@luanpdd/kit-mcp 1.10.0 → 1.12.0

package/gates/ai-prompt-stability.md

@@ -0,0 +1,120 @@
+---
+id: ai-prompt-stability
+stage: pre-execute
+blocking: false
+description: Valida que prompts/tools LLM em produção (qualquer arquivo em `prompts/` ou referenciado por código de produção como prompt) têm characterization tests linkados. Skip se projeto não usa LLM. Opt-in via workflow.ai_prompt_gate.
+---
+
+# AI prompt stability gate
+
+**When to run:** pre-execute (consultive default; blocking se `workflow.ai_prompt_gate=true`).
+
+**Skill canônica:** [`ai-prompt-characterization`](../kit/skills/ai-prompt-characterization/SKILL.md)
+
+**Agent invocado:** [`legacy-characterizer`](../kit/agents/legacy-characterizer.md) (modo prompt)
+
+## Check
+
+```bash
+#!/usr/bin/env bash
+# PT-BR: validar que prompts em prod têm characterization tests
+set -e
+
+# detectar prompts em prod (heurística — paths canônicos)
+PROMPT_FILES=""
+for d in prompts src/prompts supabase/functions/*/prompts; do
+  [ -d "$d" ] && PROMPT_FILES="$PROMPT_FILES $(find "$d" -type f \( -name "*.md" -o -name "*.txt" -o -name "*.prompt" \) 2>/dev/null)"
+done
+
+if [ -z "$PROMPT_FILES" ]; then
+  echo "INFO: nenhum prompt em prod detectado — gate skip."
+  exit 0
+fi
+
+# detectar gate mode
+GATE_BLOCKING=false
+if [ -f ".planning/config.json" ] && command -v jq >/dev/null; then
+  CFG=$(jq -r '.workflow.ai_prompt_gate // empty' .planning/config.json 2>/dev/null)
+  [ "$CFG" = "true" ] && GATE_BLOCKING=true
+fi
+
+# para cada prompt, verificar characterization tests
+PROMPTS_OK=()
+PROMPTS_MISSING=()
+
+for prompt in $PROMPT_FILES; do
+  STEM=$(basename "$prompt" | sed 's/\.[^.]*$//')
+  HAS_CHAR=false
+  for chardir in tests/characterization/prompts test/characterization/prompts __tests__/characterization/prompts; do
+    if find "$chardir" -path "*${STEM}*" 2>/dev/null | head -1 | grep -q . ; then
+      HAS_CHAR=true
+      break
+    fi
+  done
+
+  if [ "$HAS_CHAR" = "true" ]; then
+    PROMPTS_OK+=("$prompt")
+  else
+    LINES=$(wc -l < "$prompt" 2>/dev/null | tr -d ' ')
+    if [ "${LINES:-0}" -gt 50 ]; then  # threshold: prompts > 50 linhas requerem char
+      PROMPTS_MISSING+=("$prompt (lines=$LINES)")
+    fi
+  fi
+done
+
+if [ ${#PROMPTS_MISSING[@]} -eq 0 ]; then
+  echo "✓ ai-prompt-stability — todos os prompts > 50 linhas têm characterization tests."
+  exit 0
+fi
+
+echo ""
+echo "⚠ ai-prompt-stability — prompts sem characterization detectados:"
+echo ""
+for p in "${PROMPTS_MISSING[@]}"; do
+  echo "  - $p"
+done
+echo ""
+echo "Skill canônica: kit/skills/ai-prompt-characterization/SKILL.md"
+echo ""
+echo "Caminhos para resolver:"
+echo "  /caracterizar-prompt <prompt-file>            (gera characterization tests)"
+echo "  /caracterizar-prompt <prompt> --num-intents 5 (5 intents canônicas)"
+echo ""
+
+if [ "$GATE_BLOCKING" = "true" ]; then
+  echo "MODE: blocking (workflow.ai_prompt_gate=true)"
+  echo "Resolve antes de prosseguir."
+  exit 1
+else
+  echo "MODE: consultive (warning apenas)"
+  echo "Para tornar blocking: setar workflow.ai_prompt_gate=true em .planning/config.json"
+  exit 0
+fi
+```
+
+## Configuração
+
+```json
+{
+  "workflow": {
+    "ai_prompt_gate": false,
+    "ai_prompt_min_lines": 50,
+    "ai_prompt_paths": ["prompts/**", "src/prompts/**", "supabase/functions/*/prompts/**"]
+  }
+}
+```
+
+**Default:** `ai_prompt_gate` = false (consultive). Promove para blocking se projeto tem ≥ 5 prompts em prod.
