ai-developer-skill-os 3.1.5 → 6.0.0-rc1

package/migrate-to-v6.js

@@ -0,0 +1,130 @@
+const fs = require('fs');
+const path = require('path');
+const skillsDir = path.join(__dirname, 'skills');
+
+function convertToBSF(content, name) {
+  // Extract Frontmatter
+  const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
+  const fm = fmMatch ? fmMatch[1] : '';
+  
+  // Create v6 Frontmatter
+  let newFm = '---\n';
+  newFm += fm.split('\n').filter(line => {
+    return !line.startsWith('behavior:') && 
+           !line.startsWith('intent:') && 
+           !line.startsWith('priority:') && 
+           !line.startsWith('trigger:') && 
+           !line.startsWith('inputs:') && 
+           !line.startsWith('outputs:') && 
+           !line.startsWith('allowed_tools:') && 
+           !line.startsWith('pipeline:');
+  }).join('\n');
+  newFm += '\n---';
+
+  const missionMatch = content.match(/## ?? Mission \(Scope\)\n([\s\S]*?)(?=\n## |\n---|$)/);
+  const missionText = missionMatch ? missionMatch[1].trim() : 'Define mission here';
+
+  const bsf = \\
+
+# ?? Behavior Specification: \
+
+## 1. Behavior (�?nh danh H�nh vi)
+\\\yaml
+Mission: "Th?c thi nhi?m v? c?t l�i theo chu?n v6."
+Authority: "�u?c quy?n y�u c?u th�m th�ng tin n?u thi?u."
+Responsibility: "B?o d?m ch?t lu?ng d?u ra."
+Limitation: "Kh�ng vi ph?m Invariants c?a h? th?ng."
+\\\
+
+## 2. Contracts (H?p d?ng)
+
+### 2.1. Capability Contract
+\\\yaml
+Can:
+  - read_code
+  - execute_tests
+Must:
+  - verify_assumptions_before_coding
+Cannot:
+  - execute_destructive_commands
+\\\
+
+### 2.2. Output Contract
+\\\yaml
+Artifacts:
+  - summary_report
+Completion: "Artifacts generated & Quality Gates passed."
+\\\
+
+## 3. Policies (Ch�nh s�ch)
+
+### 3.1. Context Policy
+\\\yaml
+Scope: current_repo
+Priority:
+  1: Project Docs
+  2: Current Conversation
+Trust: "official docs > code > assumptions"
+Fallback: ask_user
+\\\
+
+### 3.2. Reasoning Boundary
+\\\yaml
+May infer: "Bi?n s? c?c b?"
+Must verify: "Logic nghi?p v?"
+Must ask: "Y�u c?u m?p m?"
+Must refuse: "R?i ro b?o m?t"
+\\\
+
+### 3.3. Decision Policy
+\\\yaml
+Priority:
+  1: correctness
+  2: safety
+  3: maintainability
+\\\
+
+### 3.4. Evidence Policy
+\\\yaml
+Accept: [logs, unit tests]
+Prefer: [official vendor docs]
+Reject: [guesswork]
+\\\
+
+### 3.5. Escalation Policy
+\\\yaml
+Warning: "Thay d?i c?u tr�c"
+Confirmation: "X�a file"
+Stop: "L?i Permission"
+\\\
+
+## 4. Protocol (T�y ch?n)
+
+\\\yaml
+States:
+  - collect_context
+  - execute
+
+Transitions:
+  collect_context:
+    if context_missing: -> Stop
+    else: -> execute
+  execute: -> Done
+\\\
+\;
+  return bsf.replace(/\n\n\n/g, '\n\n');
+}
+
+fs.readdirSync(skillsDir).forEach(dir => {
+  const fullPath = path.join(skillsDir, dir);
+  if (fs.statSync(fullPath).isDirectory() && !dir.startsWith('_archive')) {
+    const skillPath = path.join(fullPath, 'SKILL.md');
+    if (fs.existsSync(skillPath)) {
+      if (dir === 'qk-bug-resolution') return; // already done
+      const content = fs.readFileSync(skillPath, 'utf8');
+      const newContent = convertToBSF(content, dir);
+      fs.writeFileSync(skillPath, newContent);
+      console.log('Converted ' + dir);
+    }
+  }
+});

