@zachjxyz/jvn 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Zach J
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,136 @@
+# jvn
+
+Spec-driven development with Claude Code.
+
+Named after **John von Neumann** — the man who wrote the spec that defined computing.
+
+## Quick Start
+
+```bash
+cd my-project
+npx jvn
+```
+
+That's it. Then:
+
+```bash
+claude
+/spec "what you want to build"
+```
+
+## What it does
+
+`jvn` sets up spec-driven development in any project:
+
+1. Installs 18 curated skills globally (Neon, React, Better Auth, TDD, and more)
+2. Initializes [GitHub Spec-Kit](https://github.com/github/spec-kit) with Claude Code integration
+3. Pre-configures a project constitution with engineering best practices
+4. Adds 5 specialized agents and 5 workflow commands
+
+## Commands
+
+After setup, open `claude` and use:
+
+| Command | What it does |
+|---------|-------------|
+| `/spec "feature"` | Describe what you want to build. Creates a rich specification with product, UX, and technical considerations. |
+| `/design` | Create the technical plan. Architecture review and constitutional validation included. |
+| `/build` | Build it phase by phase. TDD enforced, tests run, code reviewed, your approval required at every gate. |
+| `/report` | Analyze the project — tech stack, routes, SWOT analysis. Generates a timestamped report. |
+| `/report-fix @latest` | Systematically fix issues from the most recent report. |
+
+Flow: `/spec` → `/design` → `/build`
+
+## CLI Flags
+
+```bash
+jvn                              # Set up spec-driven dev
+jvn --dry-run                    # Preview what would happen
+jvn --force                      # Overwrite existing files
+jvn --skip-skills                # Skip skill installation
+jvn --skip-speckit               # Skip Spec-Kit init
+jvn --report                     # Generate project report
+jvn --report-fix @latest         # Fix issues from latest report
+jvn --report-fix report-030626   # Fix issues from specific report
+jvn --version                    # Print version
+jvn --help                       # Print help
+```
+
+## What Gets Installed
+
+### Skills (18)
+
+| Skill | Source | Category |
+|-------|--------|----------|
+| Neon Postgres | neondatabase/agent-skills | Database |
+| Better Auth | better-auth/skills | Auth |
+| React Best Practices | vercel-labs/agent-skills | Frontend |
+| Composition Patterns | vercel-labs/agent-skills | Frontend |
+| Frontend Design | anthropics/skills | Design |
+| Web Design Guidelines | vercel-labs/agent-skills | Design |
+| API Design | wshobson/agents | API |
+| Webapp Testing | anthropics/skills | Testing |
+| Test-Driven Development | obra/superpowers | Testing |
+| Dogfood QA | vercel-labs/agent-browser | QA |
+| MCP Builder | anthropics/skills | Tools |
+| Doc Coauthoring | anthropics/skills | Docs |
+| PDF | anthropics/skills | Docs |
+| DOCX | anthropics/skills | Docs |
+| Resend Email | resend/resend-skills | Email |
+| Skill Creator | anthropics/skills | Meta |
+| Find Skills | vercel-labs/skills | Meta |
+| Git Commit | github/awesome-copilot | Git |
+
+### Agents (5)
+
+| Agent | Model | Role |
+|-------|-------|------|
+| architect | opus | System design, data modeling, API contracts |
+| product-manager | sonnet | User stories, acceptance criteria, scope |
