bigpowers 2.59.9 → 2.61.0

package/.mcp.json

@@ -0,0 +1,9 @@
+{
+  "mcpServers": {
+    "bigpowers-mcp": {
+      "command": "node",
+      "args": ["bigpowers-mcp/build/index.js"],
+      "cwd": "${workspaceFolder}"
+    }
+  }
+}

package/.pi/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bigpowers",
-  "version": "2.59.9",
-  "description": "73 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
+  "version": "2.61.0",
+  "description": "74 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"
   ],

package/.pi/prompts/develop-tdd.md

@@ -35,6 +35,7 @@ If you catch yourself thinking these, stop and reconsider — you are likely dev
 ### 1. Planning
 
 - [ ] Read active `specs/epics/*/epic.yaml` story tasks or `specs/bugs/BUG-*.md` — understand verify steps
+- [ ] If `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` exists for the active epic, read it before writing the first test. Implement P0 scenarios (`SC-*-P0-*`) before P1. P2/P3 scenarios are optional per time budget.
 - [ ] Confirm interface changes and behaviors to test (prioritize)
 - [ ] Design interfaces for testability — identify [deep modules](deep-modules.md) opportunities
 - [ ] Get user approval on the plan

package/.pi/prompts/gate-trace.md

@@ -15,6 +15,7 @@ Deterministic quality gate that combines traceability coverage and blind-spot da
 | R2 | Any story done but no verify evidence | CONCERNS |
 | R3 | P0 story (top WSJF quartile) with 0% coverage | FAIL |
 | R4 | Overall coverage < 60% | CONCERNS |
+| R6 | P0 story + eNN-TEST_PLAN_LATEST.md exists + zero SC-eNNsYY-P0-* in test files | CONCERNS |
 | R5 | Overall ≥ 80% + no critical gaps + all verify → PASS | PASS |
 
 ## Oracle Confidence Downgrade

package/.pi/prompts/orchestrate-project.md

@@ -45,7 +45,7 @@ See [REFERENCE.md](REFERENCE.md) for detailed phase specifications and gate type
 
 1. **Maintains state.yaml** — Tracks current phase, `active_epic`, `active_flow`, decisions, risks.
 2. **Spawns appropriate skills** — Routes by `model:` frontmatter. Decisions pass only via `specs/state.yaml` `handoff` between spawns.
-3. **Methodology lenses** — If `specs/tech-architecture/TEST_PLAN_LATEST.md` or ADRs exist, apply at phase gates.
+3. **Methodology lenses** — If `specs/tech-architecture/e*-TEST_PLAN_LATEST.md` or ADRs exist, apply at phase gates.
 4. **Enforces gates** — Hard stops if success criteria not met.
 5. **The Gatekeeper** — Between stories in BUILD: read `specs/execution-status.yaml`; previous story must be `done` before starting the next; use `build-epic` for the 8-step epic cycle.
 6. **Pauses for confirmation** — After each phase, asks "Ready to proceed?".

