bigpowers 2.38.0 → 2.40.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/.pi/package.json +1 -1
  2. package/.pi/prompts/release-branch.md +7 -0
  3. package/.pi/prompts/verify-work.md +3 -2
  4. package/.pi/skills/release-branch/SKILL.md +7 -0
  5. package/.pi/skills/verify-work/SKILL.md +3 -2
  6. package/CHANGELOG.md +14 -0
  7. package/SKILL-INDEX.md +1 -1
  8. package/package.json +1 -1
  9. package/release-branch/SKILL.md +7 -0
  10. package/skills-lock.json +2 -2
  11. package/verify-work/SKILL.md +3 -2
package/.pi/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "bigpowers",
3
- "version": "2.38.0",
3
+ "version": "2.40.0",
4
4
  "description": "71 skills — 70 agent skills for spec-driven, test-first software development by solo developers",
5
5
  "keywords": [
6
6
  "pi-package"
package/.pi/prompts/release-branch.md CHANGED
@@ -44,6 +44,13 @@ git log main...HEAD --oneline | grep -vE "^[a-f0-9]+ (feat|fix|docs|style|refact
44
44
 
45
45
  - [ ] Overall coverage ≥ 80%; business logic coverage ≥ 95%
46
46
 
47
+ ### 2a. Security gate
48
+
49
+ - [ ] `specs/security/REVIEW.md` exists and is fresh (matches current branch diff)
50
+ - [ ] No unresolved HIGH findings with confidence ≥ 8 (or all documented in `specs/security/EXCEPTIONS.md` with sign-off rationale)
51
+
52
+ If REVIEW.md is missing or stale → run `security-review` inline. Findings block the merge unless documented in EXCEPTIONS.md.
53
+
47
54
  ### 3. Diff review
48
55
 
49
56
  - [ ] All commits intentional, no secrets, CONVENTIONS.md compliance
package/.pi/prompts/verify-work.md CHANGED
@@ -33,8 +33,9 @@ Review answers "is the code good?"; Verify answers "does the built thing do what
33
33
  2. **Cold-start smoke** (if app): stop server, clear caches, boot from scratch.
34
34
  3. **AGENTS.md preflight** — before running default checks, call `bash scripts/bp-read-agents.sh` to detect project-specific commands. If `BP_PREFLIGHT` is set, run it instead of the default mechanical gates (or in addition to them if the project requires both). Output: `"Using preflight from AGENTS.md: <cmd>"`. Fall back to `CLAUDE.md` commands if AGENTS.md is absent.
35
35
  4. Mechanical gates: build → typecheck → lint → tests (from `CLAUDE.md` or AGENTS.md).
36
- 5. **Step-by-step UAT** — one user-observable action at a time.
37
- 6. **Gaps loop** — failures → log → `plan-work` → re-verify.
36
+ 5. **Security scan** — run `security-review` against the git diff (working tree vs merge-base). Parse findings report. If any HIGH findings with confidence ≥ 8 exist → **block the gate**. Write findings to `specs/security/REVIEW.md`. Allow documented exceptions via `specs/security/EXCEPTIONS.md`. MEDIUM/LOW findings warn but don't block.
37
+ 6. **Step-by-step UAT** — one user-observable action at a time.
38
+ 7. **Gaps loop** — failures → log → `plan-work` → re-verify. Unaddressed HIGH findings from step 5 feed into this loop alongside other quality gaps.
38
39
 
39
40
  ## Verify sub-operations
40
41
 
package/.pi/skills/release-branch/SKILL.md CHANGED
@@ -46,6 +46,13 @@ git log main...HEAD --oneline | grep -vE "^[a-f0-9]+ (feat|fix|docs|style|refact
46
46
 
47
47
  - [ ] Overall coverage ≥ 80%; business logic coverage ≥ 95%
48
48
 
49
+ ### 2a. Security gate
50
+
51
+ - [ ] `specs/security/REVIEW.md` exists and is fresh (matches current branch diff)
52
+ - [ ] No unresolved HIGH findings with confidence ≥ 8 (or all documented in `specs/security/EXCEPTIONS.md` with sign-off rationale)
53
+
54
+ If REVIEW.md is missing or stale → run `security-review` inline. Findings block the merge unless documented in EXCEPTIONS.md.
55
+
49
56
  ### 3. Diff review
50
57
 
51
58
  - [ ] All commits intentional, no secrets, CONVENTIONS.md compliance
package/.pi/skills/verify-work/SKILL.md CHANGED
@@ -35,8 +35,9 @@ Review answers "is the code good?"; Verify answers "does the built thing do what
35
35
  2. **Cold-start smoke** (if app): stop server, clear caches, boot from scratch.
36
36
  3. **AGENTS.md preflight** — before running default checks, call `bash scripts/bp-read-agents.sh` to detect project-specific commands. If `BP_PREFLIGHT` is set, run it instead of the default mechanical gates (or in addition to them if the project requires both). Output: `"Using preflight from AGENTS.md: <cmd>"`. Fall back to `CLAUDE.md` commands if AGENTS.md is absent.
37
37
  4. Mechanical gates: build → typecheck → lint → tests (from `CLAUDE.md` or AGENTS.md).
38
- 5. **Step-by-step UAT** — one user-observable action at a time.
39
- 6. **Gaps loop** — failures → log → `plan-work` → re-verify.
38
+ 5. **Security scan** — run `security-review` against the git diff (working tree vs merge-base). Parse findings report. If any HIGH findings with confidence ≥ 8 exist → **block the gate**. Write findings to `specs/security/REVIEW.md`. Allow documented exceptions via `specs/security/EXCEPTIONS.md`. MEDIUM/LOW findings warn but don't block.
39
+ 6. **Step-by-step UAT** — one user-observable action at a time.
40
+ 7. **Gaps loop** — failures → log → `plan-work` → re-verify. Unaddressed HIGH findings from step 5 feed into this loop alongside other quality gaps.
40
41
 