+| ux-designer | sonnet | User flows, states, accessibility |
+| code-reviewer | sonnet | Correctness, TDD enforcement, security |
+| constitutional-validator | opus | Constitution compliance gate |
+
+## Architecture
+
+```
+/spec → /design → /build
+  │        │         │
+  │        │         ├── speckit-implement (code generation, TDD)
+  │        │         ├── webapp-testing (Playwright validation)
+  │        │         ├── code-reviewer agent (TDD + checklist)
+  │        │         ├── user validation gate (your approval)
+  │        │         └── dogfood (final QA exploration)
+  │        │
+  │        ├── speckit-plan (base plan)
+  │        ├── architect agent (review)
+  │        ├── constitutional-validator agent (gate)
+  │        └── speckit-tasks (task breakdown)
+  │
+  ├── speckit-specify (base spec)
+  ├── product-manager agent (enrichment)
+  └── ux-designer agent (UX brief)
+```
+
+## Default Stack
+
+- **Next.js** (App Router) on Vercel
+- **Neon Postgres** via Drizzle ORM
+- **Better Auth** with Drizzle adapter
+- **Tailwind CSS**
+
+The constitution and stack knowledge are pre-configured for this stack. To customize:
+
+1. Edit `CLAUDE.md` — uncomment the Stack Override section
+2. Edit `.specify/memory/constitution.md` — update Stack Principles
+3. Edit `.claude/skills/stack-knowledge/SKILL.md` — update patterns
+
+## Prerequisites
+
+- [Node.js](https://nodejs.org) 18+
+- [Claude Code](https://claude.ai/code)
+- [GitHub Spec-Kit](https://github.com/github/spec-kit) (`pipx install specify-cli`)
+
+## License
+
+MIT

package/bin/jvn.mjs

@@ -0,0 +1,403 @@
+#!/usr/bin/env node
+
+import { execSync, spawn } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { platform, homedir } from 'node:os';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const PKG_ROOT = resolve(__dirname, '..');
+const TEMPLATE_DIR = join(PKG_ROOT, 'template');
+const VERSION = JSON.parse(readFileSync(join(PKG_ROOT, 'package.json'), 'utf8')).version;
+
+// ── Formatting ──────────────────────────────
+
+const BOLD = '\x1b[1m';
+const DIM = '\x1b[2m';
+const GREEN = '\x1b[32m';
+const RED = '\x1b[31m';
+const YELLOW = '\x1b[33m';
+const RESET = '\x1b[0m';
+
+const header = (msg) => console.log(`\n${BOLD}${msg}${RESET}`);
+const ok = (msg) => console.log(`  ${GREEN}✓${RESET} ${msg}`);
+const warn = (msg) => console.log(`  ${YELLOW}!${RESET} ${msg}`);
+const fail = (msg) => { console.log(`  ${RED}✗${RESET} ${msg}`); process.exit(1); };
+const info = (msg) => console.log(`  ${DIM}${msg}${RESET}`);
+
+// ── Skill Manifest ──────────────────────────
+
+const SKILLS = [
+  { name: 'neon-postgres', source: 'neondatabase/agent-skills@neon-postgres', label: 'Neon Postgres' },
+  { name: 'better-auth-best-practices', source: 'better-auth/skills@better-auth-best-practices', label: 'Better Auth' },
+  { name: 'vercel-react-best-practices', source: 'vercel-labs/agent-skills@vercel-react-best-practices', label: 'React Best Practices' },
+  { name: 'vercel-composition-patterns', source: 'vercel-labs/agent-skills@vercel-composition-patterns', label: 'Composition Patterns' },
+  { name: 'frontend-design', source: 'anthropics/skills@frontend-design', label: 'Frontend Design' },
+  { name: 'web-design-guidelines', source: 'vercel-labs/agent-skills@web-design-guidelines', label: 'Web Design Guidelines' },
