@ngocsangairvds/vsaf 5.1.5 → 5.1.7

package/skills/sdlc/pack.yaml

@@ -2,6 +2,7 @@ name: sdlc
 version: 1.2.0
 description: Distributed Agentic SDLC — multi-machine, multi-repo, graph-based knowledge
 author: "@ngocsangairvds/vsaf"
+workflows: ../../workflows/sdlc
 
 skills:
   # Setup
@@ -13,24 +14,91 @@ skills:
   - onboard-code
 
   # Phase 1-9 — Main flow
-  - discovery
-  - prd
-  - architecture
-  - srs
   - write-srs
   - validate-srs
-  - test-design
-  - implement
-  - review
-  - feature-complete
-  - ship
 
-  # Hotfix flow
-  - hotfix-analyze
-  - hotfix-prd
-  - hotfix-implement
-  - hotfix-ship
-  - hotfix-review
+  # Hotfix step skills — generated from hotfix phase SKILL.md files
+  - hotfix/analyze/entry
+  - hotfix/analyze/grill
+  - hotfix/analyze/gitnexus
+  - hotfix/analyze/reasoning
+  - hotfix/analyze/fix-strategy
+  - hotfix/analyze/write
+  - hotfix/analyze/exit
+  - hotfix/prd/entry
+  - hotfix/prd/requirements
+  - hotfix/prd/validate
+  - hotfix/prd/write
+  - hotfix/prd/gate
+  - hotfix/implement/entry
+  - hotfix/implement/branch
+  - hotfix/implement/tdd
+  - hotfix/implement/sonar
+  - hotfix/implement/verify
+  - hotfix/implement/impact
+  - hotfix/implement/gate
+  - hotfix/review/entry
+  - hotfix/review/minimality
+  - hotfix/review/test-quality
+  - hotfix/review/impact
+  - hotfix/review/gate
+  - hotfix/ship/entry
+  - hotfix/ship/gitignore
+  - hotfix/ship/test-gate
+  - hotfix/ship/commit-pr
+  - hotfix/ship/report
+  - hotfix/ship/exit
+
+
+# Phase step skills — generated from phase SKILL.md files
+  - discovery/prereq
+  - discovery/system
+  - discovery/grill
+  - discovery/brainstorm
+  - discovery/domain
+  - discovery/prfaq
+  - prd/prereq
+  - prd/elicitation
+  - prd/create
+  - prd/validate
+  - prd/blast-radius
+  - architecture/prereq
+  - architecture/current-state
+  - architecture/grill
+  - architecture/decision
+  - architecture/epics
+  - architecture/readiness
+  - srs/prereq
+  - srs/write
+  - srs/validate
+  - srs/interface
+  - test-design/prereq
+  - test-design/cases
+  - test-design/boundary
+  - test-design/coverage
+  - implement/prereq
+  - implement/subagents
+  - implement/plan
+  - implement/checkpoint
+  - implement/tdd
+  - implement/debug
+  - implement/impact
+  - implement/build-run
+  - review/prereq
+  - review/verification
+  - review/code
+  - review/impact
+  - review/debate
+  - complete/prereq
+  - complete/context
+  - complete/knowledge
+  - complete/reindex
+  - complete/status
+  - ship/prereq
+  - ship/gitignore
+  - ship/commit
+  - ship/pr
+  - ship/report
 
   # Diagnostics
   - sdlc-health
@@ -62,4 +130,3 @@ bundled:
   - zoom-out
   - tdd
   - improve-codebase-architecture
-

package/skills/sdlc/prd/blast-radius/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-prd-blast-radius
+description: "PRD 5/5 — blast radius + output"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# PRD 5/5 — blast radius + output
+
+@include(step.md)

