@ngocsangairvds/vsaf 4.1.0 → 4.1.2

package/skills/sdlc/workflows/hotfix.yaml

@@ -1,34 +1,35 @@
 name: hotfix
-description: "Hotfix — Bug report → Analyze → TDD (RED → GREEN) → Test Gate → Review → Ship"
+description: "Hotfix — Analyze → PRD → Implement (TDD) → Ship"
 
 nodes:
   - id: analyze
+    description: "Analyze — grill user, GitNexus impact, root cause, blast radius"
     command: sdlc-hotfix-analyze
     workspace: false
 
-  - id: red
-    command: sdlc-hotfix-red
+  - id: prd
+    description: "PRD — fix requirements, acceptance criteria, scope boundary"
+    command: sdlc-hotfix-prd
     depends_on: [analyze]
+    workspace: false
 
-  - id: green
-    command: sdlc-hotfix-green
-    depends_on: [red]
+  - id: implement
+    description: "Implement — TDD (RED → GREEN → REFACTOR), SonarQube-in-loop"
+    command: sdlc-hotfix-implement
+    depends_on: [prd]
 
   - id: test-gate
+    description: "Test Gate — run full test suite"
     bash: |
       cd $WORKSPACE && npm test 2>&1
-    depends_on: [green]
+    depends_on: [implement]
     loop:
-      on_fail: green
+      on_fail: implement
       max_retries: 3
       inject_error: true
 
-  - id: review
-    command: sdlc-hotfix-review
-    depends_on: [test-gate]
-    workspace: false
-
   - id: ship
-    command: sdlc-ship
-    depends_on: [review]
+    description: "Ship — commit, PR on hotfix branch"
+    command: sdlc-hotfix-ship
+    depends_on: [test-gate]
     workspace: false

package/skills/sdlc/hotfix-green/SKILL.md

@@ -1,101 +0,0 @@
----
-name: hotfix-green
-description: "Hotfix Phase 3 — TDD GREEN — write the minimal fix to make the failing test pass"
-version: 1.0.0
-author: "@ngocsangairvds/vsaf"
----
-
-# Hotfix Phase 3: TDD GREEN — Minimal Fix
-
-You are a Senior Developer applying a surgical fix. Mission: write the SMALLEST possible code change to make the failing test pass. Nothing more.
-
-## Progress Protocol
-
-Print progress at each step:
-```
-[HOTFIX-GREEN] [step/3] description... ⏳
-[HOTFIX-GREEN] [step/3] description... ✅
-```
-
-## Index Protection
-
-⛔ Do NOT modify `graphify-out/` or `.gitnexus/` — READ only.
-
-## Phase Entry Protocol
-
-```
-[HOTFIX-GREEN] [1/3] Verifying failing test... ⏳
-```
-
-1. Read `.vsaf/docs/hotfixes/{bug-id}/01-analysis.md` — understand root cause and fix strategy
-2. Locate the test file written in the RED phase
-3. Run the test — confirm it FAILS (if it passes, something changed — STOP and investigate)
-4. Read the production code that needs to be fixed
-
-```
-[HOTFIX-GREEN] [1/3] Verifying failing test... ✅
-```
-
-## Tasks
-
-### Step 2: Apply Minimal Fix
-
-```
-[HOTFIX-GREEN] [2/3] Applying minimal fix... ⏳
-```
-
-1. Apply the fix strategy from the analysis
-2. Change ONLY what is necessary to fix the bug
-3. Rules for the fix:
-   - Smallest possible diff
-   - Do NOT refactor surrounding code
-   - Do NOT fix other issues you notice
-   - Do NOT add features
-   - Do NOT change formatting of untouched code
-   - 1 bug = 1 focused fix
-4. Apply SonarQube rules on the changed code:
-   - Issues = 0, Blocker = 0, Critical = 0
-   - Security Hotspots = 0
-   - No new code smells introduced
-
-```
-[HOTFIX-GREEN] [2/3] Applying minimal fix... ✅
-```
-
-### Step 3: Run Tests — MUST PASS
-
-```
-[HOTFIX-GREEN] [3/3] Running tests... ⏳
-```
-
-1. Run the specific reproduction test — it MUST PASS now
-2. If it still FAILS → read the error, adjust the fix, try again
-3. Run the FULL test suite — check for regressions
-4. If any existing test FAILS → the fix introduced a regression
-   - Analyze which test failed and why
-   - Adjust the fix to not break existing behavior
-   - Re-run until all tests pass
-
-```
-[HOTFIX-GREEN] [3/3] Running tests... ✅ (reproduction test PASS + full suite PASS)
-```
-
-## Phase Exit Protocol
-
-Print PHASE REPORT:
-- Bug: {bug-id}
-- Status: TDD GREEN COMPLETED
-- Fix applied: {one-line description of what changed}
-- Files changed: {list of changed files}
-- Reproduction test: PASS
-- Full test suite: PASS ({N}/{N} tests)
-- Next step: test-gate (automatic) → `/hotfix-review`
-
-## Rules
-
-- ⛔ MINIMAL fix only — do NOT refactor, do NOT fix other things
-- ⛔ Do NOT modify `graphify-out/` or `.gitnexus/`
-- ⛔ Do NOT change any test file from the RED phase (the test must stay as-is)
-- If the fix requires changing more than 3 files → STOP and verify with user that this is still a hotfix scope
-- The reproduction test must pass WITHOUT modifying the test
-- All existing tests must continue to pass (zero regressions)

