@pigcloud/skills 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +70 -0
- package/LICENSE +201 -0
- package/README.en.md +84 -0
- package/README.md +79 -0
- package/bin/cli.js +663 -0
- package/bin/postinstall.js +60 -0
- package/bin/rules-loader.js +484 -0
- package/bin/runtime-bootstrap.js +121 -0
- package/index.js +7 -0
- package/install.cmd +5 -0
- package/install.ps1 +74 -0
- package/install.sh +168 -0
- package/package.json +70 -0
- package/pig-cloud-skills-commands/.codex-plugin/plugin.json +35 -0
- package/pig-cloud-skills-commands/README.md +24 -0
- package/pig-cloud-skills-commands/commands/analyze.md +21 -0
- package/pig-cloud-skills-commands/commands/build.md +21 -0
- package/pig-cloud-skills-commands/commands/design.md +21 -0
- package/pig-cloud-skills-commands/commands/distill.md +21 -0
- package/pig-cloud-skills-commands/commands/doc.md +21 -0
- package/pig-cloud-skills-commands/commands/infra.md +21 -0
- package/pig-cloud-skills-commands/commands/init.md +20 -0
- package/pig-cloud-skills-commands/commands/kb.md +20 -0
- package/pig-cloud-skills-commands/commands/perf.md +20 -0
- package/pig-cloud-skills-commands/commands/prd.md +21 -0
- package/pig-cloud-skills-commands/commands/review.md +21 -0
- package/pig-cloud-skills-commands/commands/security.md +21 -0
- package/pig-cloud-skills-commands/commands/test.md +21 -0
- package/pig-cloud-skills-commands/commands/workflow.md +20 -0
- package/rules/bundles.json +358 -0
- package/rules/coding/analysis.md +27 -0
- package/rules/coding/backend/cache-invalidation.md +30 -0
- package/rules/coding/backend/cache-keying.md +30 -0
- package/rules/coding/backend/cache.md +37 -0
- package/rules/coding/backend/database.md +32 -0
- package/rules/coding/backend/feign.md +30 -0
- package/rules/coding/backend/index.md +42 -0
- package/rules/coding/backend/query.md +32 -0
- package/rules/coding/backend/remote.md +33 -0
- package/rules/coding/backend/transaction-boundary.md +30 -0
- package/rules/coding/backend/transaction-rollback.md +30 -0
- package/rules/coding/backend/transaction.md +38 -0
- package/rules/coding/boundary.md +25 -0
- package/rules/coding/implementation.md +30 -0
- package/rules/coding/index.md +38 -0
- package/rules/coding/scaffold.md +28 -0
- package/rules/coding/testing.md +29 -0
- package/rules/coding/validation.md +29 -0
- package/rules/core/code-quality.md +30 -0
- package/rules/core/evidence.md +26 -0
- package/rules/core/index.md +41 -0
- package/rules/core/interface.md +26 -0
- package/rules/core/iteration.md +26 -0
- package/rules/core/layer-boundary.md +25 -0
- package/rules/core/logging.md +26 -0
- package/rules/core/security.md +26 -0
- package/rules/core/task-boundary.md +27 -0
- package/rules/docs/api.md +34 -0
- package/rules/docs/capture-summary.md +29 -0
- package/rules/docs/capture.md +34 -0
- package/rules/docs/contract.md +30 -0
- package/rules/docs/decision-log.md +32 -0
- package/rules/docs/examples.md +28 -0
- package/rules/docs/index.md +49 -0
- package/rules/docs/reference.md +32 -0
- package/rules/index.md +46 -0
- package/rules/overlays/index.md +28 -0
- package/rules/overlays/pig-cloud/controller.md +33 -0
- package/rules/overlays/pig-cloud/dto-vo.md +33 -0
- package/rules/overlays/pig-cloud/entity.md +32 -0
- package/rules/overlays/pig-cloud/exception.md +32 -0
- package/rules/overlays/pig-cloud/layering.md +31 -0
- package/rules/overlays/pig-cloud/mapper.md +32 -0
- package/rules/overlays/pig-cloud/query-style.md +32 -0
- package/rules/overlays/pig-cloud/rest-response.md +33 -0
- package/rules/overlays/pig-cloud/service.md +33 -0
- package/rules/overlays/pig-cloud/transactions.md +32 -0
- package/rules/overlays/pig-cloud/validation.md +33 -0
- package/rules/overlays/pig-cloud.md +45 -0
- package/rules/product/acceptance.md +25 -0
- package/rules/product/briefing.md +27 -0
- package/rules/product/index.md +36 -0
- package/rules/product/intake.md +27 -0
- package/rules/product/modeling.md +25 -0
- package/rules/product/project-context.md +29 -0
- package/rules/review/code.md +35 -0
- package/rules/review/evidence.md +31 -0
- package/rules/review/index.md +50 -0
- package/rules/review/java.md +42 -0
- package/rules/review/performance.md +38 -0
- package/rules/review/rubric.md +28 -0
- package/rules/review/security.md +38 -0
- package/rules/review/ts.md +33 -0
- package/rules/review/vue.md +33 -0
- package/rules/skill-profile-map.json +58 -0
- package/rules/skill-profile-map.md +28 -0
- package/rules/workflow/handoff.md +25 -0
- package/rules/workflow/index.md +37 -0
- package/rules/workflow/refinement.md +29 -0
- package/rules/workflow/router.md +25 -0
- package/rules/workflow/selection.md +25 -0
- package/rules/workflow/stop.md +25 -0
- package/scripts/ci-validator.sh +114 -0
- package/scripts/run-golden-replays.js +312 -0
- package/scripts/validate-rules.js +125 -0
- package/scripts/validate-skill-replay-signals.js +75 -0
- package/scripts/validate-skill-shapes.js +141 -0
