@ngocsangairvds/vsaf 4.1.8 → 4.1.9

package/skills/vds-skill/vds-scripts/scripts/brd_coverage_report.json

@@ -1,276 +0,0 @@
-{
-  "total_required": 16,
-  "total_covered": 16,
-  "coverage_percentage": 100.0,
-  "covered_sections": [
-    "3.1",
-    "3.2",
-    "3.3",
-    "3.4",
-    "3.5",
-    "4.1",
-    "4.10",
-    "4.11",
-    "4.2",
-    "4.3",
-    "4.4",
-    "4.5",
-    "4.6",
-    "4.7",
-    "4.8",
-    "4.9"
-  ],
-  "missing_sections": [],
-  "found_references": {
-    "projects/INSURANCE/analysis/target-state/TARGET_STATE_UPDATE_PLAN.md": [
-      "3.1",
-      "3.3",
-      "3.3.1",
-      "3.3.2",
-      "3.3.3",
-      "3.3.4",
-      "3.3.5",
-      "3.3.7",
-      "3.3.9",
-      "3.4",
-      "3.4.2",
-      "3.5",
-      "4.1",
-      "4.10",
-      "4.2",
-      "4.3",
-      "4.3.2",
-      "4.4",
-      "4.7",
-      "4.9"
-    ],
-    "projects/INSURANCE/analysis/target-state/BRD_COVERAGE_REPORT.md": [
-      "3.1"
-    ],
-    "projects/INSURANCE/analysis/reference/vietin/estimation/UPDATE_SUMMARY_VIETNAMESE.md": [
-      "3.3.1",
-      "3.4.3.1"
-    ],
-    "projects/INSURANCE/analysis/reference/vietin/estimation/BRD_ESTIMATION_UPDATE_SUMMARY.md": [
-      "3.3.1",
-      "3.3.2",
-      "3.3.4",
-      "4.10",
-      "4.11",
-      "4.2",
-      "4.6",
-      "4.7",
-      "4.8",
-      "4.9"
-    ],
-    "projects/INSURANCE/analysis/reference/vietin/estimation/FINAL_COMPLETION_REPORT.md": [
-      "3.1.1"
-    ],
-    "projects/INSURANCE/analysis/reference/vietin/estimation/FINAL_SUMMARY.md": [
-      "3.4.3.1",
-      "4.0",
-      "4.8"
-    ],
-    "projects/INSURANCE/analysis/reference/vietin/estimation/BRD_TO_ESTIMATION_MAPPING.md": [
-      "3.1",
-      "3.2",
-      "3.3",
-      "3.4",
-      "3.5",
-      "4.1",
-      "4.10",
-      "4.11",
-      "4.2",
-      "4.3",
-      "4.4",
-      "4.5",
-      "4.6",
-      "4.7",
-      "4.8",
-      "4.9"
-    ],
-    "projects/INSURANCE/analysis/reference/vietin/estimation/BRD_COVERAGE_IMPROVEMENT.md": [
-      "3.4.3"
-    ],
-    "projects/INSURANCE/analysis/current-state/insurance-renewal-process/insurance-renewal-process-state-machine.md": [
-      "3.5.3"
-    ],
-    "projects/INSURANCE/analysis/current-state/insurance-renewal-process/insurance-renewal-process-architecture.md": [
-      "3.5.3"
-    ],
-    "projects/INSURANCE/analysis/current-state/insurance-customer-business/insurance-customer-business-database-schema.md": [
-      "3.1"
-    ],
-    "projects/INSURANCE/analysis/current-state/insurance-customer-business/insurance-customer-business-architecture-backup.md": [
-      "3.1"
-    ],
-    "projects/INSURANCE/analysis/current-state/insurance-customer-business/insurance-customer-business-architecture-clean.md": [
-      "3.1"
-    ],
-    "projects/INSURANCE/analysis/current-state/insurance-customer-business/insurance-customer-business-architecture.md": [
-      "3.1"
-    ],
-    "projects/INSURANCE/analysis/current-state/insurance-claim-business/insurance-claim-business-state-machine.md": [
-      "3.5",
-      "3.6"
-    ],
-    "projects/INSURANCE/analysis/current-state/insurance-claim-business/insurance-claim-business-architecture.md": [
-      "3.6"
-    ],
-    "projects/INSURANCE/analysis/target-state/templates/API_CONTRACT_TEMPLATE.md": [
-      "3.1"
-    ],
-    "projects/INSURANCE/analysis/target-state/templates/ML_MODEL_TEMPLATE.md": [
-      "3.3.1"
-    ],
-    "projects/INSURANCE/analysis/target-state/templates/SERVICE_ARCHITECTURE_TEMPLATE.md": [
-      "3.3.5",
-      "3.4.2"
-    ],
-    "projects/INSURANCE/analysis/target-state/service-specifications/core-business/proposal-business/PROPOSAL_BUSINESS_SERVICE_SPEC.md": [
-      "3.3.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/service-specifications/core-business/rating-engine/RATING_ENGINE_SERVICE_SPEC.md": [
-      "3.3.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/service-specifications/core-business/rating-engine/RATING_ENGINE_BUSINESS_LOGIC.md": [
-      "3.3.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/service-specifications/core-business/renewal-process/RENEWAL_PROCESS_SERVICE_SPEC.md": [
-      "3.4.2"
-    ],
-    "projects/INSURANCE/analysis/target-state/service-specifications/core-business/renewal-process/RENEWAL_PROCESS_API_SPEC.md": [
-      "3.4.2"
-    ],
-    "projects/INSURANCE/analysis/target-state/service-specifications/core-business/product-catalog/PRODUCT_CATALOG_BUSINESS_LOGIC.md": [