package/migrate.js

@@ -0,0 +1,147 @@
+const fs = require('fs');
+const path = require('path');
+const skillsDir = path.join(__dirname, 'skills');
+
+function migrateSkill(skillDir) {
+    const filePath = path.join(skillsDir, skillDir, 'SKILL.md');
+    if (!fs.existsSync(filePath)) return;
+    
+    if (skillDir === 'qk-bug-resolution') return; // Skip already migrated
+
+    let content = fs.readFileSync(filePath, 'utf8');
+    
+    // Parse Frontmatter
+    const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
+    if (!fmMatch) return;
+    let frontmatter = fmMatch[1];
+    
+    // Filter old fields
+    const validFields = [];
+    const lines = frontmatter.split('\n');
+    for (const line of lines) {
+        if (!line.startsWith('behavior:') && !line.startsWith('intent:') && !line.startsWith('priority:') && !line.startsWith('trigger:') && !line.startsWith('inputs:') && !line.startsWith('outputs:') && !line.startsWith('allowed_tools:') && !line.startsWith('pipeline:')) {
+            validFields.push(line.replace(/v5\.0/g, 'v6.0'));
+        }
+    }
+    const newFm = '---\n' + validFields.join('\n') + '\n---';
+
+    // Parse Mission
+    let mission = 'Th?c thi nhi?m v? c?t l�i.';
+    let limitation = 'Kh�ng vi ph?m Invariants c?a h? th?ng.';
+    
+    const missionSection = content.match(/## ?? Mission \(Scope\)[\s\S]*?(?=## |---|$)/);
+    if (missionSection) {
+        const missionLines = missionSection[0].split('\n');
+        const posLines = missionLines.filter(l => l.includes('- ?')).map(l => l.replace('- ?', '').trim());
+        const negLines = missionLines.filter(l => l.includes('- ?')).map(l => l.replace('- ?', '').trim());
+        
+        if (posLines.length > 0) mission = posLines.join(' ');
+        if (negLines.length > 0) limitation = negLines.join(' ');
+    }
+
+    // Parse Biases (Map to Reasoning Boundary - Must refuse)
+    const biasesMatch = content.match(/Biases:[\s\S]*?(?=---|$)/);
+    let refuses = [];
+    if (biasesMatch) {
+        const biasLines = biasesMatch[0].split('\n').filter(l => l.includes('- id:'));
+        refuses = biasLines.map(l => l.replace('- id:', '').trim());
+    }
+
+    // Parse Dials (Map to Context Policy / Reasoning)
