2. package/.claude-plugin/plugin.json +12 -3
  3. package/ARCHITECTURE.md +9 -8
  4. package/CHANGELOG.md +34 -0
  5. package/README.md +43 -11
  6. package/agents/terraform-architect.md +1 -1
  7. package/bin/README.md +2 -2
  8. package/bin/gaia-doctor.js +18 -5
  9. package/bin/gaia-history.js +0 -1
  10. package/bin/gaia-metrics.js +2 -2
  11. package/bin/gaia-scan.py +23 -1
  12. package/bin/gaia-update.js +346 -54
  13. package/bin/pre-publish-validate.js +33 -10
  14. package/commands/gaia.md +37 -0
  15. package/config/README.md +3 -9
  16. package/config/context-contracts.json +47 -15
  17. package/config/surface-routing.json +9 -1
  18. package/dist/gaia-ops/.claude-plugin/plugin.json +22 -0
  19. package/dist/gaia-ops/agents/cloud-troubleshooter.md +73 -0
  20. package/dist/gaia-ops/agents/devops-developer.md +57 -0
  21. package/dist/gaia-ops/agents/gaia-system.md +58 -0
  22. package/dist/gaia-ops/agents/gitops-operator.md +60 -0
  23. package/dist/gaia-ops/agents/speckit-planner.md +71 -0
  24. package/dist/gaia-ops/agents/terraform-architect.md +60 -0
  25. package/dist/gaia-ops/commands/gaia.md +37 -0
  26. package/dist/gaia-ops/config/README.md +58 -0
  27. package/dist/gaia-ops/config/cloud/aws.json +140 -0
  28. package/dist/gaia-ops/config/cloud/gcp.json +145 -0
  29. package/dist/gaia-ops/config/context-contracts.json +131 -0
  30. package/dist/gaia-ops/config/git_standards.json +72 -0
  31. package/dist/gaia-ops/config/surface-routing.json +197 -0
  32. package/dist/gaia-ops/config/universal-rules.json +10 -0
  33. package/dist/gaia-ops/hooks/adapters/__init__.py +52 -0
  34. package/dist/gaia-ops/hooks/adapters/base.py +219 -0
  35. package/dist/gaia-ops/hooks/adapters/channel.py +17 -0
  36. package/dist/gaia-ops/hooks/adapters/claude_code.py +1477 -0
  37. package/dist/gaia-ops/hooks/adapters/types.py +194 -0
  38. package/dist/gaia-ops/hooks/adapters/utils.py +25 -0
  39. package/dist/gaia-ops/hooks/hooks.json +126 -0
  40. package/dist/gaia-ops/hooks/modules/__init__.py +15 -0
  41. package/dist/gaia-ops/hooks/modules/agents/__init__.py +29 -0
  42. package/dist/gaia-ops/hooks/modules/agents/contract_validator.py +647 -0
  43. package/dist/gaia-ops/hooks/modules/agents/response_contract.py +496 -0
  44. package/dist/gaia-ops/hooks/modules/agents/skill_injection_verifier.py +124 -0
  45. package/dist/gaia-ops/hooks/modules/agents/task_info_builder.py +74 -0
  46. package/dist/gaia-ops/hooks/modules/agents/transcript_analyzer.py +458 -0
  47. package/dist/gaia-ops/hooks/modules/agents/transcript_reader.py +152 -0
  48. package/dist/gaia-ops/hooks/modules/audit/__init__.py +28 -0
  49. package/dist/gaia-ops/hooks/modules/audit/event_detector.py +168 -0
  50. package/dist/gaia-ops/hooks/modules/audit/logger.py +131 -0
  51. package/dist/gaia-ops/hooks/modules/audit/metrics.py +134 -0
  52. package/dist/gaia-ops/hooks/modules/audit/workflow_auditor.py +576 -0
  53. package/dist/gaia-ops/hooks/modules/audit/workflow_recorder.py +296 -0
  54. package/dist/gaia-ops/hooks/modules/context/__init__.py +11 -0
  55. package/dist/gaia-ops/hooks/modules/context/anchor_tracker.py +317 -0
  56. package/dist/gaia-ops/hooks/modules/context/compact_context_builder.py +215 -0
  57. package/dist/gaia-ops/hooks/modules/context/context_cache.py +129 -0
  58. package/dist/gaia-ops/hooks/modules/context/context_freshness.py +145 -0
  59. package/dist/gaia-ops/hooks/modules/context/context_injector.py +427 -0
  60. package/dist/gaia-ops/hooks/modules/context/context_writer.py +518 -0
  61. package/dist/gaia-ops/hooks/modules/context/contracts_loader.py +161 -0
  62. package/dist/gaia-ops/hooks/modules/core/__init__.py +40 -0
  63. package/dist/gaia-ops/hooks/modules/core/hook_entry.py +78 -0
  64. package/dist/gaia-ops/hooks/modules/core/paths.py +160 -0
  65. package/dist/gaia-ops/hooks/modules/core/plugin_mode.py +149 -0
  66. package/dist/gaia-ops/hooks/modules/core/plugin_setup.py +558 -0
  67. package/dist/gaia-ops/hooks/modules/core/state.py +179 -0
  68. package/dist/gaia-ops/hooks/modules/core/stdin.py +24 -0
  69. package/dist/gaia-ops/hooks/modules/events/__init__.py +1 -0
  70. package/dist/gaia-ops/hooks/modules/events/event_writer.py +210 -0
  71. package/dist/gaia-ops/hooks/modules/identity/__init__.py +0 -0
  72. package/dist/gaia-ops/hooks/modules/identity/identity_provider.py +21 -0
  73. package/dist/gaia-ops/hooks/modules/identity/ops_identity.py +34 -0
  74. package/dist/gaia-ops/hooks/modules/identity/security_identity.py +10 -0
  75. package/dist/gaia-ops/hooks/modules/memory/__init__.py +8 -0
  76. package/dist/gaia-ops/hooks/modules/memory/episode_writer.py +227 -0
  77. package/dist/gaia-ops/hooks/modules/orchestrator/__init__.py +1 -0
  78. package/dist/gaia-ops/hooks/modules/orchestrator/delegate_mode.py +128 -0
  79. package/dist/gaia-ops/hooks/modules/scanning/__init__.py +8 -0
  80. package/dist/gaia-ops/hooks/modules/scanning/scan_trigger.py +84 -0
  81. package/dist/gaia-ops/hooks/modules/security/__init__.py +89 -0
  82. package/dist/gaia-ops/hooks/modules/security/approval_cleanup.py +87 -0
  83. package/dist/gaia-ops/hooks/modules/security/approval_constants.py +23 -0
  84. package/dist/gaia-ops/hooks/modules/security/approval_grants.py +912 -0
  85. package/dist/gaia-ops/hooks/modules/security/approval_messages.py +71 -0