- package/scripts/validate-skill-stop-rules.js +139 -0
- package/scripts/validate-skills.cmd +3 -0
- package/scripts/validate-skills.ps1 +42 -0
- package/scripts/validate-skills.sh +36 -0
- package/skills/api-docs/SKILL.md +76 -0
- package/skills/code-review/SKILL.md +135 -0
- package/skills/code-review/references/findings-template.md +51 -0
- package/skills/code-review/references/performance-checklist.md +213 -0
- package/skills/code-review/references/rubric.md +232 -0
- package/skills/code-review/references/rules.md +32 -0
- package/skills/code-review/references/security-checklist.md +178 -0
- package/skills/code-review/references/stack-notes.md +25 -0
- package/skills/code-review/references/template-review.md +214 -0
- package/skills/code-review/scripts/lint-code-review.mjs +431 -0
- package/skills/domain-modeling/SKILL.md +80 -0
- package/skills/domain-modeling/references/README.md +134 -0
- package/skills/domain-modeling/references/distillation-checklist.md +152 -0
- package/skills/domain-modeling/references/test-cases-template.md +128 -0
- package/skills/environment-deploy/SKILL.md +81 -0
- package/skills/feature-build/SKILL.md +122 -0
- package/skills/feature-build/references/coding-checklist.md +97 -0
- package/skills/feature-build/references/comment-specification.md +102 -0
- package/skills/knowledge-capture/SKILL.md +84 -0
- package/skills/performance-check/SKILL.md +117 -0
- package/skills/product-intake/SKILL.md +98 -0
- package/skills/project-bootstrap/SKILL.md +80 -0
- package/skills/references/agent-personas.md +34 -0
- package/skills/references/anti-rationalization.md +144 -0
- package/skills/references/engineering-delivery-method.md +63 -0
- package/skills/references/engineering-delivery-template.md +80 -0
- package/skills/references/flow-test-cases.md +62 -0
- package/skills/references/full-chain-replay-scenarios.md +79 -0
- package/skills/references/golden-prompt-suite.js +385 -0
- package/skills/references/golden-prompt-suite.md +33 -0
- package/skills/references/hooks.md +67 -0
- package/skills/references/negative-replay-scenarios.md +49 -0
- package/skills/references/project-requirement-alignment.md +41 -0
- package/skills/references/prompt-replay-checklist.md +128 -0
- package/skills/references/requirements-separation-map.md +71 -0
- package/skills/references/rule-loading-map.md +108 -0
- package/skills/references/skill-authoring-standard.md +73 -0
- package/skills/references/skill-boundary-template.md +38 -0
- package/skills/references/skill-enhanced-template.md +53 -0
- package/skills/references/skill-reference-matrix.md +53 -0
- package/skills/references/slash-commands.md +34 -0
- package/skills/security-review/SKILL.md +117 -0
- package/skills/spec-refinement/SKILL.md +143 -0
- package/skills/spec-refinement/references/ears-syntax.md +127 -0
- package/skills/spec-refinement/references/requirement-checklist.md +139 -0
- package/skills/spec-refinement/references/spec-workbook.md +75 -0
- package/skills/technical-design/SKILL.md +105 -0
- package/skills/technical-design/references/solid-checklist.md +199 -0
- package/skills/test-design/SKILL.md +91 -0
- package/skills/workflow-router/SKILL.md +86 -0
|
@@ -0,0 +1,71 @@
|
|
|
1
|
+
# 需求拆分图
|
|
2
|
+
|
|
3
|
+
## 目标
|
|
4
|
+
|
|
5
|
+
把需求工作拆成两个互相隔离的 skill:
|
|
6
|
+
|
|
7
|
+
- 产品侧需求发现
|
|
8
|
+
- 研发侧需求分析
|
|
9
|
+
|
|
10
|
+
## 产品侧
|
|
11
|
+
|
|
12
|
+
当任务主要涉及这些内容时,使用 `product-intake`:
|
|
13
|
+
|
|
14
|
+
- 业务目标
|
|
15
|
+
- 用户需求
|
|
16
|
+
- PRD 收口
|
|
17
|
+
- 范围和优先级
|
|
18
|
+
- 发布规划
|
|
19
|
+
- 会议纪要和需求讨论
|
|
20
|
+
- 当前项目事实的整理
|
|
21
|
+
|
|
22
|
+
### 产品输出
|
|
23
|
+
|
|
24
|
+
- 业务目标
|
|
25
|
+
- 用户场景
|
|
26
|
+
- 需求列表
|
|
27
|
+
- 范围和非范围
|
|
28
|
+
- 验收标准
|
|
29
|
+
- 优先级
|
|
30
|
+
- 当前项目事实
|
|
31
|
+
- 给研发的待确认项
|
|
32
|
+
|
|
33
|
+
### 产品停规则
|
|
34
|
+
|
|
35
|
+
- 不写实现细节。
|
|
36
|
+
- 不判断框架约束。
|
|
37
|
+
- 不把结果直接写成面向代码的规格。
|
|
38
|
+
- 不把当前项目事实和产品意图混成一句话。
|
|
39
|
+
|
|
40
|
+
## 研发侧
|
|
41
|
+
|
|
42
|
+
当任务主要涉及这些内容时,使用 `spec-refinement`:
|
|
43
|
+
|
|
44
|
+
- 把已确认的产品需求转成可执行规格
|
|
45
|
+
- 细化实现范围
|
|
46
|
+
- 补齐验收缺口
|
|
47
|
+
- 分析影响范围
|
|
48
|
+
- 在设计或实现前准备研发输入
|
|
49
|
+
- 对齐产品需求和当前项目事实
|
|
50
|
+
|
|
51
|
+
### 研发输出
|
|
52
|
+
|
|
53
|
+
- 可执行需求规格
|
|
54
|
+
- 验收标准
|
|
55
|
+
- 影响范围
|
|
56
|
+
- 对齐说明
|
|
57
|
+
- 任务计划
|
|
58
|
+
- 实现输入摘要
|
|
59
|
+
|
|
60
|
+
### 研发停规则
|
|
61
|
+
|
|
62
|
+
- 不把 PRD 从头重写一遍。
|
|
63
|
+
- 不直接进入代码生成。
|
|
64
|
+
- 不跳过边界检查或当前选定的 rules bundle。
|
|
65
|
+
- 不忽略当前项目事实。
|
|
66
|
+
- 不把任务计划丢给实现阶段临时补。
|
|
67
|
+
|
|
68
|
+
## 知识交接
|
|
69
|
+
|
|
70
|
+
- 产品产物和研发产物都沉淀到 `knowledge-capture`。
|
|
71
|
+
- 产品事实和研发事实保持关联,但不要混写。
|
|
@@ -0,0 +1,108 @@
|
|
|
1
|
+
# Rule Loading Map
|
|
2
|
+
|
|
3
|
+
## Goal
|
|
4
|
+
|
|
5
|
+
Keep rule loading separate from skill routing. Load the smallest rule set that matches the current task, then add the stack-specific overlay only when needed. When changed files are available, prefer them over workspace-wide heuristics.