+
+## Quando NÃO rodar
+
+- Projeto não usa LLM em produção
+- Prompts são apenas para dev tooling (não prod)
+- Prompts < 50 linhas (threshold default)
+
+## Ver também
+
+- [`ai-prompt-characterization`](../kit/skills/ai-prompt-characterization/SKILL.md) — knowledge base
+- [`legacy-characterization-tests`](../kit/skills/legacy-characterization-tests/SKILL.md) — characterization clássico
+- [`legacy-refactor-safety`](./legacy-refactor-safety.md) — gate análogo para refactor de código
+- [`llm-as-dependency`](../kit/skills/llm-as-dependency/SKILL.md) — fakear LLM em business logic tests

package/gates/legacy-refactor-safety.md

@@ -0,0 +1,178 @@
+---
+id: legacy-refactor-safety
+stage: pre-execute
+blocking: false
+description: Valida que tasks com kind=refactor em arquivos > 500 linhas OU com contrato externo têm characterization tests linkados. Skip se fase só toca markdown OR fase é greenfield. Opt-in via workflow.legacy_refactor_gate_blocking=true.
+---
+
+# Legacy refactor safety gate
+
+**When to run:** pre-execute (consultive por default; blocking se `workflow.legacy_refactor_gate_blocking=true` E `omm.capacidade_1_resilience >= 3`).
+
+**Skill canônica:** [`pre-refactor-characterization`](../kit/skills/pre-refactor-characterization/SKILL.md)
+
+**Agent invocado:** [`refactor-safety-auditor`](../kit/agents/refactor-safety-auditor.md)
+
+## Check
+
+```bash
+#!/usr/bin/env bash
+# PT-BR: validar que tasks com kind=refactor em arquivos arriscados têm safety net.
+# Estratégia: descobrir tasks da fase atual, identificar refactor + arquivos flagged,
+# verificar characterization tests linkados, gerar warning ou block conforme mode.
+# Bash 3.2-portable (macOS default).
+set -e
+
+# PT-BR: identificar fase atual via STATE.md
+STATE_FILE=".planning/STATE.md"
+CURRENT_PHASE=""
+if [ -f "$STATE_FILE" ]; then
+  CURRENT_PHASE=$(grep -E "^Fase:" "$STATE_FILE" 2>/dev/null | head -1 | sed -E 's/^Fase: *([0-9]+).*/\1/')
+fi
+
+if [ -z "$CURRENT_PHASE" ]; then
+  echo "INFO: nenhuma fase ativa — gate skip."
+  exit 0
+fi
+
+PHASE_DIR=".planning/phases/phase-${CURRENT_PHASE}"
+[ ! -d "$PHASE_DIR" ] && exit 0
+
+# PT-BR: ler config para mode
+GATE_BLOCKING=false
+if [ -f ".planning/config.json" ] && command -v jq >/dev/null; then
+  CFG=$(jq -r '.workflow.legacy_refactor_gate_blocking // empty' .planning/config.json 2>/dev/null)
+  [ "$CFG" = "true" ] && GATE_BLOCKING=true
+fi
+
+# PT-BR: ler omm — Capacidade 1 (Resilience) calibra mode default
+if [ "$GATE_BLOCKING" = "false" ] && [ -f ".planning/OMM-REPORT.md" ]; then
+  OMM_RES=$(grep -oE 'Capacidade 1.*Resilience.*[0-9]/5' .planning/OMM-REPORT.md 2>/dev/null \
+    | grep -oE '[0-9]/5' | head -1 | sed 's|/5||')
+  if [ -n "$OMM_RES" ] && [ "$OMM_RES" -ge 3 ]; then
+    GATE_BLOCKING=true
+  fi
+fi
+
+# PT-BR: identificar PLAN.md da fase atual
+PLAN_FILES=$(find "$PHASE_DIR" -name "PLAN.md" 2>/dev/null)
+
+REFACTOR_TASKS_RISKY=()
+REFACTOR_TASKS_OK=()
+TOTAL_REFACTOR=0
+
+for plan_file in $PLAN_FILES; do
+  # PT-BR: detectar tasks com kind=refactor (heurística — frase canônica)
+  if grep -qiE "(refactor|refator|extract method|extract class|move method|reorganizar|limpar)" "$plan_file"; then
+    # extrair arquivos mencionados em tasks de refactor