package/.pi/prompts/plan-tests.md

@@ -0,0 +1,74 @@
+---
+description: "Design a risk-scaled test architecture for an epic before implementation begins. Produces prioritized scenarios, test level distribution, and fixture plans based on TEA and bigpowers principles."
+---
+
+
+# Plan Tests
+
+> **Spine position:** Between `slice-tasks` and `plan-work` for epics with `risk: P0|P1`. Optional (can be waived in `state.yaml`) for P2/P3.
+
+Bridges the gap between slicing and planning by systematically designing the test suite as a first-class system. Produces `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`.
+
+## Pre-flight
+- Read `specs/epics/eNN-*/` story list.
+
+## Core Workflow
+1. **Analyze Epic**: Read sliced stories in the active epic capsule.
+2. **Risk Assessment**: Map behaviors to P0–P3 risk tiers.
+3. **Level Strategy**: Classify each scenario (Unit, Integration, E2E).
+4. **Fixture Design**: Plan factories, network intercepts, mocks (see REFERENCE.md).
+5. **NFR Plan**: Define verifiable commands for Non-Functional Requirements. Skip if `--lite`.
+6. **Publish**: Generate `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`.
+
+## Hard Gates & Guardrails
+- **DO NOT** write test code or production code during this skill.
+- Scenario ID format MUST be: `SC-eNNsYY-P{0|1|2|3}-NN`.
+- `plan-work` MUST reference these scenario IDs in its §17 Gherkin acceptance criteria.
+- Default to pushing tests to the lowest possible level.
+
+## Execution Modes
+- `$bmad plan-tests`: Standard execution.
+- `$bmad plan-tests --lite`: Skips NFRs and complex fixture planning.
+
+## Verify
+
+→ verify: `test -f specs/tech-architecture/$(echo $EPIC | sed "s|.*/||")-TEST_PLAN_LATEST.md && echo OK`
+
+## Handoff
+
+Gate: READY -> next: plan-work
+Writes: state.yaml handoff.next_skill = plan-work
+
+---
+
+# Plan Tests — Reference
+
+## Test Plan Template (`specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`)
+
+```markdown
+# Test Design: [eNN-slug]
+
+## 1. Risk Matrix & Scenarios
+| Scenario ID | Behavior Description | Risk | Test Level | Target File/Module |
+|-------------|----------------------|------|------------|--------------------|  
+| SC-P0-01    | Primary checkout     | P0   | Integration | checkout.spec.ts  |
+
+## 2. Fixture Architecture & Isolation
+- Data Factories: (e.g. UserFactory)
+- Network Intercepts: (e.g. MSW handlers)
+- Database State: (e.g. in-memory SQLite)
+
+## 3. NFR Verification
+| NFR Type | Requirement | Verification Command |
+|----------|-------------|----------------------|
+| Perf     | < 200ms     | `npm run test:perf`  |
+
+## 4. Out of Scope
+- [Explicitly excluded testing areas]
+```
+
+## Fixture Planning Guidance
+
+- **Data Factories**: Prefer factory functions over manual object construction.
+- **Network Intercepts**: For frontend integration tests, use tools like Mock Service Worker (MSW) to intercept and mock HTTP requests.
+- **Database State**: For backend tests, use a clean database state per test or an in-memory database to ensure isolation.

package/.pi/prompts/plan-work.md

@@ -42,7 +42,7 @@ If this plan touches an existing module, run `assess-impact` first to understand
 
 2. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
 
-3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
+3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task MUST include a `risk:` field (`P0` | `P1` | `P2` | `P3`) based on BCP + story type heuristics (see REFERENCE.md). If a test plan artifact (`specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`) exists, read it and inherit its P0/P1 risk classifications and scenario IDs (`SC-eNNsYY-P0-NN`). Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
 
