@martinffx/atelier 0.1.0

package/skills/code-review/references/rq.md

@@ -0,0 +1,357 @@
+# Request Review (rq) Workflow
+
+## Overview
+
+This workflow:
+1. Gets diff (git diff against target branch)
+2. Triage Subagent - Analyzes diff, selects reviewers, identifies skills to load
+3. Reviewer Subagents (parallel) - Each selected reviewer analyzes code
+4. Synthesis Subagent - Deduplicates findings
+5. Architect Subagent - Architecture review
+6. Challenge Subagent - Validates findings
+7. Final synthesis and output
+
+---
+
+## Step 1: Get Diff
+
+### Default: git diff to main
+
+```bash
+git diff main
+```
+
+If target branch specified:
+```bash
+git diff <branch>
+```
+
+Capture the list of changed files and the full diff.
+
+---
+
+## Step 2: Triage Subagent
+
+**Purpose:** Analyze diff to determine context, select reviewers, identify skills to load.
+
+**Uses:** `scout` agent - See [agents/scout.md](../../agents/scout.md)
+
+### Subagent Invocation
+
+```yaml
+subagent_type: scout
+description: "Triage diff for code review"
+prompt: |
+  Analyze this code diff to determine review needs.
+
+  FILES: {files_changed}
+  DIFF: {git_diff}
+
+  Tasks:
+  1. Detect the primary language and framework
+  2. Identify the domain (web API, frontend, database, etc.)
+  3. Select 3-5 reviewers from this list based on what's in the diff:
+     - Security (auth, secrets, injection risks)
+     - Performance (hot paths, queries, algorithms)
+     - Correctness (logic, types, error handling)
+     - Maintainability (naming, complexity, tests)
+     - Architecture (boundaries, layers, SOLID)
+     - SecuritySkeptic (security + failure scenarios)
+     - PerformanceOperator (performance at scale)
+     - MaintainabilityPedant (quality + precision)
+  4. **Identify skills to load** based on detected language/framework:
+     - TypeScript → typescript-testing, typescript-fastify (if fastify framework)
+     - Python → python-testing, python-fastapi (if fastapi framework)
+     - Security concerns → code-security
+     - Performance concerns → code-perf
+
+  Return ONLY valid JSON (no markdown, no code blocks):
+  {
+    "context": {
+      "language": "typescript|python|go|...",
+      "framework": "react|fastapi|...",
+      "domain": "web-api|frontend|database|..."
+    },
+    "reviewers": ["Security", "Correctness"],
+    "skills_to_load": ["typescript-testing", "code-security"]
+  }
+```
+
+### Expected Output
+
+```json
+{
+  "context": { "language": "typescript", "framework": "fastify", "domain": "web-api" },
+  "reviewers": ["Security", "Correctness", "PerformanceOperator"],
+  "skills_to_load": ["typescript-testing", "code-security"]
+}
+```
+
+---
+
+## Step 3: Reviewer Subagents (Parallel)
+
+**Purpose:** Each selected reviewer analyzes the code from their specialty perspective.
+
+**Uses:** `general` subagent - One per reviewer, dispatched concurrently
+
+**Pattern:** Spawn one subagent per reviewer **concurrently** (parallel execution).
+
+### Skill Loading Pre-Step
+
+Before dispatching reviewers, the detected skills are passed to each reviewer:
+```json
+{
+  "skills_to_load": ["typescript-testing", "code-security"]
+}
+```
+
+### Subagent Invocation (One per Reviewer)
+
+```yaml
+subagent_type: general
+description: "Security review of code diff"
+prompt: |
+  You are a Security Reviewer analyzing code for security vulnerabilities.
+
+  CONTEXT:
+  - Language: {language}
+  - Framework: {framework}
+  - Files: {files}
+
+  **PRE-STEP: Load Relevant Skills**
+  Before reviewing, load these skills:
+  {skills_to_load}
+
+  Use the `skill` tool to load each skill.
+
+  DIFF:
+  {git_diff}
+
+  Focus areas:
+  - Authentication and authorization flaws
+  - Injection vulnerabilities (SQL, command, XSS)
+  - Secrets in code (API keys, passwords, tokens)
+  - Surface area exposure
+  - Input validation gaps
+
+  Return findings as JSON array. For each finding:
+  {
+    "findings": [
+      {
+        "location": "file:line",
+        "severity": "Critical|High|Medium|Low",
+        "title": "Brief finding name",
+        "issue": "What's wrong",
+        "impact": "Why this matters",
+        "suggestion": "How to fix",
+        "pre_existing": true|false
+      }
+    ]
+  }
+
+  If no findings, return {"findings": []}
+```
+
+### Parallel Execution
+
+Invoke **all reviewer subagents simultaneously**:
+
+```
+Concurrent invocations:
+├── Security Reviewer
+├── Correctness Reviewer
+├── PerformanceOperator Reviewer
+└── (etc. based on triage output)
+```
+
+### Error Handling
+
+- If a subagent fails/times out: Log error, continue with other reviewers
+- If all subagents fail: Report error to user, abort review
+- Partial results: Use findings from successful reviewers only
+
+### Aggregating Results
+
+Collect findings from all reviewer subagents:
+
+```python
+all_findings = []
+for reviewer in reviewers:
+    result = await reviewer_subagent(reviewer)