-      "4.3"
-    ],
-    "projects/INSURANCE/analysis/target-state/service-specifications/core-business/policy-business/POLICY_BUSINESS_API_SPEC.md": [
-      "3.4"
-    ],
-    "projects/INSURANCE/analysis/target-state/service-specifications/core-business/customer-business/CUSTOMER_BUSINESS_SERVICE_SPEC.md": [
-      "3.1"
-    ],
-    "projects/INSURANCE/analysis/target-state/service-specifications/core-business/claim-business/CLAIM_BUSINESS_SERVICE_SPEC.md": [
-      "3.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/service-specifications/integration-ecosystem/authentication-sync-process/SERVICE_SPEC.md": [
-      "4.2",
-      "4.8"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-product-catalog/insurance-product-catalog-api-contracts.md": [
-      "4.3"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-product-catalog/insurance-product-catalog-database-target-schema.md": [
-      "4.3"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-renewal-process/insurance-renewal-process-api-contracts.md": [
-      "3.4.2"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-renewal-process/insurance-renewal-process-database-target-schema.md": [
-      "3.4.2",
-      "3.4.3",
-      "3.4.4"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-renewal-process/insurance-renewal-process-integration-patterns.md": [
-      "3.4.2"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-proposal-business/insurance-proposal-business-api-contracts.md": [
-      "3.3.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-proposal-business/insurance-proposal-business-database-target-schema.md": [
-      "3.3.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-policy-business/insurance-policy-business-architecture.md": [
-      "3.4",
-      "4.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-policy-business/insurance-policy-business-database-target-schema.md": [
-      "3.4",
-      "4.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-policy-business/insurance-policy-business-api-contracts.md": [
-      "3.4"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-customer-webview/insurance-customer-webview-architecture.md": [
-      "3.1",
-      "3.3.5",
-      "3.4",
-      "3.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-api-event-gateway/insurance-api-event-gateway-architecture.md": [
-      "3.1",
-      "3.2",
-      "4.1"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-rating-engine/insurance-rating-engine-integration-patterns.md": [
-      "3.3.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-rating-engine/insurance-rating-engine-api-contracts.md": [
-      "3.3.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-rating-engine/insurance-rating-engine-database-target-schema.md": [
-      "3.3.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-customer-business/insurance-customer-business-api-contracts.md": [
-      "3.1"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-customer-business/insurance-customer-business-security-architecture.md": [
-      "3.1"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-customer-business/insurance-customer-business-database-target-schema.md": [
-      "3.1"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-claim-business/insurance-claim-business-api-contracts.md": [
-      "3.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-claim-business/insurance-claim-business-database-target-schema.md": [
-      "3.5"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-workflow-service/insurance-workflow-service-architecture.md": [
-      "3.3.5",
-      "3.4"
-    ],
-    "projects/INSURANCE/analysis/target-state/architecture/insurance-authentication-sync-process/insurance-authentication-sync-process-architecture.md": [
-      "4.2",
-      "4.8"
-    ],
-    "projects/LEP/business/lending-business.md": [
-      "4.136.35"
-    ]
-  },
-  "high_priority_services": {
-    "insurance-policy-business": [
-      "3.4",
-      "4.5"
-    ],
-    "insurance-proposal-business": [
-      "3.3.5",
-      "3.3.6",
-      "3.3.7",
-      "3.3.8"
-    ],
-    "insurance-claim-business": [
-      "3.5",
-      "4.6"
-    ],
-    "insurance-customer-business": [
-      "3.1",
-      "3.2",
-      "4.4"
-    ],
-    "insurance-product-catalog": [
-      "4.3",
-      "4.3.1"
-    ],
-    "insurance-rating-engine": [
-      "3.3.5",
-      "4.3.3"
-    ],
-    "insurance-renewal-process": [
-      "3.4.2",
-      "3.4.3",
-      "3.4.4"
-    ]
-  }
-}

