ai-developer-skill-os 6.0.2 → 7.0.0

package/.agents/AGENTS.md

@@ -28,6 +28,7 @@ If multiple objectives or skills overlap, resolve them in this order:
 **Rules:**
 - **MUST** read before write. Always understand context before modifying code.
 - **MUST NOT** read the whole project unless explicitly required.
+- **ZERO-TRUST CONTEXT:** MUST NOT write business logic until a Dependency Graph or structural map is established (Do not guess the architecture).
 
 **Guidelines:**
 - **Context Budget:** Prefer reading `1 file` → `3 files` → `directory` → `project`.
@@ -55,6 +56,7 @@ If multiple objectives or skills overlap, resolve them in this order:
 ## 6. Execution & Repair Loop
 **Rules:**
 - **Repair Loop:** MUST follow: `Observe` → `Hypothesis` → `Evidence` → `Fix` → `Verify` → `Done`. Do NOT jump directly from Observe to Fix.
+- **Self-Correction (Anti-Slop):** MUST proactively self-audit code (especially UI) against design constraints before emitting. Reject any generic, lazy, or "slop" solutions.
 - **Escalation Policy:** If 2 consecutive attempts fail (e.g., build fail, permission denied): Stop. Explain the blocker. Request user confirmation before continuing.
 - **Stopping Criteria:** Stop immediately when: Root cause identified, task completed, required evidence collected, or sufficient confidence reached.
 
@@ -79,3 +81,9 @@ If multiple objectives or skills overlap, resolve them in this order:
 - **MUST** use Vietnamese for: User-facing explanations, questions, summaries, progress updates, and the final report.
 - **MUST NOT** translate: Code snippets, stack traces, file paths, shell commands, config keys, environment variables.
 - **MUST** follow the required reporting structure (Summary, Changes, Reason, Verification, Risks, Next Action).
+
+## 9. Design Contract (Open Design)
+**Rules:**
+- **MUST** locate and read `DESIGN.md` in the project root before performing any UI or frontend tasks.
+- **MUST NOT** invent design tokens, colors, or typography that contradict `DESIGN.md`.
+- **ENFORCEMENT:** If `DESIGN.md` is missing, the agent MUST request the user to create one (or use bootstrap skill) before continuing UI work.

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to the **AI Developer Skill OS** project will be documented
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [7.0.0] - 2026-07-15
+
+### Changed (The "Anti-Slop & Zero-Trust" Architecture Upgrade)
+- **Zero-Trust Logic**: Core logic skills (`qk-context-loader`, `qk-orchestrator`, `qk-feature-delivery`) now mandate a Topological Context Graph prior to any code generation.
+- **Strict Design Contract**: Frontend skills (`qk-ui-system-builder`, `qk-design-to-code`, `qk-ui-audit`) now explicitly reject generic styling (slop) and enforce strict token matching against a mandated `DESIGN.md`.
+- **Repair Loop Enforcement**: `qk-bug-resolution` updated to strictly prohibit jumping to fixes without explicitly establishing an `Observe -> Hypothesis -> Evidence` chain.
+- **Contract-First APIs**: `qk-api-lifecycle` now requires explicit OpenAPI/Swagger definitions prior to endpoint implementation.
+- **Upgraded Testing Framework**: Fixed regex and validation logic in `behavior-conformance.test.js` to rigorously support YAML array strings and precise V7 markdown constraints. All 22 skills bumped to `v7.0.0`.
+- **Project Bootstrapping**: `qk-project-bootstrap` now scaffolds `DESIGN.md` explicitly upon initialization.
+
+
 ## [4.0.0] - 2026-07-02
 