+  { name: 'api-design-principles', source: 'wshobson/agents@api-design-principles', label: 'API Design' },
+  { name: 'webapp-testing', source: 'anthropics/skills@webapp-testing', label: 'Webapp Testing' },
+  { name: 'mcp-builder', source: 'anthropics/skills@mcp-builder', label: 'MCP Builder' },
+  { name: 'doc-coauthoring', source: 'anthropics/skills@doc-coauthoring', label: 'Doc Coauthoring' },
+  { name: 'pdf', source: 'anthropics/skills@pdf', label: 'PDF' },
+  { name: 'docx', source: 'anthropics/skills@docx', label: 'DOCX' },
+  { name: 'resend', source: 'resend/resend-skills@resend', label: 'Resend Email' },
+  { name: 'skill-creator', source: 'anthropics/skills@skill-creator', label: 'Skill Creator' },
+  { name: 'find-skills', source: 'vercel-labs/skills@find-skills', label: 'Find Skills' },
+  { name: 'git-commit', source: 'github/awesome-copilot@git-commit', label: 'Git Commit' },
+  { name: 'test-driven-development', source: 'obra/superpowers@test-driven-development', label: 'Test-Driven Development' },
+  { name: 'dogfood', source: 'vercel-labs/agent-browser@dogfood', label: 'Dogfood QA' },
+];
+
+// ── Dotfile Rename Map ──────────────────────
+
+const RENAME_MAP = {
+  'dot-gitignore': '.gitignore',
+  'dot-gitignore-root': '.gitignore',
+  'dot-mcp.json': '.mcp.json',
+};
+
+// ── Utilities ───────────────────────────────
+
+function commandExists(cmd) {
+  try {
+    execSync(`command -v ${cmd}`, { stdio: 'ignore' });
+    return true;
+  } catch {
+    // Windows fallback
+    try {
+      execSync(`where ${cmd}`, { stdio: 'ignore' });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
+
+function claudeExists() {
+  if (commandExists('claude')) return true;
+  const localPath = join(homedir(), '.claude', 'local', 'claude');
+  return existsSync(localPath);
+}
+
+function specifyCmd() {
+  if (commandExists('specify')) return 'specify';
+  const localPath = join(homedir(), '.local', 'bin', 'specify');
+  if (existsSync(localPath)) return localPath;
+  return null;
+}
+
+function skillInstalled(name) {
+  const skillDir = join(homedir(), '.claude', 'skills', name);
+  return existsSync(skillDir);
+}
+
+function copyDirRecursive(src, dest, { force = false, dryRun = false } = {}) {
+  let copied = 0;
+  let skipped = 0;
+
+  for (const entry of readdirSync(src, { withFileTypes: true })) {
+    const srcPath = join(src, entry.name);
+    const destName = RENAME_MAP[entry.name] || entry.name;
+    const destPath = join(dest, destName);
+
+    if (entry.isDirectory()) {
+      if (!dryRun) mkdirSync(destPath, { recursive: true });
+      const sub = copyDirRecursive(srcPath, destPath, { force, dryRun });
+      copied += sub.copied;
+      skipped += sub.skipped;
+    } else {
+      if (existsSync(destPath) && !force) {
+        skipped++;
+        if (dryRun) info(`  skip: ${destPath} (exists)`);
+      } else {
+        copied++;
+        if (dryRun) {
+          info(`  copy: ${destPath}`);
+        } else {
+          mkdirSync(dirname(destPath), { recursive: true });
+          cpSync(srcPath, destPath);
+        }
+      }
+    }
+  }
+
+  return { copied, skipped };
+}
+
+// ── Commands ────────────────────────────────
+
+function printHelp() {
+  console.log(`
+${BOLD}jvn${RESET} — Spec-driven development with Claude Code
+Named after John von Neumann, who wrote the spec that defined computing.