+    AFFECTED_FILES=$(grep -oE "(src|lib|app|supabase|tests)/[a-zA-Z0-9_./-]+\.(ts|tsx|js|jsx|mjs|py|java|go|rb|cs|rs|cpp|c|h)" "$plan_file" 2>/dev/null | sort -u)
+
+    for f in $AFFECTED_FILES; do
+      [ ! -f "$f" ] && continue
+
+      # PT-BR: critérios de risco
+      LINES=$(wc -l < "$f" 2>/dev/null | tr -d ' ')
+      EXTERNAL=false
+      if echo "$f" | grep -qE "(supabase/functions|src/api|/handlers/webhooks|pages/api|integrations)"; then
+        EXTERNAL=true
+      fi
+
+      RISK_HIGH=false
+      [ "${LINES:-0}" -gt 500 ] && RISK_HIGH=true
+      [ "$EXTERNAL" = "true" ] && RISK_HIGH=true
+
+      if [ "$RISK_HIGH" = "true" ]; then
+        TOTAL_REFACTOR=$((TOTAL_REFACTOR + 1))
+
+        # PT-BR: verificar characterization tests linkados
+        STEM=$(basename "$f" | sed 's/\.[^.]*$//')
+        HAS_CHAR=false
+        for chardir in tests test __tests__; do
+          if find "$chardir" -path "*characterization*$STEM*" 2>/dev/null | head -1 | grep -q . ; then
+            HAS_CHAR=true
+            break
+          fi
+        done
+
+        if [ "$HAS_CHAR" = "true" ]; then
+          REFACTOR_TASKS_OK+=("$f")
+        else
+          REFACTOR_TASKS_RISKY+=("$f (lines=$LINES, external=$EXTERNAL)")
+        fi
+      fi
+    done
+  fi
+done
+
+# PT-BR: relatório
+if [ ${#REFACTOR_TASKS_RISKY[@]} -eq 0 ]; then
+  echo "✓ legacy-refactor-safety — sem refactors arriscados sem characterization."
+  if [ ${#REFACTOR_TASKS_OK[@]} -gt 0 ]; then
+    echo "   ${#REFACTOR_TASKS_OK[@]} refactor(s) com characterization linkados."
+  fi
+  exit 0
+fi
+
+# PT-BR: há refactors arriscados sem char
+echo ""
+echo "⚠ legacy-refactor-safety — refactor(s) sem characterization detectado(s):"
+echo ""
+for item in "${REFACTOR_TASKS_RISKY[@]}"; do
+  echo "  - $item"
+done
+echo ""
+echo "Skill canônica: kit/skills/pre-refactor-characterization/SKILL.md"
+echo ""
+echo "Caminhos para resolver:"
+echo "  1. /caracterizar <file>                    (full chain — preferido)"
+echo "  2. /refactor-seguro --mode=sprout <file>  (não toca legado, ADICIONA via sprout)"
+echo "  3. /refactor-seguro --mode=safe-extract <file>  (apenas refactor mecânico)"
+echo "  4. /refactor-seguro --mode=override --ticket REQ-N --reason \"...\"  (último recurso)"
+echo ""
+
+if [ "$GATE_BLOCKING" = "true" ]; then
+  echo "MODE: blocking (workflow.legacy_refactor_gate_blocking=true OR OMM Capacidade 1 ≥ 3)"
+  echo "Resolve antes de prosseguir com /executar-fase."
+  exit 1
+else
+  echo "MODE: consultive (warning apenas)"
+  echo "Para tornar blocking: setar workflow.legacy_refactor_gate_blocking=true em .planning/config.json"
+  exit 0
+fi
+```
+
+## Configuração
+
+```json
+// .planning/config.json
+{
+  "workflow": {
+    "legacy_refactor_gate_blocking": true,
+    "legacy_refactor_min_lines": 500,
+    "legacy_refactor_external_paths": [
+      "supabase/functions/**",
+      "src/api/**",
+      "src/handlers/webhooks/**",
+      "pages/api/**"
+    ]
+  }
+}
+```
+
+**Default:** `legacy_refactor_gate_blocking` = false (consultive). Auto-promove para `true` se `omm-auditor` (v1.9) reportar Capacidade 1 (Resilience) ≥ 3 — sinal de que projeto tem maturity de safety.
