@jakkrichm/create-nexus-devflow 2.9.5 → 2.10.1

package/template/.claude/skills/try/SKILL.md

@@ -1,10 +1,13 @@
 ---
 name: try
-description: "[devflow] Generate a human manual try guide for the current or most recently completed Blueprint feature, fix, or rollback. Reads the spec, project commands, and available app context, then tells the user exactly what to start, where to go, what to click or run, what to expect, and what would count as wrong. Read-only. Use when the user runs /try, invokes $try, asks how to test manually, asks where to click, asks how to see the change, or wants a manual review path after /implement, /autopilot, /check, or /complete."
+description: "[devflow] Generate a human manual try guide for the current or most recently completed Blueprint feature, fix, or rollback. Reads the spec, project commands, and available app context, connects with MCP browseros-neo when available for interactive previews, then tells the user exactly what to start, where to go, what to click or run, what to expect, and what would count as wrong. Read-only. Use when the user runs /try, invokes $try, asks how to test manually, asks where to click, asks how to see the change, or wants a manual review path after /implement, /autopilot, /check, or /complete."
+argument-hint: "[{latest|step-id|path}]"
 ---
 
 # try - manual review guide
 
+$ARGUMENTS
+
 Where this sits in the workflow:
 
     /implement or /complete  ->  [try]  ->  human review
@@ -58,7 +61,7 @@ include one unaffected regression path from the rollback spec.
 
 Use the Commands section in `AGENTS.md`. Match the project type:
 
-- **Web app** - dev server command, URL, and the route or screen to open.
+- **Web app** - dev server command, URL, and the route or screen to open. If `browseros-neo` MCP server is active (`http://127.0.0.1:9010/mcp`), you can also offer to inspect or navigate in the live browser.
 - **Server/API** - server command, base URL, endpoint, method, and expected
   response shape.
 - **CLI** - exact command(s), arguments, and expected output.
@@ -77,9 +80,9 @@ Produce a short guide with these sections:
 2. **Open** - URLs, screens, tabs, API endpoints, or CLI commands.
 3. **Do** - clicks, inputs, selections, or command arguments.
 4. **Expect** - visible result, output, response, state change, file, or lack of
-   error.
+    error.
 5. **Watch For** - common wrong outcomes, console or network errors, stale data,
-   missing fields, bad empty states, layout issues, or safety warnings.
+    missing fields, bad empty states, layout issues, or safety warnings.
 
 Keep it concrete. Prefer:
 
@@ -97,23 +100,5 @@ End with:
 
 - **Best signal** - the one thing the user should try first.
 - **Optional deeper checks** - only if useful.
-- **Gaps** - anything the guide cannot know from the docs, such as missing route
-  names, seed data, credentials, or external services.
-
-If the feature is not user-visible, say so and provide the closest manual signal,
-such as an API response, CLI output, log line, or unit test command.
-
-## Rules
-
-- Read-only only. Do not edit, commit, merge, push, install, or delete.
-- Do not run the app unless the user explicitly asks you to try it for them.
-- Do not pretend a path is known when the spec does not say it. Give the best
-  likely path and label uncertainty.
-- Keep the guide short enough to follow while the app is open.
-- Match the project's commands from `AGENTS.md`.
-
-## Formatting
-
-Format the output to match the project's conventions in
-`devflow/context/ai-interaction.md`: concise, scannable markdown, with numbered
-steps for the manual path and short bullets for warnings.
+- **MCP Visual Preview** - mention live browser inspection via MCP `browseros-neo` if active.
+- **Gaps** - anything the guide cannot know from the docs, such as missing route or seed data.

package/template/AGENTS.md

@@ -18,13 +18,13 @@ To start a new project, scaffold the application first in an empty folder, then
 - `devflow/context/coding-standards.md` - engineering conventions & rules to follow
 - `devflow/context/ai-interaction.md` - how to interact with the user on this project
 - `devflow/context/glossary.md` - domain terms & architecture definitions
-- `devflow/context/{xxx-slug}/` - active task living spec, stage, and findings ledger
+- `devflow/context/{xxx-slug}/` - active task living spec, stage, findings ledger, and independent review receipt
 
 ## Project configuration
 
 `devflow/config.json` is the user-owned, machine-readable workflow policy for this project. Workflow skills read the relevant settings before acting. A missing file means built-in defaults. An invalid file falls back to defaults for read-only status reporting, but mutating workflow commands stop and point to `/doctor` instead of guessing.
 