+
+${BOLD}Usage:${RESET}
+  jvn                          Set up spec-driven dev in current directory
+  jvn --dry-run                Show what would happen without doing anything
+  jvn --report                 Generate a project analysis report
+  jvn --report-fix <id>        Fix issues from a report (@latest or report-MMDDyy-HHmmss)
+
+${BOLD}Setup flags:${RESET}
+  --force                      Overwrite existing files (default: skip)
+  --skip-skills                Skip skill installation
+  --skip-speckit               Skip Spec-Kit initialization
+
+${BOLD}Info:${RESET}
+  --version, -v                Print version
+  --help, -h                   Print this help
+
+${BOLD}After setup:${RESET}
+  claude                       Start Claude Code, then:
+    /spec "feature"            Describe what you want to build
+    /design                    Create the technical plan
+    /build                     Implement it phase by phase
+`);
+}
+
+function printVersion() {
+  console.log(`jvn v${VERSION}`);
+}
+
+async function runSetup({ dryRun = false, force = false, skipSkills = false, skipSpeckit = false } = {}) {
+  console.log('');
+  console.log(`${BOLD} jvn${RESET}${DIM} — John von Neumann${RESET}`);
+  console.log('─────────────────────────────────────────────');
+
+  if (dryRun) {
+    console.log(`${YELLOW}  DRY RUN — no changes will be made${RESET}`);
+  }
+
+  // ── Prerequisites ───────────────────────
+
+  header('Checking prerequisites...');
+
+  if (!commandExists('node')) fail('Node.js not found. Install from https://nodejs.org');
+  if (!dryRun) ok(`Node.js found (${process.version})`);
+  else info(`Node.js found (${process.version})`);
+
+  if (!commandExists('npx')) fail('npx not found. Comes with Node.js');
+  if (!dryRun) ok('npx available');
+  else info('npx available');
+
+  if (!claudeExists()) fail('Claude Code not found. Install: npm install -g @anthropic-ai/claude-code');
+  if (!dryRun) ok('Claude Code found');
+  else info('Claude Code found');
+
+  const specify = specifyCmd();
+  if (!specify) fail('Spec-Kit not found. Install: pipx install specify-cli');
+  if (!dryRun) ok('Spec-Kit (specify) found');
+  else info('Spec-Kit (specify) found');
+
+  // ── Copy Template ──────────────────────
+
+  header('Copying template files...');
+
+  const { copied, skipped } = copyDirRecursive(TEMPLATE_DIR, process.cwd(), { force, dryRun });
+
+  if (!dryRun) {
+    ok(`Copied ${copied} files (skipped ${skipped} existing)`);
+  } else {
+    info(`Would copy ${copied} files (skip ${skipped} existing)`);
+  }
+
+  // ── Install Skills ─────────────────────
+
+  if (!skipSkills) {
+    header('Installing required skills...');
+
+    let installed = 0;
+    let skillsSkipped = 0;
+
+    for (const skill of SKILLS) {
+      if (skillInstalled(skill.name)) {
+        skillsSkipped++;
+        continue;
+      }
+
+      if (dryRun) {
+        info(`Would install: ${skill.label} (${skill.source})`);
+        installed++;
+        continue;
+      }
+
+      const label = skill.label.padEnd(40);
+      process.stdout.write(`  ↓ ${label}`);
+      try {
+        execSync(`npx skills add ${skill.source} -g -y`, { stdio: 'ignore' });
+        console.log(` ${GREEN}✓${RESET}`);
+        installed++;
+      } catch {
+        console.log(` ${RED}✗${RESET}`);
+        warn(`Failed to install ${skill.name}. Run manually: npx skills add ${skill.source} -g -y`);
+      }
+    }
+
+    if (!dryRun) ok(`Installed ${installed} skills (skipped ${skillsSkipped} already installed)`);
+    else info(`Would install ${installed} skills (skip ${skillsSkipped} already installed)`);
+  }
+
+  // ── Spec-Kit ───────────────────────────
+
+  if (!skipSpeckit) {
+    header('Setting up Spec-Kit...');
+
+    const scriptType = platform() === 'win32' ? 'ps' : 'sh';
+    const cmd = `${specify} init --here --ai claude --ai-skills --script ${scriptType} --force --no-git`;
+
+    if (dryRun) {
+      info(`Would run: ${cmd}`);
+    } else {
+      try {
+        execSync(cmd, { stdio: 'ignore' });
