bigpowers 2.39.0 → 2.41.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.pi/package.json +1 -1
- package/.pi/prompts/investigate-bug.md +2 -0
- package/.pi/prompts/release-branch.md +7 -0
- package/.pi/prompts/validate-fix.md +5 -0
- package/.pi/skills/investigate-bug/SKILL.md +2 -0
- package/.pi/skills/release-branch/SKILL.md +7 -0
- package/.pi/skills/validate-fix/SKILL.md +5 -0
- package/CHANGELOG.md +14 -0
- package/SKILL-INDEX.md +1 -1
- package/investigate-bug/SKILL.md +2 -0
- package/package.json +1 -1
- package/release-branch/SKILL.md +7 -0
- package/skills-lock.json +3 -3
- package/validate-fix/SKILL.md +5 -0
package/.pi/package.json
CHANGED
|
@@ -25,6 +25,8 @@ Get a brief description of the issue from the user. If they haven't provided one
|
|
|
25
25
|
|
|
26
26
|
Do NOT ask follow-up questions yet. Start investigating immediately.
|
|
27
27
|
|
|
28
|
+
> **Security-impact assessment** — After capturing the problem, assess and document: `Security impact: NONE / LOW / MEDIUM / HIGH / CRITICAL`. If HIGH or CRITICAL, assign bug severity HIGH and document the exploit path in findings. If MEDIUM+, include exploit path in the bug file. Document "no security exploit path identified" for NONE/LOW.
|
|
29
|
+
|
|
28
30
|
### 2. Explore and diagnose (4-phase RCA)
|
|
29
31
|
|
|
30
32
|
Run the 4-phase root-cause analysis via the `diagnose-root` skill (Reproduce → Isolate → Hypothesize → Verify). That skill is the canonical RCA engine — do not re-implement the phases here.
|
|
@@ -44,6 +44,13 @@ git log main...HEAD --oneline | grep -vE "^[a-f0-9]+ (feat|fix|docs|style|refact
|
|
|
44
44
|
|
|
45
45
|
- [ ] Overall coverage ≥ 80%; business logic coverage ≥ 95%
|
|
46
46
|
|
|
47
|
+
### 2a. Security gate
|
|
48
|
+
|
|
49
|
+
- [ ] `specs/security/REVIEW.md` exists and is fresh (matches current branch diff)
|
|
50
|
+
- [ ] No unresolved HIGH findings with confidence ≥ 8 (or all documented in `specs/security/EXCEPTIONS.md` with sign-off rationale)
|
|
51
|
+
|
|
52
|
+
If REVIEW.md is missing or stale → run `security-review` inline. Findings block the merge unless documented in EXCEPTIONS.md.
|
|
53
|
+
|
|
47
54
|
### 3. Diff review
|
|
48
55
|
|
|
49
56
|
- [ ] All commits intentional, no secrets, CONVENTIONS.md compliance
|
|
@@ -60,6 +60,11 @@ For every bug fixed, add at least one prevention layer:
|
|
|
60
60
|
- [ ] At least one hardening mechanism added
|
|
61
61
|
- [ ] Hardening mechanism is tested
|
|
62
62
|
|
|
63
|
+
> **Security recurrence hardening** — If the bug's security-impact assessment (from investigate-bug) was MEDIUM or higher, additionally check:
|
|
64
|
+
> - [ ] Security regression test added (covers the exploit path)
|
|
65
|
+
> - [ ] False-positive exclusion rule added (if applicable)
|
|
66
|
+
> - [ ] Threat model updated (if impact was HIGH+)
|
|
67
|
+
|
|
63
68
|
### 6. Update the bug file and registry.yaml
|
|
64
69
|
|
|
65
70
|
Find the most recent `specs/bugs/BUG-*.md` file and append the resolution:
|
|
@@ -27,6 +27,8 @@ Get a brief description of the issue from the user. If they haven't provided one
|
|
|
27
27
|
|
|
28
28
|
Do NOT ask follow-up questions yet. Start investigating immediately.
|
|
29
29
|
|
|
30
|
+
> **Security-impact assessment** — After capturing the problem, assess and document: `Security impact: NONE / LOW / MEDIUM / HIGH / CRITICAL`. If HIGH or CRITICAL, assign bug severity HIGH and document the exploit path in findings. If MEDIUM+, include exploit path in the bug file. Document "no security exploit path identified" for NONE/LOW.
