@massa-ai/cursor-plugin 1.55.0 → 1.57.0

package/skills/massa-ai/workflows/security/security-fix.md

@@ -77,7 +77,6 @@ Not for findings-only security review — route to `workflows/security/security-
 > - output: implementation summary, commands run, test counts, deviations
 > - firewall: raw diffs/logs summarized
 > - memory: suggest-only; main agent persists reusable security patterns
-> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
 
 > **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
 > - trigger: implementation complete, before the verification gate — never optional
@@ -88,20 +87,16 @@ Not for findings-only security review — route to `workflows/security/security-
 > - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
 > - firewall: summarized findings only, never raw diff dumps
 > - memory: suggest-only; main agent persists
-> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
-> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
 
 > **Dispatch: `massa-ai-verification-agent`** (role: `verification-agent`) — charter `skills/agents/verification-agent/SKILL.md`
 > - trigger: every SEC finding closed `fixed` — never optional, at every tier (verification-ladder Independent Verification Mandate, security-fix exception)
 > - scope: the fixed SEC finding's guard, exploit path, negative test, and report claim closure
-> - permissions: read-only
 > - inputs: the SEC finding, the applied guard, the verification suggestion, the exploit path, and validation assets
 > - sensors: deterministic command (negative-test re-run, guard/middleware-order inspection, redaction or crypto check) and report claim closure; guard-mutation discrimination sensor per `references/discrimination-sensor.md` (invert the specific guard just added; the negative test must kill it)
 > - output: confirmed/disproven SEC closure verdict with evidence, feeding the Fix Closure Report's Independent Verifier column
 > - firewall: raw exploit transcripts and test/log output summarized
 > - memory: suggest-only; main agent persists security verification outcomes
 > - fallback: if the subagent is unavailable, run a standalone fresh-eyes re-check of each fixed SEC row's guard and negative test, and record the skipped-delegation reason
-> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
    - Main agent owns report parsing, prioritization, memory writes, final synthesis, and Evidence Gate.
 
 11. Verify each completed finding:
@@ -111,7 +106,7 @@ Not for findings-only security review — route to `workflows/security/security-
    - A finding cannot be marked `fixed` when a target-relevant command or artifact check exists but was not attempted; if verification cannot run, mark it `blocked`, `deferred`, or `skipped` with an allowed skipped-check reason.
    - Run the report's verification suggestion when available.
    - At Standard+ size or high/critical severity, run the guard-mutation discrimination sensor per `references/discrimination-sensor.md`: invert the specific guard just added and confirm the negative test kills it; a surviving mutant marks the finding's Closure Matrix row `blocked` and records the `surviving_mutant` lessons signal even when the exploit-path test is green.
-   - The fix→re-verify cycle is capped per `references/verification-ladder.md`'s Bounded Fix→Re-verify Loop at 3 iterations; that counter is separate from the two-consecutive-failed-fixes breaker into `references/root-cause-scripts.md` named in this file's preamble, which fires inside a single edit iteration and neither consumes nor resets the loop count.
+   - The fix→re-verify cycle is capped per `references/verification-ladder.md`'s Bounded Fix→Re-verify Loop at 3 iterations.
    - Run targeted tests for negative and positive paths, plus lint/type/build checks relevant to touched files.
    - Inspect logs/config/errors when the finding involves data exposure.
    - Record command/artifact, result, skipped reason or `none`, highest Verification Ladder level reached, validation assets protected, and residual risk.
@@ -131,6 +126,3 @@ User asks: "Use security-fix to fix latest audit findings for user routes."
 3. Fix critical/high exploit paths first.
 4. Add negative tests for denied access, invalid input, or redacted output.
 5. Run deterministic tests and report residual security risk.
-
-<!-- validator anchors: every SEC finding closed `fixed` — never optional, at every tier | guard-mutation discrimination sensor | Fix Closure Report Contract | security-fix-closure | consult it before working the finding | append any newly discovered security hotspot | Urgency does not expand delivery authorization | Bounded Fix→Re-verify Loop | graceful degradation preserved -->
-

package/skills/massa-ai/workflows/skill-architect.md

@@ -15,28 +15,7 @@ You are a senior skill architect. Your job is to guide users through building th
 
 Load `references/project-context.md` (intake sweep) before the first substantive read.
 
