@ui8kit/uxdx 0.1.0

package/packages/sdlc/harness/core/sdlc.sh

@@ -0,0 +1,230 @@
+#!/usr/bin/env bash
+# Run from a product repo after this pack is copied to .sdlc/
+#   .sdlc/sdlc.sh install
+#   .sdlc/sdlc.sh start <slug>
+#   .sdlc/sdlc.sh status
+set -euo pipefail
+
+SDLC_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+REPO_ROOT="$(CDPATH= cd -- "$SDLC_DIR/.." && pwd)"
+MANIFEST="$SDLC_DIR/manifest.yaml"
+BEGIN='<!-- sdlc-harness:begin -->'
+END='<!-- sdlc-harness:end -->'
+
+die() { printf 'sdlc: %s\n' "$*" >&2; exit 1; }
+
+need_manifest() {
+  [[ -f "$MANIFEST" ]] || die "missing $MANIFEST (copy a harness pack into .sdlc/)"
+}
+
+level() {
+  awk '/^level:[[:space:]]/ { print $2; exit }' "$MANIFEST"
+}
+
+warn_location() {
+  local base
+  base="$(basename -- "$SDLC_DIR")"
+  if [[ "$base" != ".sdlc" ]]; then
+    printf 'sdlc: warning: script dir is %s (expected .sdlc in a product repo)\n' "$SDLC_DIR" >&2
+  fi
+}
+
+usage() {
+  cat <<EOF
+Usage: .sdlc/sdlc.sh <command>
+
+  install              Overlay Cursor rules/skills; merge AGENTS.md at repo root
+  start <slug> [opts]  Copy templates into .sdlc/changes/<slug>/
+  status               Show level, overlay, and changes
+
+start options:
+  --force              Overwrite files that already exist in the change folder
+  --intent             Also copy intent.md (light/core; full always copies it)
+  --spec               Also copy spec.md (light; core/full as below)
+  --boundary           core: copy intent.md + spec.md + plan.md
+
+Repo root is the parent of this .sdlc directory:
+  $REPO_ROOT
+EOF
+}
+
+copy_rules() {
+  local src="$SDLC_DIR/cursor/rules" dest="$REPO_ROOT/.cursor/rules" f
+  [[ -d "$src" ]] || die "missing $src"
+  mkdir -p "$dest"
+  shopt -s nullglob
+  for f in "$src"/*.mdc; do
+    cp -- "$f" "$dest/"
+    printf 'sdlc: rule %s\n' "$dest/$(basename -- "$f")"
+  done
+  shopt -u nullglob
+}
+
+copy_skills() {
+  local src="$SDLC_DIR/skills" dest="$REPO_ROOT/.cursor/skills" d name
+  [[ -d "$src" ]] || die "missing $src"
+  mkdir -p "$dest"
+  shopt -s nullglob
+  for d in "$src"/*/; do
+    name="$(basename -- "$d")"
+    rm -rf -- "$dest/$name"
+    cp -R -- "$d" "$dest/$name"
+    printf 'sdlc: skill %s\n' "$dest/$name"
+  done
+  shopt -u nullglob
+}
+
+merge_agents() {
+  local overlay="$SDLC_DIR/AGENTS.md" dest="$REPO_ROOT/AGENTS.md" tmp
+  [[ -f "$overlay" ]] || die "missing $overlay"
+  if [[ ! -f "$dest" ]]; then
+    cp -- "$overlay" "$dest"
+    printf 'sdlc: created %s\n' "$dest"
+    return
+  fi
+  tmp="$(mktemp)"
+  if grep -F -q -- "$BEGIN" "$dest"; then
+    awk -v begin="$BEGIN" -v end="$END" -v overlay="$overlay" '
+      BEGIN {
+        while ((getline line < overlay) > 0) { o = o line "\n" }
+        close(overlay)
+      }
+      index($0, begin) == 1 {
+        printf "%s", o
+        skip = 1
+        next
+      }
+      skip {
+        if (index($0, end) == 1) skip = 0
+        next
+      }
+      { print }
+    ' "$dest" >"$tmp"
+  else
+    cat -- "$dest" >"$tmp"
+    printf '\n' >>"$tmp"
+    cat -- "$overlay" >>"$tmp"
+  fi
+  mv -- "$tmp" "$dest"