+        ok('Spec-Kit initialized (9 workflow skills added)');
+      } catch {
+        warn('Spec-Kit init had issues. You may need to run it manually.');
+      }
+    }
+  }
+
+  // ── Constitution ───────────────────────
+
+  header('Configuring constitution...');
+
+  const constitutionLocal = join(process.cwd(), 'constitution.md');
+  const constitutionTemplate = join(TEMPLATE_DIR, 'constitution.md');
+  const constitutionSrc = existsSync(constitutionLocal) ? constitutionLocal : constitutionTemplate;
+  const constitutionDst = join(process.cwd(), '.specify', 'memory', 'constitution.md');
+
+  if (existsSync(constitutionSrc)) {
+    if (dryRun) {
+      info(`Would install constitution at .specify/memory/constitution.md`);
+    } else {
+      mkdirSync(dirname(constitutionDst), { recursive: true });
+      cpSync(constitutionSrc, constitutionDst);
+      ok(`Constitution installed at .specify/memory/constitution.md`);
+    }
+  } else {
+    warn('constitution.md not found. Skipping.');
+  }
+
+  // ── Git Init ───────────────────────────
+
+  header('Initializing git...');
+
+  if (dryRun) {
+    info('Would initialize fresh git repository');
+  } else {
+    if (!existsSync(join(process.cwd(), '.git'))) {
+      try {
+        execSync('git init -q', { stdio: 'ignore' });
+        ok('Fresh repository initialized');
+      } catch {
+        warn('Git init failed. Initialize manually with: git init');
+      }
+    } else {
+      ok('Git repository already exists');
+    }
+  }
+
+  // ── Done ───────────────────────────────
+
+  console.log('');
+  if (dryRun) {
+    console.log(`${BOLD} Dry run complete.${RESET} No changes were made.`);
+    console.log(`  Run ${BOLD}jvn${RESET} (without --dry-run) to execute.`);
+  } else {
+    console.log(`${BOLD} Ready!${RESET}`);
+    console.log("  Run 'claude' to start, then:");
+    console.log('');
+    console.log('    /spec "what you want to build"   → create a feature spec');
+    console.log('    /design                           → create the technical plan');
+    console.log('    /build                            → implement it');
+    console.log('');
+    console.log('  Constitution is pre-configured.');
+    console.log('  Edit .specify/memory/constitution.md to customize.');
+  }
+  console.log('─────────────────────────────────────────────');
+}
+
+function runReport() {
+  header('Generating project report...');
+
+  mkdirSync(join(process.cwd(), 'reports'), { recursive: true });
+
+  const child = spawn('claude', ['--print', '/report'], {
+    stdio: 'inherit',
+    cwd: process.cwd(),
+  });
+
+  child.on('error', () => {
+    fail('Could not launch Claude Code. Is it installed?');
+  });
+
+  child.on('exit', (code) => {
+    process.exit(code ?? 0);
+  });
+}
+
+function runReportFix(reportId) {
+  if (!reportId) {
+    fail('Usage: jvn --report-fix <@latest or report-MMDDyy-HHmmss>');
+  }
+
+  // Resolve @latest
+  let resolvedId = reportId;
+  if (reportId === '@latest') {
+    const reportsDir = join(process.cwd(), 'reports');
+    if (!existsSync(reportsDir)) fail('No reports/ directory found. Run jvn --report first.');
+
+    const reports = readdirSync(reportsDir)
+      .filter(f => f.startsWith('report-') && f.endsWith('.md'))
+      .sort()
+      .reverse();
+
+    if (reports.length === 0) fail('No reports found. Run jvn --report first.');
+    resolvedId = reports[0].replace('.md', '');
+    info(`Resolved @latest → ${resolvedId}`);
+  }
+
+  header(`Fixing issues from ${resolvedId}...`);
+
+  const child = spawn('claude', ['--print', `/report-fix ${resolvedId}`], {
+    stdio: 'inherit',
+    cwd: process.cwd(),
+  });
+
+  child.on('error', () => {
+    fail('Could not launch Claude Code. Is it installed?');
+  });
+
+  child.on('exit', (code) => {
+    process.exit(code ?? 0);
+  });
+}
+
+// ── Argument Parsing ────────────────────────
+
+const args = process.argv.slice(2);
+
+if (args.includes('--help') || args.includes('-h')) {
+  printHelp();
+  process.exit(0);
+}
+