  86. package/dist/gaia-ops/hooks/modules/security/approval_scopes.py +153 -0
  87. package/dist/gaia-ops/hooks/modules/security/blocked_commands.py +584 -0
  88. package/dist/gaia-ops/hooks/modules/security/blocked_message_formatter.py +86 -0
  89. package/dist/gaia-ops/hooks/modules/security/command_semantics.py +130 -0
  90. package/dist/gaia-ops/hooks/modules/security/gitops_validator.py +179 -0
  91. package/dist/gaia-ops/hooks/modules/security/mutative_verbs.py +850 -0
  92. package/dist/gaia-ops/hooks/modules/security/prompt_validator.py +40 -0
  93. package/dist/gaia-ops/hooks/modules/security/tiers.py +196 -0
  94. package/dist/gaia-ops/hooks/modules/session/__init__.py +10 -0
  95. package/dist/gaia-ops/hooks/modules/session/session_context_writer.py +100 -0
  96. package/dist/gaia-ops/hooks/modules/session/session_event_injector.py +158 -0
  97. package/dist/gaia-ops/hooks/modules/session/session_manager.py +31 -0
  98. package/dist/gaia-ops/hooks/modules/tools/__init__.py +25 -0
  99. package/dist/gaia-ops/hooks/modules/tools/bash_validator.py +708 -0
  100. package/dist/gaia-ops/hooks/modules/tools/cloud_pipe_validator.py +181 -0
  101. package/dist/gaia-ops/hooks/modules/tools/hook_response.py +55 -0
  102. package/dist/gaia-ops/hooks/modules/tools/shell_parser.py +227 -0
  103. package/dist/gaia-ops/hooks/modules/tools/task_validator.py +283 -0
  104. package/dist/gaia-ops/hooks/modules/validation/__init__.py +23 -0
  105. package/dist/gaia-ops/hooks/modules/validation/commit_validator.py +380 -0
  106. package/dist/gaia-ops/hooks/post_compact.py +43 -0
  107. package/dist/gaia-ops/hooks/post_tool_use.py +54 -0
  108. package/dist/gaia-ops/hooks/pre_tool_use.py +383 -0
  109. package/dist/gaia-ops/hooks/session_start.py +69 -0
  110. package/dist/gaia-ops/hooks/stop_hook.py +69 -0
  111. package/dist/gaia-ops/hooks/subagent_start.py +71 -0
  112. package/dist/gaia-ops/hooks/subagent_stop.py +288 -0
  113. package/dist/gaia-ops/hooks/task_completed.py +70 -0
  114. package/dist/gaia-ops/hooks/user_prompt_submit.py +177 -0
  115. package/dist/gaia-ops/settings.json +72 -0
  116. package/dist/gaia-ops/skills/README.md +109 -0
  117. package/dist/gaia-ops/skills/agent-protocol/SKILL.md +105 -0
  118. package/dist/gaia-ops/skills/agent-protocol/examples.md +170 -0
  119. package/dist/gaia-ops/skills/agent-response/SKILL.md +53 -0
  120. package/dist/gaia-ops/skills/approval/SKILL.md +85 -0
  121. package/dist/gaia-ops/skills/approval/examples.md +140 -0
  122. package/dist/gaia-ops/skills/approval/reference.md +57 -0
  123. package/dist/gaia-ops/skills/command-execution/SKILL.md +64 -0
  124. package/dist/gaia-ops/skills/command-execution/reference.md +83 -0
  125. package/dist/gaia-ops/skills/context-updater/SKILL.md +76 -0
  126. package/dist/gaia-ops/skills/context-updater/examples.md +71 -0
  127. package/dist/gaia-ops/skills/developer-patterns/SKILL.md +93 -0
  128. package/dist/gaia-ops/skills/developer-patterns/reference.md +112 -0
  129. package/dist/gaia-ops/skills/execution/SKILL.md +66 -0
  130. package/dist/gaia-ops/skills/fast-queries/SKILL.md +47 -0
  131. package/dist/gaia-ops/skills/gaia-patterns/SKILL.md +92 -0
  132. package/dist/gaia-ops/skills/gaia-patterns/reference.md +22 -0
  133. package/dist/gaia-ops/skills/git-conventions/SKILL.md +48 -0
  134. package/dist/gaia-ops/skills/gitops-patterns/SKILL.md +73 -0
  135. package/dist/gaia-ops/skills/gitops-patterns/reference.md +183 -0
  136. package/dist/gaia-ops/skills/investigation/SKILL.md +77 -0
  137. package/dist/gaia-ops/skills/orchestrator-approval/SKILL.md +64 -0
  138. package/dist/gaia-ops/skills/reference.md +134 -0
  139. package/dist/gaia-ops/skills/security-tiers/SKILL.md +61 -0
  140. package/dist/gaia-ops/skills/security-tiers/destructive-commands-reference.md +623 -0
  141. package/dist/gaia-ops/skills/security-tiers/reference.md +39 -0
  142. package/dist/gaia-ops/skills/skill-creation/SKILL.md +119 -0
  143. package/dist/gaia-ops/skills/specification/SKILL.md +186 -0
  144. package/dist/gaia-ops/skills/speckit-workflow/SKILL.md +165 -0
  145. package/dist/gaia-ops/skills/speckit-workflow/reference.md +117 -0
  146. package/dist/gaia-ops/skills/terraform-patterns/SKILL.md +63 -0
  147. package/dist/gaia-ops/skills/terraform-patterns/reference.md +93 -0
  148. package/dist/gaia-ops/speckit/README.md +516 -0
  149. package/dist/gaia-ops/speckit/scripts/.gitkeep +0 -0
  150. package/dist/gaia-ops/speckit/templates/adr-template.md +118 -0
  151. package/dist/gaia-ops/speckit/templates/agent-file-template.md +23 -0
  152. package/dist/gaia-ops/speckit/templates/plan-template.md +227 -0
  153. package/dist/gaia-ops/speckit/templates/spec-template.md +140 -0
  154. package/dist/gaia-ops/speckit/templates/tasks-template.md +257 -0
  155. package/dist/gaia-ops/tools/context/README.md +132 -0
  156. package/dist/gaia-ops/tools/context/__init__.py +42 -0
  157. package/dist/gaia-ops/tools/context/_paths.py +20 -0
  158. package/dist/gaia-ops/tools/context/context_provider.py +476 -0
  159. package/dist/gaia-ops/tools/context/context_section_reader.py +330 -0
  160. package/dist/gaia-ops/tools/context/deep_merge.py +159 -0
  161. package/dist/gaia-ops/tools/context/pending_updates.py +760 -0
  162. package/dist/gaia-ops/tools/context/surface_router.py +278 -0
  163. package/dist/gaia-ops/tools/fast-queries/README.md +65 -0
