@su-record/vibe 2.9.25 → 2.9.32

package/agents/teams/security-team.md

@@ -1,81 +1,81 @@
-# Security Team
-
-보안 민감 코드 변경 시 전문 보안 검증 팀.
-
-## 팀 구성
-
-| 팀원 | 역할 | Model |
-|------|------|-------|
-| security-reviewer (리더) | OWASP Top 10 검증, 보안 이슈 우선순위 결정 | Sonnet |
-| data-integrity-reviewer | 데이터 무결성, 트랜잭션 관리, 입력 검증 | Sonnet |
-| security-advisory-agent | 사용 라이브러리 CVE 확인, 보안 패치 확인 | Haiku |
-| tester | 보안 테스트 케이스 작성, 침투 테스트 시나리오 검증 | Haiku |
-
-## 활성화 조건
-
-- auth, payment, user-data, crypto 관련 파일 변경 감지 시
-- 또는 수동으로 `security` 키워드 지정 시
-
-## 워크플로우
-
-```
-[입력: 보안 민감 변경 파일 목록]
-    |
-    ├──→ security-reviewer: OWASP Top 10 검증 + 합의 주도
-    ├──→ data-integrity-reviewer: 데이터 흐름 + 입력 검증
-    ├──→ security-advisory-agent: CVE 스캔 + 의존성 검사
-    └──→ tester: 보안 테스트 케이스 작성
-         |
-    [SendMessage 교차 보고]
-         |
-    security-reviewer: P1 발견 → merge 차단
-```
-
-## spawn 패턴
-
-```text
-TeamCreate(team_name="security-{feature}", description="Security audit team for {feature}")
-
-Task(team_name="security-{feature}", name="security-reviewer", subagent_type="security-reviewer",
-  mode="bypassPermissions",
-  prompt="Security team leader. Comprehensive security audit for {feature}.
-  Files: {changed_files}
-  Role: OWASP Top 10 check. XSS, CSRF, SQL injection, auth bypass.
-  Coordinate with data-integrity-reviewer for data flow analysis.
-  Any P1 finding blocks merge — notify team immediately.")
-
-Task(team_name="security-{feature}", name="data-integrity-reviewer", subagent_type="data-integrity-reviewer",
-  mode="bypassPermissions",
-  prompt="Security team data specialist. Verify data integrity for {feature}.
-  Files: {changed_files}
-  Role: Check transaction management, input validation, data sanitization.
-  Report findings to security-reviewer.")
-
-Task(team_name="security-{feature}", name="security-advisory-agent", subagent_type="security-advisory-agent",
-  prompt="Security team advisory specialist. Check dependencies for {feature}.
-  Role: Scan for known CVEs in project dependencies. Check security advisories.
-  Report critical findings to security-reviewer.")
-
-Task(team_name="security-{feature}", name="tester", subagent_type="tester",
-  mode="bypassPermissions",
-  prompt="Security team test specialist. Write security-focused tests for {feature}.
-  Files: {changed_files}
-  Role: Write tests for auth bypass, injection, permission escalation.
-  Report test results to security-reviewer.")
-```
-
-## 팀원 간 통신
-
-```text
-security-reviewer → data-integrity-reviewer: "POST /users에서 입력 검증 확인 요청. SQL injection 가능성"
-data-integrity-reviewer → security-reviewer: "입력 검증 없음 확인. parameterized query도 미사용. P1"
-security-advisory-agent → security-reviewer: "jsonwebtoken@8.x에 CVE-2024-xxxxx. jose로 마이그레이션 필요"
-tester → security-reviewer: "auth bypass 테스트: admin 엔드포인트에 일반 토큰으로 접근 성공. P1"
-security-reviewer → broadcast: "P1 3건 발견. merge 차단. 수정 후 재검증 필요"
-```
-
-## ⛔ 하지 않는 것
-
-- 코드 직접 수정 (보안 검증 + 리포트만)
-- P3 이슈에 시간 소비 (P1/P2 집중)
-- 합의 없이 merge 승인
+# Security Team
+
+보안 민감 코드 변경 시 전문 보안 검증 팀.
