@onuraslan/sdd 1.0.5

package/sdd-utility/skills/code-slop-review/references/agent-prompt.md

@@ -0,0 +1,110 @@
+# Agent Prompt Template
+
+---
+
+## For Full Codebase Scope (Layer Agents)
+
+```
+You are a code slop reviewer running Layer <N> — <Layer Name>.
+
+SCOPE: <scope descriptor from Step 1>
+
+YOUR TASK:
+1. Read the rules from: [\<layer-reference-file\>](<layer-reference-file>)
+2. Scan the code in the given scope according to those rules
+3. For each finding, assign it to the correct bucket (Critical / Important / Moderate)
+   using the Severity Guide at the bottom of the reference file
+4. For diff-based scopes: scan only + lines and their nearby context;
+   also flag removed error handling, tests, and logging from - lines
+5. For full / single-file / directory scopes: read and scan each source file
+6. Write your findings to: docs/sdd/code-slop/<output-filename>
+
+OUTPUT FILE FORMAT — write exactly this structure to the output file:
+
+# Layer <N> — <Layer Name> Findings
+
+**Scope:** <scope descriptor>
+**Scanned:** <N files / N changed lines>
+**Layer findings:** Critical: <C>, Important: <I>, Moderate: <M>
+
+## Findings
+
+Omit any bucket section that has no findings (do not write an empty ### header).
+
+### 🔴 Critical
+- `<file>:<line>` — <description>
+  → Fix: <one-line fix suggestion>
+
+### 🟠 Important
+- `<file>:<line>` — <description>
+  → Fix: <one-line fix suggestion>
+
+### 🟡 Moderate
+- `<file>:<line>` — <description>
+  → Fix: <one-line fix suggestion>
+
+## Removed Code Flags *(diff scopes only — omit section if not applicable)*
+- `<file>:<line>` — <what was removed and why it matters>
+
+## Notes
+<Any freeform architectural or contextual observations. Omit section if none.>
+```
+
+---
+
+## For Non-Full-Codebase Scope (Single Explore Task)
+
+```
+You are a code slop reviewer. Scan the given code scope for ALL types of AI-generated code slop patterns.
+
+SCOPE: <scope descriptor — e.g., "git diff HEAD", "single file: src/auth.ts", "directory: src/services/">
+
+## Your Task
+
+1. Read all applicable layer rules from:
+   - [structural-slop.md](structural-slop.md)
+   - [test-slop.md](test-slop.md) (if test files in scope)
+   - [error-handling-slop.md](error-handling-slop.md)
+   - [dead-code-slop.md](dead-code-slop.md)
+   - [architecture-slop.md](architecture-slop.md)
+
+2. Scan the code in the given scope for all patterns above
+
+3. For diff-based scopes: scan only `+` lines and their nearby context;
+   also flag removed error handling, tests, and logging from `-` lines
+
+4. For each finding, assign to correct bucket (Critical / Important / Moderate)
+   using the Severity Guide from each layer reference
+
+5. Write findings to: `docs/sdd/code-slop/diff-review.md`
+
+## Output Format
+
+```markdown
+# Code Slop Review — <scope type>
+
+**Scope:** <scope descriptor>
+**Scanned:** <N files / N changed lines>
+**Total findings:** Critical: <C>, Important: <I>, Moderate: <M>
+
+## Findings by Bucket
+
+### 🔴 Critical
+- `<file>:<line>` — <description>
+  → Fix: <one-line fix suggestion>
+
+### 🟠 Important
+- `<file>:<line>` — <description>
+  → Fix: <one-line fix suggestion>
+
+### 🟡 Moderate
+- `<file>:<line>` — <description>
+  → Fix: <one-line fix suggestion>
+
+## Removed Code Flags *(diff scopes only)*
+- `<file>:<line>` — <what was removed and why it matters>
+
+## Notes
+<Any architectural or contextual observations>
+```
+```