+    if result.success:
+        all_findings.extend(result.findings)
+```
+
+---
+
+## Step 4: Synthesis Subagent (First Pass)
+
+**Purpose:** Group, deduplicate, and assign initial severity.
+
+**Uses:** `general` subagent
+
+### Subagent Invocation
+
+```yaml
+subagent_type: general
+description: "Synthesize code review findings"
+prompt: |
+  Synthesize these code review findings from multiple reviewers.
+
+  RAW FINDINGS:
+  {all_findings_json}
+
+  Tasks:
+  1. Deduplicate findings that refer to the same issue
+  2. Flag potential false positives
+  3. Assign initial severity based on consensus
+  4. Group by severity (Critical, High, Medium, Low)
+
+  Return JSON:
+  {
+    "synthesized": [
+      {
+        "title": "Finding title",
+        "severity": "Critical|High|Medium|Low",
+        "locations": ["file:line", "file:line"],
+        "issue": "Consolidated issue description",
+        "impact": "Why this matters",
+        "suggestion": "How to fix",
+        "pre_existing": true|false,
+        "flag_for_challenge": true|false,
+        "original_findings": ["Reviewer: finding summary"]
+      }
+    ]
+  }
+```
+
+---
+
+## Step 5: Architect Subagent
+
+**Purpose:** Review architecture-specific concerns.
+
+**Uses:** `architect` agent - See [agents/architect.md](../../agents/architect.md)
+
+### Subagent Invocation
+
+```yaml
+subagent_type: architect
+description: "Architecture review of code diff"
+prompt: |
+  You are an Architecture Reviewer analyzing structural issues.
+
+  CONTEXT:
+  - Language: {language}
+  - Framework: {framework}
+  - Files: {files}
+
+  SYNTHESIZED FINDINGS:
+  {synthesized_findings_json}
+
+  **PRE-STEP: Load Relevant Skills**
+  Before reviewing, load:
+  - Use `skill` tool to load: oracle-architect
+
+  Focus areas:
+  - Boundary violations
+  - Responsibility leakage
+  - Dependency direction
+  - Layer separation
+  - SOLID violations
+  - Data model design
+  - API contract design
+
+  Return findings as JSON:
+  {
+    "architecture_findings": [
+      {
+        "location": "file:line",
+        "severity": "High|Medium",
+        "title": "Architecture Finding",
+        "issue": "What's wrong",
+        "impact": "Architectural debt",
+        "suggestion": "How to fix",
+        "pre_existing": true|false
+      }
+    ]
+  }
+```
+
+---
+
+## Step 6: Challenge Subagent
+
+**Purpose:** Validate findings by challenging assumptions.
+
+**Uses:** `oracle` agent - See [agents/oracle.md](../../agents/oracle.md)
+
+### Subagent Invocation
+
+```yaml
+subagent_type: oracle
+description: "Challenge code review findings"
+prompt: |
+  Challenge these code review findings critically using sequential-thinking.
+
+  ALL FINDINGS (includes synthesized + architecture):
+  {all_findings_json}
+
+  **PRE-STEP: Load Relevant Skills**
+  Before challenging, load:
+  - Use `skill` tool to load: oracle-challenge
+
+  For each flagged finding, use `mcp__sequential-thinking__sequentialthinking` to analyze:
+  1. Is this handled elsewhere in the codebase?
+  2. Is this the correct place for this concern?
+  3. Is this a valid concern or a false positive?
+  4. What evidence supports or refutes this finding?
+  5. What are alternative perspectives to consider?
+
+  Return JSON with validated findings:
+  {
+    "validated": [
+      {
+        "title": "Finding title",
+        "severity": "Critical|High|Medium|Low",
+        "locations": ["file:line"],
+        "issue": "Issue description",
+        "impact": "Impact explanation",
+        "suggestion": "Fix suggestion",
+        "pre_existing": true|false,
+        "reasoning": {
+          "why_flagged": "What triggered the finding",
+          "verification": "How it was validated",
+          "evidence": "Code snippets or references",
+          "alternative_view": "Other perspectives to consider"
+        }
+      }
+    ],
+    "removed": ["Finding titles that were false positives"]
+  }
+```
+
+---
+
+## Step 7: Final Synthesis and Output
+
+**Purpose:** Produce final report with extended reasoning sections.
+
+This step is done **inline** (no subagent needed) - format the validated findings into the output structure defined in [output.md](./output.md).
+
+Display findings in terminal per [output.md](./output.md).
+
+---
+
+## Subagent Summary
+
+| Step | Subagent | Uses | Parallel? | Purpose |
+|------|----------|------|----------|---------|
+| 1 | Get Diff | inline | — | `git diff <branch>` |
+| 2 | Triage | `scout` agent | No | Detect context, select reviewers, identify skills |
+| 3 | Reviewers | `general` subagent | Yes (per reviewer) | Specialty analysis |
+| 4 | Synthesis | `general` subagent | No | Deduplicate and group |
+| 5 | Architect | `architect` agent | No | Architecture review |
+| 6 | Challenge | `oracle` agent | No | Validate findings |
+| 7 | Output | inline | — | Format and display findings |