  164. package/dist/gaia-ops/tools/fast-queries/__init__.py +30 -0
  165. package/dist/gaia-ops/tools/fast-queries/appservices/quicktriage_devops_developer.sh +75 -0
  166. package/dist/gaia-ops/tools/fast-queries/cloud/aws/quicktriage_aws_troubleshooter.sh +32 -0
  167. package/dist/gaia-ops/tools/fast-queries/cloud/gcp/quicktriage_gcp_troubleshooter.sh +88 -0
  168. package/dist/gaia-ops/tools/fast-queries/gitops/quicktriage_gitops_operator.sh +48 -0
  169. package/dist/gaia-ops/tools/fast-queries/run_triage.sh +59 -0
  170. package/dist/gaia-ops/tools/fast-queries/terraform/quicktriage_terraform_architect.sh +80 -0
  171. package/dist/gaia-ops/tools/gaia_simulator/__init__.py +33 -0
  172. package/dist/gaia-ops/tools/gaia_simulator/cli.py +354 -0
  173. package/dist/gaia-ops/tools/gaia_simulator/extractor.py +457 -0
  174. package/dist/gaia-ops/tools/gaia_simulator/reporter.py +258 -0
  175. package/dist/gaia-ops/tools/gaia_simulator/routing_simulator.py +334 -0
  176. package/dist/gaia-ops/tools/gaia_simulator/runner.py +539 -0
  177. package/dist/gaia-ops/tools/gaia_simulator/skills_mapper.py +262 -0
  178. package/dist/gaia-ops/tools/memory/README.md +0 -0
  179. package/dist/gaia-ops/tools/memory/__init__.py +20 -0
  180. package/dist/gaia-ops/tools/memory/episodic.py +1196 -0
  181. package/dist/gaia-ops/tools/persist_transcript_analysis.py +85 -0
  182. package/dist/gaia-ops/tools/review/__init__.py +1 -0
  183. package/dist/gaia-ops/tools/review/review_engine.py +157 -0
  184. package/dist/gaia-ops/tools/scan/__init__.py +35 -0
  185. package/dist/gaia-ops/tools/scan/config.py +247 -0
  186. package/dist/gaia-ops/tools/scan/merge.py +212 -0
  187. package/dist/gaia-ops/tools/scan/orchestrator.py +549 -0
  188. package/dist/gaia-ops/tools/scan/registry.py +127 -0
  189. package/dist/gaia-ops/tools/scan/scanners/__init__.py +18 -0
  190. package/dist/gaia-ops/tools/scan/scanners/base.py +137 -0
  191. package/dist/gaia-ops/tools/scan/scanners/environment.py +324 -0
  192. package/dist/gaia-ops/tools/scan/scanners/git.py +570 -0
  193. package/dist/gaia-ops/tools/scan/scanners/infrastructure.py +875 -0
  194. package/dist/gaia-ops/tools/scan/scanners/orchestration.py +600 -0
  195. package/dist/gaia-ops/tools/scan/scanners/stack.py +1085 -0
  196. package/dist/gaia-ops/tools/scan/scanners/tools.py +260 -0
  197. package/dist/gaia-ops/tools/scan/setup.py +753 -0
  198. package/dist/gaia-ops/tools/scan/tests/__init__.py +1 -0
  199. package/dist/gaia-ops/tools/scan/tests/conftest.py +796 -0
  200. package/dist/gaia-ops/tools/scan/tests/test_environment.py +323 -0
  201. package/dist/gaia-ops/tools/scan/tests/test_git.py +419 -0
  202. package/dist/gaia-ops/tools/scan/tests/test_infrastructure.py +382 -0
  203. package/dist/gaia-ops/tools/scan/tests/test_integration.py +920 -0
  204. package/dist/gaia-ops/tools/scan/tests/test_merge.py +269 -0
  205. package/dist/gaia-ops/tools/scan/tests/test_orchestration.py +304 -0
  206. package/dist/gaia-ops/tools/scan/tests/test_stack.py +604 -0
  207. package/dist/gaia-ops/tools/scan/tests/test_tools.py +349 -0
  208. package/dist/gaia-ops/tools/scan/ui.py +624 -0
  209. package/dist/gaia-ops/tools/scan/verify.py +266 -0
  210. package/dist/gaia-ops/tools/scan/walk.py +118 -0
  211. package/dist/gaia-ops/tools/scan/workspace.py +85 -0
  212. package/dist/gaia-ops/tools/validation/README.md +244 -0
  213. package/dist/gaia-ops/tools/validation/__init__.py +17 -0
  214. package/dist/gaia-ops/tools/validation/approval_gate.py +321 -0
  215. package/dist/gaia-ops/tools/validation/validate_skills.py +189 -0
  216. package/dist/gaia-security/.claude-plugin/plugin.json +22 -0
  217. package/dist/gaia-security/config/universal-rules.json +10 -0
  218. package/dist/gaia-security/hooks/adapters/__init__.py +52 -0
  219. package/dist/gaia-security/hooks/adapters/base.py +219 -0
  220. package/dist/gaia-security/hooks/adapters/channel.py +17 -0
  221. package/dist/gaia-security/hooks/adapters/claude_code.py +1477 -0
  222. package/dist/gaia-security/hooks/adapters/types.py +194 -0
  223. package/dist/gaia-security/hooks/adapters/utils.py +25 -0
  224. package/dist/gaia-security/hooks/hooks.json +57 -0
  225. package/dist/gaia-security/hooks/modules/__init__.py +15 -0
  226. package/dist/gaia-security/hooks/modules/agents/__init__.py +29 -0
  227. package/dist/gaia-security/hooks/modules/agents/contract_validator.py +647 -0
  228. package/dist/gaia-security/hooks/modules/agents/response_contract.py +496 -0
  229. package/dist/gaia-security/hooks/modules/agents/skill_injection_verifier.py +124 -0
  230. package/dist/gaia-security/hooks/modules/agents/task_info_builder.py +74 -0
  231. package/dist/gaia-security/hooks/modules/agents/transcript_analyzer.py +458 -0
  232. package/dist/gaia-security/hooks/modules/agents/transcript_reader.py +152 -0
  233. package/dist/gaia-security/hooks/modules/audit/__init__.py +28 -0
  234. package/dist/gaia-security/hooks/modules/audit/event_detector.py +168 -0
  235. package/dist/gaia-security/hooks/modules/audit/logger.py +131 -0
  236. package/dist/gaia-security/hooks/modules/audit/metrics.py +134 -0
  237. package/dist/gaia-security/hooks/modules/audit/workflow_auditor.py +576 -0
  238. package/dist/gaia-security/hooks/modules/audit/workflow_recorder.py +296 -0