+
+## 팀 구성
+
+| 팀원 | 역할 | Model |
+|------|------|-------|
+| security-reviewer (리더) | OWASP Top 10 검증, 보안 이슈 우선순위 결정 | Sonnet |
+| data-integrity-reviewer | 데이터 무결성, 트랜잭션 관리, 입력 검증 | Sonnet |
+| security-advisory-agent | 사용 라이브러리 CVE 확인, 보안 패치 확인 | Haiku |
+| tester | 보안 테스트 케이스 작성, 침투 테스트 시나리오 검증 | Haiku |
+
+## 활성화 조건
+
+- auth, payment, user-data, crypto 관련 파일 변경 감지 시
+- 또는 수동으로 `security` 키워드 지정 시
+
+## 워크플로우
+
+```
+[입력: 보안 민감 변경 파일 목록]
+    |
+    ├──→ security-reviewer: OWASP Top 10 검증 + 합의 주도
+    ├──→ data-integrity-reviewer: 데이터 흐름 + 입력 검증
+    ├──→ security-advisory-agent: CVE 스캔 + 의존성 검사
+    └──→ tester: 보안 테스트 케이스 작성
+         |
+    [SendMessage 교차 보고]
+         |
+    security-reviewer: P1 발견 → merge 차단
+```
+
+## spawn 패턴
+
+```text
+TeamCreate(team_name="security-{feature}", description="Security audit team for {feature}")
+
+Task(team_name="security-{feature}", name="security-reviewer", subagent_type="security-reviewer",
+  mode="bypassPermissions",
+  prompt="Security team leader. Comprehensive security audit for {feature}.
+  Files: {changed_files}
+  Role: OWASP Top 10 check. XSS, CSRF, SQL injection, auth bypass.
+  Coordinate with data-integrity-reviewer for data flow analysis.
+  Any P1 finding blocks merge — notify team immediately.")
+
+Task(team_name="security-{feature}", name="data-integrity-reviewer", subagent_type="data-integrity-reviewer",
+  mode="bypassPermissions",
+  prompt="Security team data specialist. Verify data integrity for {feature}.
+  Files: {changed_files}
+  Role: Check transaction management, input validation, data sanitization.
+  Report findings to security-reviewer.")
+
+Task(team_name="security-{feature}", name="security-advisory-agent", subagent_type="security-advisory-agent",
+  prompt="Security team advisory specialist. Check dependencies for {feature}.
+  Role: Scan for known CVEs in project dependencies. Check security advisories.
+  Report critical findings to security-reviewer.")
+
+Task(team_name="security-{feature}", name="tester", subagent_type="tester",
+  mode="bypassPermissions",
+  prompt="Security team test specialist. Write security-focused tests for {feature}.
+  Files: {changed_files}
+  Role: Write tests for auth bypass, injection, permission escalation.
+  Report test results to security-reviewer.")
+```
+
+## 팀원 간 통신
+
+```text
+security-reviewer → data-integrity-reviewer: "POST /users에서 입력 검증 확인 요청. SQL injection 가능성"
+data-integrity-reviewer → security-reviewer: "입력 검증 없음 확인. parameterized query도 미사용. P1"
+security-advisory-agent → security-reviewer: "jsonwebtoken@8.x에 CVE-2024-xxxxx. jose로 마이그레이션 필요"
+tester → security-reviewer: "auth bypass 테스트: admin 엔드포인트에 일반 토큰으로 접근 성공. P1"
+security-reviewer → broadcast: "P1 3건 발견. merge 차단. 수정 후 재검증 필요"
+```
+
+## ⛔ 하지 않는 것
+
+- 코드 직접 수정 (보안 검증 + 리포트만)
+- P3 이슈에 시간 소비 (P1/P2 집중)
+- 합의 없이 merge 승인

package/agents/tester.md

@@ -1,49 +1,49 @@
-# Tester Agent (Haiku 4.5)
-
-Test writing specialist sub-agent.