|
|
6
|
+
|
|
7
|
+
## Load Order
|
|
8
|
+
|
|
9
|
+
### 1. Core Layer
|
|
10
|
+
|
|
11
|
+
Use the core layer when the task is generic, the routing is unclear, or the current workspace does not need more specific rules yet.
|
|
12
|
+
|
|
13
|
+
- `rules/index.md`
|
|
14
|
+
- `rules/core/index.md`
|
|
15
|
+
- `rules/skill-profile-map.md`
|
|
16
|
+
- `PIG_SKILLS_RULE_SKILL=workflow-router`
|
|
17
|
+
|
|
18
|
+
### 2. Workflow Layer
|
|
19
|
+
|
|
20
|
+
Use the workflow layer when the task involves routing, handoff, boundary changes, or stage switching.
|
|
21
|
+
|
|
22
|
+
- `rules/workflow/index.md`
|
|
23
|
+
- `rules/workflow/refinement.md`
|
|
24
|
+
- `rules/workflow/router.md`
|
|
25
|
+
- `rules/workflow/selection.md`
|
|
26
|
+
- `rules/workflow/stop.md`
|
|
27
|
+
- `PIG_SKILLS_RULE_PROFILE=router|refinement`
|
|
28
|
+
- `PIG_SKILLS_RULE_SKILL=workflow-router|spec-refinement`
|
|
29
|
+
|
|
30
|
+
### 3. Coding Layer
|
|
31
|
+
|
|
32
|
+
Use the coding layer when the task involves implementation, refactoring, testing, or scaffolding.
|
|
33
|
+
|
|
34
|
+
- `rules/coding/index.md`
|
|
35
|
+
- `rules/coding/analysis.md`
|
|
36
|
+
- `rules/coding/implementation.md`
|
|
37
|
+
- `rules/coding/testing.md`
|
|
38
|
+
- `rules/coding/scaffold.md`
|
|
39
|
+
- `rules/coding/boundary.md`
|
|
40
|
+
- `rules/coding/validation.md`
|
|
41
|
+
- `rules/coding/backend/index.md`
|
|
42
|
+
- `rules/coding/backend/database.md`
|
|
43
|
+
- `rules/coding/backend/query.md`
|
|
44
|
+
- `rules/coding/backend/remote.md`
|
|
45
|
+
- `rules/coding/backend/feign.md`
|
|
46
|
+
- `rules/coding/backend/transaction-boundary.md`
|
|
47
|
+
- `rules/coding/backend/transaction-rollback.md`
|
|
48
|
+
- `rules/coding/backend/cache-keying.md`
|
|
49
|
+
- `rules/coding/backend/cache-invalidation.md`
|
|
50
|
+
- `PIG_SKILLS_RULE_PROFILE=analysis|implementation|testing|scaffold`
|
|
51
|
+
- `PIG_SKILLS_RULE_SKILL=technical-design|feature-build|test-design|project-bootstrap|environment-deploy`
|
|
52
|
+
|
|
53
|
+
### 4. Review Layer
|
|
54
|
+
|
|
55
|
+
Use the review layer when the task involves code review, security review, performance review, or a quality gate.
|
|
56
|
+
|
|
57
|
+
- `rules/review/index.md`
|
|
58
|
+
- `rules/review/code.md`
|
|
59
|
+
- `rules/review/java.md`
|
|
60
|
+
- `rules/review/vue.md`
|
|
61
|
+
- `rules/review/ts.md`
|
|
62
|
+
- `rules/review/security.md`
|
|
63
|
+
- `rules/review/performance.md`
|
|
64
|
+
- `rules/review/rubric.md`
|
|
65
|
+
- `rules/review/evidence.md`
|
|
66
|
+
- `PIG_SKILLS_RULE_PROFILE=code|code-java|code-vue|code-ts|security|performance`
|
|
67
|
+
- `PIG_SKILLS_RULE_SKILL=code-review|security-review|performance-check`
|
|
68
|
+
|
|
69
|
+
`code-review` now resolves to `code` in this repository. The loader keeps the generic review profile first, then auto-adds stack overlays such as `code-java`, `code-vue`, and `code-ts` when the workspace or changed-file signal indicates those stacks.
|
|
70
|
+
|
|
71
|
+
- `PIG_SKILLS_CHANGED_FILES` can be used to pass changed paths for more precise review overlay routing.
|
|
72
|
+
|
|
73
|
+
### 5. Product / Docs Layer
|
|
74
|
+
|
|
75
|
+
Use the product/docs layer when the task involves requirement intake, domain modeling, API docs, knowledge capture, or contract writing.
|
|
76
|
+
|
|
77
|
+
- `rules/product/index.md`
|
|
78
|
+
- `rules/product/intake.md`
|
|
79
|
+
- `rules/product/modeling.md`
|
|
80
|
+
- `rules/product/briefing.md`
|
|
81
|
+
- `rules/product/acceptance.md`
|
|
82
|
+
- `rules/docs/index.md`
|
|
83
|
+
- `rules/docs/api.md`
|
|
84
|
+
- `rules/docs/capture.md`
|
|
85
|
+
- `rules/docs/reference.md`
|
|
86
|
+
- `rules/docs/decision-log.md`
|
|
87
|
+
- `rules/docs/contract.md`
|
|
88
|
+
- `rules/docs/examples.md`
|
|
89
|
+
- `rules/docs/capture-summary.md`
|
|
90
|
+
- `PIG_SKILLS_RULE_PROFILE=intake|modeling|api|capture`
|
|
91
|
+
- `PIG_SKILLS_RULE_SKILL=product-intake|domain-modeling|api-docs|knowledge-capture`
|
|
92
|
+
|
|
93
|
+
### 6. Discovery Rules
|
|
94
|
+
|
|
95
|
+
Do not pull product discovery into the coding bundle. Discovery dependencies should be:
|
|
96
|
+
|
|
97
|
+
- `skills/references/requirements-separation-map.md`
|
|
98
|
+
- `skills/knowledge-capture/SKILL.md`
|
|
99
|
+
|
|
100
|
+
## Principles
|
|
101
|
+
|
|
102
|
+
- Skills should point to this map, then load only the minimum files needed.