  239. package/dist/gaia-security/hooks/modules/context/__init__.py +11 -0
  240. package/dist/gaia-security/hooks/modules/context/anchor_tracker.py +317 -0
  241. package/dist/gaia-security/hooks/modules/context/compact_context_builder.py +215 -0
  242. package/dist/gaia-security/hooks/modules/context/context_cache.py +129 -0
  243. package/dist/gaia-security/hooks/modules/context/context_freshness.py +145 -0
  244. package/dist/gaia-security/hooks/modules/context/context_injector.py +427 -0
  245. package/dist/gaia-security/hooks/modules/context/context_writer.py +518 -0
  246. package/dist/gaia-security/hooks/modules/context/contracts_loader.py +161 -0
  247. package/dist/gaia-security/hooks/modules/core/__init__.py +40 -0
  248. package/dist/gaia-security/hooks/modules/core/hook_entry.py +78 -0
  249. package/dist/gaia-security/hooks/modules/core/paths.py +160 -0
  250. package/dist/gaia-security/hooks/modules/core/plugin_mode.py +149 -0
  251. package/dist/gaia-security/hooks/modules/core/plugin_setup.py +558 -0
  252. package/dist/gaia-security/hooks/modules/core/state.py +179 -0
  253. package/dist/gaia-security/hooks/modules/core/stdin.py +24 -0
  254. package/dist/gaia-security/hooks/modules/events/__init__.py +1 -0
  255. package/dist/gaia-security/hooks/modules/events/event_writer.py +210 -0
  256. package/dist/gaia-security/hooks/modules/identity/__init__.py +0 -0
  257. package/dist/gaia-security/hooks/modules/identity/identity_provider.py +21 -0
  258. package/dist/gaia-security/hooks/modules/identity/ops_identity.py +34 -0
  259. package/dist/gaia-security/hooks/modules/identity/security_identity.py +10 -0
  260. package/dist/gaia-security/hooks/modules/memory/__init__.py +8 -0
  261. package/dist/gaia-security/hooks/modules/memory/episode_writer.py +227 -0
  262. package/dist/gaia-security/hooks/modules/orchestrator/__init__.py +1 -0
  263. package/dist/gaia-security/hooks/modules/orchestrator/delegate_mode.py +128 -0
  264. package/dist/gaia-security/hooks/modules/scanning/__init__.py +8 -0
  265. package/dist/gaia-security/hooks/modules/scanning/scan_trigger.py +84 -0
  266. package/dist/gaia-security/hooks/modules/security/__init__.py +89 -0
  267. package/dist/gaia-security/hooks/modules/security/approval_cleanup.py +87 -0
  268. package/dist/gaia-security/hooks/modules/security/approval_constants.py +23 -0
  269. package/dist/gaia-security/hooks/modules/security/approval_grants.py +912 -0
  270. package/dist/gaia-security/hooks/modules/security/approval_messages.py +71 -0
  271. package/dist/gaia-security/hooks/modules/security/approval_scopes.py +153 -0
  272. package/dist/gaia-security/hooks/modules/security/blocked_commands.py +584 -0
  273. package/dist/gaia-security/hooks/modules/security/blocked_message_formatter.py +86 -0
  274. package/dist/gaia-security/hooks/modules/security/command_semantics.py +130 -0
  275. package/dist/gaia-security/hooks/modules/security/gitops_validator.py +179 -0
  276. package/dist/gaia-security/hooks/modules/security/mutative_verbs.py +850 -0
  277. package/dist/gaia-security/hooks/modules/security/prompt_validator.py +40 -0
  278. package/dist/gaia-security/hooks/modules/security/tiers.py +196 -0
  279. package/dist/gaia-security/hooks/modules/session/__init__.py +10 -0
  280. package/dist/gaia-security/hooks/modules/session/session_context_writer.py +100 -0
  281. package/dist/gaia-security/hooks/modules/session/session_event_injector.py +158 -0
  282. package/dist/gaia-security/hooks/modules/session/session_manager.py +31 -0
  283. package/dist/gaia-security/hooks/modules/tools/__init__.py +25 -0
  284. package/dist/gaia-security/hooks/modules/tools/bash_validator.py +708 -0
  285. package/dist/gaia-security/hooks/modules/tools/cloud_pipe_validator.py +181 -0
  286. package/dist/gaia-security/hooks/modules/tools/hook_response.py +55 -0
  287. package/dist/gaia-security/hooks/modules/tools/shell_parser.py +227 -0
  288. package/dist/gaia-security/hooks/modules/tools/task_validator.py +283 -0
  289. package/dist/gaia-security/hooks/modules/validation/__init__.py +23 -0
  290. package/dist/gaia-security/hooks/modules/validation/commit_validator.py +380 -0
  291. package/dist/gaia-security/hooks/post_tool_use.py +54 -0
  292. package/dist/gaia-security/hooks/pre_tool_use.py +383 -0
  293. package/dist/gaia-security/hooks/session_start.py +69 -0
  294. package/dist/gaia-security/hooks/stop_hook.py +69 -0
  295. package/dist/gaia-security/hooks/user_prompt_submit.py +177 -0
  296. package/dist/gaia-security/settings.json +58 -0
  297. package/git-hooks/commit-msg +41 -0
  298. package/hooks/README.md +8 -6
  299. package/hooks/adapters/channel.py +0 -25
  300. package/hooks/adapters/claude_code.py +364 -125
  301. package/hooks/elicitation_result.py +132 -0
  302. package/hooks/hooks.json +10 -1
  303. package/hooks/modules/README.md +3 -2
  304. package/hooks/modules/agents/contract_validator.py +3 -51
  305. package/hooks/modules/agents/response_contract.py +4 -8
  306. package/hooks/modules/agents/transcript_reader.py +4 -5
  307. package/hooks/modules/audit/__init__.py +4 -6
  308. package/hooks/modules/audit/event_detector.py +0 -2
  309. package/hooks/modules/audit/metrics.py +108 -187
  310. package/hooks/modules/audit/workflow_auditor.py +0 -4
  311. package/hooks/modules/audit/workflow_recorder.py +0 -5
  312. package/hooks/modules/context/compact_context_builder.py +1 -0