+
+## Quando NÃO rodar
+
+- Fase só toca markdown/docs — sem código a refactor
+- Projeto < 1 mês de idade — código novo não é "legacy" no sentido Feathers
+- Projeto sem `omm-auditor` rodado E sem flag explícita — skip silencioso (consultive)
+- Tasks são `bug-fix` ou `feature` (não refactor) — gate só roda em refactor
+
+## Ver também
+
+- [`pre-refactor-characterization`](../kit/skills/pre-refactor-characterization/SKILL.md) — knowledge base do gate
+- [`refactor-safety-auditor`](../kit/agents/refactor-safety-auditor.md) — agent invocado em runtime
+- [`legacy-characterizer`](../kit/agents/legacy-characterizer.md) — agent que gera safety net
+- [`golden-signals-coverage`](./golden-signals-coverage.md) — gate análogo da Suíte SRE
+- [`prr-checklist-coverage`](./prr-checklist-coverage.md) — gate análogo da Suíte SRE para PRR
+- [`omm-no-regression`](./omm-no-regression.md) — gate análogo da Suíte Observabilidade para OMM

package/gates/observability-coverage.md

@@ -0,0 +1,151 @@
+---
+id: observability-coverage
+stage: pre-milestone-close
+blocking: false
+description: Valida que ≥ X% das Edge Functions têm 4 golden signals + SLO + burn alert + characterization. Default threshold 70%. Opt-in via workflow.observability_coverage_threshold.
+---
+
+# Observability coverage gate (cross-suite)
+
+**When to run:** pre-milestone-close (consultive default; blocking se `workflow.observability_coverage_threshold > 0`).
+
+**Skills canônicas:** [`four-golden-signals`](../kit/skills/four-golden-signals/SKILL.md), [`event-based-slos`](../kit/skills/event-based-slos/SKILL.md), [`burn-rate-alerting`](../kit/skills/burn-rate-alerting/SKILL.md), [`legacy-characterization-tests`](../kit/skills/legacy-characterization-tests/SKILL.md)
+
+**Agent invocado:** [`observability-coverage-auditor`](../kit/agents/observability-coverage-auditor.md)
+
+## Check
+
+```bash
+#!/usr/bin/env bash
+# PT-BR: validar cobertura cross-suite de Edge Functions
+set -e
+
+# threshold do gate
+THRESHOLD=70
+if [ -f ".planning/config.json" ] && command -v jq >/dev/null; then
+  CFG=$(jq -r '.workflow.observability_coverage_threshold // empty' .planning/config.json 2>/dev/null)
+  [ -n "$CFG" ] && [ "$CFG" != "null" ] && THRESHOLD=$CFG
+fi
+
+# se threshold = 0, gate skip (opt-in)
+if [ "$THRESHOLD" -eq 0 ]; then
+  echo "INFO: workflow.observability_coverage_threshold=0 — gate skip (opt-in não habilitado)."
+  exit 0
+fi
+
+# enumerar Edge Functions
+NUM_EDGE_FNS=$(find supabase/functions -mindepth 1 -maxdepth 1 -type d 2>/dev/null | wc -l)
+if [ "$NUM_EDGE_FNS" -eq 0 ]; then
+  echo "INFO: nenhuma Edge Function detectada — gate skip."