 4. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
 
@@ -80,6 +80,7 @@ tasks:
   - id: 1
     description: "Add login form component tests"
     verify: "npm test -- login-form.test.tsx"
+    risk: P1
     status: todo
 ```
 
@@ -91,6 +92,7 @@ Update `specs/epics/<capsule>/epic.yaml` manifest to list the story and its BCPs
 ### Story [X.Y]: [title] — Implementation Steps
 
 **type:** feat | fix | refactor
+**risk:** P0 | P1 | P2 | P3
 **context:** domain | infra
 **Context**: [One paragraph: what this story implements and why]
 
@@ -139,6 +141,17 @@ N. <What to do> → verify: <runnable command that proves it worked>
 
 ## Sub-operations
 
+### Risk Assignment Heuristics
+
+Every task and story MUST be assigned a `risk:` level (P0, P1, P2, P3). When `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` exists for the epic, defer to its scenario risk mapping (`SC-eNNsYY-P0-NN`). Otherwise, apply these heuristics based on BCP and story type:
+
+- **P0**: Critical path, data loss risk, auth/security boundary, external integration, or high BCP (≥ 5).
+- **P1**: Core feature logic, state mutations, standard business value (BCP 3-4).
+- **P2**: Utility functions, UI layout changes, display-only data, low risk (BCP 2).
+- **P3**: Documentation, cosmetic tweaks, CSS variables, zero behavioral change (BCP 1).
+
+`verify-work` scales its UAT depth based on this field.
+
 ### Define Success
 
 Before planning, convert task statements into observable "step → verify: <cmd>" pairs:

package/.pi/prompts/verify-work.md

@@ -17,25 +17,34 @@ Review answers "is the code good?"; Verify answers "does the built thing do what
 - --smoke: Cold-start only plus one happy-path flow. Use for hotfixes.
 - --cli: CLI tool verification — replaces cold-start with binary smoke checklist. Use for CLI tools with no server process.
 
+## Risk-Scaled Depth
+
+`verify-work` reads the `risk:` field from the story template (defaults to `P1` if absent) to scale verification rigor:
+- **P0**: Full verify-work multi-phase + `security-review` (step 5) + NFR evidence gate (step 5b).
+- **P1**: Standard verify-work (build, test, lint, step-by-step manual).
+- **P2**: Smoke, typecheck, lint only. Skip tests, security scan, and step-by-step manual UAT.
+- **P3**: Typecheck and lint only. Skip smoke, tests, security scan, and step-by-step manual UAT.
+
 ## Process
 
 > **Timing:** `bash scripts/bp-timing.sh start verify-work` at invocation; `bash scripts/bp-timing.sh end verify-work` before handoff.
 
 0. **Branch check** — must not be `main`/`master`.
 
-1. Read active story tasks from `specs/epics/<capsule>/eNNsYY-tasks.yaml` and story spec from `specs/epics/<capsule>/eNNsYY-<slug>.md` (countable-story-format, Gherkin in §17).
+1. Read active story tasks from `specs/epics/<capsule>/eNNsYY-tasks.yaml` and story spec from `specs/epics/<capsule>/eNNsYY-<slug>.md` (countable-story-format, Gherkin in §17). Note the `risk:` level (`P0`–`P3`).
 1a. **Pre-UAT verify validation** — for each task's `verify:` command, run it and detect pattern mismatches before UAT begins. If a grep/awk/jq command fails, check whether the pattern is wrong vs. a genuine failure:
     ```bash
     # For a failing grep -q 'PATTERN' FILE, check what is actually in FILE
     grep 'PATTERN' FILE || grep -n '' FILE | head -20   # show nearest lines
     ```
     Report: `"Pattern 'X' not found. Nearest match: 'Y' at line N"` and ask `"Update verify command? [Y/n]"`. Fix before proceeding — a mismatched verify command produces false failures during UAT.
-2. **Cold-start smoke** (if app): stop server, clear caches, boot from scratch.
+2. **Cold-start smoke** (if app; skip if P3): stop server, clear caches, boot from scratch.
 3. **AGENTS.md preflight** — before running default checks, call `bash scripts/bp-read-agents.sh` to detect project-specific commands. If `BP_PREFLIGHT` is set, run it instead of the default mechanical gates (or in addition to them if the project requires both). Output: `"Using preflight from AGENTS.md: <cmd>"`. Fall back to `CLAUDE.md` commands if AGENTS.md is absent.
-4. Mechanical gates: build → typecheck → lint → tests (from `CLAUDE.md` or AGENTS.md).