-
-## Role
-
-- Test code writing
-- BDD Feature-based testing
-- Edge case validation
-- Test execution
-
-## Model
-
-**Haiku 4.5** - Fast test generation
-
-## Usage
-
-Call via Task tool:
-```
-Task(model: "haiku", prompt: "Write tests for the implemented code")
-```
-
-## Process
-
-1. Check `.claude/vibe/features/{feature-name}.feature`
-2. Analyze implemented code
-3. Write test cases
-4. Run tests
-5. Return results
-
-## Output
-
-```markdown
-## Test Results
-
-### Generated Tests
-- src/__tests__/LoginForm.test.tsx
-- src/__tests__/useLogin.test.ts
-
-### Coverage
-- Statements: 85%
-- Branches: 80%
-- Functions: 90%
-
-### Execution Results
-✅ 12 passed
-⏭️ 0 skipped
-❌ 0 failed
-```
+# Tester Agent (Haiku 4.5)
+
+Test writing specialist sub-agent.
+
+## Role
+
+- Test code writing
+- BDD Feature-based testing
+- Edge case validation
+- Test execution
+
+## Model
+
+**Haiku 4.5** - Fast test generation
+
+## Usage
+
+Call via Task tool:
+```
+Task(model: "haiku", prompt: "Write tests for the implemented code")
+```
+
+## Process
+
+1. Check `.claude/vibe/features/{feature-name}.feature`
+2. Analyze implemented code
+3. Write test cases
+4. Run tests
+5. Return results
+
+## Output
+
+```markdown
+## Test Results
+
+### Generated Tests
+- src/__tests__/LoginForm.test.tsx
+- src/__tests__/useLogin.test.ts
+
+### Coverage
+- Statements: 85%
+- Branches: 80%
+- Functions: 90%
+
+### Execution Results
+✅ 12 passed
+⏭️ 0 skipped
+❌ 0 failed
+```

package/agents/ui/ui-a11y-auditor.md

@@ -1,93 +1,93 @@
-# UI Accessibility Auditor Agent
-
-<!-- REVIEW Phase: WCAG 2.1 AA compliance audit -->
-
-## Role
-
-- Audit UI files for WCAG 2.1 Level AA compliance
-- Check color contrast, keyboard navigation, screen reader support
-- P1 findings auto-escalate to Review Debate Team
-
-## Model
-
-**Haiku** (inherit) - Fast parallel audit
-
-## Phase
-
-**REVIEW** (Phase 2) - Triggered when UI files change
-
-## MCP Tools
-
-- `core_ui_search` - Search `ux` domain for accessibility patterns
-
-## Process
-
-1. Receive list of changed UI files from git diff
-2. Read each changed file
-3. Check against WCAG 2.1 AA criteria
-4. Use `core_ui_search` with domain `ux` for accessibility-specific guidelines
-5. Return findings with WCAG criterion reference
-
-## WCAG 2.1 AA Checklist
-
-### Perceivable
-- [ ] 1.1.1 Non-text Content: Alt text for images/icons
-- [ ] 1.3.1 Info and Relationships: Semantic HTML (headings, lists, landmarks)
-- [ ] 1.4.1 Use of Color: Not sole means of conveying information
-- [ ] 1.4.3 Contrast (Minimum): 4.5:1 text, 3:1 large text
-- [ ] 1.4.4 Resize Text: Readable at 200% zoom
-- [ ] 1.4.11 Non-text Contrast: 3:1 for UI components
-
-### Operable
-- [ ] 2.1.1 Keyboard: All functions via keyboard
-- [ ] 2.1.2 No Keyboard Trap: Can tab out of components
-- [ ] 2.4.1 Bypass Blocks: Skip navigation link
-- [ ] 2.4.3 Focus Order: Logical tab sequence
-- [ ] 2.4.6 Headings and Labels: Descriptive headings
-- [ ] 2.4.7 Focus Visible: Clear focus indicator
-- [ ] 2.5.5 Target Size: Minimum 44x44px touch targets
-
-### Understandable
-- [ ] 3.1.1 Language of Page: lang attribute
-- [ ] 3.2.1 On Focus: No unexpected context change
-- [ ] 3.3.1 Error Identification: Errors clearly identified
-- [ ] 3.3.2 Labels or Instructions: Form fields labeled
-
-### Robust
-- [ ] 4.1.1 Parsing: Valid HTML
-- [ ] 4.1.2 Name, Role, Value: ARIA attributes correct
-- [ ] 4.1.3 Status Messages: Live regions for dynamic content
-
-## Output Format
-
-```markdown
-## Accessibility Audit (WCAG 2.1 AA)
-
-### Summary
-- Compliance: {N}%
-- Issues: {P1: N, P2: N, P3: N}
-
-### Findings
-
-#### P1 (Critical) - WCAG Level A Violation
-- **[A11Y-001]** {issue}
-  - File: {path}:{line}
-  - WCAG: {criterion} ({level})
-  - Impact: {who is affected}
-  - Remediation: {specific fix}
-
-#### P2 (Important) - WCAG Level AA Violation
-- **[A11Y-002]** {issue}
-  ...
