bigpowers 2.36.0 → 2.38.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.pi/package.json +1 -1
- package/.pi/prompts/audit-code.md +1 -0
- package/.pi/prompts/plan-release.md +2 -0
- package/.pi/prompts/plan-work.md +1 -1
- package/.pi/prompts/request-review.md +1 -0
- package/.pi/skills/audit-code/SKILL.md +1 -0
- package/.pi/skills/plan-release/SKILL.md +2 -0
- package/.pi/skills/plan-work/SKILL.md +1 -1
- package/.pi/skills/request-review/SKILL.md +1 -0
- package/CHANGELOG.md +14 -0
- package/SKILL-INDEX.md +1 -1
- package/audit-code/SKILL.md +1 -0
- package/package.json +1 -1
- package/plan-release/SKILL.md +2 -0
- package/plan-work/SKILL.md +1 -1
- package/request-review/SKILL.md +1 -0
- package/skills-lock.json +4 -4
package/.pi/package.json
CHANGED
|
@@ -25,6 +25,7 @@ Run this self-review before asking anyone else to look at the code. The goal is
|
|
|
25
25
|
- [ ] No `[SLOP]` packages without documented human approval
|
|
26
26
|
- [ ] No secrets in diff (`sk-`, `ghp_`, `AKIA`, `.env` values) — see `guard-git` patterns
|
|
27
27
|
- [ ] OWASP Top 10 spot-check: injection, broken auth, sensitive data exposure, misconfiguration (see `docs/references/security-threats.md`)
|
|
28
|
+
- [ ] Security: diff scanned — no unaddressed HIGH findings (or deviations documented in `specs/security/EXCEPTIONS.md`)
|
|
28
29
|
|
|
29
30
|
### Provenance & Metadata
|
|
30
31
|
|
|
@@ -47,6 +47,8 @@ From the conversation context, define:
|
|
|
47
47
|
|
|
48
48
|
WSJF-sort epics: score = (Business Value + Time Criticality + Risk Reduction) / Job Size. Highest score first.
|
|
49
49
|
|
|
50
|
+
> **Security risk boost:** If an epic's `specs/security/epics/<id>/THREAT_MODEL.md` identifies HIGH or CRITICAL risk, add +2 to the WSJF numerator (BV + TC + RR + 2) to reflect the urgency of addressing security concerns before they ship. Document the boost in the epic's note field in release-plan.yaml.
|
|
51
|
+
|
|
50
52
|
### 2. Write acceptance criteria (Gherkin)
|
|
51
53
|
|
|
52
54
|
For each story, write at least one happy-path and one edge-case scenario (countable format §17 if maturity ≥ 3).
|
package/.pi/prompts/plan-work.md
CHANGED
|
@@ -42,7 +42,7 @@ If this plan touches an existing module, run `assess-impact` first to understand
|
|
|
42
42
|
|
|
43
43
|
2. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
|
|
44
44
|
|
|
45
|
-
3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template.
|
|
45
|
+
3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
|
|
46
46
|
|
|
47
47
|
4. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
|
|
48
48
|
|
|
@@ -25,6 +25,7 @@ Write a self-contained brief for the reviewer agent. Include:
|
|
|
25
25
|
- What CONVENTIONS.md requires
|
|
26
26
|
- What the verify command is
|
|
27
27
|
- What you're most uncertain about (where you want fresh eyes)
|
|
28
|
+
- **Security focus** — If the epic has a `specs/security/epics/<id>/THREAT_MODEL.md`, include the relevant vulnerability categories as reviewer focal points. Also include the false-positive exclusion rules so the reviewer avoids known-safe patterns. Tag the review as `security-sensitive: true` if THREAT_MODEL risk is HIGH+.
|
|
28
29
|
|
|
29
30
|
### 2. Dispatch the reviewer agent
|
|
30
31
|
|
|
@@ -27,6 +27,7 @@ Run this self-review before asking anyone else to look at the code. The goal is
|
|
|
27
27
|
- [ ] No `[SLOP]` packages without documented human approval
|
|
28
28
|
- [ ] No secrets in diff (`sk-`, `ghp_`, `AKIA`, `.env` values) — see `guard-git` patterns
|
|
29
29
|
- [ ] OWASP Top 10 spot-check: injection, broken auth, sensitive data exposure, misconfiguration (see `docs/references/security-threats.md`)
|
|
30
|
+
- [ ] Security: diff scanned — no unaddressed HIGH findings (or deviations documented in `specs/security/EXCEPTIONS.md`)
|
|
30
31
|
|
|
31
32
|
### Provenance & Metadata
|
|
32
33
|
|
|
@@ -49,6 +49,8 @@ From the conversation context, define:
|
|
|
49
49
|
|
|
50
50
|
WSJF-sort epics: score = (Business Value + Time Criticality + Risk Reduction) / Job Size. Highest score first.