package/sdd-utility/skills/code-slop-review/references/aggregate-and-report.md

@@ -0,0 +1,62 @@
+# Aggregate and Report
+
+Runs after all explore agents have written their layer output files.
+Reads `docs/sdd/code-slop/layer-*.md`, counts findings by bucket, and produces
+the final report.
+
+---
+
+## 1 — Collect and Deduplicate
+
+List all files in `docs/sdd/code-slop/` and read every file matching
+`layer-*.md`. Skipped layers will not have an output file — skip missing files silently.
+
+If the same `file:line` appears in multiple layer outputs, count it once
+using the highest bucket priority (🔴 Critical > 🟠 Important > 🟡 Moderate).
+Mark the lower-priority duplicates in the summary as "covered by Layer N — not scored."
+
+---
+
+## 2 — Count
+
+Each layer file contains bucket labels per finding (Critical / Important / Moderate),
+assigned by the layer reference file. Count findings per bucket after deduplication:
+
+```
+Critical count  → C
+Important count → I
+Moderate count  → M
+```
+
+Determine overall slop level by context:
+- Zero Critical, minimal Important → 🟢 Clean
+- Zero Critical, notable Important → 🟡 Mild Slop
+- Some Critical findings → 🟠 Heavy Slop
+- Many Critical findings → 🔴 Full Slop
+
+> **Note:** These levels are scope-agnostic. A single-file review with Critical
+> findings is proportionally more severe than a full-codebase review with the same.
+> Note the scope in the report header so the reader can calibrate.
+
+---
+
+## 3 — Write Final Report
+
+→ Read [final-report-template.md](final-report-template.md) for the report structure.
+
+Fill every placeholder from the aggregated layer data and write the result
+to `docs/sdd/code-slop/report.md`.
+
+---
+
+## 4 — Present to User
+
+Display the contents of `docs/sdd/code-slop/report.md` to the user.
+
+**Report size cap when displaying:**
+- 🔴 Critical: always show all
+- 🟠 Important: show a representative subset; group remainder as "…and N more"
+- 🟡 Moderate: show a representative subset; group remainder as "…and N more"
+
+End with — unless the user already triggered Fix Mode:
+> "Full layer reports saved to `docs/sdd/code-slop/`. Should I apply the refactors?"

package/sdd-utility/skills/code-slop-review/references/architecture-slop.md

@@ -0,0 +1,126 @@
+# Layer 4 — Architecture Slop Reference
+
+AI generates code by pattern-matching against training data. Over months this
+produces a codebase where every module is internally consistent but
+architecturally foreign to the others.
+
+---
+
+## Step 0 — Detect the Project's Architecture First
+
+Before applying any rule, identify which architecture the project uses.
+
+**Look for these signals:**
+- Layered / DDD → directories named domain/, service/, repository/, infrastructure/
+- MVC → directories named models/, views/, controllers/
+- Hexagonal → directories named ports/, adapters/, core/
+- Modular monolith → directories named modules/, features/, domains/
+- Serverless → handler functions in root or functions/
+- Minimal API → single file or flat structure, no layer separation
+
+**Apply layer boundary rules (Patterns 1 and 4) only for Layered, DDD, or Hexagonal architectures.**
+
+---
+
+## Pattern 1 — Layer Boundary Violation
+
+Each architectural layer has a responsibility.
+
+**What to flag:**
+- DB query inside a controller
+- Business logic inside a repository
+- Domain model importing from infrastructure
+
+---
+
+## Pattern 2 — Magic Values
+
+Hard-coded literals with no named constant.
+
+**What to flag:**
+- Unexplained numbers
+- Status strings
+- Service URLs that vary by environment
+
+**Do NOT flag:**
+- Public third-party API endpoints
+- Stable application constants
+
+---
+
+## Pattern 3 — Pattern Inconsistency
+
+Multiple distinct patterns for the same cross-cutting concern.
+
+**What to flag:**
+- Multiple patterns for DB access
+- Multiple error response formats
+- Multiple logging styles
+- Multiple validation approaches
+
+---
+
+## Pattern 4 — Dependency Direction Violation
+
+Outer layers depend on inner layers — never the reverse.
+
+**What to flag:**
+- Domain importing from infrastructure
+- Inner layer depending on outer layer concrete implementations
+
+---
+
+## Pattern 5 — Configuration Slop
+
+Values that vary between environments hardcoded in source.
+
+**What to flag:**
+- Database URLs
+- Internal service URLs
+- API keys
+- DEBUG flags
+- ALLOWED_HOSTS
+
+**Do NOT flag:**
+- Stable application constants
+
+---
+
+## Pattern 6 — Async/Sync Mismatch
+
+**What to flag:**
+- Blocking call inside an async function
+- Unnecessary async function with no await statements
+
+---
+
+## Detection Checklist
+
+```
+□ Is there DB access / HTTP calls inside a controller or route handler?
+□ Is there business logic inside a repository?
+□ Does a domain model import from infrastructure?
+□ Are there multiple patterns for the same cross-cutting concern?
+□ Are there multiple error response formats?
+□ Are there hardcoded credentials, URLs, or environment-specific values?
+□ Are there blocking calls inside async functions?
+□ Are there unnecessary async functions with no await statements?
+□ Are there magic numbers or strings without named constants?
+```
+
+---
+
+## Severity Guide
+
+| Finding                                       | Bucket       |
+|-----------------------------------------------|--------------|
+| Magic number or string (per occurrence)       | 🟡 Moderate  |
+| DB access in controller                       | 🔴 Critical  |
+| Business logic in repository                  | 🔴 Critical  |
+| Domain importing infrastructure               | 🔴 Critical  |
+| Multiple patterns for same concern            | 🟠 Important |
+| Multiple error response formats               | 🟡 Moderate  |
+| Hardcoded credential / secret / API key       | 🔴 Critical  |
+| Hardcoded env-specific value (non-credential) | 🟡 Moderate  |
+| Blocking call inside async function           | 🔴 Critical  |
+| Unnecessary async function                    | 🟡 Moderate  |