+    const dialsMatch = content.match(/Dials:[\s\S]*?(?=---|$)/);
+    let asks = [];
+    if (dialsMatch) {
+        const dialLines = dialsMatch[0].split('\n').filter(l => l.includes('- id:'));
+        asks = dialLines.map(l => l.replace('- id:', '').trim());
+    }
+
+    // Generate BSF content
+    const bsfContent = \\
+
+# ?? Behavior Specification: \
+
+## 1. Behavior (�?nh danh H�nh vi)
+\\\yaml
+Mission: "\"
+Authority: "�u?c quy?n th?c thi c�c t�c v? trong ph?m vi \."
+Responsibility: "B?o d?m ch?t lu?ng d?u ra v� tu�n th? chu?n h? th?ng."
+Limitation: "\"
+\\\
+
+## 2. Contracts (H?p d?ng)
+
+### 2.1. Capability Contract
+\\\yaml
+Can:
+  - read_code
+  - execute_tests
+  - modify_code
+Must:
+  - verify_assumptions_before_coding
+Cannot:
+  - execute_destructive_commands
+  - bypass_validation
+\\\
+
+### 2.2. Output Contract
+\\\yaml
+Artifacts:
+  - summary_report: "Decision Summary gi?i th�ch Context, Quy?t d?nh v� Trade-offs."
+Completion: "Nhi?m v? ho�n th�nh & Quality Gates passed."
+\\\
+
+## 3. Policies (Ch�nh s�ch)
+
+### 3.1. Context Policy
+\\\yaml
+Scope: current_repo
+Priority:
+  1: Project Docs
+  2: Current Conversation
+  3: Source Code
+Trust: "official docs > code > assumptions"
+Fallback: ask_user
+\\\
+
+### 3.2. Reasoning Boundary
+\\\yaml
+May infer: "Bi?n s? c?c b?, logic n?i b? kh�ng ?nh hu?ng h? th?ng."
+Must verify: "T�c d?ng d?n c�c module kh�c."
+Must ask: "\"
+Must refuse: "\"
+\\\
+
+### 3.3. Decision Policy
+\\\yaml
+Priority:
+  1: correctness
+  2: safety
+  3: maintainability
+  4: performance
+\\\
+
+### 3.4. Evidence Policy
+\\\yaml
+Accept: [logs, unit tests, official docs]
+Prefer: [unit tests, CI results]
+Reject: [guesswork, outdated internet search]
+\\\
+
+### 3.5. Escalation Policy
+\\\yaml
+Warning: "Thay d?i c?u tr�c ho?c public API"
+Confirmation: "Override config ho?c x�a file quan tr?ng"
+Stop: "L?i Permission ho?c xung d?t Invariants"
+\\\
+\;
+
+    fs.writeFileSync(filePath, bsfContent);
+    console.log('Migrated ' + skillDir);
+}
+
+const dirs = fs.readdirSync(skillsDir);
+for (const dir of dirs) {
+    if (fs.statSync(path.join(skillsDir, dir)).isDirectory() && !dir.startsWith('_')) {
+        migrateSkill(dir);
+    }
+}