|
|
103
|
+
- Do not duplicate rule-layer content inside every skill.
|
|
104
|
+
- Load `core` first, then the matching bundle/profile.
|
|
105
|
+
- `rule_profile` in skill frontmatter is the declaration source; mapping files are only for validation and fallback.
|
|
106
|
+
- In non-production environments, the loader should fail fast when skill metadata and mapping metadata drift apart.
|
|
107
|
+
- A new skill should start from `skills/references/skill-boundary-template.md`, then add only the skill-specific I/O and stop rules.
|
|
108
|
+
- Negative replay tests should use `skills/references/negative-replay-scenarios.md` to validate stop boundaries and handoffs.
|
|
@@ -0,0 +1,73 @@
|
|
|
1
|
+
# Skill Authoring Standard
|
|
2
|
+
|
|
3
|
+
## Goal
|
|
4
|
+
Make every skill easy for AI to detect, cheap to read, and hard to misuse.
|
|
5
|
+
|
|
6
|
+
## Required Shape
|
|
7
|
+
- `name`: one canonical skill name
|
|
8
|
+
- `description`: action + trigger + scope in one sentence
|
|
9
|
+
- `lifecycle_stage`: stable stage label
|
|
10
|
+
- `slash_commands`: only when the skill has a real command surface
|
|
11
|
+
- `dependencies`: only true hard prerequisites
|
|
12
|
+
- `triggers`: exact user phrases and intent keywords
|
|
13
|
+
- `inputs`: what the skill consumes
|
|
14
|
+
- `outputs`: what the skill must produce
|
|
15
|
+
- `workflow`: short ordered steps
|
|
16
|
+
- `gates`: objective completion checks
|
|
17
|
+
- `refs`: where the long detail lives
|
|
18
|
+
- `rule_profile`: optional hint for which rules bundle profile a skill should load
|
|
19
|
+
|
|
20
|
+
## Template Levels
|
|
21
|
+
- `short`: use [`skill-boundary-template.md`](skill-boundary-template.md) for routing, intake, capture, and other low-complexity skills.
|
|
22
|
+
- `enhanced`: use [`skill-enhanced-template.md`](skill-enhanced-template.md) for design, implementation, review, and other high-density skills.
|
|
23
|
+
- Keep one skill on one level unless the skill clearly crosses into a more complex phase.
|
|
24
|
+
|
|
25
|
+
## Token Saving Rules
|
|
26
|
+
- Keep the skill body short.
|
|
27
|
+
- Move templates, long examples, and repeated background into `references/`.
|
|
28
|
+
- Keep rule bundles in `rules/` and point `refs` at the smallest needed bundle.
|
|
29
|
+
- Reuse `skills/references/skill-boundary-template.md` for the common skill shape.
|
|
30
|
+
- Write once, reference many.
|
|
31
|
+
- Prefer bullets over paragraphs.
|
|
32
|
+
- Avoid repeating rule bundles in every skill.
|
|
33
|
+
|
|
34
|
+
## AI Recognition Rules
|
|
35
|
+
- Put trigger words in the first screen.
|
|
36
|
+
- Use one name for one capability.
|
|
37
|
+
- Make `description` concrete: verb + object + outcome.
|
|
38
|
+
- Keep `lifecycle_stage` and `dependencies` stable.
|
|
39
|
+
- Encode hard prerequisites in `dependencies`; keep soft routing hints in `triggers`.
|
|
40
|
+
- When a skill needs rules, declare its preferred `rule_profile` rather than repeating rules in prose.
|
|
41
|
+
- Add `适合 / 不适合` when the skill needs fast routing.
|
|
42
|
+
- Put hard-stop rules in `gates`, not in prose.
|
|
43
|
+
- Use `Quick Start`, `Inputs / Outputs`, and `Gotchas` only in enhanced skills.
|
|
44
|
+
|
|
45
|
+
## Canonical Order
|
|
46
|
+
1. Purpose
|
|
47
|
+
2. Suitable / Unsuitable
|
|
48
|
+
3. Quick Start
|
|
49
|
+
4. Inputs / Outputs
|
|
50
|
+
5. Workflow
|
|
51
|
+
6. Replay Signals
|
|
52
|
+
7. Gotchas
|
|
53
|
+
8. Stop Rules
|
|
54
|
+
9. References
|
|
55
|
+
10. Safety
|
|
56
|
+
|
|
57
|
+
## What Belongs Outside
|
|
58
|
+
- Long tutorials
|
|
59
|
+
- Large examples
|
|
60
|
+
- Repeated rule details
|
|
61
|
+
- External comparison notes
|
|
62
|
+
- Shared templates
|
|
63
|
+
- Negative replay scenarios
|
|
64
|
+
|
|
65
|
+
## Template Selection
|
|
66
|
+
- Short template: `workflow-router`, `product-intake`, `knowledge-capture`, `api-docs`, `test-design`, `domain-modeling`, `project-bootstrap`, `environment-deploy`
|
|
67
|
+
- Enhanced template: `spec-refinement`, `technical-design`, `feature-build`, `code-review`, `security-review`, `performance-check`
|
|
68
|
+
|
|
69
|
+
## Quality Bar
|
|
70
|
+
- A model should know whether to use the skill in under 10 seconds.
|
|
71
|
+
- A model should know what output to produce in under 20 seconds.
|
|
72
|
+
- A human should be able to maintain the skill without reading half the repo.
|
|
73
|
+
- A reviewer should be able to see the stop boundary and replay signal in one screen.