package/sdd-utility/skills/code-slop-review/references/dead-code-slop.md

@@ -0,0 +1,107 @@
+# Layer 5 — Dead Code Slop Reference
+
+AI generates code in bulk. It doesn't prune. Dead code accumulates silently.
+
+---
+
+## Pattern 1 — Unused Imports
+
+Imports that are never referenced in the file.
+
+**What to flag:**
+- Any import statement where the imported name is never used
+
+---
+
+## Pattern 2 — Unreachable Code
+
+Code that can never execute.
+
+**What to flag:**
+- Statements after an unconditional return/exit/break/continue
+- Branches that can never be true given the surrounding logic
+- Exception handlers for exceptions that the try block cannot raise
+
+---
+
+## Pattern 3 — Unused Variables and Parameters
+
+Variables assigned but never read. Parameters declared but never used.
+
+**What to flag:**
+- Variable assigned at the top of a function and never referenced
+- Parameter in a function signature that the body ignores entirely
+- Loop variable assigned but only the loop side-effect matters
+
+**Do NOT flag:**
+- Variables prefixed with underscore (intentionally unused)
+- Parameters required by an interface or callback contract
+- Unused parameters in test fixtures or framework callbacks
+
+---
+
+## Pattern 4 — Dead Feature Flags and Stale Config
+
+Hard-coded boolean flags that always evaluate to the same value.
+
+**What to flag:**
+- if True: / if False: blocks
+- ENABLE_*, USE_*, FLAG_* constants that are never toggled
+- Config values that are overridden immediately
+- Feature toggles from completed migrations
+
+---
+
+## Pattern 5 — Debug Artifacts
+
+Logging, printing, or assertions left from development.
+
+**What to flag:**
+- print() / console.log() / System.out statements
+- debugger; / pdb.set_trace() / breakpoint() calls
+- panic() calls used for debugging
+- DEBUG / TEMP / REMOVE / HACK comments
+
+**Do NOT flag:**
+- Structured logging through the project's logger
+
+---
+
+## Pattern 6 — Commented-Out Code
+
+Blocks of code that have been commented out instead of deleted.
+
+**What to flag:**
+- Multi-line comment blocks that contain code
+
+**Do NOT flag:**
+- Single-line comments that explain why something is NOT done
+- Commented-out code with an explicit explanation of why it is kept
+
+---
+
+## Detection Checklist
+
+```
+□ Any imports that are never used in the file?
+□ Any code after an unconditional return/exit/break?
+□ Any variables assigned but never read?
+□ Any parameters declared but never used (without _ prefix)?
+□ Any boolean constants that are always true or always false?
+□ Any print/console.log/debugger statements?
+□ Any DEBUG / TEMP / REMOVE comments?
+□ Any large commented-out code blocks?
+```
+
+---
+
+## Severity Guide
+
+| Finding                                     | Bucket       |
+|---------------------------------------------|--------------|
+| Unused import                               | 🟡 Moderate  |
+| Unreachable code after unconditional exit   | 🟠 Important |
+| Unused variable or parameter                | 🟡 Moderate  |
+| Dead feature flag (always true/false)       | 🟠 Important |
+| Debug artifact (print, console.log, etc.)   | 🟠 Important |
+| Commented-out code block                    | 🟡 Moderate  |