 ### Changed (Major Architecture Upgrade)

package/package.json

@@ -1,44 +1,44 @@
-{
-  "name": "ai-developer-skill-os",
-  "version": "6.0.2",
-  "description": "Behavior Specification Format Framework, AI coding agents (Claude, Cursor, Windsurf, Antigravity) với 23 skills chuyên nghiệp.",
-  "main": "bin/install.js",
-  "bin": {
-    "ai-developer-skill-os": "bin/install.js",
-    "ai-skill": "bin/install.js"
-  },
-  "type": "module",
-  "scripts": {
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:registry": "vitest run --config vitest.config.js",
-    "lint": "echo \"No linter configured\" && exit 0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/phamquangkhanh2999/ai-developer-skill-os.git"
-  },
-  "keywords": [
-    "ai",
-    "claude",
-    "cursor",
-    "windsurf",
-    "skills",
-    "developer",
-    "agent",
-    "prompts",
-    "framework"
-  ],
-  "author": "Quang Khánh",
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/phamquangkhanh2999/ai-developer-skill-os/issues"
-  },
-  "homepage": "https://github.com/phamquangkhanh2999/ai-developer-skill-os#readme",
-  "devDependencies": {
-    "vitest": "^2.1.0",
-    "fast-glob": "^3.3.0",
-    "gray-matter": "^4.0.0",
-    "js-yaml": "^4.1.0"
-  }
-}
+{
+  "name": "ai-developer-skill-os",
+  "version": "7.0.0",
+  "description": "Behavior Specification Format Framework, AI coding agents (Claude, Cursor, Windsurf, Antigravity) với 23 skills chuyên nghiệp.",
+  "main": "bin/install.js",
+  "bin": {
+    "ai-developer-skill-os": "bin/install.js",
+    "ai-skill": "bin/install.js"
+  },
+  "type": "module",
+  "scripts": {
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:registry": "vitest run --config vitest.config.js",
+    "lint": "echo \"No linter configured\" && exit 0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/phamquangkhanh2999/ai-developer-skill-os.git"
+  },
+  "keywords": [
+    "ai",
+    "claude",
+    "cursor",
+    "windsurf",
+    "skills",
+    "developer",
+    "agent",
+    "prompts",
+    "framework"
+  ],
+  "author": "Quang Khánh",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/phamquangkhanh2999/ai-developer-skill-os/issues"
+  },
+  "homepage": "https://github.com/phamquangkhanh2999/ai-developer-skill-os#readme",
+  "devDependencies": {
+    "vitest": "^2.1.0",
+    "fast-glob": "^3.3.0",
+    "gray-matter": "^4.0.0",
+    "js-yaml": "^4.1.0"
+  }
+}

package/skills/qk-access-policy/SKILL.md

@@ -1,35 +1,39 @@
 ---
 name: qk-access-policy
 category: security
-version: 6.0.0
+version: 7.0.0
+description: "Quản lý RBAC, ABAC và thiết lập ranh giới bảo mật nghiêm ngặt."
 ---
 
 # qk-access-policy
 
 ## Scope
-- Security boundaries and policies (Govern)
+- Role-Based and Attribute-Based Access Control configuration (Plan & Execute)
+
+## Verbs
+- `[CONFIGURE]`: Setup explicit role hierarchies and access lists.
 
 ## Constraints
 ```yaml
 must:
-  - Enforce access controls at API level
-  - Check security rules
+  - "Explicitly define roles and permissions in a Matrix"
+  - "Validate user identity before granting role-based access"
 must_not:
-  - Rely on UI-only security
+  - "Grant wildcard (*) permissions unless absolutely mandated by system architecture"
+  - "Mix authentication logic with authorization logic"
 ```
 
 ## Policies
 ```yaml
 prefer:
-  - Deny-by-default
+  - "Attribute-Based Access Control (ABAC) for complex business logic"
 ```
 
 ## Escalation
 ```yaml
 stop:
-  - Policy is missing or ambiguous
+  - "Access Matrix is contradictory or undefined"
 ```
 
 ## Output
-- Policy enforcement decision
-```
+- RBAC/ABAC configurations and middleware.

package/skills/qk-ai-builder/SKILL.md

@@ -1,37 +1,40 @@
 ---
 name: qk-ai-builder
-category: ai
-version: 6.0.0
+category: core
+version: 7.0.0
+description: "Thiết kế AI Logic, Prompts, RAG pipelines với bảo mật chống Injection."
 ---
 
 # qk-ai-builder
 
 ## Scope
-- AI logic, prompts, RAG pipelines, and Agents (Plan & Execute)
+- AI integration, Prompt Engineering, and RAG architectures (Plan & Execute)
+
+## Verbs
+- `[PROMPT]`: Design strict and deterministic prompts.
 