package/skills/vds-skill/vds-scripts/scripts/check-future-annotations.py

@@ -1,22 +0,0 @@
-"""Gate FR-10.13: every non-__init__ .py in vds_agent_core/src/ must start with
-'from __future__ import annotations'.
-"""
-
-import pathlib
-import sys
-
-src = pathlib.Path("vds_agent_core/src")
-if not src.exists():
-    sys.exit(0)
-
-missing = []
-for f in src.rglob("*.py"):
-    if f.name == "__init__.py":
-        continue
-    if "from __future__ import annotations" not in f.read_text():
-        missing.append(str(f))
-
-if missing:
-    for path in sorted(missing):
-        print(f"MISSING 'from __future__ import annotations': {path}")
-    sys.exit(1)

package/skills/vds-skill/vds-scripts/scripts/check-invalid-symlinks.py

@@ -1,183 +0,0 @@
-#!/usr/bin/env python3
-"""Pre-commit guard: block invalid symlinks, committed worktrees, and macOS artifacts.
-
-Rejects staged changes that match any of these antipatterns:
-
-1. Staged path under `worktrees/` (committed worktree directories)
-2. Staged path under `audit_orchestrator/temp_bitbucket_clones/` (clone cache)
-3. Basename matching `<name> <digits>` — macOS Finder rename-conflict artifacts
-   (e.g. `.venv 3`, `file 2.txt`)
-4. Symlink (mode 120000) with absolute target (starts with `/`)
-5. Symlink with target containing `.nosync` (macOS iCloud marker)
-6. Symlink whose relative target escapes the repo root
-7. Staged path containing any ASCII control byte (0x00-0x1F or 0x7F) — crashes Bitbucket Server /browse
-
-stdlib-only; exits 0 on pass, 1 on violation.
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import subprocess
-import sys
-from pathlib import PurePosixPath
-
-# Rule constants
-WORKTREES_PREFIX = "worktrees/"
-CLONE_CACHE_PREFIX = "audit_orchestrator/temp_bitbucket_clones/"
-NOSYNC_MARKER = ".nosync"
-SYMLINK_MODE = "120000"
-
-# Match a trailing " <digits>" before an optional extension, e.g.:
-#   ".venv 3", "file 2", "file 2.txt", "foo 12.md"
-RENAME_CONFLICT_RE = re.compile(r" \d+(\.[^/]*)?$")
-
-
-def _run(cmd: list[str]) -> bytes:
-    """Run a git command and return stdout bytes. Raises on non-zero exit."""
-    result = subprocess.run(cmd, capture_output=True, check=True)
-    return result.stdout
-
-
-def _staged_paths_bytes() -> list[bytes]:
-    """Return staged added/modified paths as raw bytes. Raw bytes are required
-    for Rule 7; decoding would mask ASCII control bytes as UTF-8 replacements."""
-    out = _run(["git", "diff", "--cached", "--name-only", "--diff-filter=AM", "-z"])
-    return [p for p in out.split(b"\x00") if p]
-
-
-def _check_control_chars(path_bytes: bytes) -> str | None:
-    """Rule-7: reject any ASCII control byte (0x00-0x1F or 0x7F) in a path."""
-    for b in path_bytes:
-        if b < 0x20 or b == 0x7F:
-            decoded = path_bytes.decode("utf-8", errors="replace")
-            return (
-                f"{decoded!r}: path contains ASCII control character (byte 0x{b:02x})"
-                " — crashes Bitbucket /browse renderer (KB 'A non-blank path is required')"
-            )
-    return None
-
-
-def _index_entry(path: str) -> tuple[str, str] | None:
-    """Return (mode, sha) for a path in the index, or None if not staged."""
-    try:
-        out = _run(["git", "ls-files", "-s", "--", path])
-    except subprocess.CalledProcessError:
-        return None
-    if not out:
-        return None
-    # Format: "<mode> <sha> <stage>\t<path>"
-    first_line = out.split(b"\n", 1)[0].decode("utf-8", errors="replace")
-    head = first_line.split("\t", 1)[0]
-    fields = head.split()
-    if len(fields) < 2:
-        return None
-    return fields[0], fields[1]
-
-
-def _symlink_target(sha: str) -> str:
-    """Read the blob content of a symlink object (its target path)."""
-    out = _run(["git", "cat-file", "blob", sha])
-    return out.decode("utf-8", errors="replace")
-
-
-def _escapes_repo_root(link_path: str, target: str) -> bool:
-    """Return True if a relative target escapes above the repo root.
-
-    link_path is the repo-relative path of the symlink itself; target is its