  313. package/hooks/modules/context/context_cache.py +129 -0
  314. package/hooks/modules/context/context_injector.py +18 -40
  315. package/hooks/modules/context/context_writer.py +1 -25
  316. package/hooks/modules/context/contracts_loader.py +7 -10
  317. package/hooks/modules/core/hook_entry.py +1 -0
  318. package/hooks/modules/core/paths.py +12 -13
  319. package/hooks/modules/core/plugin_mode.py +74 -4
  320. package/hooks/modules/core/plugin_setup.py +395 -23
  321. package/hooks/modules/events/__init__.py +1 -0
  322. package/hooks/modules/events/event_writer.py +210 -0
  323. package/hooks/modules/identity/ops_identity.py +18 -27
  324. package/hooks/modules/memory/episode_writer.py +1 -6
  325. package/hooks/modules/orchestrator/__init__.py +1 -0
  326. package/hooks/modules/orchestrator/delegate_mode.py +128 -0
  327. package/hooks/modules/security/__init__.py +2 -4
  328. package/hooks/modules/security/approval_constants.py +5 -1
  329. package/hooks/modules/security/approval_grants.py +189 -6
  330. package/hooks/modules/security/approval_messages.py +9 -21
  331. package/hooks/modules/security/blocked_commands.py +98 -34
  332. package/hooks/modules/security/command_semantics.py +0 -4
  333. package/hooks/modules/security/gitops_validator.py +1 -11
  334. package/hooks/modules/security/mutative_verbs.py +179 -38
  335. package/hooks/modules/security/tiers.py +1 -19
  336. package/hooks/modules/session/session_event_injector.py +1 -25
  337. package/hooks/modules/tools/bash_validator.py +310 -94
  338. package/hooks/modules/tools/shell_parser.py +0 -1
  339. package/hooks/modules/tools/task_validator.py +9 -29
  340. package/hooks/post_tool_use.py +0 -72
  341. package/hooks/pre_tool_use.py +42 -102
  342. package/hooks/session_start.py +4 -2
  343. package/hooks/subagent_start.py +6 -2
  344. package/hooks/subagent_stop.py +1 -13
  345. package/hooks/user_prompt_submit.py +119 -37
  346. package/index.js +1 -1
  347. package/package.json +5 -3
  348. package/skills/README.md +3 -5
  349. package/skills/agent-protocol/SKILL.md +17 -16
  350. package/skills/agent-protocol/examples.md +6 -6
  351. package/skills/agent-response/SKILL.md +11 -14
  352. package/skills/approval/SKILL.md +28 -13
  353. package/skills/approval/reference.md +2 -2
  354. package/skills/execution/SKILL.md +1 -1
  355. package/skills/gaia-patterns/SKILL.md +2 -3
  356. package/skills/orchestrator-approval/SKILL.md +22 -50
  357. package/skills/security-tiers/SKILL.md +1 -1
  358. package/templates/README.md +9 -9
  359. package/templates/managed-settings.template.json +43 -0
  360. package/tools/gaia_simulator/runner.py +34 -1
  361. package/tools/scan/orchestrator.py +13 -0
  362. package/tools/scan/scanners/base.py +8 -0
  363. package/tools/scan/scanners/git.py +78 -0
  364. package/tools/scan/scanners/infrastructure.py +65 -0
  365. package/tools/scan/scanners/stack.py +110 -0
  366. package/tools/scan/setup.py +120 -13
  367. package/tools/scan/workspace.py +85 -0
  368. package/config/context-contracts.aws.json +0 -42
  369. package/config/context-contracts.gcp.json +0 -39
  370. package/skills/project-dispatch/SKILL.md +0 -34
  371. package/templates/settings.template.json +0 -226
@@ -0,0 +1,118 @@
1
+ # ADR-XXX: [Decision Title]
2
+
3
+ **Status**: Proposed | Accepted | Rejected | Superseded
4
+
5
+ **Date**: YYYY-MM-DD
6
+
7
+ **Tags**: #infrastructure #kubernetes #security
8
+
9
+ ---
10
+
11
+ ## Context
12
+
13
+ What problem or situation requires a decision?
14
+
15
+ Include:
16
+ - Current state and problems
17
+ - Constraints (time, budget, technical)
18
+ - Requirements driving the decision
19
+ - Stakeholders affected
20
+
21
+ ---
22
+
23
+ ## Decision Drivers
24
+
25
+ Key factors influencing this decision:
26
+
27
+ - **Security**: [Requirements or concerns]
28
+ - **Cost**: [Budget implications]
29
+ - **Performance**: [Latency, throughput needs]
30
+ - **Team Skills**: [Expertise or learning curve]
31
+ - **Integration**: [Compatibility with existing stack]
32
+ - **Maintainability**: [Operational complexity]
33
+
34
+ ---
35
+
36
+ ## Options Considered
37
+
38
+ ### Option 1: [Name]
39
+
40
+ **Pros**:
41
+ - ✅ Advantage 1
42
+ - ✅ Advantage 2
43
+
44
+ **Cons**:
45
+ - ❌ Disadvantage 1
46
+ - ❌ Disadvantage 2
47
+
48
+ **Effort**: Low | Medium | High
49
+
50
+ ### Option 2: [Name]
51
+
52
+ **Pros**:
53
+ - ✅ Advantage 1
54
+
55
+ **Cons**:
56
+ - ❌ Disadvantage 1
57
+
58
+ **Effort**: Low | Medium | High
59
+
60
+ ---
61
+
62
+ ## Decision
63
+
64
+ **We chose: [Selected Option]**
65
+
66
+ **Rationale**:
67
+
68
+ Explain why this option was selected:
69
+ 1. Primary deciding factor
70
+ 2. Trade-offs we accept
71
+ 3. How we'll mitigate the cons
72
+
73
+ ---
74
+
75
+ ## Consequences
76
+
77
+ ### Positive
78
+ - ✅ Improvement 1
79
+ - ✅ Improvement 2
80
+
81
+ ### Negative
82
+ - ❌ Challenge 1
83
+ - ❌ Challenge 2
84
+
85
+ ### Mitigations
86
+ - How we'll address challenge 1
87
+ - How we'll address challenge 2
88
+
89
+ ---
90
+
91
+ ## Implementation
92
+
93
+ **Action Items**:
94
+ - [ ] Task 1 (Owner, Deadline)
95
+ - [ ] Task 2 (Owner, Deadline)
96
+
97
+ **Success Criteria**:
98
+ - How we'll validate this decision worked
99
+
100
+ ---
101
+
102
+ ## Compliance
103
+
104
+ **Aligns with governance.md principles**: [Which ones?]