|
|
51
51
|
|
|
52
|
+
> **Security risk boost:** If an epic's `specs/security/epics/<id>/THREAT_MODEL.md` identifies HIGH or CRITICAL risk, add +2 to the WSJF numerator (BV + TC + RR + 2) to reflect the urgency of addressing security concerns before they ship. Document the boost in the epic's note field in release-plan.yaml.
|
|
53
|
+
|
|
52
54
|
### 2. Write acceptance criteria (Gherkin)
|
|
53
55
|
|
|
54
56
|
For each story, write at least one happy-path and one edge-case scenario (countable format §17 if maturity ≥ 3).
|
|
@@ -44,7 +44,7 @@ If this plan touches an existing module, run `assess-impact` first to understand
|
|
|
44
44
|
|
|
45
45
|
2. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
|
|
46
46
|
|
|
47
|
-
3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template.
|
|
47
|
+
3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
|
|
48
48
|
|
|
49
49
|
4. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
|
|
50
50
|
|
|
@@ -27,6 +27,7 @@ Write a self-contained brief for the reviewer agent. Include:
|
|
|
27
27
|
- What CONVENTIONS.md requires
|
|
28
28
|
- What the verify command is
|
|
29
29
|
- What you're most uncertain about (where you want fresh eyes)
|
|
30
|
+
- **Security focus** — If the epic has a `specs/security/epics/<id>/THREAT_MODEL.md`, include the relevant vulnerability categories as reviewer focal points. Also include the false-positive exclusion rules so the reviewer avoids known-safe patterns. Tag the review as `security-sensitive: true` if THREAT_MODEL risk is HIGH+.
|
|
30
31
|
|
|
31
32
|
### 2. Dispatch the reviewer agent
|
|
32
33
|
|
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,17 @@
|
|
|
1
|
+
# [2.38.0](https://github.com/danielvm-git/bigpowers/compare/v2.37.0...v2.38.0) (2026-06-27)
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
### Features
|
|
5
|
+
|
|
6
|
+
* **audit-code request-review:** add security gate and focus ([092bc61](https://github.com/danielvm-git/bigpowers/commit/092bc6139764f34babb35d0705eb2b628aa4abf7))
|
|
7
|
+
|
|
8
|
+
# [2.37.0](https://github.com/danielvm-git/bigpowers/compare/v2.36.0...v2.37.0) (2026-06-27)
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
### Features
|
|
12
|
+
|
|
13
|
+
* **plan-work plan-release:** add security field and risk boost ([cf8c516](https://github.com/danielvm-git/bigpowers/commit/cf8c51647629b167a14800ac7db34dc5d44f5922))
|
|
14
|
+
|
|
1
15
|
# [2.36.0](https://github.com/danielvm-git/bigpowers/compare/v2.35.0...v2.36.0) (2026-06-27)
|
|
2
16
|
|
|
3
17
|
|
package/SKILL-INDEX.md
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
> **DO NOT EDIT** — This file is auto-generated by `scripts/generate-skill-index.sh`.
|
|
4
4
|
> Edit `SKILL.md` source files or `skills-lock.json` instead. Run `bash scripts/sync-skills.sh` to regenerate.
|
|
5
5
|
|
|
6
|
-
**Generated:** 2026-06-27T16:
|
|
6
|
+
**Generated:** 2026-06-27T16:39:38Z
|
|
7
7
|
**Skills:** 71
|
|
8
8
|
|
|
9
9
|
---
|
package/audit-code/SKILL.md
CHANGED
|
@@ -26,6 +26,7 @@ Run this self-review before asking anyone else to look at the code. The goal is
|
|
|
26
26
|
- [ ] No `[SLOP]` packages without documented human approval
|
|
27
27
|
- [ ] No secrets in diff (`sk-`, `ghp_`, `AKIA`, `.env` values) — see `guard-git` patterns
|
|
28
28
|
- [ ] OWASP Top 10 spot-check: injection, broken auth, sensitive data exposure, misconfiguration (see `docs/references/security-threats.md`)
|
|
29
|
+
- [ ] Security: diff scanned — no unaddressed HIGH findings (or deviations documented in `specs/security/EXCEPTIONS.md`)
|
|
29
30
|
|
|
30
31
|
### Provenance & Metadata
|
|
31
32
|
|
package/package.json
CHANGED
package/plan-release/SKILL.md
CHANGED
|
@@ -48,6 +48,8 @@ From the conversation context, define:
|
|
|
48
48
|
|
|
49
49
|
WSJF-sort epics: score = (Business Value + Time Criticality + Risk Reduction) / Job Size. Highest score first.
