ai-developer-skill-os 8.2.0 → 8.3.0

package/.agents/skills/qk-production-release/SKILL.md

@@ -47,6 +47,18 @@ knowledge_scope:
     - deployment-gate
   references:
     - architecture
+    - security
+    - anti-patterns
+
+decision_boundary:
+  owns:
+    - release-gate-checklist
+    - deployment-readiness-verdict
+  does_not_own:
+    - ci-cd-pipeline-design
+    - infrastructure-provisioning
+  conflicts_with:
+    - qk-devops-platform
 
 # ── V8: Verification ───────────────────────────────────────
 verification:
@@ -73,19 +85,14 @@ token_budget:
   max_files_read: 3
   max_lines_per_read: 100
   max_shell_commands: 2
-  stop_early: false
+  stop_early: true
 
 exit_codes: [SUCCESS, BLOCKED, FAILED, PARTIAL]
 ---
 
 # qk-production-release — Release Gate
 
-> **Language rule:** Code, identifiers, file names ? English. Explanations, summaries ? Vietnamese.
-
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
+> **Language rule:** Code, identifiers, file names → English. Explanations, summaries → Vietnamese.
 
 ## Preconditions
 - [ ] `qk-validation-gate` has been run and returned SUCCESS or PARTIAL
@@ -98,11 +105,6 @@ On missing precondition:
   Message: "qk-validation-gate must pass before release. Run it first."
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Scope
 - ✅ Run 8-gate release checklist
 - ✅ Verify no dev artifacts in production build
@@ -113,11 +115,6 @@ schema_version: 2
 - ❌ Deploy to infrastructure — that's DevOps/CI system
 - ❌ Skip any gate unless user explicitly overrides
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Priority Order
 
 | Priority | Gate | Block Release? |
@@ -128,14 +125,9 @@ schema_version: 2
 | P4 | .env.production exists (not .env.development) | YES — hard block |
 | P5 | Build succeeds in production mode | YES — hard block |
 | P6 | Bundle size within limit (< 500KB gzipped) | WARN only |
-| P7 | No dev dependencies in production build | YES — hard block |
+| P7 | No dev dependencies in production build. Check vulnerabilities (`npm audit`) | YES — hard block (Nếu có CRITICAL, báo gọi `qk-security-audit`) |
 | P8 | CHANGELOG.md updated with release notes | WARN only |
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Release Checklist (Mandatory)
 
 ```
@@ -149,11 +141,6 @@ schema_version: 2
 [ ] P8: CHANGELOG.md has entry for this release
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Workflow
 
 ### Phase 1 — Pre-flight Checks (P1–P4)
@@ -173,11 +160,6 @@ IF all P1–P4 pass
   → go to Phase 2
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ### Phase 2 — Build & Size Gate (P5–P7)
 
 **Steps:**
@@ -197,11 +179,6 @@ IF production audit has critical/high
   → EXIT: FAILED
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ### Phase 3 — Release Report
 
 Generate signed release report with all gate results.
@@ -218,11 +195,6 @@ IF any hard-block gate failed
   → EXIT: FAILED — do NOT deploy
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Evidence Format
 
 ```
@@ -234,11 +206,6 @@ Actual:     [what was found]
 Fix:        [what must be done before release]
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Escalation Rules
 
 ```
@@ -250,11 +217,6 @@ Questions:
   2. Có bug nào HIGH/CRITICAL chưa fix không?
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Handoff Contract
 
 ### Consumes
@@ -274,11 +236,6 @@ schema_version: 2
 }
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Output Format
 
 ```
@@ -301,28 +258,37 @@ Verdict:    [✅ SAFE TO DEPLOY | ❌ DO NOT DEPLOY — fix: list]
 Exit Code:  [SUCCESS | PARTIAL | BLOCKED | FAILED]
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
-
 ---
 
 ## Confidence Model
 
+| Level | Condition | Action |
+|-------|-----------|--------|
+| HIGH | validation-gate result confirmed + all 8 gates checked directly | Deploy approved |
+| MEDIUM | some gates inferred from partial CI output | Deploy with caution |
+| LOW | validation-gate not run / gate results stale | EXIT: BLOCKED |
 
 ---
 
 ## Severity
 
+| Level | Definition |
+|-------|-----------|
+| CRITICAL | deploying with unresolved P1–P5 hard-block gate failure |
+| HIGH | P6/P7 warning ignored without user override |
+| MEDIUM | CHANGELOG missing |
+| LOW | minor formatting in release report |
 
 ---
 
 ## Retry Policy
 
-
----
+```
+Build fails during Phase 2
+  └─ check syntax vs. environment error
+       ├─ fix and retry once
+       └─ do not retry more than 1 time (risk of masking a real failure)
+```
 ## Exit Codes
 
 | Code | Meaning | When |
@@ -334,4 +300,3 @@ schema_version: 2
 
 ---
 
-

package/.agents/skills/qk-project-bootstrap/SKILL.md

@@ -49,6 +49,8 @@ knowledge_scope:
     - initial-setup
   references:
     - architecture
+    - security
+    - anti-patterns
 
 # ── V8: Verification ───────────────────────────────────────
 verification:
@@ -67,9 +69,7 @@ execution_mode: deterministic
 cost: high
 latency: slow
 risk: low
-side_effects: 
-  - create_files
-  - create_structure
+side_effects: edit_files
 produces: [code, schema, plan]
 consumes: [user-description]
 
@@ -77,14 +77,14 @@ token_budget:
   max_files_read: 1
   max_lines_per_read: 50
   max_shell_commands: 2
-  stop_early: false
+  stop_early: true
 
 exit_codes: [SUCCESS, BLOCKED, FAILED, PARTIAL]
 ---
 
 # qk-project-bootstrap — Project Foundation Builder
 
-> **Language rule:** Code, identifiers, file names ? English. Explanations, summaries ? Vietnamese.
+> **Language rule:** Code, identifiers, file names → English. Explanations, summaries → Vietnamese.
 