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
# Skill 边界模板
|
|
2
|
+
|
|
3
|
+
这是一份给基础 skill 复用的短模板。正文只保留可执行边界,不写长背景。
|
|
4
|
+
|
|
5
|
+
## 默认结构
|
|
6
|
+
|
|
7
|
+
```text
|
|
8
|
+
## Purpose
|
|
9
|
+
一句话说明这个 skill 只负责什么。
|
|
10
|
+
|
|
11
|
+
## Suitable / Unsuitable
|
|
12
|
+
- Suitable: 该 skill 该接的输入类型
|
|
13
|
+
- Unsuitable: 该 skill 不该碰的工作
|
|
14
|
+
|
|
15
|
+
## Workflow
|
|
16
|
+
1. 识别输入。
|
|
17
|
+
2. 执行本阶段工作。
|
|
18
|
+
3. 产出本阶段工件。
|
|
19
|
+
4. 交接到下一 skill。
|
|
20
|
+
|
|
21
|
+
## Replay Signals
|
|
22
|
+
- Input signal: 什么输入会触发这个 skill。
|
|
23
|
+
- Output to verify: 需要检查什么产物。
|
|
24
|
+
- Stop signal: 什么行为说明越界了。
|
|
25
|
+
- Handoff signal: 什么时候交给下一 skill。
|
|
26
|
+
|
|
27
|
+
## Stop Rules
|
|
28
|
+
- 停在本阶段。
|
|
29
|
+
- 不做下一阶段的工作。
|
|
30
|
+
- 不跳过规则加载。
|
|
31
|
+
```
|
|
32
|
+
|
|
33
|
+
## 使用原则
|
|
34
|
+
|
|
35
|
+
- `Replay Signals` 只写可验证的信号。
|
|
36
|
+
- `Stop Rules` 只写硬边界。
|
|
37
|
+
- 两者都要短,不要写成说明文。
|
|
38
|
+
- 复杂 skill 需要升级到 [`skill-enhanced-template.md`](skill-enhanced-template.md)。
|
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
# Skill 增强模板
|
|
2
|
+
|
|
3
|
+
这是一份给复杂 skill 复用的增强模板。它在短边界模板之上补充快速启动、输入输出和常见坑。
|
|
4
|
+
|
|
5
|
+
## 默认结构
|
|
6
|
+
|
|
7
|
+
```text
|
|
8
|
+
## Purpose
|
|
9
|
+
一句话说明这个 skill 只负责什么。
|
|
10
|
+
|
|
11
|
+
## Suitable / Unsuitable
|
|
12
|
+
- Suitable: 该 skill 该接的输入类型
|
|
13
|
+
- Unsuitable: 该 skill 不该碰的工作
|
|
14
|
+
|
|
15
|
+
## Quick Start
|
|
16
|
+
- 一句话说明怎么进入这个 skill。
|
|
17
|
+
- 一句话说明第一步看什么。
|
|
18
|
+
|
|
19
|
+
## Inputs / Outputs
|
|
20
|
+
- Inputs: 这个 skill 需要什么输入。
|
|
21
|
+
- Outputs: 这个 skill 要交付什么产物。
|
|
22
|
+
|
|
23
|
+
## Workflow
|
|
24
|
+
1. 识别输入。
|
|
25
|
+
2. 执行本阶段工作。
|
|
26
|
+
3. 产出本阶段工件。
|
|
27
|
+
4. 交接到下一 skill。
|
|
28
|
+
|
|
29
|
+
## Replay Signals
|
|
30
|
+
- Input signal: 什么输入会触发这个 skill。
|
|
31
|
+
- Output to verify: 需要检查什么产物。
|
|
32
|
+
- Stop signal: 什么行为说明越界了。
|
|
33
|
+
- Handoff signal: 什么时候交给下一 skill。
|
|
34
|
+
|
|
35
|
+
## Gotchas
|
|
36
|
+
- 该 skill 最容易犯的 2-4 个错误。
|
|
37
|
+
|
|
38
|
+
## Stop Rules
|
|
39
|
+
- 停在本阶段。
|
|
40
|
+
- 不做下一阶段的工作。
|
|
41
|
+
- 不跳过规则加载。
|
|
42
|
+
|
|
43
|
+
## References
|
|
44
|
+
- 该 skill 依赖的最小 references。
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
## 使用原则
|
|
48
|
+
|
|
49
|
+
- 增强模板只给复杂 skill。
|
|
50
|
+
- `Quick Start` 先帮模型快速进入任务。
|
|
51
|
+
- `Inputs / Outputs` 让产出更稳定。
|
|
52
|
+
- `Gotchas` 只写最常见、最容易越界的点。
|
|
53
|
+
- `References` 只挂最小必要文件,不要堆背景。
|
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
# Skill Reference Matrix
|
|
2
|
+
|
|
3
|
+
## Borrowed Patterns
|
|
4
|
+
|
|
5
|
+
| Source | Best Practice | Applies To |
|
|
6
|
+
|---|---|---|
|
|
7
|
+
| GitHub Spec Kit | Define before build | `spec-refinement` |
|
|
8
|
+
| AWS Kiro EARS | Structured requirement writing | `spec-refinement` |
|
|
9
|
+
| RIPER | Research / Innovate / Plan / Execute / Review | `spec-refinement` / routing context |
|
|
10
|
+
| Claude Code | Short, dense prompts | all skills |
|
|
11
|
+
| open-code-review | Deterministic review plus agent review | `code-review` |
|
|
12
|
+
| Skill Reviewer | Rubric-based review gate | `code-review` / `performance-check` / `security-review` |
|
|
13
|
+
| Short boundary template | One screen for Purpose / Workflow / Replay Signals / Stop Rules | low-complexity skills |
|
|
14
|
+
| Enhanced template | Add Quick Start / Inputs / Outputs / Gotchas / References | `spec-refinement` / `technical-design` / `feature-build` / `code-review` / `security-review` / `performance-check` |
|
|
15
|
+
| Negative replay | Use counterexamples to verify stop boundaries | `spec-refinement` / `technical-design` / `feature-build` / `test-design` |
|
|
16
|
+
| Engineering delivery method | Decide complexity first, then split and implement inside `feature-build` | `feature-build` / `test-design` / `code-review` |
|
|
17
|
+
| Engineering delivery template | One-page task card with facts, complexity, tasks, self-test, and validation | `feature-build` / `test-design` |
|
|
18
|
+
|
|
19
|
+
## Skill Principles
|
|
20
|
+
|
|
21
|
+
- Collect the boundary first, then expand output.