+  printf 'sdlc: merged overlay into %s\n' "$dest"
+}
+
+cmd_install() {
+  need_manifest
+  warn_location
+  copy_rules
+  copy_skills
+  merge_agents
+  printf 'sdlc: install done (level %s) repo %s\n' "$(level)" "$REPO_ROOT"
+}
+
+valid_slug() {
+  [[ "$1" =~ ^[a-z0-9][a-z0-9-]*$ ]] || die "slug must be kebab-case: $1"
+}
+
+copy_template() {
+  local src="$SDLC_DIR/$1" dest="$2/$1"
+  [[ -f "$src" ]] || die "missing template $src"
+  if [[ -e "$dest" && "$FORCE" -eq 0 ]]; then
+    printf 'sdlc: skip existing %s (use --force)\n' "$dest"
+    return
+  fi
+  cp -- "$src" "$dest"
+  printf 'sdlc: %s\n' "$dest"
+}
+
+cmd_start() {
+  need_manifest
+  warn_location
+  local slug="" with_intent=0 with_spec=0 boundary=0
+  FORCE=0
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --force) FORCE=1; shift ;;
+      --intent) with_intent=1; shift ;;
+      --spec) with_spec=1; shift ;;
+      --boundary) boundary=1; shift ;;
+      --help|-h) usage; exit 0 ;;
+      -*) die "unknown option $1" ;;
+      *)
+        [[ -z "$slug" ]] || die "unexpected argument $1"
+        slug="$1"
+        shift
+        ;;
+    esac
+  done
+  [[ -n "$slug" ]] || die "start requires <slug>"
+  valid_slug "$slug"
+
+  local lvl dest
+  lvl="$(level)"
+  dest="$SDLC_DIR/changes/$slug"
+  mkdir -p "$dest"
+
+  case "$lvl" in
+    light)
+      copy_template plan.md "$dest"
+      [[ "$with_intent" -eq 1 ]] && copy_template intent.md "$dest"
+      [[ "$with_spec" -eq 1 ]] && copy_template spec.md "$dest"
+      ;;
+    core)
+      copy_template plan.md "$dest"
+      if [[ "$boundary" -eq 1 || "$with_intent" -eq 1 || "$with_spec" -eq 1 ]]; then
+        copy_template intent.md "$dest"
+        copy_template spec.md "$dest"
+      fi
+      ;;
+    full)
+      copy_template intent.md "$dest"
+      copy_template spec.md "$dest"
+      copy_template plan.md "$dest"
+      ;;
+    *)
+      die "unknown level in manifest: $lvl"
+      ;;
+  esac
+  printf 'sdlc: change %s ready under %s\n' "$slug" "$dest"
+}
+
+cmd_status() {
+  need_manifest
+  warn_location
+  local lvl
+  lvl="$(level)"
+  printf 'level:     %s\n' "$lvl"
+  printf 'sdlc dir:  %s\n' "$SDLC_DIR"
+  printf 'repo:      %s\n' "$REPO_ROOT"
+  if [[ -f "$REPO_ROOT/AGENTS.md" ]] && grep -F -q -- "$BEGIN" "$REPO_ROOT/AGENTS.md"; then
+    printf 'AGENTS.md: overlay present\n'
+  else
+    printf 'AGENTS.md: overlay missing (run install)\n'
+  fi
+  if [[ -d "$REPO_ROOT/.cursor/rules" ]]; then
+    printf 'rules:\n'
+    ls -1 "$REPO_ROOT/.cursor/rules"/sdlc-*.mdc 2>/dev/null || printf '  (no sdlc-*.mdc)\n'
+  fi
+  printf 'changes:\n'
+  if [[ -d "$SDLC_DIR/changes" ]]; then
+    local d
+    shopt -s nullglob
+    for d in "$SDLC_DIR/changes"/*/; do
+      printf '  %s\n' "$(basename -- "$d")"
+    done
+    shopt -u nullglob
+  fi
+}
+
+main() {
+  local cmd="${1:-}"
+  [[ -n "$cmd" ]] || { usage; exit 1; }
+  shift || true
+  case "$cmd" in
+    install) cmd_install "$@" ;;
+    start) cmd_start "$@" ;;
+    status) cmd_status "$@" ;;
+    -h|--help|help) usage ;;
+    *) die "unknown command $cmd" ;;
+  esac
+}
+
+main "$@"