 ---
 
@@ -173,6 +173,8 @@ evals/                    # Traceability logs
 [ ] README.md — project description + setup instructions
 [ ] DESIGN.md — (UI projects) brand contract with color/font/spacing tokens
 [ ] evals/scorecard.yaml — (AI/RAG/Workflow projects) eval standard
+[ ] .agents/rules/anti-patterns.md — Bắt buộc phải có (chuẩn V8.3 R-C-09)
+[ ] .agents/rules/security.md — Bắt buộc phải có (chuẩn V8.3 R-SEC-04)
 ```
 -----
 
@@ -204,21 +206,72 @@ evals/                    # Traceability logs
 
 ---
 
-
 ---
 
 ## Workflow
 
+### Phase 1 — Blueprint Selection
+**Steps:**
+1. Assess Preconditions to determine framework/purpose.
+2. Select appropriate blueprint (coding, rag, workflow, enterprise).
+
+**Decision:**
+```
+IF framework/purpose is clear
+  → Confidence: HIGH → go to Phase 2
+ELSE
+  → EXIT: BLOCKED — ask user
+```
+
+### Phase 2 — Scaffold Generation
+**Steps:**
+1. Generate `project.yaml` manifest.
+2. Create directory tree structure based on blueprint.
+3. Configure tooling and generate `DESIGN.md` if UI project.
+
+**Decision:**
+```
+IF directories and files are generated
+  → Confidence: HIGH → go to Phase 3
+ELSE
+  → EXIT: FAILED
+```
+
+### Phase 3 — Verification
+**Steps:**
+1. Check Required Files Checklist against what was actually created.
+2. Ensure no mandatory files are missing.
+
+**Decision:**
+```
+IF all required files exist
+  → EXIT: SUCCESS
+ELSE
+  → EXIT: PARTIAL
+```
 
 ---
 
 ## Evidence Format
 
+```
+[SEVERITY] path/to/expected-file
+Issue:      [MISSING_MANIFEST | MISSING_DESIGN_MD | WRONG_STRUCTURE]
+Confidence: HIGH
+Fix:        [specific file to create]
+```
 
 ---
 
 ## Priority Order
 
+| Priority | Task | Skip Threshold |
+|----------|------|----------------|
+| P1 | project.yaml manifest created | Never |
+| P2 | Core scaffolding per blueprint type | Never |
+| P3 | Tooling config | Budget < 40% |
+| P4 | DESIGN.md for UI projects | Never for UI |
+| P5 | README | Budget < 60% |
 
 ---
 ## Exit Codes
@@ -295,5 +348,3 @@ Recommended Assumptions (if proceeding):
 
 ---
 
-
-

package/.agents/skills/qk-project-health/SKILL.md

@@ -48,6 +48,8 @@ knowledge_scope:
     - codebase-health
   references:
     - architecture
+    - security
+    - anti-patterns
 
 # ── V8: Verification ───────────────────────────────────────
 verification:
@@ -105,8 +107,8 @@ exit_codes: [SUCCESS, BLOCKED, FAILED, PARTIAL]
 
 | Dimension | Max Points | Key Checks |
 |-----------|-----------|------------|
-| Security | 20 | 0 critical CVEs, no hardcoded secrets, auth guards present |
-| Code Quality | 20 | Functions ≤ 30L, complexity ≤ 10, no God Files |
+| Security | 20 | 0 critical CVEs, no hardcoded secrets, auth guards present, **tuân thủ Zero-Trust (R-SEC-04)** |
+| Code Quality | 20 | Functions ≤ 30L, complexity ≤ 10, no God Files, **sạch bóng Anti-patterns (R-C-09)** |
 | Architecture | 20 | Clean layers (UI/Logic/Data separated), no circular imports |
 | Dependencies | 20 | No deprecated packages, no unused deps, versions pinned |
 | Documentation | 20 | README complete, public APIs documented, DESIGN.md exists |

package/.agents/skills/qk-project-memory/SKILL.md

@@ -48,6 +48,8 @@ knowledge_scope:
     - verified-context
   references:
     - architecture
+    - security
+    - anti-patterns
 
 # ── V8: Verification ───────────────────────────────────────
 verification:
@@ -98,7 +100,7 @@ exit_codes: [SUCCESS, BLOCKED, FAILED, PARTIAL]
 ## Non-Goals
 - ❌ Store assumptions or unverified hypotheses
 - ❌ Overwrite architectural rules without explicit user consent
-- ❌ Store sensitive data (env vars, secrets)
+- ❌ Store sensitive data (env vars, secrets). **Tuyệt đối cấm lưu trữ PII, API Keys, raw JWTs, hoặc các bad practices vi phạm R-C-09 vào bộ nhớ dài hạn.**
 
 ---