-5. **Security scan** — run `security-review` against the git diff (working tree vs merge-base). Parse findings report. If any HIGH findings with confidence ≥ 8 exist → **block the gate**. Write findings to `specs/security/REVIEW.md`. Allow documented exceptions via `specs/security/EXCEPTIONS.md`. MEDIUM/LOW findings warn but don't block.
+4. Mechanical gates: build → typecheck → lint → tests (from `CLAUDE.md` or AGENTS.md). Skip tests if P2/P3.
+5. **Security scan** (skip if P2/P3) — run `security-review` against the git diff (working tree vs merge-base). Parse findings report. If any HIGH findings with confidence ≥ 8 exist → **block the gate**. Write findings to `specs/security/REVIEW.md`. Allow documented exceptions via `specs/security/EXCEPTIONS.md`. MEDIUM/LOW findings warn but don't block.
 5a. **Blind-spot check** — run `bash scripts/check-blind-spots.sh`. This detects structural quality gaps (verify-gap, test-gap, stale-tag, etc.) beyond percentage coverage. If any HIGH-severity findings exist → **block the verify-work PASS gate**. Findings are written to `specs/blind-spots.json`. MEDIUM/LOW findings warn but don't block.
-6. **Step-by-step UAT** — one user-observable action at a time.
+5b. **NFR Evidence Gate** (P0 only) — Produces go/no-go output on three dimensions: Performance (response time, throughput), Reliability (error rate, recovery), and Operability (logging, health checks). Reads thresholds from `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` and writes evidence as OKF verification-report bundles to `specs/verifications/NFR-eNNsYY.json`. FAIL on any dimension blocks the gate.
+6. **Step-by-step UAT** (skip if P2/P3) — one user-observable action at a time.
 7. **Gaps loop** — failures → log → `plan-work` → re-verify. Unaddressed HIGH findings from step 5 feed into this loop alongside other quality gaps.
 
 ## Verify sub-operations

package/.pi/skills/develop-tdd/SKILL.md

@@ -37,6 +37,7 @@ If you catch yourself thinking these, stop and reconsider — you are likely dev
 ### 1. Planning
 
 - [ ] Read active `specs/epics/*/epic.yaml` story tasks or `specs/bugs/BUG-*.md` — understand verify steps
+- [ ] If `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` exists for the active epic, read it before writing the first test. Implement P0 scenarios (`SC-*-P0-*`) before P1. P2/P3 scenarios are optional per time budget.
 - [ ] Confirm interface changes and behaviors to test (prioritize)
 - [ ] Design interfaces for testability — identify [deep modules](deep-modules.md) opportunities
 - [ ] Get user approval on the plan

package/.pi/skills/gate-trace/SKILL.md

@@ -17,6 +17,7 @@ Deterministic quality gate that combines traceability coverage and blind-spot da
 | R2 | Any story done but no verify evidence | CONCERNS |
 | R3 | P0 story (top WSJF quartile) with 0% coverage | FAIL |
 | R4 | Overall coverage < 60% | CONCERNS |
+| R6 | P0 story + eNN-TEST_PLAN_LATEST.md exists + zero SC-eNNsYY-P0-* in test files | CONCERNS |
 | R5 | Overall ≥ 80% + no critical gaps + all verify → PASS | PASS |
 
 ## Oracle Confidence Downgrade

package/.pi/skills/orchestrate-project/SKILL.md

@@ -47,7 +47,7 @@ See [REFERENCE.md](REFERENCE.md) for detailed phase specifications and gate type
 
 1. **Maintains state.yaml** — Tracks current phase, `active_epic`, `active_flow`, decisions, risks.
 2. **Spawns appropriate skills** — Routes by `model:` frontmatter. Decisions pass only via `specs/state.yaml` `handoff` between spawns.
-3. **Methodology lenses** — If `specs/tech-architecture/TEST_PLAN_LATEST.md` or ADRs exist, apply at phase gates.
+3. **Methodology lenses** — If `specs/tech-architecture/e*-TEST_PLAN_LATEST.md` or ADRs exist, apply at phase gates.
 4. **Enforces gates** — Hard stops if success criteria not met.
 5. **The Gatekeeper** — Between stories in BUILD: read `specs/execution-status.yaml`; previous story must be `done` before starting the next; use `build-epic` for the 8-step epic cycle.
 6. **Pauses for confirmation** — After each phase, asks "Ready to proceed?".

package/.pi/skills/plan-tests/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: plan-tests
+description: "\"Design a risk-scaled test architecture for an epic before implementation begins. Produces prioritized scenarios, test level distribution, and fixture plans based on TEA and bigpowers principles.\""
+model: opus
+---
+
+
+# Plan Tests
+