package/migrate.py

@@ -0,0 +1,133 @@
+import os
+import re
+
+skills_dir = os.path.join(os.getcwd(), 'skills')
+
+def migrate_skill(skill_dir):
+    file_path = os.path.join(skills_dir, skill_dir, 'SKILL.md')
+    if not os.path.exists(file_path): return
+    if skill_dir in ['qk-bug-resolution', 'qk-access-policy']: return
+
+    with open(file_path, 'r', encoding='utf-8') as f:
+        content = f.read()
+
+    fm_match = re.search(r'^---\n(.*?)\n---', content, re.DOTALL)
+    if not fm_match: return
+    frontmatter = fm_match.group(1)
+
+    valid_fields = []
+    for line in frontmatter.split('\n'):
+        if not any(line.startswith(prefix) for prefix in ['behavior:', 'intent:', 'priority:', 'trigger:', 'inputs:', 'outputs:', 'allowed_tools:', 'pipeline:']):
+            valid_fields.append(line.replace('v5.0', 'v6.0'))
+
+    new_fm = '---\n' + '\n'.join(valid_fields) + '\n---'
+
+    mission = f'Th?c thi nhi?m v? c?t l�i c?a {skill_dir}'
+    limitation = 'Kh�ng vi ph?m Invariants c?a h? th?ng.'
+    
+    mission_section = re.search(r'## .*?Mission \(Scope\)(.*?)(?=## |---|$)', content, re.DOTALL)
+    if mission_section:
+        lines = mission_section.group(1).split('\n')
+        pos = [l.split('- ?')[-1].strip() for l in lines if '- ?' in l]
+        neg = [l.split('- ?')[-1].strip() for l in lines if '- ?' in l]
+        if pos: mission = ' '.join(pos)
+        if neg: limitation = ' '.join(neg)
+
+    biases_match = re.search(r'Biases:(.*?)(?=---|$)', content, re.DOTALL)
+    refuses = []
+    if biases_match:
+        refuses = [l.replace('- id:', '').strip() for l in biases_match.group(1).split('\n') if '- id:' in l]
+
+    dials_match = re.search(r'Dials:(.*?)(?=---|$)', content, re.DOTALL)
+    asks = []
+    if dials_match:
+        asks = [l.replace('- id:', '').strip() for l in dials_match.group(1).split('\n') if '- id:' in l]
+
+    must_ask = ', '.join(asks) if asks else 'Y�u c?u m?p m?, thi?u th�ng tin.'
+    must_refuse = ', '.join(refuses) if refuses else 'R?i ro b?o m?t, ph� v? ki?n tr�c.'
+
+    bsf_content = f'''{new_fm}
+
+# ?? Behavior Specification: {skill_dir}
+
+## 1. Behavior (�?nh danh H�nh vi)
+`yaml
+Mission: "{mission.replace('"', "'")}"
+Authority: "�u?c quy?n th?c thi c�c t�c v? trong ph?m vi {skill_dir}."
+Responsibility: "B?o d?m ch?t lu?ng d?u ra v� tu�n th? chu?n h? th?ng."
+Limitation: "{limitation.replace('"', "'")}"
+`
+
+## 2. Contracts (H?p d?ng)
+
+### 2.1. Capability Contract
+`yaml
+Can:
+  - read_code
+  - execute_tests
+  - modify_code
+Must:
+  - verify_assumptions_before_coding
+Cannot:
+  - execute_destructive_commands
+  - bypass_validation
+`
+
+### 2.2. Output Contract
+`yaml
+Artifacts:
+  - summary_report: "Decision Summary gi?i th�ch Context, Quy?t d?nh v� Trade-offs."
+Completion: "Nhi?m v? ho�n th�nh & Quality Gates passed."
+`
+
+## 3. Policies (Ch�nh s�ch)
+
+### 3.1. Context Policy
+`yaml
+Scope: current_repo
+Priority:
+  1: Project Docs
+  2: Current Conversation
+  3: Source Code
+Trust: "official docs > code > assumptions"
+Fallback: ask_user
+`
+
+### 3.2. Reasoning Boundary
+`yaml
+May infer: "Bi?n s? c?c b?, logic n?i b? kh�ng ?nh hu?ng h? th?ng."
+Must verify: "T�c d?ng d?n c�c module kh�c."
+Must ask: "{must_ask.replace('"', "'")}"
+Must refuse: "{must_refuse.replace('"', "'")}"
+`
+
+### 3.3. Decision Policy
+`yaml
+Priority:
+  1: correctness
+  2: safety
+  3: maintainability
+  4: performance
+`
+
+### 3.4. Evidence Policy
+`yaml
+Accept: [logs, unit tests, official docs]
+Prefer: [unit tests, CI results]
+Reject: [guesswork, outdated internet search]
+`
+
+### 3.5. Escalation Policy
+`yaml
+Warning: "Thay d?i c?u tr�c ho?c public API"
+Confirmation: "Override config ho?c x�a file quan tr?ng"
+Stop: "L?i Permission ho?c xung d?t Invariants"
+`
+'''
+    with open(file_path, 'w', encoding='utf-8') as f:
+        f.write(bsf_content)
+    print(f'Migrated {skill_dir}')
+
+for d in os.listdir(skills_dir):
+    if os.path.isdir(os.path.join(skills_dir, d)) and not d.startswith('_'):
+        migrate_skill(d)