package/skills/sdlc/prd/blast-radius/step.md

@@ -0,0 +1,76 @@
+### Step 5: Blast Radius
+
+```
+[PRD] [5/5] Assessing blast radius via GitNexus... ⏳
+```
+
+Use GitNexus `impact` — assess scope of feature impact.
+Write to `02-prd.md` §Blast Radius.
+
+```
+[PRD] [5/5] Assessing blast radius via GitNexus... ✅
+```
+
+## Gate
+
+Human must approve the PRD. Write `## Gate: APPROVED` at the end of the file.
+Do NOT proceed to Phase 3 without the Gate marker.
+
+**Automated mode (opt-in):** when the environment has `VSAF_CI=1` or `VSAF_AUTO_APPROVE=1`, write the Gate yourself as `## Gate: APPROVED (auto · VSAF_CI · rationale: <one line>)` and proceed — the one-line rationale is REQUIRED for audit. Without the env flag, a human must approve (default).
+
+## Output
+
+Write file: `.vsaf/docs/features/{feature-name}/02-prd.md`
+
+```markdown
+# PRD: {feature-name}
+
+## Grill Log
+{elicitation Q&A}
+
+## Requirements
+### User Stories
+{with acceptance criteria}
+### Functional Requirements
+{FR-001, FR-002...}
+### Non-Functional Requirements
+{NFR-001, NFR-002...}
+
+## Validation
+{validate-prd result}
+
+## Adversarial
+{adversarial findings}
+
+## Blast Radius
+{GitNexus impact result}
+
+## Gate: {PENDING / APPROVED by {name} on {date}}
+```
+
+## Artifact Auto-Save
+
+After writing the file, print the message:
+
+> Artifacts saved. If the session is interrupted, open a new session and run the next phase — data is safe.
+
+## Phase Exit Protocol
+
+Print PHASE REPORT:
+- Feature: {feature-name}
+- Status: COMPLETED
+- Completed: elicitation, create PRD, validate, adversarial review, blast radius
+- Output files: `.vsaf/docs/features/{feature-name}/02-prd.md`
+- Suggested next steps:
+  [1] Phase 3 Architecture → `/sdlc-architecture`
+  [2] Save artifacts
+
+Update `.vsaf/docs/STATUS.md`.
+
+## Rules
+
+- ⛔ Do NOT skip elicitation — Shared Understanding is mandatory
+- ⛔ Do NOT modify `graphify-out/` or `.gitnexus/`
+- Every user story MUST have acceptance criteria
+- Every FR/NFR MUST have a unique ID
+- Do NOT proceed if blast radius = HIGH without human approval

package/skills/sdlc/prd/create/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-prd-create
+description: "PRD 3/5 — create PRD"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# PRD 3/5 — create PRD
+
+@include(step.md)

package/skills/sdlc/prd/create/step.md

@@ -0,0 +1,21 @@
+### Step 3: Create PRD
+
+```
+[PRD] [3/5] Creating PRD from grill results... ⏳
+```
+
+Use `/bmad-create-prd` — create structured PRD from grill results (Step 2).
+
+Ensure the output covers:
+
+1. **Goals** — business goals + success metrics
+2. **User Stories** — each MUST have acceptance criteria (Given/When/Then)
+3. **Functional Requirements** — unique ID per requirement (FR-001, FR-002...)
+4. **Non-Functional Requirements** — unique ID (NFR-001, NFR-002...) — performance, security, scalability
+5. **Success Metrics** — measurable KPIs tied to goals
+
+Write to `02-prd.md` §Requirements.
+
+```
+[PRD] [3/5] Creating PRD from grill results... ✅
+```

package/skills/sdlc/prd/elicitation/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-prd-elicitation
+description: "PRD 2/5 — elicitation"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# PRD 2/5 — elicitation
+
+@include(step.md)

package/skills/sdlc/prd/elicitation/step.md

@@ -0,0 +1,12 @@
+### Step 2: Elicitation (Grill Session)
+
+```
+[PRD] [2/5] Grill session — elicitation probing edge cases... ⏳
+```
+
+Use `/bmad-advanced-elicitation` — grill 40-100 questions probing edge cases.
+Record results in `02-prd.md` §Grill Log.
+
+```
+[PRD] [2/5] Grill session — elicitation probing edge cases... ✅
+```

package/skills/sdlc/prd/prereq/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-prd-prereq
+description: "PRD 1/5 — prerequisites"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# PRD 1/5 — prerequisites
+
+@include(step.md)

package/skills/sdlc/prd/prereq/step.md

@@ -0,0 +1,16 @@
+## Phase Entry Protocol
+
+```
+[PRD] [1/5] Checking prerequisites... ⏳
+```
+
+1. Input: `.vsaf/docs/features/{feature-name}/01-discovery.md`
+2. Check if file exists:
+   - Does not exist → Ask: "File not found. Have you run Phase 1 Discovery?"
+3. Read `.vsaf/docs/STATUS.md`
+4. Read `CONTEXT.md`
+5. Query `graph.json` for business domain context
+
+```
+[PRD] [1/5] Checking prerequisites... ✅
+```