|
|
31
|
+
|
|
30
32
|
### 2. Explore and diagnose (4-phase RCA)
|
|
31
33
|
|
|
32
34
|
Run the 4-phase root-cause analysis via the `diagnose-root` skill (Reproduce → Isolate → Hypothesize → Verify). That skill is the canonical RCA engine — do not re-implement the phases here.
|
|
@@ -46,6 +46,13 @@ git log main...HEAD --oneline | grep -vE "^[a-f0-9]+ (feat|fix|docs|style|refact
|
|
|
46
46
|
|
|
47
47
|
- [ ] Overall coverage ≥ 80%; business logic coverage ≥ 95%
|
|
48
48
|
|
|
49
|
+
### 2a. Security gate
|
|
50
|
+
|
|
51
|
+
- [ ] `specs/security/REVIEW.md` exists and is fresh (matches current branch diff)
|
|
52
|
+
- [ ] No unresolved HIGH findings with confidence ≥ 8 (or all documented in `specs/security/EXCEPTIONS.md` with sign-off rationale)
|
|
53
|
+
|
|
54
|
+
If REVIEW.md is missing or stale → run `security-review` inline. Findings block the merge unless documented in EXCEPTIONS.md.
|
|
55
|
+
|
|
49
56
|
### 3. Diff review
|
|
50
57
|
|
|
51
58
|
- [ ] All commits intentional, no secrets, CONVENTIONS.md compliance
|
|
@@ -62,6 +62,11 @@ For every bug fixed, add at least one prevention layer:
|
|
|
62
62
|
- [ ] At least one hardening mechanism added
|
|
63
63
|
- [ ] Hardening mechanism is tested
|
|
64
64
|
|
|
65
|
+
> **Security recurrence hardening** — If the bug's security-impact assessment (from investigate-bug) was MEDIUM or higher, additionally check:
|
|
66
|
+
> - [ ] Security regression test added (covers the exploit path)
|
|
67
|
+
> - [ ] False-positive exclusion rule added (if applicable)
|
|
68
|
+
> - [ ] Threat model updated (if impact was HIGH+)
|
|
69
|
+
|
|
65
70
|
### 6. Update the bug file and registry.yaml
|
|
66
71
|
|
|
67
72
|
Find the most recent `specs/bugs/BUG-*.md` file and append the resolution:
|
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,17 @@
|
|
|
1
|
+
# [2.41.0](https://github.com/danielvm-git/bigpowers/compare/v2.40.0...v2.41.0) (2026-06-27)
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
### Features
|
|
5
|
+
|
|
6
|
+
* **investigate-bug validate-fix:** add security impact and hardening ([b67ca83](https://github.com/danielvm-git/bigpowers/commit/b67ca8343a39a51dab6305897e0ba81cc7d5623c))
|
|
7
|
+
|
|
8
|
+
# [2.40.0](https://github.com/danielvm-git/bigpowers/compare/v2.39.0...v2.40.0) (2026-06-27)
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
### Features
|
|
12
|
+
|
|
13
|
+
* **release-branch:** add security gate before diff review ([c861f40](https://github.com/danielvm-git/bigpowers/commit/c861f404b417d68fbc500df7b98e532c0a6d3d81))
|
|
14
|
+
|
|
1
15
|
# [2.39.0](https://github.com/danielvm-git/bigpowers/compare/v2.38.0...v2.39.0) (2026-06-27)
|
|
2
16
|
|
|
3
17
|
|
package/SKILL-INDEX.md
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
> **DO NOT EDIT** — This file is auto-generated by `scripts/generate-skill-index.sh`.
|
|
4
4
|
> Edit `SKILL.md` source files or `skills-lock.json` instead. Run `bash scripts/sync-skills.sh` to regenerate.
|
|
5
5
|
|
|
6
|
-
**Generated:** 2026-06-27T16:
|
|
6
|
+
**Generated:** 2026-06-27T16:42:29Z
|
|
7
7
|
**Skills:** 71
|
|
8
8
|
|
|
9
9
|
---
|
package/investigate-bug/SKILL.md
CHANGED
|
@@ -26,6 +26,8 @@ Get a brief description of the issue from the user. If they haven't provided one
|
|
|
26
26
|
|
|
27
27
|
Do NOT ask follow-up questions yet. Start investigating immediately.
|
|
28
28
|
|
|
29
|
+
> **Security-impact assessment** — After capturing the problem, assess and document: `Security impact: NONE / LOW / MEDIUM / HIGH / CRITICAL`. If HIGH or CRITICAL, assign bug severity HIGH and document the exploit path in findings. If MEDIUM+, include exploit path in the bug file. Document "no security exploit path identified" for NONE/LOW.