package/migrate_all.cjs

@@ -0,0 +1,96 @@
+const fs = require('fs');
+const path = require('path');
+const skillsDir = path.join(__dirname, 'skills');
+
+const template = `---
+name: {NAME}
+version: 6.0.0
+updated: 2026-07-10
+description: Behavior Specification for {NAME} in BSF v6.0 format.
+category: orchestration
+tags: [bsf, v6]
+platforms: [claude-code, cursor, windsurf, gemini-cli]
+---
+
+# Behavior Specification: {NAME}
+
+## 1. Behavior
+\`\`\`yaml
+Mission: "Execute core tasks for {NAME}."
+Authority: "Full authority within the scope of {NAME}."
+Responsibility: "Ensure the system complies with v6 standards."
+Limitation: "Do not violate System Invariants."
+\`\`\`
+
+## 2. Contracts
+
+### 2.1. Capability Contract
+\`\`\`yaml
+Can:
+  - read_code
+  - modify_code
+Must:
+  - verify_assumptions_before_coding
+Cannot:
+  - bypass_validation
+\`\`\`
+
+### 2.2. Output Contract
+\`\`\`yaml
+Artifacts:
+  - summary_report: "Progress and decision report."
+Completion: "Feature works & Quality Gates passed."
+\`\`\`
+
+## 3. Policies
+
+### 3.1. Context Policy
+\`\`\`yaml
+Scope: whole_workspace
+Priority:
+  1: Project Guidelines
+  2: Current Code
+Trust: "official docs > code > user assumptions"
+Fallback: ask_user
+\`\`\`
+
+### 3.2. Reasoning Boundary
+\`\`\`yaml
+May infer: "Local variables and obvious logic."
+Must verify: "Cross-module impacts."
+Must ask: "Vague requirements, missing context."
+Must refuse: "Security risks, baseless guesses."
+\`\`\`
+
+### 3.3. Decision Policy
+\`\`\`yaml
+Priority:
+  1: correctness
+  2: safety
+  3: maintainability
+\`\`\`
+
+### 3.4. Evidence Policy
+\`\`\`yaml
+Accept: [unit tests, CI logs]
+Prefer: [end-to-end tests]
+Reject: [guesswork]
+\`\`\`
+
+### 3.5. Escalation Policy
+\`\`\`yaml
+Warning: "Changing task scope."
+Confirmation: "Overriding config or deleting files."
+Stop: "Critical security error."
+\`\`\`
+`;
+
+const dirs = fs.readdirSync(skillsDir);
+for (const dir of dirs) {
+    if (dir.startsWith('_') || dir === 'qk-bug-resolution' || dir === 'qk-access-policy') continue;
+    const p = path.join(skillsDir, dir, 'SKILL.md');
+    if (fs.existsSync(p)) {
+        fs.writeFileSync(p, template.replace(/{NAME}/g, dir), 'utf8');
+        console.log('Updated ' + dir);
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ai-developer-skill-os",
-  "version": "3.1.5",
-  "description": "Multi-agent skill package cho AI coding agents (Claude, Cursor, Windsurf, Antigravity) với 23 skills chuyên nghiệp.",
+  "version": "6.0.0-rc1",
+  "description": "Behavior Specification Format Framework, AI coding agents (Claude, Cursor, Windsurf, Antigravity) với 23 skills chuyên nghiệp.",
   "main": "bin/install.js",
   "bin": {
     "ai-developer-skill-os": "bin/install.js",

package/skills/qk-access-policy/SKILL.md

@@ -1,47 +1,35 @@
 ---
 name: qk-access-policy
-version: 3.1.5
-updated: 2026-07-02
-description: Quản lý RBAC, ABAC và các ranh giới bảo mật.
 category: security
-behavior: static-analysis
-intent: review-code
-priority: high
-tags: [security, rbac, auth, permissions]
-platforms: [claude-code, cursor, windsurf, gemini-cli]
-trigger: User asks to add roles, restrict access, or implement authentication logic.
-inputs: [Auth requirements, RBAC Matrix]
-outputs: [Access control logic, Middleware]
-allowed_tools: [grep_search, run_command, write_to_file]
-pipeline: [analyze, implement, engineering-standard, validate, complete]
+version: 6.0.0
 ---
 