 ## Constraints
 ```yaml
 must:
-  - Validate prompt changes against actual model outputs
-  - Handle API rate limits and failures gracefully
+  - "Include explicit constraints and negative constraints (must_not) in all prompts"
+  - "Sanitize user inputs before feeding them to LLMs (Anti-Injection)"
 must_not:
-  - Use LLMs for deterministic logic (e.g. math, exact matching)
-  - Fabricate non-existent models or APIs
+  - "Create open-ended 'chat' prompts without strict system boundaries"
+  - "Trust LLM output for critical logic without a validation step"
 ```
 
 ## Policies
 ```yaml
 prefer:
-  - System prompts over user prompts for constraints
-  - Few-shot examples over complex instructions
+  - "Few-shot prompting with clear examples"
+  - "Structured output (JSON) over raw text for API interactions"
 ```
 
 ## Escalation
 ```yaml
 stop:
-  - Model context window limits are exceeded
+  - "Prompt architecture lacks validation or security boundaries"
 ```
 
 ## Output
-- Prompts, pipelines, or Agent configuration
-```
+- Prompts, RAG pipelines, and AI integration logic.

package/skills/qk-api-lifecycle/SKILL.md

@@ -1,38 +1,46 @@
 ---
 name: qk-api-lifecycle
 category: fullstack
-version: 6.0.0
+version: 7.0.0
+description: "Thiết kế, triển khai, và tích hợp các API endpoints với kỷ luật Zero-Trust."
 ---
 
 # qk-api-lifecycle
 
 ## Scope
 - API design, endpoints, contracts, and lifecycle management (Plan & Execute)
+- Zero-Trust validation of API schemas.
+
+## Verbs
+- `[DEFINE]`: Create strict API contracts before implementation.
+- `[IMPLEMENT]`: Build endpoints strictly adhering to the defined contract.
 
 ## Constraints
 ```yaml
 must:
-  - Define clear request/response contracts (OpenAPI/Swagger)
-  - Ensure backward compatibility on existing endpoints
+  - "Define clear request/response contracts (OpenAPI/Swagger) BEFORE coding"
+  - "Ensure backward compatibility on existing endpoints"
+  - "Validate all incoming data against the strict schema"
 must_not:
-  - Introduce breaking changes without versioning
-  - Bypass authentication or authorization checks
+  - "Introduce breaking changes without versioning"
+  - "Bypass authentication or authorization checks"
+  - "Hallucinate or guess external API shapes without evidence"
 ```
 
 ## Policies
 ```yaml
 prefer:
-  - RESTful resource naming conventions
-  - Meaningful HTTP status codes
+  - "RESTful resource naming conventions"
+  - "Meaningful HTTP status codes"
+  - "Strict type-checking and validation over loose parsing"
 ```
 
 ## Escalation
 ```yaml
 stop:
-  - Required API contracts or models are missing
-  - Major breaking change detected on production APIs
+  - "Required API contracts or models are missing"
+  - "Major breaking change detected on production APIs"
 ```
 
 ## Output
-- API endpoints, controllers, and documentation
-```
+- API endpoints, controllers, and strict documentation.

package/skills/qk-bug-resolution/SKILL.md

@@ -1,39 +1,46 @@
 ---
 name: qk-bug-resolution
 category: maintenance
-version: 6.0.0
+version: 7.0.0
+description: "Sửa lỗi (bugs) bằng chu trình khép kín: Quan sát -> Giả thuyết -> Bằng chứng -> Sửa."
 ---
 
 # qk-bug-resolution
 
 ## Scope
-- Existing defects only (Diagnose)
+- Existing defects only (Diagnose & Repair)
+- Enforcing the strict Repair Loop.
+
+## Verbs
+- `[DIAGNOSE]`: Follow the `Observe -> Hypothesis -> Evidence` loop.
+- `[REPAIR]`: Execute the fix only when confidence is high.
 
 ## Constraints
 ```yaml
 must:
-  - Collect evidence (stack trace/logs) before diagnosis
-  - Verify fix before completion
+  - "Strictly follow the Repair Loop: Observe -> Hypothesis -> Evidence -> Fix -> Verify -> Done"
+  - "Collect evidence (stack trace/logs/dependency graph) before diagnosis"
+  - "Verify fix before completion"
 must_not:
-  - Rewrite modules
-  - Guess root cause without evidence
+  - "Jump directly from Observe to Fix (No slop debugging)"
+  - "Rewrite modules unnecessarily"
+  - "Guess root cause without concrete evidence"
 ```
 
 ## Policies
 ```yaml
 prefer:
-  - Minimal patch
-  - Regression prevention
+  - "Minimal patch"
+  - "Root cause resolution over symptom patching"
+  - "Regression prevention via targeted tests"
 ```
 
 ## Escalation
 ```yaml
 stop:
-  - Missing logs/evidence
-  - Fix requires major architectural changes
+  - "Missing logs/evidence after 2 attempts to gather them"
+  - "Fix requires major architectural changes"
 ```
 