package/packages/sdlc/harness/core/skills/sdlc-invariants/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: sdlc-invariants
+description: >-
+  Enforce shared-module invariants for core SDLC harness. Use when editing a
+  kernel, form library, ARIA contract, or other pinned dependency. Block
+  product IA, second APIs, and hand-edits of generated code.
+---
+
+# Core invariants
+
+Apply whenever creating or changing a public surface in this repository.
+
+1. Consumers pin this module. Do not add site-specific kinds, carts, or CMS
+   schemas so a product can ship a page.
+2. Do not invent a parallel REST or GraphQL content contract.
+3. Do not hand-edit generated sources if the repo marks them generated.
+4. If a policy must always hold, prefer a test or hook over a comment in
+   `plan.md`.
+5. Record the invariant in `.sdlc/changes/<slug>/spec.md` when the contract
+   itself changes.

package/packages/sdlc/harness/core/skills/sdlc-plan/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: sdlc-plan
+description: >-
+  Write and follow plan.md for core SDLC. Use at the start of implementation
+  in a repo with .sdlc/manifest.yaml level core. Interview risks and callers
+  before editing.
+---
+
+# Plan mode (core)
+
+1. Read `intent.md` / `spec.md` in `.sdlc/changes/<slug>/` if they exist.
+2. Produce `plan.md`: files, order, proof commands, blast radius, rollback.
+3. Do not edit product files until a human accepts the plan (or the change is
+   a documented one-line fix).
+4. If implementation diverges, update `plan.md` in the same commit.

package/packages/sdlc/harness/core/spec.md

@@ -0,0 +1,24 @@
+# Spec (core — compressed)
+
+Intent: `.sdlc/changes/<slug>/intent.md`
+
+This is not a product design session. Record the contract so a later `plan.md`
+and PR review can check it.
+
+## Requirements
+
+-
+
+## Non-requirements
+
+What this library will not absorb from a consumer.
+
+## Concerns
+
+Flag contradictions with published API, ARIA, or kernel boundaries. A human
+resolves each flag before implementation.
+
+## Compatibility
+
+Callers / pins that must not break:
+-

package/packages/sdlc/harness/core/start.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -euo pipefail
+exec "$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)/sdlc.sh" start "$@"

package/packages/sdlc/harness/full/AGENTS.md

@@ -0,0 +1,15 @@
+<!-- sdlc-harness:begin -->
+## SDLC harness (full)
+
+This repo uses the **full** pack (`.harness-sdlc/full` → `.sdlc/`).
+
+Loop: accepted `intent.md` → `spec.md` → `plan.md` → diff + existing verify
+→ PR against `.sdlc/REVIEW.md` → you merge. Optional later: `evals/` on
+harness-file changes, `bands.yaml` only if metrics already exist.
+
+- Skills: `sdlc-loop`, `sdlc-feedback`, `sdlc-review`. Rule: `sdlc-full.mdc`.
+- Start non-trivial sessions in plan mode. Auto-apply edits only after the
+  plan is accepted and tests exist for the blast radius.
+- Do not replace this overlay with a second product contract. Stack rules win.
+- Production deploy stays a human gate (release owner / existing runbooks).
+<!-- sdlc-harness:end -->

package/packages/sdlc/harness/full/README.md

@@ -0,0 +1,23 @@
+# Full harness
+
+For the portable Codex path and high-stakes operators.
+Examples: SiteStarter, GoBackend, SvelteCMS, YPanel.
+
+Copy this directory to `<repo>/.sdlc/`. Overlay Cursor files — `../README.md`.
+
+Solo adaptation: no MDM, no weekly committee. You still accept `spec.md` and
+`plan.md`, merge PRs, and authorize production.
+
+## Loop
+
+1. `intent.md` — originator + agent; you correct and commit.
+2. `spec.md` — requirements and design in one pass; flagged concerns first.
+3. `plan.md` — plan mode; implement only after you accept.
+4. Feedback loop — repo verify commands before "done".
+5. PR — `.sdlc/REVIEW.md`; you approve.
+6. Maintain — `bands.yaml` is a stub. Fill it only if this repo already has
+   metrics; do not invent an on-call agent.
+
+## Per change
+
+`mkdir -p .sdlc/changes/<slug>` and copy `intent.md`, `spec.md`, `plan.md`.

package/packages/sdlc/harness/full/REVIEW.md

@@ -0,0 +1,19 @@
+# Review instructions (full)
+
+## Passes
+
+Run three passes and tag each finding:
+
+- Bugs: logic errors, broken edge cases, subtle regressions
+- Security: injection, auth gaps, PII in logs, CSRF/session mistakes
+- Compliance: the change matches `spec.md`, `plan.md`, and this repo's
+  `AGENTS.md` / `.project/` ADRs
+
+## Important vs nit
+
+Important: would break behaviour, leak data, or breach a documented policy.
+Style and naming are nits. At most five nits; summarize the rest as a count.
+
+## Do not report
+
+Generated files the repo forbids editing, and anything CI already enforces.

package/packages/sdlc/harness/full/bands.yaml

@@ -0,0 +1,13 @@
+# Control bands stub. Fill only if this repo already has a queryable metric.
+# Do not invent a headless on-call agent.
+metric: ci_test_failure_rate
+baseline: rolling_30d
+rules: western_electric
+tiers:
+  1sigma:
+    action: log
+  2sigma:
+    action: diagnose
+  3sigma:
+    action: propose
+    routes: [pull_request]

package/packages/sdlc/harness/full/changes/README.md

@@ -0,0 +1,4 @@
+# changes/
+
+Copy `../intent.md`, `../spec.md`, and `../plan.md` into `./<slug>/` and fill
+them. Commit the folder with the implementation diff.