|
|
22
|
+
- Use verifiable facts instead of guesses.
|
|
23
|
+
- Keep existing boundaries during iteration.
|
|
24
|
+
- Let objective gates take priority over narrative explanation.
|
|
25
|
+
- Move long content into dedicated references.
|
|
26
|
+
- Keep framework rules in `rules/`; do not write them into skill bodies.
|
|
27
|
+
|
|
28
|
+
## Applicable Skills
|
|
29
|
+
|
|
30
|
+
- `product-intake`: turn business intent into a PRD-ready brief
|
|
31
|
+
- `spec-refinement`: turn approved requirements into an executable spec
|
|
32
|
+
- `technical-design`: turn complex changes into boundaries, dependencies, and rollback
|
|
33
|
+
- `feature-build`: turn the confirmed spec into code
|
|
34
|
+
- `test-design`: turn implementation results into a validation plan
|
|
35
|
+
- `knowledge-capture`: turn product and engineering facts into requirements knowledge, realtime code facts, CodeWiki entries, and enterprise knowledge
|
|
36
|
+
- `api-docs`: turn confirmed interfaces into docs
|
|
37
|
+
- `domain-modeling`: turn domain language into boundaries
|
|
38
|
+
- `workflow-router`: route the stage
|
|
39
|
+
- `code-review`: output generic review findings
|
|
40
|
+
- `security-review`: output security findings
|
|
41
|
+
- `performance-check`: output performance findings
|
|
42
|
+
|
|
43
|
+
## Template Selection
|
|
44
|
+
|
|
45
|
+
- Short template: `workflow-router`, `product-intake`, `knowledge-capture`, `api-docs`, `test-design`, `domain-modeling`, `project-bootstrap`, `environment-deploy`
|
|
46
|
+
- Enhanced template: `spec-refinement`, `technical-design`, `feature-build`, `code-review`, `security-review`, `performance-check`
|
|
47
|
+
|
|
48
|
+
## Rules Loading
|
|
49
|
+
|
|
50
|
+
- `rules/` is the only source for framework knowledge.
|
|
51
|
+
- Use `skills/references/rule-loading-map.md` to decide which bundle to load.
|
|
52
|
+
- Load the smallest bundle that covers the task.
|
|
53
|
+
- Skills should reference at least one `rules` bundle when the task touches code.
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
# Canonical Skill Entry Mapping
|
|
2
|
+
|
|
3
|
+
This page maps older slash-command style entry points to canonical skill names.
|
|
4
|
+
|
|
5
|
+
## Skill Mapping
|
|
6
|
+
|
|
7
|
+
| Skill | Use |
|
|
8
|
+
|---|---|
|
|
9
|
+
| `workflow-router` | Stage routing and handoff |
|
|
10
|
+
| `product-intake` | Product intent capture |
|
|
11
|
+
| `spec-refinement` | PRD, facts, and knowledge alignment into executable spec |
|
|
12
|
+
| `technical-design` | Boundaries, dependencies, and interfaces |
|
|
13
|
+
| `feature-build` | Implementation and task-level self-test |
|
|
14
|
+
| `test-design` | Test strategy and regression coverage |
|
|
15
|
+
| `code-review` | Generic code review findings |
|
|
16
|
+
| `security-review` | Security findings only |
|
|
17
|
+
| `performance-check` | Performance findings only |
|
|
18
|
+
| `knowledge-capture` | Decision and artifact capture |
|
|
19
|
+
| `domain-modeling` | Boundary extraction and domain terms |
|
|
20
|
+
| `api-docs` | API contract capture |
|
|
21
|
+
|
|
22
|
+
## Common Chains
|
|
23
|
+
|
|
24
|
+
```text
|
|
25
|
+
workflow-router -> product-intake -> spec-refinement -> technical-design -> feature-build -> test-design -> code-review -> knowledge-capture
|
|
26
|
+
product-intake -> spec-refinement
|
|
27
|
+
feature-build -> test-design -> code-review -> knowledge-capture
|
|
28
|
+
```
|
|
29
|
+
|
|
30
|
+
## Notes
|
|
31
|
+
|
|
32
|
+
- Canonical skill names take precedence over old slash-command names.
|
|
33
|
+
- Keep framework rules in `rules/`.
|
|
34
|
+
- Keep skill bodies short and stable.
|
|
@@ -0,0 +1,117 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: security-review
|
|
3
|
+
description: Review a diff, endpoint, or design note for auth, secret, or data exposure risks when security findings are needed
|
|
4
|
+
lifecycle_stage: review
|
|
5
|
+
rule_profile: security
|
|
6
|
+
dependencies:
|
|
7
|
+
- feature-build
|
|
8
|
+
triggers:
|
|
9
|
+
- security
|
|
10
|
+
- injection
|
|
11
|
+
- secret
|
|
12
|
+
- permission
|
|
13
|
+
- auth
|
|
14
|
+
- data exposure
|
|
15
|
+
- trust boundary
|
|
16
|
+
inputs:
|
|
17
|
+
- diff
|
|
18
|
+
- design notes
|
|
19
|
+
- endpoint behavior
|
|
20
|
+
outputs:
|
|
21
|
+
- security findings
|
|
22
|
+
- risk level
|
|
23
|
+
- mitigation advice
|
|
24
|
+
- trust boundary summary
|
|
25
|
+
- review summary
|
|
26
|
+
workflow:
|
|
27
|
+
- identify trust boundaries and sensitive flows
|
|
28
|
+
- inspect input validation and authorization
|
|
29
|
+
- route generic correctness issues to `code-review`
|
|
30
|
+
- rank the risks by severity
|
|
31
|
+
- produce mitigation advice
|
|
32
|
+
gates:
|
|
33
|
+
- stop at security findings
|
|
34
|
+
- do not rewrite code
|
|
35
|
+
- do not turn into a general review
|
|
36
|
+
refs:
|
|
37
|
+
- skills/references/rule-loading-map.md
|
|
38
|
+
- skills/references/prompt-replay-checklist.md
|
|
39
|
+
- skills/references/full-chain-replay-scenarios.md
|
|
40
|
+
- rules/index.md
|
|
41
|
+
---
|
|
42
|
+
|
|
43
|
+
# Security Review
|
|
44
|
+
|
|
45
|
+
## Purpose
|
|
46
|
+
|
|
47
|
+
Find and rank security risks before release.