+  exit 0
+fi
+
+# contar Edge Functions cobertas em cada dimensão
+COVERED_SIGNALS=0
+COVERED_SLO=0
+COVERED_BURN=0
+COVERED_CHAR=0
+
+for fn_dir in $(find supabase/functions -mindepth 1 -maxdepth 1 -type d 2>/dev/null); do
+  FN_NAME=$(basename "$fn_dir")
+  FN_FILE="$fn_dir/index.ts"
+  [ ! -f "$FN_FILE" ] && continue
+
+  # 4 golden signals
+  HAS_LATENCY=$(grep -qE "createHistogram|histogram.*ms|latency_histogram" "$FN_FILE" && echo true || echo false)
+  HAS_TRAFFIC=$(grep -qE "createCounter.*requests|http_requests_total|trafficCounter" "$FN_FILE" && echo true || echo false)
+  HAS_ERRORS=$(grep -qE "createCounter.*errors|http_errors_total|error_type" "$FN_FILE" && echo true || echo false)
+  HAS_SAT=$(grep -qE "createObservableGauge|connection_pool|queue_depth" "$FN_FILE" && echo true || echo false)
+  if [ "$HAS_LATENCY" = "true" ] && [ "$HAS_TRAFFIC" = "true" ] && [ "$HAS_ERRORS" = "true" ] && [ "$HAS_SAT" = "true" ]; then
+    COVERED_SIGNALS=$((COVERED_SIGNALS + 1))
+  fi
+
+  # SLO
+  if [ -f ".planning/slos/$FN_NAME.md" ] || ([ -f ".planning/SLO.md" ] && grep -q "$FN_NAME" ".planning/SLO.md"); then
+    COVERED_SLO=$((COVERED_SLO + 1))
+  fi
+
+  # Burn alert
+  if grep -rq "$FN_NAME" .planning/burn-rate-alerts.md .planning/SLO.md 2>/dev/null; then
+    COVERED_BURN=$((COVERED_BURN + 1))
+  fi
+
+  # Characterization
+  for chardir in tests/characterization test/characterization __tests__/characterization; do
+    if find "$chardir" -path "*$FN_NAME*" 2>/dev/null | head -1 | grep -q .; then
+      COVERED_CHAR=$((COVERED_CHAR + 1))
+      break
+    fi
+  done
+done
+
+# computar percentages
+PCT_SIGNALS=$((COVERED_SIGNALS * 100 / NUM_EDGE_FNS))
+PCT_SLO=$((COVERED_SLO * 100 / NUM_EDGE_FNS))
+PCT_BURN=$((COVERED_BURN * 100 / NUM_EDGE_FNS))
+PCT_CHAR=$((COVERED_CHAR * 100 / NUM_EDGE_FNS))
+
+# avg
+PCT_AVG=$(( (PCT_SIGNALS + PCT_SLO + PCT_BURN + PCT_CHAR) / 4 ))
+
+echo ""
+echo "observability-coverage gate — threshold: ${THRESHOLD}%"
+echo ""
+echo "  4 Golden Signals:        ${COVERED_SIGNALS}/${NUM_EDGE_FNS} (${PCT_SIGNALS}%)"
+echo "  SLO definido:            ${COVERED_SLO}/${NUM_EDGE_FNS} (${PCT_SLO}%)"
+echo "  Burn rate alert:         ${COVERED_BURN}/${NUM_EDGE_FNS} (${PCT_BURN}%)"
+echo "  Characterization tests:  ${COVERED_CHAR}/${NUM_EDGE_FNS} (${PCT_CHAR}%)"
+echo ""
+echo "  Avg coverage: ${PCT_AVG}%"
+echo ""
+
+# decisão
+if [ "$PCT_AVG" -ge "$THRESHOLD" ]; then
+  echo "✓ Avg ≥ threshold (${PCT_AVG}% ≥ ${THRESHOLD}%). Gate aprovado."
+  exit 0
+fi
+
+echo "⚠ Avg < threshold (${PCT_AVG}% < ${THRESHOLD}%)."