-`qualityGates.regular` controls automatic audit, check, and try-guide behavior for the normal workflow and Autopilot. `qualityGates.continuous` controls the same per-feature gates for Continuous Mode. Every gate defaults to `manual`.
+`qualityGates.regular` controls automatic audit, independent-review, check, and try-guide behavior for the normal workflow and Autopilot. `qualityGates.continuous` controls the same per-feature gates for Continuous Mode. Every gate defaults to `manual`. The conditional modes are `when-sensitive` for audit and independent review, `when-behavioral` for check, and `when-user-facing` for try guides. `always` runs the gate for every work item in that workflow.
 
 ## Tool-Specific Adapters & Execution Rules
 
@@ -38,7 +38,7 @@ Unused adapter families can be removed. Codex, Antigravity, GitHub Copilot, and
 
 ### Universal Invocation & Agent Directives:
 
-1. **Canonical Command Names & AI Provider Invocation**: Each workflow stage and companion tool has exactly **one Canonical Name** (e.g. `feature`, `fix`, `implement`, `check`, `complete`, `continuous`, `discovery`, `idea`, `grill`, `brainstorm`, `devflow`, `doctor`, `overview`, `debug`, `onboard`, `adopt`, `try`, `rollback`, `ci`, `test`, `tests`, `autopilot`, `prototype`, `report-html`, `brief`, `audit`, `release`, `convert-any-to-md`). The way you invoke commands depends on your AI Provider / Tool:
+1. **Canonical Command Names & AI Provider Invocation**: Each workflow stage and companion tool has exactly **one Canonical Name** (e.g. `feature`, `fix`, `implement`, `check`, `complete`, `continuous`, `discovery`, `idea`, `grill`, `brainstorm`, `devflow`, `doctor`, `overview`, `debug`, `onboard`, `adopt`, `try`, `rollback`, `ci`, `test`, `setup-tests`, `browser-tests`, `autopilot`, `prototype`, `report-html`, `brief`, `audit`, `release`, `convert-any-to-md`, `publish-devflow`). The way you invoke commands depends on your AI Provider / Tool:
    - **Canonical Name (Plain text)**: Directly invoke or prompt the command by its standard name (e.g., `feature`, `implement`, `continuous`, `devflow`, `discovery`).
    - **Slash Prefix (`/`)**: For tools supporting slash commands (Claude Code, Google Antigravity, Gemini CLI), e.g., `/feature`, `/fix`, `/implement`, `/continuous`, `/devflow`, `/discovery`.
    - **Dollar Prefix (`$`)**: For OpenAI Codex CLI or skill-invocation tools, e.g., `$feature`, `$fix`, `$continuous`, `$devflow`, `$discovery`.
@@ -82,7 +82,11 @@ All development tasks execute through the 4-step progressive lifecycle:
 
 The dashboard and status reporting can show the active or most recent substantial DevFlow command from `devflow/.state/run.json`. This file is generated local state, ignored by Git, and never part of a feature commit.
 
-Commands with meaningful progress or a durable handoff should write it when the state directory exists: `onboard`, `adopt`, `discovery`, `overview`, `feature`, `fix`, `rollback`, `implement`, `debug`, `check`, `audit`, `tests`, `ci`, `prototype`, `autopilot`, `continuous`, `complete`, and `release`. Short read-only orientation commands such as `brief`, `try`, `status`, and `doctor` do not need activity state.
+<<<<<<< HEAD
+Commands with meaningful progress or a durable handoff should write it when the state directory exists: `onboard`, `adopt`, `discovery`, `overview`, `feature`, `fix`, `rollback`, `implement`, `debug`, `check`, `audit`, `tests`, `browser-tests`, `ci`, `prototype`, `autopilot`, `continuous`, `complete`, and `release`. Short read-only orientation commands such as `brief`, `try`, `status`, and `doctor` do not need activity state.
+=======
+Commands with meaningful progress or a durable handoff should write it when the state directory exists: `onboard`, `adopt`, `discovery`, `overview`, `feature`, `fix`, `rollback`, `implement`, `debug`, `check`, `audit`, `setup-tests`, `ci`, `prototype`, `autopilot`, `continuous`, `complete`, and `release`. Short read-only orientation commands such as `brief`, `try`, `status`, and `doctor` do not need activity state.
+>>>>>>> feature/064-bughunter-master-skill-and-sync-engine
 
 Writing the initial activity record is the first action of a tracked command, before project inspection, preflight, or other tool calls. This one generated state write does not authorize product changes or bypass any safety check. Set status to `running`, use the command name and a truthful initial summary, then replace the record at meaningful milestones. On a preflight stop or another blocker, set it to `blocked` with the exact recovery command. Leave the final state in place for the next session; the next tracked command replaces it. Use this schema:
 

package/template/devflow/build-plan.md

@@ -140,4 +140,18 @@
   - *Dependencies*: None
   - *Scope*: เพิ่มฟังก์ชัน `installRecommendedSkills` และ `updateRecommendedSkills` ใน `skill-manager.ts`, รองรับสวิตช์ `--recommended` ในคำสั่ง `nexus-devflow skill add` และ `nexus-devflow skill update`, พร้อมอัปเดตเอกสาร `README.md`, `README.th.md` และ Automated Tests
 