|
|
48
|
+
|
|
49
|
+
## Suitable / Unsuitable
|
|
50
|
+
|
|
51
|
+
- Suitable: injection, secrets, permissions, auth, data exposure, trust boundary breaks
|
|
52
|
+
- Unsuitable: implementation work, broad code review, requirement discovery, generic correctness review
|
|
53
|
+
|
|
54
|
+
## Quick Start
|
|
55
|
+
|
|
56
|
+
- Start by mapping trust boundaries and sensitive flows.
|
|
57
|
+
- Inspect authorization and input validation before anything else.
|
|
58
|
+
- Keep the output focused on findings and mitigation advice.
|
|
59
|
+
- If the issue is only about correctness or maintainability, hand off to `code-review`.
|
|
60
|
+
|
|
61
|
+
## Report Format
|
|
62
|
+
|
|
63
|
+
- Use one entry per security finding.
|
|
64
|
+
- Include `location`, `risk level`, `attack path`, `impacted asset`, `evidence`, and `mitigation advice`.
|
|
65
|
+
- Anchor each finding to the smallest relevant security surface:
|
|
66
|
+
- endpoint, auth flow, permission boundary, secret handling path, or data exposure path
|
|
67
|
+
- State the violated trust boundary when it is clear.
|
|
68
|
+
- Keep the review summary short when no security issue is present.
|
|
69
|
+
- If there are no findings, say what was checked and why the change is acceptable.
|
|
70
|
+
|
|
71
|
+
## Inputs / Outputs
|
|
72
|
+
|
|
73
|
+
- Inputs:
|
|
74
|
+
- diff
|
|
75
|
+
- design notes
|
|
76
|
+
- endpoint behavior
|
|
77
|
+
- Outputs:
|
|
78
|
+
- security findings
|
|
79
|
+
- risk level
|
|
80
|
+
- mitigation advice
|
|
81
|
+
- trust boundary summary
|
|
82
|
+
|
|
83
|
+
## Workflow
|
|
84
|
+
|
|
85
|
+
1. Identify trust boundaries and sensitive flows.
|
|
86
|
+
2. Inspect input validation and authorization.
|
|
87
|
+
3. Route generic correctness issues to `code-review`.
|
|
88
|
+
4. Rank the risks by severity.
|
|
89
|
+
5. Produce mitigation advice.
|
|
90
|
+
|
|
91
|
+
## Replay Signals
|
|
92
|
+
|
|
93
|
+
- Input signal: diff, design notes, endpoint behavior, or a security concern.
|
|
94
|
+
- Output to verify: security findings, risk level, mitigation advice, trust boundary summary, review summary.
|
|
95
|
+
- Stop signal: rewrite code or turn into a general review.
|
|
96
|
+
- Handoff signal: the findings are ready for `knowledge-capture`.
|
|
97
|
+
|
|
98
|
+
## Gotchas
|
|
99
|
+
|
|
100
|
+
- Do not blur security review into generic correctness review.
|
|
101
|
+
- Do not skip trust boundaries.
|
|
102
|
+
- Do not omit risk level when reporting findings.
|
|
103
|
+
- Do not approve changes without explicit evidence.
|
|
104
|
+
- Do not file a generic code-quality issue as a security finding.
|
|
105
|
+
|
|
106
|
+
## Stop Rules
|
|
107
|
+
|
|
108
|
+
- Stop at security findings.
|
|
109
|
+
- Do not rewrite code.
|
|
110
|
+
- Do not turn into a general review.
|
|
111
|
+
|
|
112
|
+
## References
|
|
113
|
+
|
|
114
|
+
- `skills/references/rule-loading-map.md`
|
|
115
|
+
- `skills/references/prompt-replay-checklist.md`
|
|
116
|
+
- `skills/references/full-chain-replay-scenarios.md`
|
|
117
|
+
- `rules/index.md`
|
|
@@ -0,0 +1,143 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: spec-refinement
|
|
3
|
+
description: Refine approved demand into an executable spec by aligning product intent, project facts, prototypes, implementation facts, and knowledge-base evidence when acceptance gaps, constraints, or implementation inputs remain
|
|
4
|
+
lifecycle_stage: refinement
|
|
5
|
+
rule_profile: refinement
|
|
6
|
+
dependencies:
|
|
7
|
+
- product-intake
|
|
8
|
+
triggers:
|
|
9
|
+
- requirement clarification
|
|
10
|
+
- acceptance gap
|
|
11
|
+
- impact analysis
|
|
12
|
+
- engineering spec
|
|
13
|
+
- open question
|
|
14
|
+
inputs:
|
|
15
|
+
- approved product brief
|
|
16
|
+
- current project facts
|
|
17
|
+
- prototype notes
|
|
18
|
+
- implementation facts
|
|
19
|
+
- scope decisions
|
|
20
|
+
- open questions
|
|
21
|
+
- rules bundle
|
|
22
|
+
outputs:
|
|
23
|
+
- executable spec
|
|
24
|
+
- execution direction plan
|
|
25
|
+
- acceptance criteria
|
|
26
|
+
- impact scope
|
|
27
|
+
- implementation inputs
|
|
28
|
+
- alignment notes
|
|
29
|
+
- task breakdown plan
|
|
30
|
+
- confirmation package
|
|
31
|
+
workflow:
|
|
32
|
+
- verify the product brief is approved
|
|
33
|
+
- compare the brief with current project facts, prototype notes, implementation facts, and knowledge snippets
|
|
34
|
+
- clarify boundaries, assumptions, and acceptance gaps
|
|
35
|
+
- identify conflicts between intent and current facts
|
|
36
|
+
- decide the task execution direction before splitting tasks
|
|
37
|
+
- extract a task breakdown plan for user confirmation
|
|
38
|
+
- define implementation-facing constraints and verification inputs
|
|
39
|
+
- assemble a confirmation package for user sign-off
|
|
40
|
+
- hand off to technical-design or feature-build only after confirmation
|
|
41
|
+
gates:
|
|
42
|
+
- stop at spec clarity
|
|
43
|
+
- do not restart PRD writing
|
|
44
|
+
- do not generate code
|
|
45
|
+
- do not skip the selected rules bundle
|
|
46
|
+
refs:
|
|
47
|
+
- skills/references/requirements-separation-map.md
|
|
48
|
+
- skills/references/project-requirement-alignment.md
|
|
49
|
+
- skills/references/engineering-delivery-method.md
|
|
50
|
+
- skills/references/engineering-delivery-template.md
|
|
51
|
+
- skills/references/rule-loading-map.md
|
|
52
|
+
- skills/references/flow-test-cases.md
|
|
53
|
+
- skills/references/full-chain-replay-scenarios.md
|
|
54
|
+
- skills/references/prompt-replay-checklist.md
|
|
55
|
+
- rules/index.md
|
|
56
|
+
---
|
|
57
|
+
|
|
58
|
+
# Spec Refinement
|
|
59
|
+
|
|
60
|
+
## Purpose
|
|
61
|
+
|
|
62
|
+
Turn approved product input into an executable spec for engineering. This skill ends when the scope is clear enough for design or implementation.