41
42
  ## Verify sub-operations
42
43
 
package/CHANGELOG.md CHANGED
@@ -1,3 +1,17 @@
1
+ # [2.40.0](https://github.com/danielvm-git/bigpowers/compare/v2.39.0...v2.40.0) (2026-06-27)
2
+
3
+
4
+ ### Features
5
+
6
+ * **release-branch:** add security gate before diff review ([c861f40](https://github.com/danielvm-git/bigpowers/commit/c861f404b417d68fbc500df7b98e532c0a6d3d81))
7
+
8
+ # [2.39.0](https://github.com/danielvm-git/bigpowers/compare/v2.38.0...v2.39.0) (2026-06-27)
9
+
10
+
11
+ ### Features
12
+
13
+ * **verify-work:** add Phase 5 security scan gate ([a0a8b1e](https://github.com/danielvm-git/bigpowers/commit/a0a8b1e4362a727bc642c70e037c478ba45b25c1))
14
+
1
15
  # [2.38.0](https://github.com/danielvm-git/bigpowers/compare/v2.37.0...v2.38.0) (2026-06-27)
2
16
 
3
17
 
package/SKILL-INDEX.md CHANGED
@@ -3,7 +3,7 @@
3
3
  > **DO NOT EDIT** — This file is auto-generated by `scripts/generate-skill-index.sh`.
4
4
  > Edit `SKILL.md` source files or `skills-lock.json` instead. Run `bash scripts/sync-skills.sh` to regenerate.
5
5
 
6
- **Generated:** 2026-06-27T16:39:38Z
6
+ **Generated:** 2026-06-27T16:41:01Z
7
7
  **Skills:** 71
8
8
 
9
9
  ---
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "bigpowers",
3
- "version": "2.38.0",
3
+ "version": "2.40.0",
4
4
  "description": "70 agent skills for spec-driven, test-first software development by solo developers",
5
5
  "main": "index.js",
6
6
  "scripts": {
package/release-branch/SKILL.md CHANGED
@@ -45,6 +45,13 @@ git log main...HEAD --oneline | grep -vE "^[a-f0-9]+ (feat|fix|docs|style|refact
45
45
 
46
46
  - [ ] Overall coverage ≥ 80%; business logic coverage ≥ 95%
47
47
 
48
+ ### 2a. Security gate
49
+
50
+ - [ ] `specs/security/REVIEW.md` exists and is fresh (matches current branch diff)
51
+ - [ ] No unresolved HIGH findings with confidence ≥ 8 (or all documented in `specs/security/EXCEPTIONS.md` with sign-off rationale)
52
+
53
+ If REVIEW.md is missing or stale → run `security-review` inline. Findings block the merge unless documented in EXCEPTIONS.md.
54
+
48
55
  ### 3. Diff review
49
56
 
50
57
  - [ ] All commits intentional, no secrets, CONVENTIONS.md compliance
package/skills-lock.json CHANGED
@@ -208,7 +208,7 @@
208
208
  },
209
209
  "release-branch": {
210
210
  "description": "Make the merge/PR/keep/discard decision for a feature branch, verify coverage gates, create the PR with gh, and clean up the worktree. Use when a feature is done and ready to ship, or when user says \"release\", \"merge\", or \"open a PR\".",
211
- "sha256": "fd5e968246ce07bd",
211
+ "sha256": "0514cbd9163e4e87",
212
212
  "path": "release-branch/SKILL.md"
213
213
  },
214
214
  "request-review": {
@@ -333,7 +333,7 @@
333
333
  },
334
334
  "verify-work": {
335
335
  "description": "Multi-phase UAT gate — cold-start smoke, build, typecheck, lint, tests, step-by-step manual verification, gaps-closure loop. Use after execute-plan or develop-tdd, before audit-code.",
336
- "sha256": "44f96eac8380c15b",
336
+ "sha256": "7ea4ccf0ed1303fb",
337
337
  "path": "verify-work/SKILL.md"
338
338
  },
339
339
  "visual-dashboard": {
package/verify-work/SKILL.md CHANGED
@@ -34,8 +34,9 @@ Review answers "is the code good?"; Verify answers "does the built thing do what
34
34
  2. **Cold-start smoke** (if app): stop server, clear caches, boot from scratch.
35
35
  3. **AGENTS.md preflight** — before running default checks, call `bash scripts/bp-read-agents.sh` to detect project-specific commands. If `BP_PREFLIGHT` is set, run it instead of the default mechanical gates (or in addition to them if the project requires both). Output: `"Using preflight from AGENTS.md: <cmd>"`. Fall back to `CLAUDE.md` commands if AGENTS.md is absent.
36
36
  4. Mechanical gates: build → typecheck → lint → tests (from `CLAUDE.md` or AGENTS.md).
37
- 5. **Step-by-step UAT** — one user-observable action at a time.
38
- 6. **Gaps loop** — failures → log → `plan-work` → re-verify.
37
+ 5. **Security scan** — run `security-review` against the git diff (working tree vs merge-base). Parse findings report. If any HIGH findings with confidence ≥ 8 exist → **block the gate**. Write findings to `specs/security/REVIEW.md`. Allow documented exceptions via `specs/security/EXCEPTIONS.md`. MEDIUM/LOW findings warn but don't block.
38
+ 6. **Step-by-step UAT** — one user-observable action at a time.
39
+ 7. **Gaps loop** — failures → log → `plan-work` → re-verify. Unaddressed HIGH findings from step 5 feed into this loop alongside other quality gaps.
39
40
 
40
41
  ## Verify sub-operations
41
42