package/skills/sdlc/prd/validate/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-prd-validate
+description: "PRD 4/5 — validate + adversarial review"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# PRD 4/5 — validate + adversarial review
+
+@include(step.md)

package/skills/sdlc/prd/validate/step.md

@@ -0,0 +1,24 @@
+### Step 4: Validate + Adversarial Review
+
+```
+[PRD] [4/5] Validate + adversarial review... ⏳
+```
+
+**4a — Validate PRD:**
+
+Use `/bmad-validate-prd` — validate the PRD against BMAD standards:
+- Completeness — all user stories covered by FRs? All FRs traceable to a user story?
+- Clarity — any ambiguous requirements? Can each FR be implemented without guessing?
+- Testability — can each FR be verified with a test case?
+- Consistency — any FRs that contradict each other?
+
+Write to `02-prd.md` §Validation. If FAIL → fix inline, re-validate.
+
+**4b — Adversarial review:**
+
+Use `/bmad-review-adversarial-general` — cynical review to find gaps.
+Write to `02-prd.md` §Adversarial.
+
+```
+[PRD] [4/5] Validate + adversarial review... ✅
+```

package/skills/sdlc/review/code/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-review-code
+description: "Review 3/5 — code review + quality gate"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# Review 3/5 — code review + quality gate
+
+@include(step.md)

package/skills/sdlc/review/code/step.md

@@ -0,0 +1,45 @@
+### Step 3: Code Review
+
+```
+[REVIEW] [3/5] Adversarial code review... ⏳
+```
+
+Use `/bmad-code-review` — adversarial code review on the feature branch diff with parallel review layers (Blind Hunter, Edge Case Hunter, Acceptance Auditor).
+
+Ensure the review covers:
+
+1. **Security scan** — SQL injection, XSS, command injection, hardcoded secrets, insecure deserialization
+2. **Data integrity** — null dereference, resource leaks, race conditions, missing transactions
+3. **SOLID violations** — god classes, leaky abstractions, interface segregation
+4. **Naming consistency** — verify against CONTEXT.md terminology
+5. **SRS compliance** — every FR/NFR implemented? Any extra scope not in SRS?
+
+Classify each finding: MUST FIX / SHOULD FIX / NOTED.
+Write to `08-review.md` §Code Review.
+
+#### Quality Gate Re-check (SonarQube)
+
+**IMPORTANT:** SonarQube rules were already applied in Phase 6 (Implementation). The Review phase only RE-CHECKS — confirming that code still meets standards after all changes.
+
+Verify that code meets the `sonar-viettel` Quality Gate.
+
+> **Standard (single source of truth):** **`.claude/skills/_shared/sdlc/sonar-viettel/quality-gate.md`** — the full New Code + Overall Code tables, the 357-rule parameters, and the importable `sonar-viettel-profile.xml` / `sonar-viettel-gate.json`. This is the **same** file Phase 6 (`/sdlc-implement`) coded against — review only confirms compliance, do not change the numbers.
+
+**Hard fails to confirm (summary — see the shared doc for the full gate):**
+- New Code: Issues / Blocker / Critical / Major / Vulnerabilities = **0**; Code Smells **≤ 20**; Security Hotspots Reviewed = **100%**; Duplicated **≤ 45%**; Maintainability / Reliability / Security Rating **≥ A**.
+- Overall Code: Bugs = **0**; Code Smells **≤ 50**; same Blocker/Critical/Major/Vuln/Duplication/rating rules.
+
+**How to execute (auto-detect — check whether `sonar-scanner` is on PATH):**
+- SonarQube present → ensure it uses the `sonar-viettel` Profile + Gate (import from the shared folder if missing), run `sonar-scanner`, and check the report
+- SonarQube absent → print `Sonar not found → self-checklist mode` and perform a manual re-check against the shared `quality-gate.md` (a fully supported path — SonarQube is OPTIONAL):
+  - Scan for security vulnerabilities (SQL injection, XSS, command injection, hardcoded secrets)
+  - Scan for bugs (null dereference, resource leaks, concurrency issues)
+  - Scan for code smells (long methods, deep nesting, duplicated blocks)
+  - Verify naming conventions, SOLID principles, duplicated blocks
+- Write results to `08-review.md` §Quality Gate
+
+**Quality Gate FAIL** → classify each issue as MUST FIX / SHOULD FIX / NOTED per the triage rules below.
+
+```
+[REVIEW] [3/5] Adversarial code review + Quality Gate re-check... ✅
+```