105
+
106
+ **Review Date**: [Optional - When to reconsider]
107
+
108
+ ---
109
+
110
+ ## Related Decisions
111
+
112
+ **Supersedes**: ADR-XXX (if any)
113
+
114
+ **Related**: ADR-XXX, ADR-XXX
115
+
116
+ **References**:
117
+ - [External docs]
118
+ - [Implementation PRs]
@@ -0,0 +1,23 @@
1
+ # [PROJECT NAME] Development Guidelines
2
+
3
+ Auto-generated from all feature plans. Last updated: [DATE]
4
+
5
+ ## Active Technologies
6
+ [EXTRACTED FROM ALL PLAN.MD FILES]
7
+
8
+ ## Project Structure
9
+ ```
10
+ [ACTUAL STRUCTURE FROM PLANS]
11
+ ```
12
+
13
+ ## Commands
14
+ [ONLY COMMANDS FOR ACTIVE TECHNOLOGIES]
15
+
16
+ ## Code Style
17
+ [LANGUAGE-SPECIFIC, ONLY FOR LANGUAGES IN USE]
18
+
19
+ ## Recent Changes
20
+ [LAST 3 FEATURES AND WHAT THEY ADDED]
21
+
22
+ <!-- MANUAL ADDITIONS START -->
23
+ <!-- MANUAL ADDITIONS END -->
@@ -0,0 +1,227 @@
1
+
2
+ # Implementation Plan: [FEATURE]
3
+
4
+ **Branch**: `[###-feature-name]` | **Date**: [DATE] | **Spec**: [link]
5
+ **Input**: Feature specification from `/specs/[###-feature-name]/spec.md`
6
+
7
+ ## Execution Flow (/plan command scope)
8
+ ```
9
+ 1. Load feature spec from Input path
10
+ → If not found: ERROR "No feature spec at {path}"
11
+ 2. Fill Technical Context (scan for NEEDS CLARIFICATION)
12
+ → Detect Project Type from file system structure or context (web=frontend+backend, mobile=app+api)
13
+ → Set Structure Decision based on project type
14
+ 3. Fill the Constitution Check section based on the content of the constitution document.
15
+ 4. Evaluate Constitution Check section below
16
+ → If violations exist: Document in Complexity Tracking
17
+ → If no justification possible: ERROR "Simplify approach first"
18
+ → Update Progress Tracking: Initial Constitution Check
19
+ 5. Execute Phase 0 → research.md
20
+ → If NEEDS CLARIFICATION remain: ERROR "Resolve unknowns"
21
+ 6. Execute Phase 1 → contracts, data-model.md, quickstart.md, agent-specific template file (e.g., `CLAUDE.md` for Claude Code, `.github/copilot-instructions.md` for GitHub Copilot, `GEMINI.md` for Gemini CLI, `QWEN.md` for Qwen Code or `AGENTS.md` for opencode).
22
+ 7. Re-evaluate Constitution Check section
23
+ → If new violations: Refactor design, return to Phase 1
24
+ → Update Progress Tracking: Post-Design Constitution Check
25
+ 8. Plan Phase 2 → Describe task generation approach (DO NOT create tasks.md)
26
+ 9. STOP - Ready for /tasks command
27
+ ```
28
+
29
+ **IMPORTANT**: The /plan command STOPS at step 7. Phases 2-4 are executed by other commands:
30
+ - Phase 2: /tasks command creates tasks.md
31
+ - Phase 3-4: Implementation execution (manual or via tools)
32
+
33
+ ## Summary
34
+ [Extract from feature spec: primary requirement + technical approach from research]
35
+
36
+ ## Technical Context
37
+ **Language/Version**: [e.g., Python 3.11, Swift 5.9, Rust 1.75 or NEEDS CLARIFICATION]
38
+ **Primary Dependencies**: [e.g., FastAPI, UIKit, LLVM or NEEDS CLARIFICATION]
39
+ **Storage**: [if applicable, e.g., PostgreSQL, CoreData, files or N/A]
40
+ **Testing**: [e.g., pytest, XCTest, cargo test or NEEDS CLARIFICATION]
41
+ **Target Platform**: [e.g., Linux server, iOS 15+, WASM or NEEDS CLARIFICATION]
42
+ **Project Type**: [single/web/mobile - determines source structure]
43
+ **Performance Goals**: [domain-specific, e.g., 1000 req/s, 10k lines/sec, 60 fps or NEEDS CLARIFICATION]
44
+ **Constraints**: [domain-specific, e.g., <200ms p95, <100MB memory, offline-capable or NEEDS CLARIFICATION]
45
+ **Scale/Scope**: [domain-specific, e.g., 10k users, 1M LOC, 50 screens or NEEDS CLARIFICATION]
46
+
47
+ ## Constitution Check
48
+ *GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
49
+ <!-- Load project-specific governance rules from governance.md if it exists -->
50
+ <!-- If no governance.md, use these generic checks -->
51
+
52
+ | Check | Status |
53
+ |-------|--------|
54
+ | Changes are additive (no breaking changes to existing interfaces) | {PASS/FAIL/N/A} |
55
+ | No new external dependencies without justification | {PASS/FAIL/N/A} |
56
+ | Security: no credentials, secrets, or PII in code | {PASS/FAIL/N/A} |
57
+ | Testing: plan includes test strategy | {PASS/FAIL/N/A} |
58
+ | Documentation: plan includes doc updates if user-facing | {PASS/FAIL/N/A} |
59
+
60
+ ## Project Structure
61
+
62
+ ### Documentation (this feature)
63
+ ```
64
+ specs/[###-feature]/
65
+ ├── plan.md # This file (/plan command output)
66
+ ├── research.md # Phase 0 output (/plan command)
67
+ ├── data-model.md # Phase 1 output (/plan command)
68
+ ├── quickstart.md # Phase 1 output (/plan command)
69
+ ├── contracts/ # Phase 1 output (/plan command)
70
+ └── tasks.md # Phase 2 output (/tasks command - NOT created by /plan)
71
+ ```
72
+
73
+ ### Source Code (repository root)
74
+ <!--
75
+ ACTION REQUIRED: Replace the placeholder tree below with the concrete layout
76
+ for this feature. Delete unused options and expand the chosen structure with
77
+ real paths (e.g., apps/admin, packages/something). The delivered plan must
78
+ not include Option labels.