-## Core Philosophy
-
-1. **Understand before building.** Never generate a SKILL.md until you've completed Discovery and Architecture phases. A bad skill is worse than no skill — it triggers incorrectly, gives inconsistent results, and erodes trust.
-
-2. **Progressive disclosure is everything.** The three-level system (frontmatter → SKILL.md body → linked files) exists for a reason: token economy. A bloated skill degrades performance for every conversation it loads into.
-
-3. **Composability over completeness.** Skills coexist with other skills. Never assume yours is the only one loaded. Be a good neighbor.
-
-4. **Specificity beats verbosity.** One precise instruction outperforms three paragraphs of vague guidance. Code beats prose for deterministic checks.
-
-5. **Skills are for agents, not humans.** No README.md inside the skill folder. No onboarding documentation. Write for an LLM that needs clear, actionable instructions.
-
----
-
-## Workflow Overview
-
-```
-DISCOVERY → ARCHITECTURE → CRAFT → VALIDATE → DELIVER
-```
-
-Move through phases sequentially. Never skip Discovery. Each phase has
-explicit exit criteria before you advance.
+Read `references/skill-architect/authoring-principles.md` once before Phase 1: it carries the five design principles this workflow applies, the phase sequence, and the conversation style to hold throughout.
 
 ---
 
@@ -271,7 +250,7 @@ Consult `references/skill-architect/examples.md` for the full anti-pattern list.
 ### 4.1 — Structural Validation
 
 Run the full checklist from `references/skill-architect/quality-checklist.md` and execute
-`bun scripts/validate_skill.ts <skill-folder>` against the generated skill to check:
+`bun skills/massa-ai/scripts/validate_skill.ts <skill-folder>` against the generated skill to check:
 
 - SKILL.md exists with correct casing
 - Frontmatter has required fields with correct format
@@ -281,7 +260,7 @@ Run the full checklist from `references/skill-architect/quality-checklist.md` an
 - Description includes trigger phrases
 
 IF the script cannot run (no code-execution tool available) THEN skip
-`scripts/validate_skill.ts` and run the
+`skills/massa-ai/scripts/validate_skill.ts` and run the
 `references/skill-architect/quality-checklist.md` checklist manually instead.
 
 ### 4.2 — Trigger Testing
@@ -335,7 +314,7 @@ Create the final skill folder structure in the project's skills directory.
 
 ### 5.2 — Present
 
-Use `present_files` to share the packaged skill. Include a brief summary:
+Present the created file tree (every path written, relative to the skill folder) and a brief summary:
 
 - What the skill does
 - How to install it in the user's preferred AI agent or IDE
@@ -347,25 +326,14 @@ Suggest:
 
 - Test with the suggested phrases
 - If results aren't right, bring the conversation back and iterate
-- For formal evaluation, use the `skill-creator` skill's eval and benchmark modes
+- For a formal re-check after edits, re-run Phase 4 against the changed skill
 
 ---
 
-## Conversation Style
-
-- Ask questions one area at a time — don't dump all Discovery questions at once
-- Give concrete suggestions the user can react to ("Would something like X work?")
-- If the user provides a vague request, propose a specific interpretation and ask
-  if it matches their intent
-- If the conversation already contains a workflow (user says "turn this into a
-  skill"), extract what you can from history FIRST, then fill gaps with questions
-- Match the user's technical level — explain terms if they seem non-technical
-- Be direct about tradeoffs: if a design choice has a downside, say so
-
 ## Important Boundaries
 
-- This skill is for CREATING new skills. For improving, evaluating, or
-  benchmarking existing skills, direct users to the `skill-creator` skill.
+- This skill is for CREATING new skills. To improve or evaluate an existing
+  skill, run Phase 4 (Validate) against it directly instead of Phases 1-3.
 - Never generate a SKILL.md without completing Discovery and Architecture.
   If the user insists on skipping, explain why these phases matter and offer
   a compressed version rather than skipping entirely.

package/skills/massa-ai/workflows/spec-driven.md

@@ -119,15 +119,9 @@ Quick artifacts live under `.specs/quick/NNN-slug/` with a `TASK.md` (one-line i
 **Screen work — before writing or judging any user-facing screen:** when this task creates or modifies a screen, the `massa-ai-designer` dispatch below is mandatory rather than discretionary, carved out of ordinary delegation gating by the Screen Implementation Exception in `references/agent-orchestration.md`. It does not fire when the task touches no screen surface.
 