package/skills/sdlc/review/debate/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-review-debate
+description: "Review 5/5 — debate + output"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# Review 5/5 — debate + output
+
+@include(step.md)

package/skills/sdlc/review/debate/step.md

@@ -0,0 +1,84 @@
+### Step 5: Debate (complex features only)
+
+```
+[REVIEW] [5/5] Multi-agent debate (if needed)... ⏳
+```
+
+Use `/bmad-party-mode` — multi-agent debate:
+- Security vs Performance vs Maintainability
+Write to `08-review.md` §Debate.
+
+```
+[REVIEW] [5/5] Multi-agent debate... ✅
+```
+
+## Gate
+
+MUST FIX = 0, Human approve.
+
+**Automated mode (opt-in):** when `VSAF_CI=1` or `VSAF_AUTO_APPROVE=1` is set AND MUST FIX = 0, write `## Gate: APPROVED (auto · VSAF_CI · rationale: <one line>)` and proceed. If MUST FIX > 0, NEVER auto-approve — return to Phase 6 (Implement) regardless of the flag. Without the env flag, a human must approve (default).
+
+Triage:
+- **MUST FIX**: Security, data loss, SRS FR/NFR not satisfied, crash → Blocks ship
+- **SHOULD FIX**: Performance, maintainability → Fix if time allows
+- **NOTED**: Style, minor naming → Log only
+
+If MUST FIX > 0 → return to Phase 6 (Implementation) with specific issues.
+
+## Output
+
+Write file: `.vsaf/docs/features/{feature-name}/08-review.md`
+
+```markdown
+# Review: {feature-name}
+
+## Verification
+- Build: PASS/FAIL
+- Tests: {X}/{Y} passed
+- Uncommitted files: none
+- Scope: matches SRS ✓
+
+## Code Review
+### MUST FIX
+- (none)
+### SHOULD FIX
+- {issue description}
+### NOTED
+- {minor items}
+
+## Quality Gate (Re-check)
+- SonarQube: {available / manual re-check}
+- New Code: {PASS/FAIL} — Issues={N}, Blocker={N}, Critical={N}, Major={N}, Smells={N}, Vulns={N}, Duplication={N}%
+- Overall: {PASS/FAIL} — Bugs={N}, Blocker={N}, Critical={N}, Major={N}, Smells={N}, Vulns={N}, Duplication={N}%
+- Compile: PASS/FAIL
+- Runtime: PASS/FAIL
+
+## Impact
+- Files changed: {N}
+- Blast radius: {low/medium/high}
+- Confidence: {%}
+
+## Debate (if applicable)
+{party-mode findings}
+
+## Gate: {PENDING / APPROVED by {name} on {date}}
+```
+
+## Phase Exit Protocol
+
+Print PHASE REPORT:
+- Results: MUST FIX = {N}, SHOULD FIX = {N}, NOTED = {N}
+- Output files: `08-review.md`
+- Suggestion: [1] `/sdlc-feature-complete` (if APPROVED) [2] Return to Phase 6 (if MUST FIX > 0)
+
+Update `.vsaf/docs/STATUS.md`.
+
+## Rules
+
+- Review against SRS (spec), NOT against code implementation
+- Max 2 review rounds — if still failing → escalate to human
+- MUST FIX items MUST be resolved before feature-complete
+- **Quality Gate FAIL = MUST FIX** — Blocker, Critical, Vulnerability all block ship
+- **Code does not compile = MUST FIX** — hard gate, no exceptions
+- If there is no SonarQube, Claude performs a manual quality gate re-check
+- **SonarQube only RE-CHECKS** — rules were applied in Phase 6, review only confirms compliance

package/skills/sdlc/review/impact/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-review-impact
+description: "Review 4/5 — impact assessment"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# Review 4/5 — impact assessment
+
+@include(step.md)