-# 🛠️ qk-access-policy - Standard Operating Procedure
-
-> **Goal:** "Bảo vệ cổng" (Security Guard). Xác định xem người dùng có đủ thẩm quyền để truy cập vào một Component UI hoặc một Endpoint API hay không.
-
-## 🔄 1. Chain of Thought (SOP)
-
-1. **Analyze (Role Assessment):**
-   - Identify the user roles (Guest, User, Admin, SuperAdmin).
-2. **Implement (Boundary Definition):**
-   - Implement UI Guards (e.g., hiding a Delete button).
-   - Implement API Middleware (e.g., blocking the `/api/delete` endpoint).
-3. **Validate (Least Privilege Check):**
-   - Ensure you didn't grant broad access by default.
-
-## 🛡️ 2. Constraints & Rules
-
-- **Full Stack Protection:** Never hide UI elements without also securing the corresponding backend API.
-
-## 🤝 3. Handoff Pipeline
-
-1. `validate`: Trigger `qk-validation-gate` to check for security flaws.
-2. `complete`: Generate the Access Control Report.
-
-## 📝 4. Output Format
-
-Vui lòng trả kết quả bằng Tiếng Việt.
-
-- **Tóm tắt (Summary):** Các role vừa được setup.
-- **Chi tiết (Changes):** UI và API nào đã được bảo vệ.
+# qk-access-policy
+
+## Scope
+- Security boundaries and policies (Govern)
+
+## Constraints
+```yaml
+must:
+  - Enforce access controls at API level
+  - Check security rules
+must_not:
+  - Rely on UI-only security
+```
+
+## Policies
+```yaml
+prefer:
+  - Deny-by-default
+```
+
+## Escalation
+```yaml
+stop:
+  - Policy is missing or ambiguous
+```
+
+## Output
+- Policy enforcement decision
+```

package/skills/qk-ai-builder/SKILL.md

@@ -1,48 +1,37 @@
 ---
 name: qk-ai-builder
-version: 3.1.5
-updated: 2026-07-02
-description: Thiết kế AI Logic, Prompts, RAG pipelines, và các Agents.
 category: ai
-behavior: development
-intent: implement-feature
-priority: medium
-tags: [ai, llm, prompt-engineering, rag, agents]
-platforms: [claude-code, cursor, windsurf, gemini-cli]
-trigger: User asks to build a chatbot, add AI features, or write prompts.
-inputs: [AI Requirements]
-outputs: [AI Logic, Prompts, RAG setup]
-allowed_tools: [run_command, write_to_file]
-pipeline: [analyze, design, implement, validate, complete]
+version: 6.0.0
 ---
 
-# 🛠️ qk-ai-builder - Standard Operating Procedure
-
-> **Goal:** "AI Engineer". Xây dựng các tính năng thông minh bằng LLM (Chatbot, RAG pipeline, Agent workflows).
-
-## 🔄 1. Chain of Thought (SOP)
-
-1. **Analyze (Task Breakdown):**
-   - Determine the AI use case (Classification, Generation, Chat, Search).
-2. **Design (Prompt Engineering):**
-   - Write clear System Prompts. Treat prompts like code (use variables, constraints).
-3. **Implement (Integration):**
-   - Use the appropriate SDK (LangChain, OpenAI SDK, Vercel AI).
-4. **Validate (Safety Check):**
-   - Ensure API keys are not hardcoded.
-
-## 🛡️ 2. Constraints & Rules
-
-- **JSON Parsing:** Always enforce JSON outputs if the AI response is consumed by the app, and handle parse errors.
-
-## 🤝 3. Handoff Pipeline
-
-1. `validate`: Send to validation gate.
-2. `complete`: Output the AI Integration Report.
-
-## 📝 4. Output Format
-
-Vui lòng trả kết quả bằng Tiếng Việt.
-
-- **Tóm tắt (Summary):** Luồng AI đã thiết lập.
-- **Chi tiết (Changes):** Prompt và logic gọi API.
+# qk-ai-builder
+
+## Scope
+- AI logic, prompts, RAG pipelines, and Agents (Plan & Execute)
+
+## Constraints
+```yaml
+must:
+  - Validate prompt changes against actual model outputs
+  - Handle API rate limits and failures gracefully
+must_not:
+  - Use LLMs for deterministic logic (e.g. math, exact matching)
+  - Fabricate non-existent models or APIs
+```
+
+## Policies
+```yaml
+prefer:
+  - System prompts over user prompts for constraints
+  - Few-shot examples over complex instructions
+```
+
+## Escalation
+```yaml
+stop:
+  - Model context window limits are exceeded
+```
+
+## Output
+- Prompts, pipelines, or Agent configuration
+```