|
|
50
50
|
|
|
51
|
+
> **Security risk boost:** If an epic's `specs/security/epics/<id>/THREAT_MODEL.md` identifies HIGH or CRITICAL risk, add +2 to the WSJF numerator (BV + TC + RR + 2) to reflect the urgency of addressing security concerns before they ship. Document the boost in the epic's note field in release-plan.yaml.
|
|
52
|
+
|
|
51
53
|
### 2. Write acceptance criteria (Gherkin)
|
|
52
54
|
|
|
53
55
|
For each story, write at least one happy-path and one edge-case scenario (countable format §17 if maturity ≥ 3).
|
package/plan-work/SKILL.md
CHANGED
|
@@ -43,7 +43,7 @@ If this plan touches an existing module, run `assess-impact` first to understand
|
|
|
43
43
|
|
|
44
44
|
2. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
|
|
45
45
|
|
|
46
|
-
3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template.
|
|
46
|
+
3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
|
|
47
47
|
|
|
48
48
|
4. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
|
|
49
49
|
|
package/request-review/SKILL.md
CHANGED
|
@@ -26,6 +26,7 @@ Write a self-contained brief for the reviewer agent. Include:
|
|
|
26
26
|
- What CONVENTIONS.md requires
|
|
27
27
|
- What the verify command is
|
|
28
28
|
- What you're most uncertain about (where you want fresh eyes)
|
|
29
|
+
- **Security focus** — If the epic has a `specs/security/epics/<id>/THREAT_MODEL.md`, include the relevant vulnerability categories as reviewer focal points. Also include the false-positive exclusion rules so the reviewer avoids known-safe patterns. Tag the review as `security-sensitive: true` if THREAT_MODEL risk is HIGH+.
|
|
29
30
|
|
|
30
31
|
### 2. Dispatch the reviewer agent
|
|
31
32
|
|
package/skills-lock.json
CHANGED
|
@@ -13,7 +13,7 @@
|
|
|
13
13
|
},
|
|
14
14
|
"audit-code": {
|
|
15
15
|
"description": "Self-review checklist for the coding agent to run before dispatching a reviewer. Checks CONVENTIONS.md compliance, Boy Scout Rule, test coverage, types, and SOLID. Produces a pass/fail checklist. Use before request-review, before committing, or when user asks for a code quality check.",
|
|
16
|
-
"sha256": "
|
|
16
|
+
"sha256": "2e67f9125e0bec7c",
|
|
17
17
|
"path": "audit-code/SKILL.md"
|
|
18
18
|
},
|
|
19
19
|
"audit-plan": {
|
|
@@ -188,12 +188,12 @@
|
|
|
188
188
|
},
|
|
189
189
|
"plan-release": {
|
|
190
190
|
"description": "\"RELEASE-INDEX BUILDER — Sequence elaborated epics into specs/release-plan.yaml with WSJF ordering and BCP baselines. NOT a planning-spine substitute: it does not scope work (scope-work) or write story tasks (plan-work). Use after elaborate-spec when the user wants a versioned release index of epics.\"",
|
|
191
|
-
"sha256": "
|
|
191
|
+
"sha256": "d664fde0d07e88ba",
|
|
192
192
|
"path": "plan-release/SKILL.md"
|
|
193
193
|
},
|
|
194
194
|
"plan-work": {
|
|
195
195
|
"description": "\"PLANNING SPINE STEP 3 of 3 — Plan the work: write detailed implementation tasks into the active epic capsule (specs/epics/eNN-slug/). Produces countable-story-format .md specs and runnable -tasks.yaml files. Use after slice-tasks (step 2). Not a substitute for scope-work (step 1) or slice-tasks (step 2).\"",
|
|
196
|
-
"sha256": "
|
|
196
|
+
"sha256": "30a021b06af25f08",
|
|
197
197
|
"path": "plan-work/SKILL.md"
|
|
198
198
|
},
|
|
199
199
|
"publish-package": {
|
|
@@ -213,7 +213,7 @@
|
|
|
213
213
|
},
|
|
214
214
|
"request-review": {
|
|
215
215
|
"description": "Dispatch a fresh reviewer agent with a clean context to critique the code after audit-code passes. The reviewer has no shared state with the coding agent and gives a genuine second opinion. Use after audit-code passes, before committing, or when user wants an independent code review.",
|
|
216
|
-
"sha256": "
|
|
216
|
+
"sha256": "b2498ecdf55104b6",
|
|
217
217
|
"path": "request-review/SKILL.md"
|
|
218
218
|
},
|
|
219
219
|
"research-first": {
|