 > **Dispatch: `massa-ai-designer`** (role: `designer`) — charter `skills/agents/designer/SKILL.md`
-> - trigger: the task creates or modifies a user-facing screen — mandatory once that condition holds, per the Screen Implementation Exception in `references/agent-orchestration.md`; it does not fire when no screen surface is touched
 > - scope: the screens, views, components, layouts, styles, and design tokens in this task's UI surface — never the whole repository
 > - permissions: write, scoped to UI-layer files only with a disjoint write set
-> - inputs: exact `projectId`, parent `workflowSessionId`, Figma links/node ids or screenshots when supplied, acceptance criteria, the repository's existing UI conventions and design tokens, recalled screen patterns
-> - sensors: Figma MCP read when a design source exists; per-element expected-vs-actual comparison; the UI module's own build/lint; the states a design under-specifies — empty, loading, error, long text, small and large sizes
 > - output: per-element conformance table (element, expected, actual, verdict, severity) plus the UI files written; a missing or unreachable design source is listed as a skipped sensor, never a silent pass
-> - firewall: summarized design-source evidence and `path:line` pointers only, never raw Figma node dumps or full file bodies
-> - memory: suggest-only; the main agent persists durable screen and design-token conventions
-> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
 
 > **Dispatch: `massa-ai-reviewer`** (role: `reviewer`) — charter `skills/agents/reviewer/SKILL.md`
 > - trigger: implementation complete, before the verification gate — never optional
@@ -138,19 +132,15 @@ Quick artifacts live under `.specs/quick/NNN-slug/` with a `TASK.md` (one-line i
 > - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
 > - firewall: summarized findings only, never raw diff dumps
 > - memory: suggest-only; main agent persists
-> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
-> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
 
 > **Dispatch: `massa-ai-verification-agent`** (role: `verification-agent`) — charter `skills/agents/verification-agent/SKILL.md`
 > - trigger: spec-driven Execute final gate; author ≠ verifier independence required
 > - scope: the feature's git diff surface, test files, and spec ACs
-> - permissions: read-only
 > - inputs: `spec.md` (ACs = source of truth), `references/spec-driven/validate.md` as operating checklist, commit range, test files in scope
 > - sensors: (1) spec-anchored outcome check — each test's asserted value matches the spec-defined expected outcome; (2) discrimination sensor — injects behavior-level faults in scratch state, confirms tests kill them, discards mutations; surviving mutants become fix tasks
 > - output: `.specs/features/<slug>/validation.md` (PASS/FAIL, per-AC evidence, sensor result, diff range); compact verdict + ranked gap list; gaps become fix tasks
 > - firewall: raw diffs/logs/test output summarized; mutations run in scratch state only
 > - memory: suggest-only; main agent persists validation outcomes
-> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
 
     - The verification-agent re-derives coverage independently using evidence-or-zero and does not inherit the author's mental model.
    - The fix → re-verify loop is bounded by the Bounded Fix→Re-verify Loop rule in `references/verification-ladder.md` (cap reached → `Blocked`).
@@ -228,4 +218,3 @@ User asks: "Specify offline draft sync, design it, create tasks, implement it, a
 4. Include Tasks because execution has dependency complexity.
 5. Execute one approved task at a time.
 6. Finish Execute with independent validation, including the discrimination sensor, then write `validation.md`.
-<!-- validator anchors: .specs/ files | current repository source and approved .specs/ artifacts override stale memory | .specs/ directory missing | 3 verification iterations -->