-    literal target string. We resolve logically (no filesystem access) using
-    PurePosixPath so parent-count reasoning is deterministic.
-    """
-    if target.startswith("/"):
-        # Absolute targets are handled by a dedicated rule; skip here.
-        return False
-    link_dir = PurePosixPath(link_path).parent
-    parts = list(link_dir.parts) + target.split("/")
-    depth = 0
-    for part in parts:
-        if part in ("", "."):
-            continue
-        if part == "..":
-            depth -= 1
-            if depth < 0:
-                return True
-        else:
-            depth += 1
-    return False
-
-
-def _check_path(path: str) -> list[str]:
-    """Return a list of violation messages for one staged path."""
-    violations: list[str] = []
-
-    if path.startswith(WORKTREES_PREFIX):
-        violations.append(f"{path}: path under 'worktrees/' — committed worktree directories are a git antipattern")
-
-    if path.startswith(CLONE_CACHE_PREFIX):
-        violations.append(f"{path}: path under '{CLONE_CACHE_PREFIX}' — external clone cache must not be tracked")
-
-    basename = os.path.basename(path)
-    if RENAME_CONFLICT_RE.search(basename):
-        violations.append(
-            f"{path}: basename '{basename}' looks like a macOS Finder rename-conflict artifact (' <digits>' suffix)"
-        )
-
-    entry = _index_entry(path)
-    if entry is None:
-        return violations
-    mode, sha = entry
-    if mode != SYMLINK_MODE:
-        return violations
-
-    try:
-        target = _symlink_target(sha)
-    except subprocess.CalledProcessError:
-        violations.append(f"{path}: unable to read symlink target from index")
-        return violations
-
-    if target.startswith("/"):
-        violations.append(f"{path}: symlink has ABSOLUTE target '{target}' — won't resolve on other machines")
-    if NOSYNC_MARKER in target:
-        violations.append(
-            f"{path}: symlink target contains '.nosync' (target={target!r}) — macOS iCloud marker must not be committed"
-        )
-    if _escapes_repo_root(path, target):
-        violations.append(f"{path}: relative symlink target '{target}' escapes repo root")
-
-    return violations
-
-
-def main() -> int:
-    try:
-        paths_bytes = _staged_paths_bytes()
-    except subprocess.CalledProcessError as exc:
-        sys.stderr.write(f"check-invalid-symlinks: git call failed: {exc}\n")
-        return 1
-
-    all_violations: list[str] = []
-    for path_bytes in paths_bytes:
-        # Rule 7 on raw bytes; on hit we skip later rules (they need a str).
-        ctrl_msg = _check_control_chars(path_bytes)
-        if ctrl_msg is not None:
-            all_violations.append(ctrl_msg)
-            continue
-        path = path_bytes.decode("utf-8", errors="replace")
-        all_violations.extend(_check_path(path))
-
-    if not all_violations:
-        return 0
-
-    sys.stderr.write("check-invalid-symlinks: BLOCKED — staged changes contain disallowed patterns:\n")
-    for msg in all_violations:
-        sys.stderr.write(f"  - {msg}\n")
-    sys.stderr.write(
-        "\nRefuse rationale: these patterns break Bitbucket Server's /browse "
-        "renderer and fail on Linux CI. Unstage with `git reset HEAD -- <path>` "
-        "and add to .gitignore if needed.\n"
-    )
-    return 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())

package/skills/vds-skill/vds-scripts/scripts/check-no-debug-markers.py

@@ -1,21 +0,0 @@
-"""Gate FR-10.13: vds_agent_core/src/ must not contain TODO/FIXME/XXX/HACK."""
-
-import pathlib
-import re
-import sys
-
-pattern = re.compile(r"\b(TODO|FIXME|XXX|HACK)\b")
-src = pathlib.Path("vds_agent_core/src")
-if not src.exists():
-    sys.exit(0)
-
-violations = []
-for f in src.rglob("*.py"):
-    for i, line in enumerate(f.read_text().splitlines(), 1):
-        if pattern.search(line):
-            violations.append(f"{f}:{i}: {line.strip()}")
-
-if violations:
-    for v in violations:
-        print(v)
-    sys.exit(1)