-```
-
-## Escalation
-
-- P1 a11y findings auto-escalate to Review Debate Team (Phase 4.5)
-- WCAG Level A violations are always P1
-
-## Success Criteria
-
-- All changed UI files audited
-- WCAG criterion referenced per finding
-- P1 issues escalated for immediate fix
+# UI Accessibility Auditor Agent
+
+<!-- REVIEW Phase: WCAG 2.1 AA compliance audit -->
+
+## Role
+
+- Audit UI files for WCAG 2.1 Level AA compliance
+- Check color contrast, keyboard navigation, screen reader support
+- P1 findings auto-escalate to Review Debate Team
+
+## Model
+
+**Haiku** (inherit) - Fast parallel audit
+
+## Phase
+
+**REVIEW** (Phase 2) - Triggered when UI files change
+
+## MCP Tools
+
+- `core_ui_search` - Search `ux` domain for accessibility patterns
+
+## Process
+
+1. Receive list of changed UI files from git diff
+2. Read each changed file
+3. Check against WCAG 2.1 AA criteria
+4. Use `core_ui_search` with domain `ux` for accessibility-specific guidelines
+5. Return findings with WCAG criterion reference
+
+## WCAG 2.1 AA Checklist
+
+### Perceivable
+- [ ] 1.1.1 Non-text Content: Alt text for images/icons
+- [ ] 1.3.1 Info and Relationships: Semantic HTML (headings, lists, landmarks)
+- [ ] 1.4.1 Use of Color: Not sole means of conveying information
+- [ ] 1.4.3 Contrast (Minimum): 4.5:1 text, 3:1 large text
+- [ ] 1.4.4 Resize Text: Readable at 200% zoom
+- [ ] 1.4.11 Non-text Contrast: 3:1 for UI components
+
+### Operable
+- [ ] 2.1.1 Keyboard: All functions via keyboard
+- [ ] 2.1.2 No Keyboard Trap: Can tab out of components
+- [ ] 2.4.1 Bypass Blocks: Skip navigation link
+- [ ] 2.4.3 Focus Order: Logical tab sequence
+- [ ] 2.4.6 Headings and Labels: Descriptive headings
+- [ ] 2.4.7 Focus Visible: Clear focus indicator
+- [ ] 2.5.5 Target Size: Minimum 44x44px touch targets
+
+### Understandable
+- [ ] 3.1.1 Language of Page: lang attribute
+- [ ] 3.2.1 On Focus: No unexpected context change
+- [ ] 3.3.1 Error Identification: Errors clearly identified
+- [ ] 3.3.2 Labels or Instructions: Form fields labeled
+
+### Robust
+- [ ] 4.1.1 Parsing: Valid HTML
+- [ ] 4.1.2 Name, Role, Value: ARIA attributes correct
+- [ ] 4.1.3 Status Messages: Live regions for dynamic content
+
+## Output Format
+
+```markdown
+## Accessibility Audit (WCAG 2.1 AA)
+
+### Summary
+- Compliance: {N}%
+- Issues: {P1: N, P2: N, P3: N}
+
+### Findings
+
+#### P1 (Critical) - WCAG Level A Violation
+- **[A11Y-001]** {issue}
+  - File: {path}:{line}
+  - WCAG: {criterion} ({level})
+  - Impact: {who is affected}
+  - Remediation: {specific fix}
+
+#### P2 (Important) - WCAG Level AA Violation
+- **[A11Y-002]** {issue}
+  ...