package/skills/massa-ai/workflows/tests/tests-audit.md

@@ -39,18 +39,7 @@ Five gates, five distinct error classes. A green gate elsewhere never substitute
    - `references/agent-orchestration.md` only for large scopes, explicit parallel/subagent requests, PR subagent invocation, or independent verification of high-impact findings
 3. `recall` -> load testing conventions, mock boundaries, prior flaky tests, known regressions, project constraints, reusable verification recipes, and accepted test exceptions for the target area.
    - Apply the Memory Freshness Gate from `references/audit-scope.md`; recalled exceptions are leads, not proof.
-4. Establish the investigation scope before proceeding:
-   - Modified files scope: use when the user says modified files, changed files, current changes, uncommitted changes, staged changes, or unstaged changes.
-   - Explicit files/globs scope: use when the user names files, directories, or globs.
-   - Commit range scope: use when the user provides commits/ranges or asks for commits made by me, my branch commits, or test gaps introduced by branch commits.
-   - Branch comparison scope: use when the user names base/head branches, refs, or a branch diff.
-   - Codebase area scope: use when the user names a path, module, package, feature area, test suite, or glob.
-   - Symbol/class/function scope: use when the user names public classes, functions, APIs, handlers, or exported surfaces.
-   - Feature/flow scope: use when the user names a runtime flow, user journey, or feature area.
-   - Whole-repo scope: use only when the user explicitly asks for a whole-repo tests audit.
-   - Implementation parent scope: use only when `workflows/implementation/implementation-audit.md` invokes this workflow with a concrete implementation scope packet.
-   - If the target focus is missing, vague, or too broad, ask for a concrete target from the supported scope types in `references/audit-scope.md`.
-   - Build the shared scope packet from `references/audit-scope.md` and carry it into the report.
+4. Establish the investigation scope: select the scope type and build the shared scope packet per `references/audit-scope.md`, which owns the supported scope types, the ask-when-vague rule, and the packet fields. Carry the packet into the report.
 5. Resolve the selected branch's mechanics (modified files, commit range, codebase area, explicit-files/branch/symbol/feature/whole-repo, or implementation parent scope) per `references/audit-scope.md` (Lens Audit Scope Resolution Procedure, Tests row of Per-Lens Scope Deltas).
 6. Investigation pass. Dispatch `audit-specialist` per `references/agent-orchestration.md` when the scope justifies an isolated read-only subagent:
 
@@ -63,7 +52,6 @@ Five gates, five distinct error classes. A green gate elsewhere never substitute
 > - output: findings with missing/weak coverage type, location, evidence, regression risk, severity, simplest test direction, deterministic sensor, verification suggestion
 > - firewall: raw diffs/logs/search output summarized, not returned raw
 > - memory: suggest-only; main agent persists reusable testing patterns
-> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
 
     - Map changed or targeted behavior to existing tests, fixtures, mocks, and deterministic harnesses.
    - Variation check: flag tests exercising only the single fixture example where input bounds or parameters can vary — hardcoded-example brittleness the unit gate cannot see.

package/skills/massa-ai/workflows/tests/tests-fix.md

@@ -77,20 +77,16 @@ Not for findings-only test coverage, assertion quality, fixture health, flakines
 > - output: ranked findings, blocking vs advisory; blocking findings become fix items before verification runs
 > - firewall: summarized findings only, never raw diff dumps
 > - memory: suggest-only; main agent persists
-> - fallback: if the subagent is unavailable, run a standalone fresh-eyes review against this output contract and record the skipped-delegation reason
-> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
 
 > **Dispatch: `massa-ai-verification-agent`** (role: `verification-agent`) — charter `skills/agents/verification-agent/SKILL.md`
 > - trigger: mandatory per the verification-ladder's Independent Verification Mandate for any TST finding closed at Standard+/Spec-driven size or high/critical severity; at Quick size the subagent hop is skipped and the standalone fresh-eyes assertion re-check below runs instead
 > - scope: the fixed TST finding's assertion strength, fixture/mock boundary, coverage-execution-map row, and report claim closure
-> - permissions: read-only
 > - inputs: the finding, the applied test change, the coverage execution map row, the verification command, and validation assets
 > - sensors: deterministic command (focused test run, assertion inspection, fixture-not-weakened check) against the coverage execution map row; discrimination sensor per `references/discrimination-sensor.md` (mutate the new/repaired test's subject; the test must kill it)
 > - output: confirmed/disproven TST closure verdict with assertion evidence
 > - firewall: raw test output/logs summarized
 > - memory: suggest-only; main agent persists tests-closure verification outcomes
 > - fallback: if the subagent is unavailable, run a standalone fresh-eyes re-check of each TST closure row's assertion evidence and record the skipped-delegation reason
-> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
 