+---
+
+## 🔄 Phase 18: Upstream AI Blueprint v1.1.0 & v1.2.0 Synchronization
+
+- [x] **18. Sync Upstream v1.1.0 & v1.2.0 (Browser Tests & Independent Review System) (`DISC-20260901-001`)** `[Size: M]`
+  - *Dependencies*: None
+  - *Scope*: ผสานสคิล `/browser-tests` สำหรับ Playwright/E2E testing, ระบบตรวจทานอิสระ Independent Audit Review (`audit independent current` พร้อม `review.ts` และ `review.md`), อัปเกรด Config Quality Gates (`independentReview`), อัปเดต CLI Engine/Dashboard และปรับปรุงคู่มือ Scaffolding
+
+---
+
+## 🛡️ Phase 19: BugHunter Master Skill & Upstream Knowledge Sync Engine
 
+- [x] **19. BugHunter Master Skill & Upstream Knowledge Sync Engine (`DISC-20260901-002`, `065-bughunter-master-skill-and-sync-engine`)** `[Size: M]`
+  - *Dependencies*: Feature 17, Feature 18
+  - *Scope*: พัฒนา Master Orchestrator Skill `bughunter` พร้อมระบบ Sync ดึงคลังความรู้ 83 skills และ report patterns จาก `elementalsouls/Claude-BugHunter` เก็บใน `devflow/.vendor/bughunter/`, รองรับคำสั่ง `nexus-devflow skill add/update bughunter`, อัปเดต Manifest และผสานเข้ากับ Multi-Adapter (`.agents/`, `.claude/`)

package/template/devflow/config.json

@@ -16,11 +16,13 @@
   "qualityGates": {
     "regular": {
       "audit": "manual",
+      "independentReview": "manual",
       "check": "manual",
       "tryGuide": "manual"
     },
     "continuous": {
       "audit": "manual",
+      "independentReview": "manual",
       "check": "manual",
       "tryGuide": "manual"
     }

package/template/devflow/context/coding-standards.md

@@ -131,6 +131,10 @@ Testing is a core quality gate in Nexus-DevFlow, not an afterthought:
   - Use isolated temporary directories (`fs.mkdtemp` in `os.tmpdir()`) and ensure cleanup in `finally` blocks.
 - **Empirical Proof Contract**:
   - Never claim a task is "working", "tested", or "verified" without providing concrete empirical proof (exact command executed, terminal output, pass/fail counts, exit code).
+- **Hybrid Browser Verification Protocol**:
+  - **Dual-Layer Hierarchy**:
+    1. *Code-Driven Automation (CI/Repeatable)*: Headless Playwright (`@playwright/test`) assertions executed via `npm run test:browser`.
+    2. *Interactive AI Visual QA (MCP)*: Live DOM and styling inspection via MCP `browseros-neo` (`http://127.0.0.1:9010/mcp`) during `/check` and `/try`.
 - **Two-Stage Review Pattern (Verification Gate)**:
   - **Stage 1: Spec Fidelity & Acceptance Gate**:
     - Verify 100% conformance against the Single Living Spec (`current-feature.md`).
@@ -145,7 +149,7 @@ Testing is a core quality gate in Nexus-DevFlow, not an afterthought:
 
 ---
 
-## 8. Findings Ledger & Quality Gates (`findings.md`)
+## 8. Findings Ledger & Quality Gates (`findings.md`, `review.md`)
 
 - All quality defects, security findings, or regression issues identified during review must be logged in `devflow/context/findings.md`.
 - **Finding State Machine**:
@@ -155,6 +159,9 @@ Testing is a core quality gate in Nexus-DevFlow, not an afterthought:
   - `accepted`: Formally waived with recorded user justification.
 - **P0/P1 Blockers**: Any P0 or P1 finding in `open` or `fixed` status unconditionally blocks `/complete`.
 - **Allowed Waivers**: A P0 or P1 finding may only be bypassed if marked `accepted` (with explicit user justification recorded) or `invalid` (with evidence recorded by `/audit`).
+- **Independent Review Gate (`review.md`)**:
+  - Holds immutable review request and receipt records bound to target commit SHA, merge base, and spec SHA-256 hash.
+  - When `qualityGates.regular.independentReview` is active, completion is blocked until a fresh session completes the 4-lens audit and records a valid, non-stale `passed` receipt.
 
 ---