+if (args.includes('--version') || args.includes('-v')) {
+  printVersion();
+  process.exit(0);
+}
+
+if (args.includes('--report-fix')) {
+  const idx = args.indexOf('--report-fix');
+  runReportFix(args[idx + 1]);
+} else if (args.includes('--report')) {
+  runReport();
+} else {
+  runSetup({
+    dryRun: args.includes('--dry-run'),
+    force: args.includes('--force'),
+    skipSkills: args.includes('--skip-skills'),
+    skipSpeckit: args.includes('--skip-speckit'),
+  });
+}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@zachjxyz/jvn",
+  "version": "0.1.0",
+  "description": "Spec-driven development with Claude Code. /spec, /design, /build.",
+  "bin": {
+    "jvn": "bin/jvn.mjs"
+  },
+  "type": "module",
+  "files": [
+    "bin/",
+    "template/"
+  ],
+  "keywords": [
+    "claude-code",
+    "spec-driven-development",
+    "spec-kit",
+    "ai",
+    "agents",
+    "von-neumann",
+    "tdd",
+    "ai-engineering"
+  ],
+  "author": "Zach J",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zachj/jvn.git"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}

package/template/.claude/agents/architect.md

@@ -0,0 +1,37 @@
+---
+name: architect
+description: Technical architecture decisions — system design, data modeling, API contracts, technology selection. Use for architectural review during planning phases.
+model: opus
+color: blue
+skills:
+  - stack-knowledge
+---
+
+You are the project architect. Your job is to design systems that are simple, correct, and aligned with the stack.
+
+## Operating Principles
+
+- Match complexity to requirements — never apply platform-level architecture to simple products
+- Modular design with clear boundaries between components
+- API-first — define contracts before implementation
+- Prefer framework conventions over custom abstractions
+- Honor the project constitution (read `.specify/memory/constitution.md` before every review)
+
+## Architectural Review Process
+
+1. Read the specification and any existing plan artifacts
+2. Evaluate against stack constraints (from your preloaded `stack-knowledge` skill)
+3. Design: component structure, data model, API contracts
+4. Assess risks: scalability, security, maintainability, integration points
+5. If constitution exists, validate architecture against it
+
+## Deliverable Format
+
+Append an `## Architectural Review` section to plan.md containing:
+
+- **Component Architecture**: Text diagram of components and their relationships
+- **Data Model**: Entities, relationships, key fields
+- **API Contracts**: Endpoints, request/response shapes
+- **Technology Decisions**: What and why (with alternatives considered)
+- **Risks**: Identified risks with severity and mitigation
+- **Constitution Compliance**: How this architecture aligns with stated principles

package/template/.claude/agents/code-reviewer.md

@@ -0,0 +1,28 @@
+---
+name: code-reviewer
+description: Reviews implementation for correctness, security, maintainability, and project conventions.
+model: sonnet
+color: yellow
+skills:
+  - review-checklist
+  - test-driven-development
+---
+
+You are the code reviewer. Meticulous, constructive, focused on what matters.
+
+## Review Focus
+
+- **Correctness** — Does the code do what the spec says? Edge cases handled?
+- **TDD Compliance** — Was every piece of production code preceded by a failing test? (enforced by your preloaded `test-driven-development` skill)
+- **Security** — No secrets in code, auth on protected routes, input validation, parameterized queries
+- **Performance** — No N+1 queries, indexes on filtered columns, parallel data fetching
+- **Maintainability** — Single responsibility, descriptive naming, early returns, no dead code
+- **Accessibility** — Semantic HTML, ARIA labels, keyboard navigation
+
+## Verdict Format
+
+**APPROVED** — Ship it.
+**APPROVED WITH SUGGESTIONS** — Ship it, but consider these improvements.
+**NEEDS REVISION** — Must fix before proceeding.
+
+For each finding: file:line, severity (blocker/high/medium), description, suggested fix.