package/skills/code-review/references/rs.md

@@ -0,0 +1,30 @@
+# Respond to Review (rs) — Interview Mode
+
+## Overview
+
+Interactive interview mode to resolve code review findings. No subagents.
+
+The agent interviews the user one question at a time, multiple choice, until it has enough context to resolve all issues raised by the review.
+
+## Prompt
+
+```
+Interview me until you have enough context to resolve all the issues raised by the code review.
+Ask me questions 1 by 1, multiple choice.
+```
+
+## Behavior
+
+1. Load the review findings from the current conversation context
+2. Begin interviewing the user — one question at a time, always multiple choice
+3. Use answers to build understanding of how to resolve each finding
+4. Once all context is gathered, apply the fixes
+5. **Always ask user before applying fixes**
+
+## Guidelines
+
+- One question at a time — never batch questions
+- Always provide multiple choice answers (a, b, c, d...)
+- Start with the most ambiguous findings first
+- Skip findings that are clearly actionable without input
+- After all questions are answered, summarize the plan and confirm before making changes

package/skills/code-security/SKILL.md

@@ -0,0 +1,183 @@
+---
+name: code-security
+description: >
+  Security audit and vulnerability detection. Use when reviewing code for security issues,
+  scanning dependencies, or addressing security concerns. Triggers on "security", "vulnerability",
+  "audit", "CVE", "injection", "XSS", "SQL injection", "auth", or when the user asks to check
+  for security issues.
+user-invocable: true
+---
+
+# Code Security
+
+Security audit workflow and checklist.
+
+## The Workflow
+
+### 1. Scan
+
+Run automated security tools.
+
+```bash
+# Check dependencies
+npm audit
+pip audit
+cargo audit
+
+# Run security scanner
+trivy fs .
+snyk test
+```
+
+### 2. Review
+
+Manual code review against checklist.
+
+See references/owasp-top-10.md for common vulnerabilities.
+
+### 3. Fix
+
+Remediate vulnerabilities found.
+
+### 4. Verify
+
+Re-scan to confirm fixes.
+
+---
+
+## Security Checklist
+
+### Injection
+
+| Check | Pattern |
+|-------|---------|
+| SQL | Parameterized queries |
+| Command | No shell execution with user input |
+| XSS | Escape/validate output |
+| LDAP | Escape DN components |
+
+### Authentication
+
+| Check | Pattern |
+|-------|---------|
+| Passwords | Hash with bcrypt/argon2 |
+| Sessions | Secure, httpOnly cookies |
+| Tokens | Short-lived, proper validation |
+| MFA | Consider for sensitive ops |
+
+### Data Protection
+
+| Check | Pattern |
+|-------|---------|
+| Secrets | Never in code |
+| PII | Encrypt at rest |
+| Transport | HTTPS only |
+| Logs | No sensitive data |
+
+### Dependencies
+
+| Check | Pattern |
+|-------|---------|
+| Vulnerabilities | Scan regularly |
+| Outdated | Update promptly |
+| Sources | Trusted packages only |
+
+---
+
+## Common Vulnerabilities
+
+See references/vulnerability-patterns.md for detailed patterns:
+
+### SQL Injection
+
+```python
+# BAD
+query = f"SELECT * FROM users WHERE id = {user_id}"
+
+# GOOD
+query = "SELECT * FROM users WHERE id = %s"
+cursor.execute(query, (user_id,))
+```
+
+### XSS
+
+```javascript
+// BAD
+element.innerHTML = userInput;
+
+// GOOD
+element.textContent = userInput;
+// or
+element.setAttribute('title', sanitize(userInput))
+```
+
+### Command Injection
+
+```python
+# BAD
+os.system(f"ping {host}")
+
+# GOOD
+subprocess.run(['ping', host])
+```
+
+### Hardcoded Secrets
+
+```javascript
+// BAD
+const apiKey = "sk_live_12345";
+
+// GOOD (environment variable)
+const apiKey = process.env.API_KEY;
+```
+
+---
+
+## Tools
+
+See references/security-tools.md for setup and usage:
+
+| Tool | Ecosystem | Purpose |
+|------|-----------|---------|
+| npm audit | Node.js | Dependency vulnerabilities |
+| pip-audit | Python | Dependency vulnerabilities |
+| cargo-audit | Rust | Dependency vulnerabilities |
+| Snyk | Multi | Vulnerability scanning |
+| Trivy | Multi | Container/infra scanning |
+| OWASP ZAP | Multi | Web app scanning |
+| bandit | Python | Static analysis |
+| ESLint security | JS/TS | Static analysis |
+
+---
+
+## Output Format
+
+After security audit:
+
+```markdown
+## Security Audit
+
+### Scan Results
+- Dependencies: 0 vulnerabilities
+- Static analysis: 1 issue found
+
+### Issues Found
+
+| Severity | Issue | Location | Fix |
+|----------|-------|----------|-----|
+| High | SQL injection | users.py:42 | Use parameterized query |
+| Medium | Hardcoded secret | config.js:5 | Use env var |
+
+### Recommendations
+1. Enable 2FA for admin accounts
+2. Rotate API keys quarterly
+3. Set up automated dependency scanning
+```
+
+---
+
+## Skill Loading
+
+- For database issues → load python-sqlalchemy or typescript-drizzle-orm
+- For auth issues → load relevant auth patterns
+- For deployment security → load infra skills if available