package/skills/sdlc/review/impact/step.md

@@ -0,0 +1,14 @@
+### Step 4: Impact Assessment
+
+```
+[REVIEW] [4/5] Impact assessment via GitNexus... ⏳
+```
+
+Use GitNexus `detect_changes` + `impact`:
+- Confirm only expected files changed
+- Blast radius confidence scoring
+Write to `08-review.md` §Impact.
+
+```
+[REVIEW] [4/5] Impact assessment... ✅
+```

package/skills/sdlc/review/prereq/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-review-prereq
+description: "Review 1/5 — prerequisites"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# Review 1/5 — prerequisites
+
+@include(step.md)

package/skills/sdlc/review/prereq/step.md

@@ -0,0 +1,18 @@
+## Phase Entry Protocol
+
+```
+[REVIEW] [1/5] Checking prerequisites... ⏳
+```
+
+1. Input:
+   - `.vsaf/docs/features/{feature-name}/05-srs.md`
+   - Code diff on feature branch
+2. Check that SRS file exists
+3. Check that feature branch exists
+4. Read `.vsaf/docs/STATUS.md`
+5. Read `CONTEXT.md`
+6. Query `graph.json` for impact verification
+
+```
+[REVIEW] [1/5] Checking prerequisites... ✅
+```

package/skills/sdlc/review/verification/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-review-verification
+description: "Review 2/5 — system verification"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# Review 2/5 — system verification
+
+@include(step.md)

package/skills/sdlc/review/verification/step.md

@@ -0,0 +1,16 @@
+### Step 2: System Verification
+
+```
+[REVIEW] [2/5] System verification — build, tests, scope... ⏳
+```
+
+Use `/superpowers:verification-before-completion`:
+- Build passes
+- All tests GREEN
+- No uncommitted files
+- Scope matches SRS
+Write to `08-review.md` §Verification.
+
+```
+[REVIEW] [2/5] System verification... ✅
+```

package/skills/sdlc/ship/commit/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-ship-commit
+description: "Ship 3/5 — merge strategy + commit"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# Ship 3/5 — merge strategy + commit
+
+@include(step.md)

package/skills/sdlc/ship/commit/step.md

@@ -0,0 +1,23 @@
+### Step 3: Merge Strategy + Commit
+
+```
+[SHIP] [3/5] Commit source code + .vsaf/docs/... ⏳
+```
+
+Use `/superpowers:finishing-a-development-branch`:
+- Decide merge strategy (merge commit / squash / rebase)
+- Resolve conflicts if any
+- Verify final build passes
+
+**Commit scope — ONLY commit:**
+- Source code changes (implementation / fix)
+- `.vsaf/docs/` folder (artifacts, CONTEXT.md, KNOWLEDGE.md, STATUS.md)
+- `.gitignore` (if updated)
+
+**DO NOT commit:**
+- `graphify-out/` — local graph index
+- `.gitnexus/` — local code index
+
+```
+[SHIP] [3/5] Commit source code + .vsaf/docs/... ✅
+```

package/skills/sdlc/ship/gitignore/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-ship-gitignore
+description: "Ship 2/5 — .gitignore enforcement"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# Ship 2/5 — .gitignore enforcement
+
+@include(step.md)

package/skills/sdlc/ship/gitignore/step.md

@@ -0,0 +1,22 @@
+### Step 2: .gitignore Enforcement
+
+```
+[SHIP] [2/5] Checking .gitignore — ensuring index files are not committed... ⏳
+```
+
+**MANDATORY** — MUST verify before committing:
+
+1. Check that `.gitignore` contains:
+   ```
+   graphify-out/
+   .gitnexus/
+   ```
+2. If MISSING → **AUTOMATICALLY add to `.gitignore`** and notify user
+3. Verify with `git status` — `graphify-out/` and `.gitnexus/` DO NOT appear in staged/unstaged files
+4. If they still appear → `git rm --cached -r graphify-out/ .gitnexus/` before committing
+
+⚠️ **ABSOLUTELY DO NOT commit `graphify-out/` or `.gitnexus/`** — these are local indexes, each machine builds its own.
+
+```
+[SHIP] [2/5] Checking .gitignore... ✅
+```

package/skills/sdlc/ship/pr/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: sdlc-ship-pr
+description: "Ship 4/5 — push + PR"
+version: 1.0.0
+author: "@ngocsangairvds/vsaf"
+---
+
+# Ship 4/5 — push + PR
+
+@include(step.md)