79
+ -->
80
+ ```
81
+ # [REMOVE IF UNUSED] Option 1: Single project (DEFAULT)
82
+ src/
83
+ ├── models/
84
+ ├── services/
85
+ ├── cli/
86
+ └── lib/
87
+
88
+ tests/
89
+ ├── contract/
90
+ ├── integration/
91
+ └── unit/
92
+
93
+ # [REMOVE IF UNUSED] Option 2: Web application (when "frontend" + "backend" detected)
94
+ backend/
95
+ ├── src/
96
+ │ ├── models/
97
+ │ ├── services/
98
+ │ └── api/
99
+ └── tests/
100
+
101
+ frontend/
102
+ ├── src/
103
+ │ ├── components/
104
+ │ ├── pages/
105
+ │ └── services/
106
+ └── tests/
107
+
108
+ # [REMOVE IF UNUSED] Option 3: Mobile + API (when "iOS/Android" detected)
109
+ api/
110
+ └── [same as backend above]
111
+
112
+ ios/ or android/
113
+ └── [platform-specific structure: feature modules, UI flows, platform tests]
114
+ ```
115
+
116
+ **Structure Decision**: [Document the selected structure and reference the real
117
+ directories captured above]
118
+
119
+ ## Phase 0: Outline & Research
120
+ 1. **Extract unknowns from Technical Context** above:
121
+ - For each NEEDS CLARIFICATION → research task
122
+ - For each dependency → best practices task
123
+ - For each integration → patterns task
124
+
125
+ 2. **Generate and dispatch research agents**:
126
+ ```
127
+ For each unknown in Technical Context:
128
+ Task: "Research {unknown} for {feature context}"
129
+ For each technology choice:
130
+ Task: "Find best practices for {tech} in {domain}"
131
+ ```
132
+
133
+ 3. **Consolidate findings** in `research.md` using format:
134
+ - Decision: [what was chosen]
135
+ - Rationale: [why chosen]
136
+ - Alternatives considered: [what else evaluated]
137
+
138
+ **Output**: research.md with all NEEDS CLARIFICATION resolved
139
+
140
+ ## Phase 1: Design & Contracts
141
+ *Prerequisites: research.md complete*
142
+
143
+ 1. **Extract entities from feature spec** → `data-model.md`:
144
+ - Entity name, fields, relationships
145
+ - Validation rules from requirements
146
+ - State transitions if applicable
147
+
148
+ 2. **Generate API contracts** from functional requirements:
149
+ - For each user action → endpoint
150
+ - Use standard REST/GraphQL patterns
151
+ - Output OpenAPI/GraphQL schema to `/contracts/`
152
+
153
+ 3. **Generate contract tests** from contracts:
154
+ - One test file per endpoint
155
+ - Assert request/response schemas
156
+ - Tests must fail (no implementation yet)
157
+
158
+ 4. **Extract test scenarios** from user stories:
159
+ - Each story → integration test scenario
160
+ - Quickstart test = story validation steps
161
+
162
+ 5. **Update agent file incrementally** (O(1) operation):
163
+ - Run `.claude/speckit/scripts/update-agent-context.sh <speckit-root> <feature-name> claude`
164
+ **IMPORTANT**: Execute it exactly as specified above. Do not add or remove any arguments.
165
+ - If exists: Add only NEW tech from current plan
166
+ - Preserve manual additions between markers
167
+ - Update recent changes (keep last 3)
168
+ - Keep under 150 lines for token efficiency
169
+ - Output to repository root
170
+
171
+ **Output**: data-model.md, /contracts/*, failing tests, quickstart.md, agent-specific file
172
+
173
+ ## Phase 2: Task Planning Approach
174
+ *This section describes what the /tasks command will do - DO NOT execute during /plan*
175
+
176
+ **Task Generation Strategy**:
177
+ - Load `.specify/templates/tasks-template.md` as base
178
+ - Generate tasks from Phase 1 design docs (contracts, data model, quickstart)
179
+ - Each contract → contract test task [P]
180
+ - Each entity → model creation task [P]
181
+ - Each user story → integration test task
182
+ - Implementation tasks to make tests pass
183
+
184
+ **Ordering Strategy**:
185
+ - TDD order: Tests before implementation
186
+ - Dependency order: Models before services before UI
187
+ - Mark [P] for parallel execution (independent files)
188
+
189
+ **Estimated Output**: 25-30 numbered, ordered tasks in tasks.md
190
+
191
+ **IMPORTANT**: This phase is executed by the /tasks command, NOT by /plan
192
+
193
+ ## Phase 3+: Future Implementation
194
+ *These phases are beyond the scope of the /plan command*
195
+
196
+ **Phase 3**: Task execution (/tasks command creates tasks.md)
197
+ **Phase 4**: Implementation (execute tasks.md following constitutional principles)
198
+ **Phase 5**: Validation (run tests, execute quickstart.md, performance validation)
199
+
200
+ ## Complexity Tracking
201
+ *Fill ONLY if Constitution Check has violations that must be justified*
202
+
203
+ | Violation | Why Needed | Simpler Alternative Rejected Because |
204
+ |-----------|------------|-------------------------------------|
205
+ | [e.g., 4th project] | [current need] | [why 3 projects insufficient] |
206
+ | [e.g., Repository pattern] | [specific problem] | [why direct DB access insufficient] |
207
+
208
+
209
+ ## Progress Tracking
210
+ *This checklist is updated during execution flow*
211
+
212
+ **Phase Status**:
213
+ - [ ] Phase 0: Research complete (/plan command)
214
+ - [ ] Phase 1: Design complete (/plan command)
215
+ - [ ] Phase 2: Task planning complete (/plan command - describe approach only)
216
+ - [ ] Phase 3: Tasks generated (/tasks command)
217
+ - [ ] Phase 4: Implementation complete
218
+ - [ ] Phase 5: Validation passed
219
+
220
+ **Gate Status**:
221
+ - [ ] Initial Constitution Check: PASS
222
+ - [ ] Post-Design Constitution Check: PASS
223
+ - [ ] All NEEDS CLARIFICATION resolved
224
+ - [ ] Complexity deviations documented
225
+
226
+ ---
227
+ *Based on governance.md - See `<speckit-root>/governance.md`*
@@ -0,0 +1,140 @@
1
+ # Feature Specification: [FEATURE NAME]
2
+
3
+ **Feature Branch**: `[###-feature-name]`
4
+ **Created**: [DATE]
5
+ **Status**: Draft
6
+ **Input**: User description: "$ARGUMENTS"
7
+
8
+ ## Execution Flow (main)
9
+ ```
10
+ 1. Parse user description from Input
11
+ → If empty: ERROR "No feature description provided"
12