+echo ""
+echo "Próximas ações:"
+echo "  /auditar-observabilidade-cobertura      (vê detalhes + top 5 críticas)"
+echo "  /golden-signals <fn>                    (instrumentar 4 signals)"
+echo "  /definir-slo <fn>                       (define SLO event-based)"
+echo "  /caracterizar <fn>                      (characterization tests)"
+echo ""
+
+# blocking se threshold > 0 e não atingido
+if [ "$THRESHOLD" -gt 0 ]; then
+  exit 1
+fi
+
+exit 0
+```
+
+## Configuração
+
+```json
+{
+  "workflow": {
+    "observability_coverage_threshold": 70
+  }
+}
+```
+
+**Default:** `0` (skip — opt-in). Recomendação:
+- Projetos < 6 meses: 50 (consultive)
+- Projetos 6-12 meses: 70
+- Projetos > 12 meses ou tier-1 production: 80+
+
+## Quando NÃO rodar
+
+- Projeto sem Edge Functions (puro frontend/backend stateless)
+- Projeto recém-criado (< 1 mês) — distribuição de Edge Functions ainda imatura
+- Greenfield onde Edge Functions estão sendo escritas em paralelo a milestones
+
+## Ver também
+
+- [`observability-coverage-auditor`](../kit/agents/observability-coverage-auditor.md) — agent canônico
+- [`/auditar-observabilidade-cobertura`](../kit/commands/auditar-observabilidade-cobertura.md) — comando dedicado
+- [`omm-no-regression`](./omm-no-regression.md) — gate análogo da Suíte Observabilidade
+- [`golden-signals-coverage`](./golden-signals-coverage.md) — gate específico apenas para golden signals

package/gates/release-pipeline-policy.md

@@ -0,0 +1,132 @@
+---
+id: release-pipeline-policy
+stage: pre-milestone-close
+blocking: false
+description: Valida release pipeline scored ≥ X/30 (default 20 = ADEQUATE) em hermeticidade + reprodutibilidade + policy enforcement. Opt-in via workflow.complete_milestone_release_pipeline_gate. Cap 8 livro Google SRE.
+---
+
+# Release pipeline policy gate
+
+**When to run:** pre-milestone-close (consultive default; blocking se `workflow.complete_milestone_release_pipeline_gate=true`).
+
+**Skill canônica:** [`release-engineering`](../kit/skills/release-engineering/SKILL.md) + [`hermetic-builds`](../kit/skills/hermetic-builds/SKILL.md)
+
+**Agent invocado:** [`release-pipeline-auditor`](../kit/agents/release-pipeline-auditor.md)
+
+## Check
+
+```bash
+#!/usr/bin/env bash
+# PT-BR: validar release pipeline scored >= threshold
+set -e
+
+# threshold do gate
+THRESHOLD=20  # default: ADEQUATE
+GATE_BLOCKING=false
+
+if [ -f ".planning/config.json" ] && command -v jq >/dev/null; then
+  CFG=$(jq -r '.workflow.complete_milestone_release_pipeline_gate // empty' .planning/config.json 2>/dev/null)
+  if [ "$CFG" = "true" ]; then
+    GATE_BLOCKING=true
+  fi
+  CFG_THRESH=$(jq -r '.workflow.release_pipeline_threshold // empty' .planning/config.json 2>/dev/null)
+  [ -n "$CFG_THRESH" ] && [ "$CFG_THRESH" != "null" ] && THRESHOLD=$CFG_THRESH
+fi
+
+# se não opt-in, gate skip
+if [ "$GATE_BLOCKING" = false ] && [ -z "$RELEASE_PIPELINE_POLICY_FORCE" ]; then
+  echo "INFO: release-pipeline-policy gate is opt-in (workflow.complete_milestone_release_pipeline_gate=false). Skip."
+  exit 0
+fi
+
+# ler RELEASE-AUDIT.md OR delegar via Task se ausente/stale
+AUDIT_FILE=".planning/RELEASE-AUDIT.md"
+SCORE=""
+
+if [ -f "$AUDIT_FILE" ]; then
+  # check se fresh (≤ 30 dias)
+  if [ "$(uname)" = "Darwin" ]; then
+    AUDIT_DATE=$(stat -f %m "$AUDIT_FILE")
+  else
+    AUDIT_DATE=$(stat -c %Y "$AUDIT_FILE")
+  fi
+  AGE_DAYS=$(( ($(date +%s) - AUDIT_DATE) / 86400 ))
+
+  if [ "$AGE_DAYS" -gt 30 ]; then
+    echo "⚠ RELEASE-AUDIT.md stale (${AGE_DAYS}d). Re-rodar /auditar-release antes de close."
+    [ "$GATE_BLOCKING" = true ] && exit 1
+  fi
+
+  # parse score
+  SCORE=$(grep -oE "Score:\*\*\s*[0-9]+/30" "$AUDIT_FILE" | grep -oE "[0-9]+" | head -1)
+fi
+
+if [ -z "$SCORE" ]; then
+  echo "⚠ RELEASE-AUDIT.md ausente OR sem score parseável."