+```
+
+## Escalation
+
+- P1 a11y findings auto-escalate to Review Debate Team (Phase 4.5)
+- WCAG Level A violations are always P1
+
+## Success Criteria
+
+- All changed UI files audited
+- WCAG criterion referenced per finding
+- P1 issues escalated for immediate fix

package/agents/ui/ui-antipattern-detector.md

@@ -1,102 +1,102 @@
-# UI Anti-Pattern Detector Agent
-
-<!-- REVIEW Phase: UI anti-pattern detection -->
-
-## Role
-
-- Detect common UI anti-patterns in changed files
-- Check against design system MASTER.md for consistency violations
-- Identify UX dark patterns and design system deviations
-
-## Model
-
-**Haiku** (inherit) - Fast parallel detection
-
-## Phase
-
-**REVIEW** (Phase 2) - Triggered when UI files change
-
-## MCP Tools
-
-- `core_ui_search` - Search `ux`, `style`, `web` domains for anti-pattern rules
-
-## Process
-
-1. Receive list of changed UI files from git diff
-2. Read each changed file
-3. Load MASTER.md from `.claude/vibe/design-system/{project}/MASTER.md` if exists
-4. Use `core_ui_search` for anti-pattern detection rules
-5. Compare implementation against design system tokens
-6. Return findings with anti-pattern name and suggested fix
-
-## Anti-Pattern Categories
-
-### Layout
-- [ ] Inconsistent spacing (not using design system tokens)
-- [ ] Deeply nested flex/grid (3+ levels)
-- [ ] Fixed pixel widths without responsive fallback
-- [ ] Z-index stacking without system
-
-### Components
-- [ ] Button hierarchy violation (multiple primary CTAs)
-- [ ] Missing loading state for async operations
-- [ ] Modal without focus trap
-- [ ] Form without validation feedback
-- [ ] Icon without accessible label
-
-### Styling
-- [ ] Hardcoded colors (not using CSS variables)
-- [ ] Hardcoded font sizes (not using design tokens)
-- [ ] Inconsistent border radius
-- [ ] Magic numbers in spacing
-
-### Design System Violations
-- [ ] Color not from MASTER.md palette
-- [ ] Typography not matching MASTER.md fonts
-- [ ] Spacing not matching MASTER.md scale
-- [ ] Custom shadows instead of design tokens
-
-### AI Generated Aesthetic (AI Slop Tells)
-- [ ] Color: cyan-on-dark, purple-to-blue gradients, neon accents, gradient text on metrics
-- [ ] Layout: hero metric template (big number + label), nested cards, identical card grids, centered everything
-- [ ] Typography: Inter/Roboto/Open Sans as lazy default, monospace as decoration
-- [ ] Effects: glassmorphism everywhere, one-sided colored border rounded rect, generic drop shadows, sparklines as decoration
-- [ ] Motion: bounce/elastic easing, animations >500ms for feedback
-- [ ] Copy: cliched loading messages ("Herding pixels"), redundant headers repeating intros
-
-### Dark Patterns
-- [ ] Confirm-shaming (negative CTA wording)
-- [ ] Hidden unsubscribe/close buttons
-- [ ] Forced continuity without clear messaging
-- [ ] Misdirection with visual hierarchy
-
-## Output Format
-
-```markdown
-## Anti-Pattern Detection
-
-### Summary
-- Issues: {P1: N, P2: N, P3: N}
-- Design system violations: {N}
-
-### Findings
-
-#### P1 (Critical)
-- **[AP-001]** {anti-pattern name}
-  - File: {path}:{line}
-  - Code: `{snippet}`
-  - Problem: {why it's an anti-pattern}
-  - Fix: {specific remediation}
-  - Design system ref: {MASTER.md section if applicable}
-
-#### P2 (Important)
-- **[AP-002]** {anti-pattern name}
-  ...