+ 2. Extract key concepts from description
13
+ → Identify: actors, actions, data, constraints
14
+ 3. For each unclear aspect:
15
+ → Mark with [NEEDS CLARIFICATION: specific question]
16
+ 4. Fill User Scenarios & Testing section
17
+ → If no clear user flow: ERROR "Cannot determine user scenarios"
18
+ 5. Generate Functional Requirements
19
+ → Each requirement must be testable
20
+ → Mark ambiguous requirements
21
+ 6. Identify Key Entities (if data involved)
22
+ 7. Run Review Checklist
23
+ → If any [NEEDS CLARIFICATION]: WARN "Spec has uncertainties"
24
+ → If implementation details found: ERROR "Remove tech details"
25
+ 8. Return: SUCCESS (spec ready for planning)
26
+ ```
27
+
28
+ ---
29
+
30
+ ## ⚡ Quick Guidelines
31
+ - ✅ Focus on WHAT users need and WHY
32
+ - ❌ Avoid HOW to implement (no tech stack, APIs, code structure)
33
+ - 👥 Written for business stakeholders, not developers
34
+
35
+ ### Section Requirements
36
+ - **Mandatory sections**: Must be completed for every feature
37
+ - **Optional sections**: Include only when relevant to the feature
38
+ - When a section doesn't apply, remove it entirely (don't leave as "N/A")
39
+
40
+ ### For AI Generation
41
+ When creating this spec from a user prompt:
42
+ 1. **Mark all ambiguities**: Use [NEEDS CLARIFICATION: specific question] for any assumption you'd need to make
43
+ 2. **Don't guess**: If the prompt doesn't specify something (e.g., "login system" without auth method), mark it
44
+ 3. **Think like a tester**: Every vague requirement should fail the "testable and unambiguous" checklist item
45
+ 4. **Common underspecified areas**:
46
+ - User types and permissions
47
+ - Data retention/deletion policies
48
+ - Performance targets and scale
49
+ - Error handling behaviors
50
+ - Integration requirements
51
+ - Security/compliance needs
52
+
53
+ ---
54
+
55
+ ## User Scenarios & Testing *(mandatory)*
56
+
57
+ ### Primary User Story
58
+ [Describe the main user journey in plain language]
59
+
60
+ ### Acceptance Scenarios
61
+ 1. **Given** [initial state], **When** [action], **Then** [expected outcome]
62
+ 2. **Given** [initial state], **When** [action], **Then** [expected outcome]
63
+
64
+ ### Edge Cases
65
+ - What happens when [boundary condition]?
66
+ - How does system handle [error scenario]?
67
+
68
+ ## Requirements *(mandatory)*
69
+
70
+ ### Functional Requirements
71
+ - **FR-001**: System MUST [specific capability, e.g., "allow users to create accounts"]
72
+ - **FR-002**: System MUST [specific capability, e.g., "validate email addresses"]
73
+ - **FR-003**: Users MUST be able to [key interaction, e.g., "reset their password"]
74
+ - **FR-004**: System MUST [data requirement, e.g., "persist user preferences"]
75
+ - **FR-005**: System MUST [behavior, e.g., "log all security events"]
76
+
77
+ *Example of marking unclear requirements:*
78
+ - **FR-006**: System MUST authenticate users via [NEEDS CLARIFICATION: auth method not specified - email/password, SSO, OAuth?]
79
+ - **FR-007**: System MUST retain user data for [NEEDS CLARIFICATION: retention period not specified]
80
+
81
+ ### Key Entities *(include if feature involves data)*
82
+ - **[Entity 1]**: [What it represents, key attributes without implementation]
83
+ - **[Entity 2]**: [What it represents, relationships to other entities]
84
+
85
+ ---
86
+
87
+ ## Review & Acceptance Checklist
88
+ *GATE: Automated checks run during main() execution*
89
+
90
+ ### Content Quality
91
+ - [ ] No implementation details (languages, frameworks, APIs)
92
+ - [ ] Focused on user value and business needs
93
+ - [ ] Written for non-technical stakeholders
94
+ - [ ] All mandatory sections completed
95
+
96
+ ### Requirement Completeness
97
+ - [ ] No [NEEDS CLARIFICATION] markers remain
98
+ - [ ] Requirements are testable and unambiguous
99
+ - [ ] Success criteria are measurable
100
+ - [ ] Scope is clearly bounded
101
+ - [ ] Dependencies and assumptions identified
102
+
103
+ ## Domain Checklists *(opcional — completar si aplica)*
104
+
105
+ ### Security *(incluir si la feature maneja autenticacion, autorizacion o datos sensibles)*
106
+ - [ ] Roles y permisos definidos: quien puede realizar cada accion
107
+ - [ ] Datos sensibles identificados (PII, credenciales, tokens)
108
+ - [ ] Inputs no confiables del usuario especificados (formularios, APIs, uploads)
109
+ - [ ] Requisitos de autenticacion definidos (quien debe estar autenticado)
110
+ - [ ] Politica de exposicion de errores: que informacion puede ver el usuario final
111
+ - [ ] Requisitos de auditoria o registro de eventos de seguridad
112
+
113
+ ### UX *(incluir si la feature tiene interfaz de usuario o interacciones visibles)*
114
+ - [ ] Estado de error definido: mensaje y accion sugerida al usuario
115
+ - [ ] Estado vacio definido: que ve el usuario cuando no hay datos
116
+ - [ ] Feedback de operaciones largas: indicador de progreso o confirmacion
117
+ - [ ] Accesibilidad basica: navegacion por teclado, contraste, textos alternativos
118
+ - [ ] Comportamiento en dispositivos moviles o pantallas pequeñas (si aplica)
119
+
120
+ ### Performance *(incluir si la feature tiene requisitos de carga, latencia o escala)*
121
+ - [ ] Latencia objetivo definida (ej. p95 < 200ms)
122
+ - [ ] Throughput esperado (ej. N requests/segundo, N usuarios concurrentes)
123
+ - [ ] Volumen de datos esperado (ej. N registros, tamaño maximo por operacion)
124
+ - [ ] Estrategia de caching definida (si aplica)
125
+ - [ ] Comportamiento bajo carga maxima: degradacion aceptable o fallo explicito
126
+
127
+ ---
128
+
129
+ ## Execution Status
130
+ *Updated by main() during processing*
131
+
132
+ - [ ] User description parsed
133
+ - [ ] Key concepts extracted
134
+ - [ ] Ambiguities marked
135
+ - [ ] User scenarios defined
136
+ - [ ] Requirements generated
137
+ - [ ] Entities identified
138
+ - [ ] Review checklist passed
139
+
140
+ ---