+  echo "Rode: /auditar-release  (gera relatório fresh)"
+  [ "$GATE_BLOCKING" = true ] && exit 1
+  exit 0
+fi
+
+echo ""
+echo "release-pipeline-policy gate — threshold: ${THRESHOLD}/30"
+echo "  RELEASE-AUDIT.md score: ${SCORE}/30"
+echo ""
+
+# decisão
+if [ "$SCORE" -ge "$THRESHOLD" ]; then
+  if [ "$SCORE" -ge 25 ]; then
+    echo "✓ ROBUST (≥ 25/30) — milestone arquivável."
+  else
+    echo "✓ ADEQUATE (20-24) — milestone arquivável com warnings."
+  fi
+  exit 0
+fi
+
+if [ "$SCORE" -lt 15 ]; then
+  echo "✗ BROKEN (< 15/30) — pipeline não pode ser fonte de verdade. ESCALAR."
+elif [ "$SCORE" -lt 20 ]; then
+  echo "✗ FRAGILE (15-19/30) — gaps significativos."
+fi
+
+echo ""
+echo "Próximas ações:"
+echo "  1. Aplicar top 5 fixes do RELEASE-AUDIT.md"
+echo "  2. Re-rodar /auditar-release"
+echo "  3. Re-tentar /concluir-marco após score >= ${THRESHOLD}"
+echo ""
+
+[ "$GATE_BLOCKING" = true ] && exit 1
+exit 0
+```
+
+## Configuração
+
+```json
+{
+  "workflow": {
+    "complete_milestone_release_pipeline_gate": false,
+    "release_pipeline_threshold": 20
+  }
+}
+```
+
+**Default:** `complete_milestone_release_pipeline_gate=false` (opt-in). Threshold 20 = ADEQUATE; promove para 25 (ROBUST) em projetos tier-1.
+
+## Quando NÃO rodar
+
+- Projeto < 6 meses (pipeline ainda imatura)
+- Releases manuais (sem CI/CD complexo)
+- Solo dev side project
+- Projeto puramente experimental
+
+## Ver também
+
+- [`release-pipeline-auditor`](../kit/agents/release-pipeline-auditor.md) — agent canônico
+- [`/auditar-release`](../kit/commands/auditar-release.md) — comando dedicado
+- [`hermetic-builds`](../kit/skills/hermetic-builds/SKILL.md)
+- [`release-engineering`](../kit/skills/release-engineering/SKILL.md)
+- [`prr-checklist-coverage`](./prr-checklist-coverage.md) — gate análogo PRR (v1.10)
+- [`legacy-refactor-safety`](./legacy-refactor-safety.md) — gate análogo Legacy (v1.12)
+
+*Material-fonte: cap 8 livro Google SRE.*

package/kit/COMANDOS.md

@@ -112,6 +112,21 @@
 | `/definir-perfil` | Altera o perfil de modelo para os agentes framework (quality/balanced/budget/inherit) |
 | `/configuracoes` | Configura os toggles de workflow framework e perfil de modelo |
 
+## Suíte Legacy Code (Feathers + modernizações IA/Supabase 2026)
+
+| Comando | O que faz |
+|---------|-----------|
+| `/legacy <subcomando>` | Orquestrador único — dispatch para agents da suíte (10 subcomandos com sinônimos PT/EN) |
+| `/caracterizar` | Gera characterization tests (cap 13) — golden snapshots cobrindo 7 grupos de equivalência |
+| `/encontrar-seams` | Identifica seams (cap 25) e recomenda técnica de dependency-breaking |
+| `/auditar-refactor` | Gate canônico — coleta evidências e retorna veredito GO/BLOCK/WARN/GO-OVERRIDE |
+| `/refactor-seguro` | Chain canônico — seams → caracterizar → auditar → executar; modos full/sprout/safe-extract/override |
+| `/capturar-payloads` | Instrumenta Edge Function Supabase para captura de payloads reais via mcp__supabase__get_logs (modernização) |
+| `/caracterizar-prompt` | Characterization de prompts/tools LLM com temperature=0 + seed fixo (modernização IA) |
+| `/storytelling` | IA gera mental model + naked CRC + extract candidates (cap 16-17 + modernização IA) |
+| `/detectar-duplicacao` | Shotgun surgery cross-codebase via embeddings + jscpd (cap 21 + modernização IA) |
+| `/auditar-observabilidade-cobertura` | Audit X/N Edge Functions com signals + SLO + burn alert + char (cross-suite) |
+
 ## Utilitários
 
 | Comando | O que faz |