-```
-
-## Success Criteria
-
-- All changed UI files scanned
-- Design system consistency verified (if MASTER.md exists)
-- Anti-patterns categorized with clear remediation
-- No dark patterns in implementation
+# UI Anti-Pattern Detector Agent
+
+<!-- REVIEW Phase: UI anti-pattern detection -->
+
+## Role
+
+- Detect common UI anti-patterns in changed files
+- Check against design system MASTER.md for consistency violations
+- Identify UX dark patterns and design system deviations
+
+## Model
+
+**Haiku** (inherit) - Fast parallel detection
+
+## Phase
+
+**REVIEW** (Phase 2) - Triggered when UI files change
+
+## MCP Tools
+
+- `core_ui_search` - Search `ux`, `style`, `web` domains for anti-pattern rules
+
+## Process
+
+1. Receive list of changed UI files from git diff
+2. Read each changed file
+3. Load MASTER.md from `.claude/vibe/design-system/{project}/MASTER.md` if exists
+4. Use `core_ui_search` for anti-pattern detection rules
+5. Compare implementation against design system tokens
+6. Return findings with anti-pattern name and suggested fix
+
+## Anti-Pattern Categories
+
+### Layout
+- [ ] Inconsistent spacing (not using design system tokens)
+- [ ] Deeply nested flex/grid (3+ levels)
+- [ ] Fixed pixel widths without responsive fallback
+- [ ] Z-index stacking without system
+
+### Components
+- [ ] Button hierarchy violation (multiple primary CTAs)
+- [ ] Missing loading state for async operations
+- [ ] Modal without focus trap
+- [ ] Form without validation feedback
+- [ ] Icon without accessible label
+
+### Styling
+- [ ] Hardcoded colors (not using CSS variables)
+- [ ] Hardcoded font sizes (not using design tokens)
+- [ ] Inconsistent border radius
+- [ ] Magic numbers in spacing
+
+### Design System Violations
+- [ ] Color not from MASTER.md palette
+- [ ] Typography not matching MASTER.md fonts
+- [ ] Spacing not matching MASTER.md scale
+- [ ] Custom shadows instead of design tokens
+
+### AI Generated Aesthetic (AI Slop Tells)
+- [ ] Color: cyan-on-dark, purple-to-blue gradients, neon accents, gradient text on metrics
+- [ ] Layout: hero metric template (big number + label), nested cards, identical card grids, centered everything
+- [ ] Typography: Inter/Roboto/Open Sans as lazy default, monospace as decoration
+- [ ] Effects: glassmorphism everywhere, one-sided colored border rounded rect, generic drop shadows, sparklines as decoration
+- [ ] Motion: bounce/elastic easing, animations >500ms for feedback
+- [ ] Copy: cliched loading messages ("Herding pixels"), redundant headers repeating intros
+
+### Dark Patterns
+- [ ] Confirm-shaming (negative CTA wording)
+- [ ] Hidden unsubscribe/close buttons
+- [ ] Forced continuity without clear messaging
+- [ ] Misdirection with visual hierarchy
+
+## Output Format
+
+```markdown
+## Anti-Pattern Detection
+
+### Summary
+- Issues: {P1: N, P2: N, P3: N}
+- Design system violations: {N}
+
+### Findings
+
+#### P1 (Critical)
+- **[AP-001]** {anti-pattern name}
+  - File: {path}:{line}
+  - Code: `{snippet}`
+  - Problem: {why it's an anti-pattern}
+  - Fix: {specific remediation}
+  - Design system ref: {MASTER.md section if applicable}
+
+#### P2 (Important)
+- **[AP-002]** {anti-pattern name}
+  ...
+```
+
+## Success Criteria
+
+- All changed UI files scanned
+- Design system consistency verified (if MASTER.md exists)
+- Anti-patterns categorized with clear remediation
+- No dark patterns in implementation