 ## Output
-- Minimal patch
-- Risk summary
-```
+- Minimal patch and Risk summary.

package/skills/qk-context-loader/SKILL.md

@@ -1,36 +1,43 @@
 ---
 name: qk-context-loader
 category: utilities
-version: 6.0.0
+version: 7.0.0
+description: "Tải các file liên quan và vẽ biểu đồ phụ thuộc (dependency graph) khắt khe trước khi code."
 ---
 
 # qk-context-loader
 
 ## Scope
-- Context collection and dependency mapping (Collect)
+- Context collection and structural dependency mapping (Collect)
+- Implementing Understand Anything's "Graphing" philosophy to prevent hallucination.
+
+## Verbs
+- `[MAP]`: Analyze file relationships and generate a topological graph or tree map of the domain logic.
 
 ## Constraints
 ```yaml
 must:
-  - Find and load related dependency files
+  - Generate a Structural Map (Dependency Graph) BEFORE attempting to solve complex tasks.
+  - Find and load related dependency files based strictly on the map.
 must_not:
   - Modify code
   - Load entire repo or node_modules
-  - Hallucinate filenames
+  - Guess or hallucinate filenames or API shapes.
+  - Skip the graphing phase for business logic tasks.
 ```
 
 ## Policies
 ```yaml
 prefer:
-  - Build dependency graph
+  - Deterministic tracing (following imports/exports) over semantic guessing.
 ```
 
 ## Escalation
 ```yaml
 stop:
   - Repo or files are inaccessible
+  - Cannot determine the architectural structure (Context overflow)
 ```
 
 ## Output
-- Context mapping
-```
+- Explicit JSON or Markdown Topological Graph of Context

package/skills/qk-data-lifecycle/SKILL.md

@@ -1,35 +1,44 @@
 ---
 name: qk-data-lifecycle
-category: infrastructure
-version: 6.0.0
+category: backend
+version: 7.0.0
+description: "Quản lý Database Schema, Migrations, và Repositories khắt khe với Zero-Trust."
 ---
 
 # qk-data-lifecycle
 
 ## Scope
-- Database Schema, Migrations, and Repositories management (Plan & Execute)
+- Database Schema management, Migrations, and Repositories (Plan & Execute)
+- Enforcing structural database contracts before implementation.
+
+## Verbs
+- `[SCHEMA]`: Define database tables/models explicitly.
+- `[MIGRATE]`: Safely manage state changes.
 
 ## Constraints
 ```yaml
 must:
-  - Ensure data schema matches application domain models
-  - Generate reversible migration scripts
+  - "MUST define explicitly strict database schemas (e.g., Prisma/TypeORM) before writing repository code"
+  - "Enforce strict types for all database operations"
 must_not:
-  - Perform destructive schema changes without explicit user approval
+  - "Create dynamic queries without schema definitions"
+  - "Delete or drop columns without a deprecation phase"
+  - "Write complex business logic inside repository files"
 ```
 
 ## Policies
 ```yaml
 prefer:
-  - Declarative schema definitions over imperative scripts
+  - "Separation of concerns (Repositories handle data, Services handle logic)"
+  - "Transactions for multi-table updates"
 ```
 
 ## Escalation
 ```yaml
 stop:
-  - Migration script risks massive data loss
+  - "Missing database schema or ORM models"
+  - "Attempting destructive migrations on production"
 ```
 
 ## Output
-- Database schemas and migration scripts
-```
+- ORM Schema, Repositories, and Migration files.

package/skills/qk-db-optimizer/SKILL.md

@@ -1,35 +1,41 @@
 ---
 name: qk-db-optimizer
-category: infrastructure
-version: 6.0.0
+category: backend
+version: 7.0.0
+description: "Tối ưu hóa Database (đánh Index, xử lý N+1 Queries, Slow Queries) dựa trên bằng chứng."
 ---
 
 # qk-db-optimizer
 
 ## Scope
-- Database optimization (Indexes, N+1 Queries, Slow Queries) (Diagnose & Evaluate)
+- Database Optimization and Performance Auditing (Diagnose & Execute)
+
+## Verbs
+- `[OPTIMIZE]`: Analyze query plans and apply targeted indexes.
 