|
|
63
|
+
|
|
64
|
+
## Suitable / Unsuitable
|
|
65
|
+
|
|
66
|
+
- Suitable: requirement clarification, boundary checks, acceptance gaps, impact analysis, project-fact alignment, prototype alignment, implementation-fact alignment
|
|
67
|
+
- Unsuitable: redoing the PRD, writing code, selecting rule bundles, skipping the rules bundle
|
|
68
|
+
|
|
69
|
+
## Quick Start
|
|
70
|
+
|
|
71
|
+
- Start from the approved brief and compare it with current project facts, prototype notes, implementation facts, code, docs, and knowledge snippets.
|
|
72
|
+
- Identify acceptance gaps and fact conflicts before writing any implementation-facing spec.
|
|
73
|
+
- Decide the task execution direction before extracting the task breakdown plan.
|
|
74
|
+
- Extract the task breakdown plan so feature-build can break the work into small tasks.
|
|
75
|
+
- Convert the result into an executable spec that AI can follow without re-interpreting the PRD.
|
|
76
|
+
- Package the spec, task plan, and acceptance criteria into a confirmation package before execution starts.
|
|
77
|
+
- If scope is still unstable, stop and keep the output at spec clarity.
|
|
78
|
+
|
|
79
|
+
## Inputs / Outputs
|
|
80
|
+
|
|
81
|
+
- Inputs:
|
|
82
|
+
- approved product brief
|
|
83
|
+
- current project facts
|
|
84
|
+
- prototype notes
|
|
85
|
+
- implementation facts
|
|
86
|
+
- knowledge snippets
|
|
87
|
+
- scope decisions
|
|
88
|
+
- open questions
|
|
89
|
+
- rules bundle
|
|
90
|
+
- Outputs:
|
|
91
|
+
- executable spec
|
|
92
|
+
- execution direction plan
|
|
93
|
+
- acceptance criteria
|
|
94
|
+
- impact scope
|
|
95
|
+
- implementation inputs
|
|
96
|
+
- alignment notes
|
|
97
|
+
- conflict map
|
|
98
|
+
- task breakdown plan
|
|
99
|
+
- confirmation package
|
|
100
|
+
|
|
101
|
+
## Workflow
|
|
102
|
+
|
|
103
|
+
1. Verify the product brief is approved.
|
|
104
|
+
2. Compare the brief with current project facts, prototype notes, implementation facts, docs, and known constraints.
|
|
105
|
+
3. Clarify boundaries, assumptions, acceptance gaps, and fact conflicts.
|
|
106
|
+
4. Extract the task breakdown plan for later implementation.
|
|
107
|
+
5. Write the execution direction plan, executable spec, task breakdown plan, conflict map, implementation inputs, and confirmation package.
|
|
108
|
+
6. Hand off to `technical-design` or `feature-build` when the scope is stable and confirmed.
|
|
109
|
+
7. Stop before code generation.
|
|
110
|
+
|
|
111
|
+
## Replay Signals
|
|
112
|
+
|
|
113
|
+
- Input signal: approved PRD, open acceptance gaps, or code-to-requirement alignment work.
|
|
114
|
+
- Output to verify: executable spec, execution direction plan, acceptance criteria, impact scope, alignment notes, conflict map, task breakdown plan, implementation input summary, confirmation package.
|
|
115
|
+
- Stop signal: code generation, implementation detail expansion, or redoing the PRD.
|
|
116
|
+
- Handoff signal: the spec is stable enough for `technical-design` or `feature-build`.
|
|
117
|
+
|
|
118
|
+
## Gotchas
|
|
119
|
+
|
|
120
|
+
- Do not reopen product discovery.
|
|
121
|
+
- Do not ignore current project facts.
|
|
122
|
+
- Do not ignore knowledge-base evidence.
|
|
123
|
+
- Do not rewrite the PRD when the task is spec refinement.
|
|
124
|
+
- Do not let implementation details leak into the brief.
|
|
125
|
+
- Do not collapse the task breakdown plan into one coarse requirement.
|
|
126
|
+
- Do not skip the selected rules bundle.
|
|
127
|
+
|
|
128
|
+
## Stop Rules
|
|
129
|
+
|
|
130
|
+
- Stop at spec clarity.
|
|
131
|
+
- Do not restart PRD writing.
|
|
132
|
+
- Do not rewrite the PRD.
|
|
133
|
+
- Do not jump into implementation.
|
|
134
|
+
- Do not generate code.
|
|
135
|
+
- Do not ignore the selected rules bundle.
|
|
136
|
+
- Do not skip the selected rules bundle.
|
|
137
|
+
|
|
138
|
+
## References
|
|
139
|
+
|
|
140
|
+
- `skills/references/requirements-separation-map.md`
|
|
141
|
+
- `skills/references/rule-loading-map.md`
|
|
142
|
+
- `skills/references/flow-test-cases.md`
|
|
143
|
+
- `rules/index.md`
|