package/sdd-utility/skills/code-slop-review/references/error-handling-slop.md

@@ -0,0 +1,101 @@
+# Layer 3 — Error Handling Slop Reference
+
+AI adds error handling blocks to make code "look safe" — but silently swallows
+errors, returns null/None to callers who don't expect it, and makes production
+debugging nearly impossible.
+
+---
+
+## Pattern 1 — Silent Swallow
+
+Catching an exception and doing nothing.
+
+**What to flag:**
+- except Exception: pass
+- except: pass
+- Empty catch blocks
+- Ignoring error results (Go: `_ = someCall()`, Rust: `let _ = some_call()`)
+
+---
+
+## Pattern 2 — Null Return on Failure
+
+Catching an exception and returning None/null/nil without documented contract.
+
+**What to flag:**
+- Return None/null/nil on exception without documented contract
+
+**Do NOT flag:**
+- Returning default on "not found" errors when the value is genuinely optional
+- Caller's contract explicitly treats absence as "use defaults"
+
+---
+
+## Pattern 3 — Catch-All Exception
+
+Catching the broadest possible exception instead of the specific exception the
+code can actually handle.
+
+**What to flag:**
+- except Exception as e
+- catch (e) without specificity
+- catch (Exception e)
+
+---
+
+## Pattern 4 — Missing Context in Logs
+
+Error logs without identity, operation, or input context.
+
+**What to flag:**
+- logger.error("Error: %s", e) without context variables
+- console.error("Error:", e) without identity information
+- Log statements that only print the exception message
+
+---
+
+## Pattern 5 — Resource Leak
+
+File, connection, or socket opened without structured cleanup.
+
+**What to flag:**
+- Files opened without context manager or try/finally
+- Database connections without cleanup
+- Sockets/HTTP clients without proper close
+
+---
+
+## Pattern 6 — Inconsistent Error Contract
+
+Different functions in the same module handle errors differently.
+
+**What to flag:**
+- Some functions raise on failure, others return null/None
+- Some functions return error objects, others raise
+- The same error condition handled differently in different functions
+
+---
+
+## Detection Checklist
+
+```
+□ Any bare catch/except without re-raise or logging?
+□ Any catch block ending with return None/null/nil?
+□ Any log statement without identity/context variables?
+□ Any file/connection/socket opened without structured cleanup?
+□ Any catch block catching broader than necessary?
+□ Does the module mix raise/throw and return null for the same class of failure?
+```
+
+---
+
+## Severity Guide
+
+| Finding                                   | Bucket       |
+|-------------------------------------------|--------------|
+| Bare pass/empty in except block           | 🔴 Critical  |
+| Return null on exception (no contract)    | 🟠 Important |
+| Bare catch-all exception                  | 🔴 Critical  |
+| Log without context (no ids/values)       | 🟡 Moderate  |
+| Resource leak (no structured cleanup)     | 🟠 Important |
+| Inconsistent error contract within module | 🟠 Important |