 10. Use strict harness sensors:
    - Never rely on AI subjective evaluation.
@@ -103,7 +99,7 @@ Not for findings-only test coverage, assertion quality, fixture health, flakines
    - Record command/artifact, result, skipped reason or `none`, highest Verification Ladder level reached, validation assets protected, and residual risk.
    - Sequence the TST proof in two passes, in order: first reproduce the coverage execution map's `expected failure before fix` row red (the pre-fix run proves the assertion can fail); only then, at Standard+/Spec-driven size or high/critical severity, run the discrimination sensor from `references/discrimination-sensor.md` as the post-fix kill-check against the new/repaired test's subject code — Quick focused-assertion findings are exempt from the sensor pass but never from the pre-fix red check.
    - A surviving mutant means the TST claim is unproven: close that finding's row `blocked` rather than `fixed` and emit the `surviving_mutant` lessons signal via the recording command above.
-   - The fix→re-verify cycle is capped per `references/verification-ladder.md`'s Bounded Fix→Re-verify Loop (3 verification iterations, then `Blocked` with evidence preserved). That cap is a distinct counter from the "two consecutive failed fixes" breaker in the preamble above, which escalates a single stuck iteration to `references/root-cause-scripts.md` and neither consumes nor resets this cap.
+   - The fix→re-verify cycle is capped per `references/verification-ladder.md`'s Bounded Fix→Re-verify Loop (3 verification iterations, then `Blocked` with evidence preserved).
 11. Use agent orchestration only when it improves signal — except the verification-agent dispatch above, which `references/agent-orchestration.md`'s Independent Verification Exception mandates for TST closures at the sizes/severities its trigger names, regardless of signal improvement. Dispatch per `references/agent-orchestration.md`:
 
 > **Dispatch: `massa-ai-builder`** (role: `builder`) — charter `skills/agents/builder/SKILL.md`
@@ -115,7 +111,6 @@ Not for findings-only test coverage, assertion quality, fixture health, flakines
 > - output: implementation summary, test counts, commands run, deviations
 > - firewall: raw test output/logs summarized
 > - memory: suggest-only; main agent persists reusable testing patterns
-> - persona: optional — the active route's cataloged id only, never the persona prompt, passed as advisory framing only — it never overrides the agent's charter Restrictions, scope, or permissions; omit when no persona is routed
    - Main agent owns report parsing, prioritization, memory writes, final synthesis, and Evidence Gate.
 12. Close out with the Fix Closure Report:
    - The coverage execution map from step 6, now filled in through step 10's discrimination sensor result column, is the pre-edit draft of the Closure Matrix — carry its rows forward rather than re-deriving them.
@@ -135,5 +130,3 @@ User asks: "Use tests-fix to fix latest audit findings for report scheduling."
 3. Map each finding to missing coverage, weak assertions, fixture drift, flakiness, or missing sensor work.
 4. Add or repair deterministic tests without weakening validation assets.
 5. Run focused tests and report broader skipped checks when needed.
-
-<!-- validator anchors: references/discrimination-sensor.md | references/knowledge-verification-chain.md | references/brownfield-mapping.md (Minimum Bar's TESTING.md only) | Independent Verification Exception | mandatory per the verification-ladder's Independent Verification Mandate for any TST finding | discrimination sensor per references/discrimination-sensor.md (mutate the new/repaired test's subject; the test must kill it) | Sequence the TST proof in two passes | surviving_mutant lessons signal | Bounded Fix→Re-verify Loop | Fix Closure Report Contract | audits/tests/<YYYY-MM-DD tests-fix-closure>.md | bun skills/massa-ai/scripts/check_fix_closure.ts <closure.md> --family tests | graceful degradation preserved -->

package/skills/massa-ai/workflows/to-prd.md

@@ -187,4 +187,3 @@ To-PRD is done when every requirement has an ID, acceptance criteria are testabl
 - **Code analysis:** Use massa-ai tools first (`list_projects`, `search`, `project_map`, `optimized_context`) before `ast-grep`/`rg`/`grep` for the explore step. Current source overrides a stale index or memory (source-precedence rule).
 - **Memory:** Persist verified outcomes worth reusing with `remember`, tagging `project:<id>`, `session:<id>`, `workflow:to-prd`, `entity:<slug>`, `memory:working|episodic|semantic|procedural`.
 - **Validation:** Evidence-or-zero. Every requirement resolved and assumption logged is checked against current source.
-<!-- validator anchors: references/project-context.md | read-only workflow | no implementation-delivery/code-annotation/root-cause-scripts | no Isolation Gate | no Reuse Scan -->