bigpowers 2.36.0 → 2.37.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/.pi/package.json +1 -1
  2. package/.pi/prompts/plan-release.md +2 -0
  3. package/.pi/prompts/plan-work.md +1 -1
  4. package/.pi/skills/plan-release/SKILL.md +2 -0
  5. package/.pi/skills/plan-work/SKILL.md +1 -1
  6. package/CHANGELOG.md +7 -0
  7. package/SKILL-INDEX.md +1 -1
  8. package/package.json +1 -1
  9. package/plan-release/SKILL.md +2 -0
  10. package/plan-work/SKILL.md +1 -1
  11. package/skills-lock.json +2 -2
package/.pi/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "bigpowers",
3
- "version": "2.36.0",
3
+ "version": "2.37.0",
4
4
  "description": "71 skills — 70 agent skills for spec-driven, test-first software development by solo developers",
5
5
  "keywords": [
6
6
  "pi-package"
package/.pi/prompts/plan-release.md CHANGED
@@ -47,6 +47,8 @@ From the conversation context, define:
47
47
 
48
48
  WSJF-sort epics: score = (Business Value + Time Criticality + Risk Reduction) / Job Size. Highest score first.
49
49
 
50
+ > **Security risk boost:** If an epic's `specs/security/epics/<id>/THREAT_MODEL.md` identifies HIGH or CRITICAL risk, add +2 to the WSJF numerator (BV + TC + RR + 2) to reflect the urgency of addressing security concerns before they ship. Document the boost in the epic's note field in release-plan.yaml.
51
+
50
52
  ### 2. Write acceptance criteria (Gherkin)
51
53
 
52
54
  For each story, write at least one happy-path and one edge-case scenario (countable format §17 if maturity ≥ 3).
package/.pi/prompts/plan-work.md CHANGED
@@ -42,7 +42,7 @@ If this plan touches an existing module, run `assess-impact` first to understand
42
42
 
43
43
  2. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
44
44
 
45
- 3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template.
45
+ 3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
46
46
 
47
47
  4. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
48
48
 
package/.pi/skills/plan-release/SKILL.md CHANGED
@@ -49,6 +49,8 @@ From the conversation context, define:
49
49
 
50
50
  WSJF-sort epics: score = (Business Value + Time Criticality + Risk Reduction) / Job Size. Highest score first.
51
51
 
52
+ > **Security risk boost:** If an epic's `specs/security/epics/<id>/THREAT_MODEL.md` identifies HIGH or CRITICAL risk, add +2 to the WSJF numerator (BV + TC + RR + 2) to reflect the urgency of addressing security concerns before they ship. Document the boost in the epic's note field in release-plan.yaml.
53
+
52
54
  ### 2. Write acceptance criteria (Gherkin)
53
55
 
54
56
  For each story, write at least one happy-path and one edge-case scenario (countable format §17 if maturity ≥ 3).
package/.pi/skills/plan-work/SKILL.md CHANGED
@@ -44,7 +44,7 @@ If this plan touches an existing module, run `assess-impact` first to understand
44
44
 
45
45
  2. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
46
46
 
47
- 3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template.
47
+ 3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
48
48
 
49
49
  4. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
50
50
 
package/CHANGELOG.md CHANGED
@@ -1,3 +1,10 @@
1
+ # [2.37.0](https://github.com/danielvm-git/bigpowers/compare/v2.36.0...v2.37.0) (2026-06-27)
2
+
3
+
4
+ ### Features
5
+
6
+ * **plan-work plan-release:** add security field and risk boost ([cf8c516](https://github.com/danielvm-git/bigpowers/commit/cf8c51647629b167a14800ac7db34dc5d44f5922))
7
+
1
8
  # [2.36.0](https://github.com/danielvm-git/bigpowers/compare/v2.35.0...v2.36.0) (2026-06-27)
2
9
 
3
10
 
package/SKILL-INDEX.md CHANGED
@@ -3,7 +3,7 @@
3
3
  > **DO NOT EDIT** — This file is auto-generated by `scripts/generate-skill-index.sh`.
4
4
  > Edit `SKILL.md` source files or `skills-lock.json` instead. Run `bash scripts/sync-skills.sh` to regenerate.
5
5
 
6
- **Generated:** 2026-06-27T16:37:32Z
6
+ **Generated:** 2026-06-27T16:38:24Z
7
7
  **Skills:** 71
8
8
 
9
9
  ---
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "bigpowers",
3
- "version": "2.36.0",
3
+ "version": "2.37.0",
4
4
  "description": "70 agent skills for spec-driven, test-first software development by solo developers",
5
5
  "main": "index.js",
6
6
  "scripts": {
package/plan-release/SKILL.md CHANGED
@@ -48,6 +48,8 @@ From the conversation context, define:
48
48
 
49
49
  WSJF-sort epics: score = (Business Value + Time Criticality + Risk Reduction) / Job Size. Highest score first.
50
50
 
51
+ > **Security risk boost:** If an epic's `specs/security/epics/<id>/THREAT_MODEL.md` identifies HIGH or CRITICAL risk, add +2 to the WSJF numerator (BV + TC + RR + 2) to reflect the urgency of addressing security concerns before they ship. Document the boost in the epic's note field in release-plan.yaml.
52
+
51
53
  ### 2. Write acceptance criteria (Gherkin)
52
54
 
53
55
  For each story, write at least one happy-path and one edge-case scenario (countable format §17 if maturity ≥ 3).
package/plan-work/SKILL.md CHANGED
@@ -43,7 +43,7 @@ If this plan touches an existing module, run `assess-impact` first to understand
43
43
 
44
44
  2. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
45
45
 
46
- 3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template.
46
+ 3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
47
47
 
48
48
  4. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
49
49
 
package/skills-lock.json CHANGED
@@ -188,12 +188,12 @@
188
188
  },
189
189
  "plan-release": {
190
190
  "description": "\"RELEASE-INDEX BUILDER — Sequence elaborated epics into specs/release-plan.yaml with WSJF ordering and BCP baselines. NOT a planning-spine substitute: it does not scope work (scope-work) or write story tasks (plan-work). Use after elaborate-spec when the user wants a versioned release index of epics.\"",
191
- "sha256": "352d54fe911757ad",
191
+ "sha256": "d664fde0d07e88ba",
192
192
  "path": "plan-release/SKILL.md"
193
193
  },
194
194
  "plan-work": {
195
195
  "description": "\"PLANNING SPINE STEP 3 of 3 — Plan the work: write detailed implementation tasks into the active epic capsule (specs/epics/eNN-slug/). Produces countable-story-format .md specs and runnable -tasks.yaml files. Use after slice-tasks (step 2). Not a substitute for scope-work (step 1) or slice-tasks (step 2).\"",
196
- "sha256": "2e171101c1e24469",
196
+ "sha256": "30a021b06af25f08",
197
197
  "path": "plan-work/SKILL.md"
198
198
  },
199
199
  "publish-package": {