package/sdd-utility/skills/code-slop-review/references/final-report-template.md

@@ -0,0 +1,55 @@
+# Final Report Template
+
+Write this structure to `docs/sdd/code-slop/report.md`.
+Fill every `<placeholder>` from the aggregated layer data.
+
+---
+
+```markdown
+# Code Slop Review Report
+
+**Date:** <ISO date>
+**Scope:** <scope descriptor>
+**Files reviewed:** <N>
+**Slop level:** <emoji + label>
+**Findings:** Critical: <C>, Important: <I>, Moderate: <M>
+
+---
+
+## 🔴 Critical (fix before merge)
+- `<file>:<line>` — <description> [Layer <N>]
+  → Fix: <one-line fix suggestion>
+
+## 🟠 Important
+- `<file>:<line>` — <description> [Layer <N>]
+  → Fix: <one-line fix suggestion>
+<!-- Show a representative subset. If more: "…and N more — see layer report." -->
+
+## 🟡 Moderate
+- `<file>:<line>` — <description> [Layer <N>]
+  → Fix: <one-line fix suggestion>
+<!-- Show a representative subset. If more: "…and N more — see layer report." -->
+
+## 💡 Architecture Notes
+<!-- Aggregated from docs/sdd/code-slop/layer-4-architecture.md Notes section.
+     Omit this section if Layer 4 did not run. -->
+
+## 📊 Summary by Layer
+
+| Layer | 🔴 Critical | 🟠 Important | 🟡 Moderate |
+|-------|-------------|--------------|-------------|
+| 1 — Structural | <N> | <N> | <N> |
+| 2 — Tests | <N> | <N> | <N> |
+| 3 — Error Handling | <N> | <N> | <N> |
+| 4 — Architecture | <N> | <N> | <N> |
+| 5 — Dead Code | <N> | <N> | <N> |
+| **Total (after dedup)** | **<C>** | **<I>** | **<M>** |
+
+## Layer Reports
+<!-- Omit links for layers that were skipped (no output file exists) -->
+- [Layer 1 — Structural](layer-1-structural.md)
+- [Layer 2 — Tests](layer-2-tests.md)
+- [Layer 3 — Error Handling](layer-3-error-handling.md)
+- [Layer 4 — Architecture](layer-4-architecture.md)
+- [Layer 5 — Dead Code](layer-5-dead-code.md)
+```

package/sdd-utility/skills/code-slop-review/references/fix-mode.md

@@ -0,0 +1,68 @@
+# Fix Mode
+
+Apply when the user says "fix", "refactor", or "apply".
+
+---
+
+## Pre-Fix: Behavior Lock
+
+Before applying any change, identify what behavior must stay the same:
+
+1. Run existing tests — confirm they pass before touching any code
+2. If a finding affects a function with no tests, note it explicitly:
+   > "No test coverage for `<function>` — behavior lock not possible. Apply with caution."
+3. For Critical and Important findings that change control flow or error
+   handling, confirm the user is aware: "This change may affect observable
+   behavior. Confirm?"
+
+Do not skip the behavior lock step. If tests cannot be run, record the
+verification plan explicitly before proceeding.
+
+---
+
+## Process
+
+1. Read `docs/sdd/code-slop/report.md` to get the full findings list.
+   If the report shows "…and N more — see layer report", also read the relevant
+   `docs/sdd/code-slop/layer-N-<name>.md` files to get the complete findings.
+
+2. **Lock behavior before editing:**
+   Before applying any fix, confirm that the current behavior is covered by
+   tests. If tests are missing for the code about to be changed, write the
+   narrowest regression test first. If writing tests is not possible, state
+   explicitly what verification will be run after each fix.
+
+3. For each finding, the format is:
+   ```
+   # Before
+   <original code>
+
+   # After
+   <corrected code>
+   ```
+
+3. Work through Critical findings first — show each one as a before/after block
+   and wait for confirmation before applying.
+
+4. After all Critical findings are processed, work through Important findings
+   the same way.
+
+5. After all Important findings are processed, ask:
+   "There are N Moderate findings — apply those too?"
+   Apply Moderate findings only with explicit user confirmation.
+
+6. Before any structural change (splitting a function, moving a file,
+   renaming a module) — pause and ask for explicit confirmation even if
+   the user has already confirmed the finding.
+
+7. After each applied change: `⚠️ Run tests before continuing.`
+
+---
+
+## Constraints
+
+- Do not change behavior — refactors must be semantically equivalent
+- Do not apply Moderate findings automatically — ask first
+- Apply one finding at a time, not all at once
+- If a finding spans multiple files, show all affected files before applying
+- If the user says "skip" on any finding, move to the next without applying