package/skills/vds-skill/vds-scripts/scripts/check-no-unittest.py

@@ -1,21 +0,0 @@
-"""Gate FR-10.13: vds_agent_core/tests/ must not use unittest.TestCase or self.assert*."""
-
-import pathlib
-import re
-import sys
-
-pattern = re.compile(r"(unittest\.TestCase|self\.assert)")
-tests = pathlib.Path("vds_agent_core/tests")
-if not tests.exists():
-    sys.exit(0)
-
-violations = []
-for f in tests.rglob("*.py"):
-    for i, line in enumerate(f.read_text().splitlines(), 1):
-        if pattern.search(line):
-            violations.append(f"{f}:{i}: {line.strip()}")
-
-if violations:
-    for v in violations:
-        print(v)
-    sys.exit(1)

package/skills/vds-skill/vds-scripts/scripts/ci/assert_no_openspace_commits.sh

@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-# Assert No OpenSpace Commits Script (TSK-2.2)
-#
-# Checks that no commits authored by 'openspace-mcp' exist on master.
-# Fails if any OpenSpace-authored commits are found.
-#
-# Usage: ./scripts/ci/assert_no_openspace_commits.sh <repo>
-
-set -uo pipefail
-
-REPO="${1:-vds-skills}"
-PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-REPO_PATH="$PROJECT_ROOT/WHO-project/$REPO"
-
-echo "=== Checking for OpenSpace-authored commits on master ==="
-echo
-
-if [ ! -d "$REPO_PATH/.git" ]; then
-    echo "Error: Not a git repository: $REPO_PATH"
-    exit 1
-fi
-
-cd "$REPO_PATH"
-
-# Check for commits by openspace-mcp
-COMMITS=$(git log master --since="2024-01-01" --author="openspace-mcp" --oneline 2>/dev/null || echo "")
-
-if [ -n "$COMMITS" ]; then
-    echo "✗ Found OpenSpace-authored commits on master:"
-    echo "$COMMITS"
-    echo
-    echo "This indicates a violation of branch protection policy."
-    exit 1
-else
-    echo "✓ No OpenSpace-authored commits found on master"
-    exit 0
-fi

package/skills/vds-skill/vds-scripts/scripts/ci/verify_branch_protection.sh

@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-# Verify Branch Protection Script (TSK-2.2)
-#
-# Checks that server-side branch protection is active on Bitbucket.
-# Fails if any required restriction is missing.
-#
-# Usage: ./scripts/ci/verify_branch_protection.sh <repo>
-
-set -uo pipefail
-
-REPO="${1:-vds-skills}"
-BITBUCKET_BASE="${VDS_BITBUCKET_HTTP_BASE:-http://bitbucket.digital.vn}"
-
-# Load credentials
-source ~/.vds/.env 2>/dev/null || true
-
-if [ -z "${VDS_USERNAME:-}" ] || [ -z "${VDS_PASSWORD:-}" ]; then
-    echo "Error: VDS_USERNAME and VDS_PASSWORD must be set in ~/.vds/.env"
-    exit 1
-fi
-
-echo "=== Verifying Branch Protection for $REPO ==="
-echo
-
-FAILED=0
-
-# Required restrictions
-REQUIRED_RESTRICTIONS=(
-    "no-deletes"
-    "fast-forward-only"
-    "read-only"
-)
-
-for RESTRICTION in "${REQUIRED_RESTRICTIONS[@]}"; do
-    echo -n "Checking '$RESTRICTION' restriction... "
-
-    RESPONSE=$(curl -s -u "$VDS_USERNAME:$VDS_PASSWORD" \
-        "$BITBUCKET_BASE/rest/branch-permissions/2.0/projects/WHO/repos/$REPO/restrictions" \
-        -H "Accept: application/json" 2>/dev/null)
-
-    if echo "$RESPONSE" | grep -q "\"type\":\"$RESTRICTION\""; then
-        echo "✓"
-    else
-        echo "✗ (missing)"
-        FAILED=1
-    fi
-done
-
-# Check openspace-mcp user restriction
-echo -n "Checking 'openspace-mcp' user restriction... "
-if echo "$RESPONSE" | grep -q "openspace-mcp"; then
-    echo "✓"
-else
-    echo "⚠ (openspace-mcp user not restricted)"
-fi
-
-echo
-if [ "$FAILED" -eq 0 ]; then
-    echo "✓ Branch protection verification PASSED"
-    exit 0
-else
-    echo "✗ Branch protection verification FAILED"
-    exit 1
-fi