bigpowers 2.35.0 → 2.37.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.pi/package.json +1 -1
- package/.pi/prompts/build-epic.md +10 -8
- package/.pi/prompts/plan-release.md +2 -0
- package/.pi/prompts/plan-work.md +1 -1
- package/.pi/skills/build-epic/SKILL.md +10 -8
- package/.pi/skills/plan-release/SKILL.md +2 -0
- package/.pi/skills/plan-work/SKILL.md +1 -1
- package/CHANGELOG.md +14 -0
- package/SKILL-INDEX.md +1 -1
- package/build-epic/SKILL.md +10 -8
- package/package.json +1 -1
- package/plan-release/SKILL.md +2 -0
- package/plan-work/SKILL.md +1 -1
- package/skills-lock.json +3 -3
package/.pi/package.json
CHANGED
|
@@ -13,10 +13,11 @@ Orchestrates the **build** flow for a single epic: survey → plan tasks → kic
|
|
|
13
13
|
>
|
|
14
14
|
> **HARD GATE** — Not on `main`/`master` before step 3 (kickoff-branch).
|
|
15
15
|
|
|
16
|
-
##
|
|
16
|
+
## Nine steps (`epic_cycle` in state.yaml)
|
|
17
17
|
|
|
18
18
|
| Step | Skill / action |
|
|
19
19
|
|------|----------------|
|
|
20
|
+
| 0 | `security-review` — threat-model epic scope → `specs/security/epics/<id>/THREAT_MODEL.md` |
|
|
20
21
|
| 1 | `survey-context` — confirm epic + story |
|
|
21
22
|
| 2 | `plan-work` — flesh out story `tasks[]` in `specs/epics/eNN-slug/epic.yaml` |
|
|
22
23
|
| 3 | `kickoff-branch` — feature branch + clean baseline |
|
|
@@ -24,17 +25,18 @@ Orchestrates the **build** flow for a single epic: survey → plan tasks → kic
|
|
|
24
25
|
| 5 | `verify-work` — UAT + mechanical gates |
|
|
25
26
|
| 6 | `audit-code` — **non-optional gate** (pass/fail; fail → loop back to step 4) |
|
|
26
27
|
| 7 | `commit-message` — Conventional Commits draft |
|
|
27
|
-
| 8 | `release-branch` — PR or solo land (supports `--squash-state`) |
|
|
28
|
+
| 8 | `release-branch` — PR or solo land (supports `--squash-state`) | |
|
|
28
29
|
|
|
29
30
|
## Process
|
|
30
31
|
|
|
31
32
|
1. Read `specs/state.yaml`, `specs/execution-status.yaml`, `specs/release-plan.yaml`, active `specs/epics/eNN-slug/epic.yaml`.
|
|
32
|
-
2. **
|
|
33
|
-
3. **
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
33
|
+
2. **Step 0 — Threat Model:** Run `security-review` against the epic's scope (read from the epic capsule). Output `specs/security/epics/<epic-id>/THREAT_MODEL.md` with surface area, vulnerability categories, risk level, and mitigation guidance.
|
|
34
|
+
3. **Assess Impact (Step 2):** Before writing tasks, run `assess-impact --lightweight` on the proposed change. If the risk score exceeds 7, gate — require a `grill-me` session. Write the impact report to `specs/IMPACT-<epic>-<story>.md`. For net-new code with no existing dependents, skip.
|
|
35
|
+
4. **BCP Tracking (Step 2):** After `plan-work` completes, read the `bcps:` count (Business Complexity Points story size) from the epic capsule and carry it into `state.yaml` as `epic_cycle.story_bcps = N`.
|
|
36
|
+
5. If `epic_cycle.step` missing, set to `1`.
|
|
37
|
+
6. Run **only the current step** (resume mode) unless user asked for full auto-run.
|
|
38
|
+
7. After step verify passes, increment `epic_cycle.step` in `state.yaml` (or `bash scripts/bp-yaml-set.sh` if available).
|
|
39
|
+
8. On story complete, set `execution-status.yaml` story key to `done`; run `bash scripts/sync-status-from-epics.sh`.
|
|
38
40
|
|
|
39
41
|
### Step 6 — audit-code gate (non-optional)
|
|
40
42
|
|
|
@@ -47,6 +47,8 @@ From the conversation context, define:
|
|
|
47
47
|
|
|
48
48
|
WSJF-sort epics: score = (Business Value + Time Criticality + Risk Reduction) / Job Size. Highest score first.
|
|
49
49
|
|
|
50
|
+
> **Security risk boost:** If an epic's `specs/security/epics/<id>/THREAT_MODEL.md` identifies HIGH or CRITICAL risk, add +2 to the WSJF numerator (BV + TC + RR + 2) to reflect the urgency of addressing security concerns before they ship. Document the boost in the epic's note field in release-plan.yaml.