package/skills/code-security/references/owasp-top-10.md

@@ -0,0 +1,129 @@
+# OWASP Top 10 (2021)
+
+## A01: Broken Access Control
+
+Users acting outside their intended permissions.
+
+**Check:**
+- Enforce authorization on every request
+- Don't rely on hidden URLs
+- Disable directory listing
+- Log access control failures
+
+**Patterns:**
+```javascript
+// Check permission
+if (user.id !== resource.ownerId) {
+  throw new ForbiddenError();
+}
+```
+
+---
+
+## A02: Cryptographic Failures
+
+Data exposure due to weak cryptography.
+
+**Check:**
+- Encrypt sensitive data at rest
+- Use strong encryption (AES-256, RSA-2048+)
+- Don't use deprecated algorithms (MD5, SHA1)
+- Proper key management
+
+---
+
+## A03: Injection
+
+User data interpreted as code.
+
+**Types:**
+- SQL
+- NoSQL
+- OS Command
+- LDAP
+- Expression Language
+
+**Prevention:**
+- Parameterized queries
+- Input validation
+- Escape output
+
+---
+
+## A04: Insecure Design
+
+Missing security controls in design.
+
+**Check:**
+- Threat modeling
+- Secure design patterns
+- Segregation of duties
+
+---
+
+## A05: Security Misconfiguration
+
+Incorrect security settings.
+
+**Check:**
+- Default credentials
+- Unnecessary features
+- Error handling (no stack traces)
+- Security headers
+
+---
+
+## A06: Vulnerable Components
+
+Using components with known vulnerabilities.
+
+**Check:**
+- Keep dependencies updated
+- Monitor CVE feeds
+- Remove unused components
+
+---
+
+## A07: Auth Failures
+
+Weaknesses in authentication.
+
+**Check:**
+- Don't ship with default credentials
+- Implement MFA
+- Proper session handling
+- Credential recovery flows
+
+---
+
+## A08: Software/Data Integrity Failures
+
+Assuming software updates are safe.
+
+**Check:**
+- Verify integrity (signatures, checksums)
+- Don't use untrusted CDNs
+- CI/CD security
+
+---
+
+## A09: Logging Failures
+
+Insufficient logging and monitoring.
+
+**Check:**
+- Log access control failures
+- Log sensitive operations
+- Don't log secrets
+- Set up alerting
+
+---
+
+## A10: SSRF
+
+Fetching remote resources without validating URLs.
+
+**Check:**
+- Validate URLs
+- Disable HTTP redirects
+- Use allowlists