package/skills/sdlc/hotfix-red/SKILL.md

@@ -1,96 +0,0 @@
----
-name: hotfix-red
-description: "Hotfix Phase 2 — TDD RED — write a failing test that reproduces the bug before any fix"
-version: 1.0.0
-author: "@ngocsangairvds/vsaf"
----
-
-# Hotfix Phase 2: TDD RED — Write Failing Test
-
-You are a Test Engineer. Mission: write a test that reproduces the bug. The test MUST FAIL — proving the bug exists before anyone writes a fix.
-
-## Progress Protocol
-
-Print progress at each step:
-```
-[HOTFIX-RED] [step/3] description... ⏳
-[HOTFIX-RED] [step/3] description... ✅
-```
-
-## Index Protection
-
-⛔ Do NOT modify `graphify-out/` or `.gitnexus/` — READ only.
-
-## Phase Entry Protocol
-
-```
-[HOTFIX-RED] [1/3] Reading analysis... ⏳
-```
-
-1. Read `.vsaf/docs/hotfixes/{bug-id}/01-analysis.md`
-2. Verify file exists — if not, ask: "Analysis not found. Have you run hotfix-analyze?"
-3. Understand: root cause, affected files, reproduction steps
-4. Detect the project's test framework (scan `package.json`, `pom.xml`, existing test files)
-5. Read at least one existing test file to understand conventions (naming, structure, assertions)
-
-```
-[HOTFIX-RED] [1/3] Reading analysis... ✅
-```
-
-## Tasks
-
-### Step 2: Write Reproduction Test
-
-```
-[HOTFIX-RED] [2/3] Writing reproduction test... ⏳
-```
-
-1. Create a test that exercises the EXACT code path identified in the analysis
-2. The test must:
-   - Target the root cause specifically (not a generic test)
-   - Follow the project's existing test conventions
-   - Have a descriptive name: `test_{bug-id}_should_{expected_behavior}`
-   - Include a comment linking to the bug: `// Regression test for {bug-id}`
-3. Place the test file in the correct directory per project convention
-
-```
-[HOTFIX-RED] [2/3] Writing reproduction test... ✅
-```
-
-### Step 3: Run Test — MUST FAIL
-
-```
-[HOTFIX-RED] [3/3] Running test — expecting FAILURE... ⏳
-```
-
-1. Run ONLY the new test (not the full suite)
-2. Expected result: **TEST FAILS**
-3. If test FAILS → Correct. The bug is proven to exist. Proceed.
-4. If test PASSES → **STOP.** Something is wrong:
-   - The test does not exercise the buggy code path
-   - The analysis root cause is incorrect
-   - Re-read the analysis, rewrite the test, and try again
-5. Capture the failure output as evidence
-
-```
-[HOTFIX-RED] [3/3] Running test — expecting FAILURE... ✅ (test failed as expected)
-```
-
-## Phase Exit Protocol
-
-Print PHASE REPORT:
-- Bug: {bug-id}
-- Status: TDD RED COMPLETED
-- Test file: {path to test file}
-- Test result: FAIL (as expected)
-- Failure output: {key line from test failure}
-- Next step: `/hotfix-green`
-
-## Rules
-
-- ⛔ Do NOT fix the bug — only write the test
-- ⛔ Do NOT modify any production code
-- ⛔ Do NOT modify `graphify-out/` or `.gitnexus/`
-- The test MUST FAIL — a passing test means the test is wrong, not that the bug is fixed
-- One test per bug — do not write extra tests beyond what reproduces this specific bug
-- The test must be specific enough that fixing the bug (and only the bug) will make it pass