package/packages/sdlc/harness/full/cursor/rules/sdlc-full.mdc

@@ -0,0 +1,17 @@
+---
+description: Full SDLC — intent, spec, plan, verify, human merge
+alwaysApply: true
+---
+
+# Full SDLC overlay
+
+This repository opted into `.sdlc` harness **full**.
+
+- One change = `.sdlc/changes/<slug>/{intent,spec,plan}.md`.
+- Plan mode before large edits. Feedback loop = existing repo verify commands.
+- Review policy: `.sdlc/REVIEW.md`. Production stays a human gate.
+- `evals/` and `bands.yaml` are stubs until this repo already has CI/metrics.
+- Skills: `sdlc-loop`, `sdlc-feedback`, `sdlc-review`.
+- Product `AGENTS.md`, `.project/`, and stack-contract win on conflict.
+- Do not invent a second content API, product CMS schema, or local module
+  replace to ship a site.

package/packages/sdlc/harness/full/evals/README.md

@@ -0,0 +1,16 @@
+# Agent evals (stub)
+
+When this repo's agent config (`AGENTS.md`, `.sdlc`, `.cursor/rules`, skills)
+changes, add 20–50 real tasks here later. Each eval is a prompt plus checks
+(tests pass, lint clean, policy followed).
+
+Do not add a second CI framework. Prefer the existing GitHub Actions /
+`make verify` job, gated on paths:
+
+- `AGENTS.md`
+- `.sdlc/**`
+- `.cursor/rules/**`
+- `.cursor/skills/**`
+
+A production incident becomes a permanent eval in this folder, owned by the
+person who closed the incident.

package/packages/sdlc/harness/full/hooks/README.md

@@ -0,0 +1,17 @@
+# Hooks (notes, not a runtime)
+
+Solo default: rely on existing tests and PR review.
+
+Add deterministic hooks later if you run Claude Code / Cursor hooks in this
+repo, for example:
+
+- Block edits to generated or frozen paths
+- Block secret files (`.env`, `**/secrets/**`)
+- Ask a human before production deploy commands
+
+Keep approval prompts off the build hot path so parallel sessions are not
+serialized. Production gates belong at deploy, not on every file save.
+
+Example PreToolUse shape lives in the playbook
+(`.manual/sdlc-en/10-hooks-as-approval-gates.md`). Do not enable managed-only
+enterprise settings unless you actually operate MDM.

package/packages/sdlc/harness/full/install.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -euo pipefail
+exec "$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)/sdlc.sh" install "$@"

package/packages/sdlc/harness/full/intent.md

@@ -0,0 +1,26 @@
+# Intent: <!-- short title -->
+
+Author: <!-- name / role -->
+Status: draft
+Slug: <!-- kebab-case, matches .sdlc/changes/<slug>/ -->
+
+## Problem
+
+What cannot be done today. Who is affected.
+
+## Proposed outcome
+
+What better looks like. Observable, not a slogan.
+
+## Affected users and systems
+
+People, processes, and repos that change or must stay pinned.
+
+## Constraints
+
+- Existing product `AGENTS.md` and `.project/` (if any) stay authoritative.
+- No second content REST, no storefront-owned CMS SoT, no local `replace` of
+  portable modules to ship a site.
+- Secrets stay out of `cms/` and `content/`.
+
+## Open questions

package/packages/sdlc/harness/full/manifest.yaml

@@ -0,0 +1,17 @@
+level: full
+version: 1
+copy_to: .sdlc
+cursor:
+  rules: cursor/rules
+  skills: skills
+agents_md:
+  overlay: AGENTS.md
+  merge_markers:
+    begin: "<!-- sdlc-harness:begin -->"
+    end: "<!-- sdlc-harness:end -->"
+artifacts:
+  required: [intent.md, spec.md, plan.md]
+review: REVIEW.md
+evals: evals/
+hooks: hooks/
+maintain: bands.yaml

package/packages/sdlc/harness/full/plan.md

@@ -0,0 +1,30 @@
+# Plan: <!-- title -->
+
+From: `.sdlc/changes/<slug>/spec.md` (intent <!-- date or slug -->)
+Status: draft
+
+## Files that change
+
+-
+
+## Order of work
+
+1.
+2.
+3.
+
+## Risks
+
+What could break. Highest-risk step. Options considered and rejected.
+
+## Proof
+
+- Commands (from repo `AGENTS.md`): 
+- Tests or screenshots that match the spec:
+
+An engineer who never saw the chat must be able to implement from this file
+alone.
+
+## Divergence
+
+If implementation leaves this plan, update this file in the same commit.