|
|
51
|
+
|
|
50
52
|
### 2. Write acceptance criteria (Gherkin)
|
|
51
53
|
|
|
52
54
|
For each story, write at least one happy-path and one edge-case scenario (countable format §17 if maturity ≥ 3).
|
package/.pi/prompts/plan-work.md
CHANGED
|
@@ -42,7 +42,7 @@ If this plan touches an existing module, run `assess-impact` first to understand
|
|
|
42
42
|
|
|
43
43
|
2. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
|
|
44
44
|
|
|
45
|
-
3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template.
|
|
45
|
+
3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
|
|
46
46
|
|
|
47
47
|
4. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
|
|
48
48
|
|
|
@@ -15,10 +15,11 @@ Orchestrates the **build** flow for a single epic: survey → plan tasks → kic
|
|
|
15
15
|
>
|
|
16
16
|
> **HARD GATE** — Not on `main`/`master` before step 3 (kickoff-branch).
|
|
17
17
|
|
|
18
|
-
##
|
|
18
|
+
## Nine steps (`epic_cycle` in state.yaml)
|
|
19
19
|
|
|
20
20
|
| Step | Skill / action |
|
|
21
21
|
|------|----------------|
|
|
22
|
+
| 0 | `security-review` — threat-model epic scope → `specs/security/epics/<id>/THREAT_MODEL.md` |
|
|
22
23
|
| 1 | `survey-context` — confirm epic + story |
|
|
23
24
|
| 2 | `plan-work` — flesh out story `tasks[]` in `specs/epics/eNN-slug/epic.yaml` |
|
|
24
25
|
| 3 | `kickoff-branch` — feature branch + clean baseline |
|
|
@@ -26,17 +27,18 @@ Orchestrates the **build** flow for a single epic: survey → plan tasks → kic
|
|
|
26
27
|
| 5 | `verify-work` — UAT + mechanical gates |
|
|
27
28
|
| 6 | `audit-code` — **non-optional gate** (pass/fail; fail → loop back to step 4) |
|
|
28
29
|
| 7 | `commit-message` — Conventional Commits draft |
|
|
29
|
-
| 8 | `release-branch` — PR or solo land (supports `--squash-state`) |
|
|
30
|
+
| 8 | `release-branch` — PR or solo land (supports `--squash-state`) | |
|
|
30
31
|
|
|
31
32
|
## Process
|
|
32
33
|
|
|
33
34
|
1. Read `specs/state.yaml`, `specs/execution-status.yaml`, `specs/release-plan.yaml`, active `specs/epics/eNN-slug/epic.yaml`.
|
|
34
|
-
2. **
|
|
35
|
-
3. **
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
35
|
+
2. **Step 0 — Threat Model:** Run `security-review` against the epic's scope (read from the epic capsule). Output `specs/security/epics/<epic-id>/THREAT_MODEL.md` with surface area, vulnerability categories, risk level, and mitigation guidance.
|
|
36
|
+
3. **Assess Impact (Step 2):** Before writing tasks, run `assess-impact --lightweight` on the proposed change. If the risk score exceeds 7, gate — require a `grill-me` session. Write the impact report to `specs/IMPACT-<epic>-<story>.md`. For net-new code with no existing dependents, skip.
|
|
37
|
+
4. **BCP Tracking (Step 2):** After `plan-work` completes, read the `bcps:` count (Business Complexity Points story size) from the epic capsule and carry it into `state.yaml` as `epic_cycle.story_bcps = N`.
|
|
38
|
+
5. If `epic_cycle.step` missing, set to `1`.
|
|
39
|
+
6. Run **only the current step** (resume mode) unless user asked for full auto-run.
|
|
40
|
+
7. After step verify passes, increment `epic_cycle.step` in `state.yaml` (or `bash scripts/bp-yaml-set.sh` if available).
|
|
41
|
+
8. On story complete, set `execution-status.yaml` story key to `done`; run `bash scripts/sync-status-from-epics.sh`.
|
|
40
42
|
|
|
41
43
|
### Step 6 — audit-code gate (non-optional)
|
|
42
44
|
|
|
@@ -49,6 +49,8 @@ From the conversation context, define:
|
|
|
49
49
|
|
|
50
50
|
WSJF-sort epics: score = (Business Value + Time Criticality + Risk Reduction) / Job Size. Highest score first.