 ## Constraints
 ```yaml
 must:
-  - Analyze query execution plans if available
-  - Suggest non-breaking performance fixes
+  - "Analyze EXPLAIN or Query Plans BEFORE adding indexes"
+  - "Solve N+1 queries using Data Loaders or explicit Joins"
+  - "Validate query performance improvements"
 must_not:
-  - Change database engine or major architecture without consent
+  - "Guess missing indexes without slow query logs"
+  - "Add overlapping or redundant indexes"
 ```
 
 ## Policies
 ```yaml
 prefer:
-  - Adding indexes before rewriting complex queries
+  - "Compound indexes for multi-column queries"
+  - "Eager loading over lazy loading for known data relations"
 ```
 
 ## Escalation
 ```yaml
-ask:
-  - For exact slow query logs if not provided
+stop:
+  - "No evidence of slow queries or performance bottlenecks"
 ```
 
 ## Output
-- Optimization plan and SQL patches
-```
+- Optimized queries and index migration files.

package/skills/qk-design-to-code/SKILL.md

@@ -1,22 +1,30 @@
 ---
 name: qk-design-to-code
 category: frontend
-version: 6.0.0
+version: 7.0.0
+description: "Chuyển đổi thiết kế từ Figma/Images thành các UI component hoàn chỉnh, chuẩn pixel."
 ---
 
 # qk-design-to-code
 
 ## Scope
 - Converting Figma/UI designs into pixel-perfect frontend code (Execute)
+- Rejecting generic templates and enforcing bespoke, high-quality aesthetics.
+
+## Verbs
+- `[REDESIGN]`: Discard generic UI structure, keep data, and rebuild with strict Hallmark/Open Design principles.
+- `[BUILD]`: Generate UI adhering 100% to `DESIGN.md`.
 
 ## Constraints
 ```yaml
 must:
-  - Use the project's existing design system / tokens
-  - Ensure responsive layouts
+  - Use the project's existing `DESIGN.md` design system / tokens ONLY
+  - Ensure responsive layouts and generous whitespace
+  - Include micro-interactions and smooth transitions
 must_not:
   - Hardcode magic numbers for spacing/colors
   - Invent new UI components if existing ones suffice
+  - Use generic "AI-slop" aesthetics (e.g., default Tailwind blue/red, cluttered layouts, 1px default borders)
 ```
 
 ## Policies
@@ -24,14 +32,15 @@ must_not:
 prefer:
   - Semantic HTML elements
   - CSS Grid / Flexbox over absolute positioning
+  - High-end aesthetics (glassmorphism, organic shadows, exact typography)
 ```
 
 ## Escalation
 ```yaml
 stop:
-  - Design assets or requirements are ambiguous
+  - "Design assets or requirements are ambiguous"
+  - "DESIGN.md is missing"
 ```
 
 ## Output
-- Frontend components and stylesheets
-```
+- Frontend components and stylesheets (Anti-Slop compliant)

package/skills/qk-docs/SKILL.md

@@ -1,36 +1,40 @@
 ---
 name: qk-docs
-category: utilities
-version: 6.0.0
+category: documentation
+version: 7.0.0
+description: "Viết và duy trì tài liệu dự án chính xác tuyệt đối, cấm bịa đặt."
 ---
 
 # qk-docs
 
 ## Scope
-- Writing and maintaining project documentation for human readability (Execute)
+- Technical documentation, Readme files, and inline comments (Execute)
+
+## Verbs
+- `[DOCUMENT]`: Synchronize documentation with the actual implementation.
 
 ## Constraints
 ```yaml
 must:
-  - Keep documentation in sync with the actual codebase
-  - Use clear, accessible language
+  - "Ensure documentation matches the exact implementation in the codebase"
+  - "Update documentation whenever corresponding code is changed"
 must_not:
-  - Generate overly verbose or redundant docs
-  - Invent features that don't exist in the code
+  - "Hallucinate or guess API parameters not present in the code"
+  - "Write generic or useless comments (e.g., '// gets the user')"
 ```
 
 ## Policies
 ```yaml
 prefer:
-  - Examples and code snippets over pure text
+  - "Self-documenting code over excessive inline comments"
+  - "Living documentation (e.g., Swagger/JSDoc) over isolated Markdown files"
 ```
 
 ## Escalation
 ```yaml
 stop:
-  - The codebase logic is too ambiguous to document accurately
+  - "Documentation requests conflict with actual codebase implementation"
 ```
 
 ## Output
-- Markdown documentation files
-```
+- Accurate documentation files or inline comments.