|
|
30
|
+
|
|
29
31
|
### 2. Explore and diagnose (4-phase RCA)
|
|
30
32
|
|
|
31
33
|
Run the 4-phase root-cause analysis via the `diagnose-root` skill (Reproduce → Isolate → Hypothesize → Verify). That skill is the canonical RCA engine — do not re-implement the phases here.
|
package/package.json
CHANGED
package/release-branch/SKILL.md
CHANGED
|
@@ -45,6 +45,13 @@ git log main...HEAD --oneline | grep -vE "^[a-f0-9]+ (feat|fix|docs|style|refact
|
|
|
45
45
|
|
|
46
46
|
- [ ] Overall coverage ≥ 80%; business logic coverage ≥ 95%
|
|
47
47
|
|
|
48
|
+
### 2a. Security gate
|
|
49
|
+
|
|
50
|
+
- [ ] `specs/security/REVIEW.md` exists and is fresh (matches current branch diff)
|
|
51
|
+
- [ ] No unresolved HIGH findings with confidence ≥ 8 (or all documented in `specs/security/EXCEPTIONS.md` with sign-off rationale)
|
|
52
|
+
|
|
53
|
+
If REVIEW.md is missing or stale → run `security-review` inline. Findings block the merge unless documented in EXCEPTIONS.md.
|
|
54
|
+
|
|
48
55
|
### 3. Diff review
|
|
49
56
|
|
|
50
57
|
- [ ] All commits intentional, no secrets, CONVENTIONS.md compliance
|
package/skills-lock.json
CHANGED
|
@@ -148,7 +148,7 @@
|
|
|
148
148
|
},
|
|
149
149
|
"investigate-bug": {
|
|
150
150
|
"description": "Investigate a bug or issue by exploring the codebase to find root cause, then write a TDD-based fix plan to specs/bugs/BUG-*.md. Use when user reports a bug, wants to investigate a problem, mentions \"triage\", or wants to plan a fix.",
|
|
151
|
-
"sha256": "
|
|
151
|
+
"sha256": "46e956e627f24b46",
|
|
152
152
|
"path": "investigate-bug/SKILL.md"
|
|
153
153
|
},
|
|
154
154
|
"kickoff-branch": {
|
|
@@ -208,7 +208,7 @@
|
|
|
208
208
|
},
|
|
209
209
|
"release-branch": {
|
|
210
210
|
"description": "Make the merge/PR/keep/discard decision for a feature branch, verify coverage gates, create the PR with gh, and clean up the worktree. Use when a feature is done and ready to ship, or when user says \"release\", \"merge\", or \"open a PR\".",
|
|
211
|
-
"sha256": "
|
|
211
|
+
"sha256": "0514cbd9163e4e87",
|
|
212
212
|
"path": "release-branch/SKILL.md"
|
|
213
213
|
},
|
|
214
214
|
"request-review": {
|
|
@@ -328,7 +328,7 @@
|
|
|
328
328
|
},
|
|
329
329
|
"validate-fix": {
|
|
330
330
|
"description": "Prove a fix works before declaring done — re-run the failing test, run the full suite, typecheck, lint, and harden against recurrence. Use after implementing a bug fix, when user says \"is this fixed?\", or before closing an investigation.",
|
|
331
|
-
"sha256": "
|
|
331
|
+
"sha256": "f559f4b8dcf03c4a",
|
|
332
332
|
"path": "validate-fix/SKILL.md"
|
|
333
333
|
},
|
|
334
334
|
"verify-work": {
|
package/validate-fix/SKILL.md
CHANGED
|
@@ -61,6 +61,11 @@ For every bug fixed, add at least one prevention layer:
|
|
|
61
61
|
- [ ] At least one hardening mechanism added
|
|
62
62
|
- [ ] Hardening mechanism is tested
|
|
63
63
|
|
|
64
|
+
> **Security recurrence hardening** — If the bug's security-impact assessment (from investigate-bug) was MEDIUM or higher, additionally check:
|
|
65
|
+
> - [ ] Security regression test added (covers the exploit path)
|
|
66
|
+
> - [ ] False-positive exclusion rule added (if applicable)
|
|
67
|
+
> - [ ] Threat model updated (if impact was HIGH+)
|
|
68
|
+
|
|
64
69
|
### 6. Update the bug file and registry.yaml
|
|
65
70
|
|
|
66
71
|
Find the most recent `specs/bugs/BUG-*.md` file and append the resolution:
|