|
|
51
51
|
|
|
52
|
+
> **Security risk boost:** If an epic's `specs/security/epics/<id>/THREAT_MODEL.md` identifies HIGH or CRITICAL risk, add +2 to the WSJF numerator (BV + TC + RR + 2) to reflect the urgency of addressing security concerns before they ship. Document the boost in the epic's note field in release-plan.yaml.
|
|
53
|
+
|
|
52
54
|
### 2. Write acceptance criteria (Gherkin)
|
|
53
55
|
|
|
54
56
|
For each story, write at least one happy-path and one edge-case scenario (countable format §17 if maturity ≥ 3).
|
|
@@ -44,7 +44,7 @@ If this plan touches an existing module, run `assess-impact` first to understand
|
|
|
44
44
|
|
|
45
45
|
2. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
|
|
46
46
|
|
|
47
|
-
3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template.
|
|
47
|
+
3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
|
|
48
48
|
|
|
49
49
|
4. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
|
|
50
50
|
|
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,17 @@
|
|
|
1
|
+
# [2.37.0](https://github.com/danielvm-git/bigpowers/compare/v2.36.0...v2.37.0) (2026-06-27)
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
### Features
|
|
5
|
+
|
|
6
|
+
* **plan-work plan-release:** add security field and risk boost ([cf8c516](https://github.com/danielvm-git/bigpowers/commit/cf8c51647629b167a14800ac7db34dc5d44f5922))
|
|
7
|
+
|
|
8
|
+
# [2.36.0](https://github.com/danielvm-git/bigpowers/compare/v2.35.0...v2.36.0) (2026-06-27)
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
### Features
|
|
12
|
+
|
|
13
|
+
* **build-epic:** add Step 0 threat model to epic cycle ([9977f3e](https://github.com/danielvm-git/bigpowers/commit/9977f3e491b9cdefef644e145fa2331fe0ce1154))
|
|
14
|
+
|
|
1
15
|
# [2.35.0](https://github.com/danielvm-git/bigpowers/compare/v2.34.2...v2.35.0) (2026-06-27)
|
|
2
16
|
|
|
3
17
|
|
package/SKILL-INDEX.md
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
> **DO NOT EDIT** — This file is auto-generated by `scripts/generate-skill-index.sh`.
|
|
4
4
|
> Edit `SKILL.md` source files or `skills-lock.json` instead. Run `bash scripts/sync-skills.sh` to regenerate.
|
|
5
5
|
|
|
6
|
-
**Generated:** 2026-06-27T16:
|
|
6
|
+
**Generated:** 2026-06-27T16:38:24Z
|
|
7
7
|
**Skills:** 71
|
|
8
8
|
|
|
9
9
|
---
|
package/build-epic/SKILL.md
CHANGED
|
@@ -14,10 +14,11 @@ Orchestrates the **build** flow for a single epic: survey → plan tasks → kic
|
|
|
14
14
|
>
|
|
15
15
|
> **HARD GATE** — Not on `main`/`master` before step 3 (kickoff-branch).
|
|
16
16
|
|
|
17
|
-
##
|
|
17
|
+
## Nine steps (`epic_cycle` in state.yaml)
|
|
18
18
|
|
|
19
19
|
| Step | Skill / action |
|
|
20
20
|
|------|----------------|
|
|
21
|
+
| 0 | `security-review` — threat-model epic scope → `specs/security/epics/<id>/THREAT_MODEL.md` |
|
|
21
22
|
| 1 | `survey-context` — confirm epic + story |
|
|
22
23
|
| 2 | `plan-work` — flesh out story `tasks[]` in `specs/epics/eNN-slug/epic.yaml` |
|
|
23
24
|
| 3 | `kickoff-branch` — feature branch + clean baseline |
|
|
@@ -25,17 +26,18 @@ Orchestrates the **build** flow for a single epic: survey → plan tasks → kic
|
|
|
25
26
|
| 5 | `verify-work` — UAT + mechanical gates |
|
|
26
27
|
| 6 | `audit-code` — **non-optional gate** (pass/fail; fail → loop back to step 4) |
|
|
27
28
|
| 7 | `commit-message` — Conventional Commits draft |
|
|
28
|
-
| 8 | `release-branch` — PR or solo land (supports `--squash-state`) |
|
|
29
|
+
| 8 | `release-branch` — PR or solo land (supports `--squash-state`) | |
|
|
29
30
|
|
|
30
31
|
## Process
|
|
31
32
|
|
|
32
33
|
1. Read `specs/state.yaml`, `specs/execution-status.yaml`, `specs/release-plan.yaml`, active `specs/epics/eNN-slug/epic.yaml`.
|
|
33
|
-
2. **
|
|
34
|
-
3. **
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
34
|
+
2. **Step 0 — Threat Model:** Run `security-review` against the epic's scope (read from the epic capsule). Output `specs/security/epics/<epic-id>/THREAT_MODEL.md` with surface area, vulnerability categories, risk level, and mitigation guidance.
|
|
35
|
+
3. **Assess Impact (Step 2):** Before writing tasks, run `assess-impact --lightweight` on the proposed change. If the risk score exceeds 7, gate — require a `grill-me` session. Write the impact report to `specs/IMPACT-<epic>-<story>.md`. For net-new code with no existing dependents, skip.
|
|
36
|
+
4. **BCP Tracking (Step 2):** After `plan-work` completes, read the `bcps:` count (Business Complexity Points story size) from the epic capsule and carry it into `state.yaml` as `epic_cycle.story_bcps = N`.
|
|
37
|
+
5. If `epic_cycle.step` missing, set to `1`.
|
|
38
|
+
6. Run **only the current step** (resume mode) unless user asked for full auto-run.
|
|
39
|
+
7. After step verify passes, increment `epic_cycle.step` in `state.yaml` (or `bash scripts/bp-yaml-set.sh` if available).
|
|
40
|
+
8. On story complete, set `execution-status.yaml` story key to `done`; run `bash scripts/sync-status-from-epics.sh`.
|
|
39
41
|
|
|
40
42
|
### Step 6 — audit-code gate (non-optional)
|
|
41
43
|
|
package/package.json
CHANGED
package/plan-release/SKILL.md
CHANGED
|
@@ -48,6 +48,8 @@ From the conversation context, define:
|
|
|
48
48
|
|
|
49
49
|
WSJF-sort epics: score = (Business Value + Time Criticality + Risk Reduction) / Job Size. Highest score first.
|
|
50
50
|
|
|
51
|
+
> **Security risk boost:** If an epic's `specs/security/epics/<id>/THREAT_MODEL.md` identifies HIGH or CRITICAL risk, add +2 to the WSJF numerator (BV + TC + RR + 2) to reflect the urgency of addressing security concerns before they ship. Document the boost in the epic's note field in release-plan.yaml.
|
|
52
|
+
|
|
51
53
|
### 2. Write acceptance criteria (Gherkin)
|
|
52
54
|
|
|
53
55
|
For each story, write at least one happy-path and one edge-case scenario (countable format §17 if maturity ≥ 3).
|
package/plan-work/SKILL.md
CHANGED
|
@@ -43,7 +43,7 @@ If this plan touches an existing module, run `assess-impact` first to understand
|
|
|
43
43
|
|
|
44
44
|
2. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
|
|
45
45
|
|
|
46
|
-
3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template.
|
|
46
|
+
3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
|
|
47
47
|
|
|
48
48
|
4. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
|
|
49
49
|
|
package/skills-lock.json
CHANGED
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
},
|
|
24
24
|
"build-epic": {
|
|
25
25
|
"description": "Eight-step epic build cycle — reads state.yaml, execution-status.yaml, and one epic capsule; updates status via bp-yaml-set or direct edit. Resume mode runs one step per invocation. Use instead of ad-hoc execute-plan for release work.",
|
|
26
|
-
"sha256": "
|
|
26
|
+
"sha256": "565d8396889dd9c9",
|
|
27
27
|
"path": "build-epic/SKILL.md"
|
|
28
28
|
},
|
|
29
29
|
"change-request": {
|
|
@@ -188,12 +188,12 @@
|
|
|
188
188
|
},
|
|
189
189
|
"plan-release": {
|
|
190
190
|
"description": "\"RELEASE-INDEX BUILDER — Sequence elaborated epics into specs/release-plan.yaml with WSJF ordering and BCP baselines. NOT a planning-spine substitute: it does not scope work (scope-work) or write story tasks (plan-work). Use after elaborate-spec when the user wants a versioned release index of epics.\"",
|
|
191
|
-
"sha256": "
|
|
191
|
+
"sha256": "d664fde0d07e88ba",
|
|
192
192
|
"path": "plan-release/SKILL.md"
|
|
193
193
|
},
|
|
194
194
|
"plan-work": {
|
|
195
195
|
"description": "\"PLANNING SPINE STEP 3 of 3 — Plan the work: write detailed implementation tasks into the active epic capsule (specs/epics/eNN-slug/). Produces countable-story-format .md specs and runnable -tasks.yaml files. Use after slice-tasks (step 2). Not a substitute for scope-work (step 1) or slice-tasks (step 2).\"",
|
|
196
|
-
"sha256": "
|
|
196
|
+
"sha256": "30a021b06af25f08",
|
|
197
197
|
"path": "plan-work/SKILL.md"
|
|
198
198
|
},
|
|
199
199
|
"publish-package": {
|