+> **Spine position:** Between `slice-tasks` and `plan-work` for epics with `risk: P0|P1`. Optional (can be waived in `state.yaml`) for P2/P3.
+
+Bridges the gap between slicing and planning by systematically designing the test suite as a first-class system. Produces `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`.
+
+## Pre-flight
+- Read `specs/epics/eNN-*/` story list.
+
+## Core Workflow
+1. **Analyze Epic**: Read sliced stories in the active epic capsule.
+2. **Risk Assessment**: Map behaviors to P0–P3 risk tiers.
+3. **Level Strategy**: Classify each scenario (Unit, Integration, E2E).
+4. **Fixture Design**: Plan factories, network intercepts, mocks (see REFERENCE.md).
+5. **NFR Plan**: Define verifiable commands for Non-Functional Requirements. Skip if `--lite`.
+6. **Publish**: Generate `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`.
+
+## Hard Gates & Guardrails
+- **DO NOT** write test code or production code during this skill.
+- Scenario ID format MUST be: `SC-eNNsYY-P{0|1|2|3}-NN`.
+- `plan-work` MUST reference these scenario IDs in its §17 Gherkin acceptance criteria.
+- Default to pushing tests to the lowest possible level.
+
+## Execution Modes
+- `$bmad plan-tests`: Standard execution.
+- `$bmad plan-tests --lite`: Skips NFRs and complex fixture planning.
+
+## Verify
+
+→ verify: `test -f specs/tech-architecture/$(echo $EPIC | sed "s|.*/||")-TEST_PLAN_LATEST.md && echo OK`
+
+## Handoff
+
+Gate: READY -> next: plan-work
+Writes: state.yaml handoff.next_skill = plan-work
+
+---
+
+# Plan Tests — Reference
+
+## Test Plan Template (`specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`)
+
+```markdown
+# Test Design: [eNN-slug]
+
+## 1. Risk Matrix & Scenarios
+| Scenario ID | Behavior Description | Risk | Test Level | Target File/Module |
+|-------------|----------------------|------|------------|--------------------|  
+| SC-P0-01    | Primary checkout     | P0   | Integration | checkout.spec.ts  |
+
+## 2. Fixture Architecture & Isolation
+- Data Factories: (e.g. UserFactory)
+- Network Intercepts: (e.g. MSW handlers)
+- Database State: (e.g. in-memory SQLite)
+
+## 3. NFR Verification
+| NFR Type | Requirement | Verification Command |
+|----------|-------------|----------------------|
+| Perf     | < 200ms     | `npm run test:perf`  |
+
+## 4. Out of Scope
+- [Explicitly excluded testing areas]
+```
+
+## Fixture Planning Guidance
+
+- **Data Factories**: Prefer factory functions over manual object construction.
+- **Network Intercepts**: For frontend integration tests, use tools like Mock Service Worker (MSW) to intercept and mock HTTP requests.
+- **Database State**: For backend tests, use a clean database state per test or an in-memory database to ensure isolation.

package/.pi/skills/plan-work/SKILL.md

@@ -44,7 +44,7 @@ If this plan touches an existing module, run `assess-impact` first to understand
 
 2. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
 
-3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
+3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task MUST include a `risk:` field (`P0` | `P1` | `P2` | `P3`) based on BCP + story type heuristics (see REFERENCE.md). If a test plan artifact (`specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`) exists, read it and inherit its P0/P1 risk classifications and scenario IDs (`SC-eNNsYY-P0-NN`). Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
 
 4. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
 
@@ -82,6 +82,7 @@ tasks:
   - id: 1
     description: "Add login form component tests"
     verify: "npm test -- login-form.test.tsx"
+    risk: P1
     status: todo
 ```
 
@@ -93,6 +94,7 @@ Update `specs/epics/<capsule>/epic.yaml` manifest to list the story and its BCPs
 ### Story [X.Y]: [title] — Implementation Steps
 
 **type:** feat | fix | refactor
+**risk:** P0 | P1 | P2 | P3
 **context:** domain | infra
 **Context**: [One paragraph: what this story implements and why]
 
@@ -141,6 +143,17 @@ N. <What to do> → verify: <runnable command that proves it worked>
 
 ## Sub-operations
 
+### Risk Assignment Heuristics
+
+Every task and story MUST be assigned a `risk:` level (P0, P1, P2, P3). When `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` exists for the epic, defer to its scenario risk mapping (`SC-eNNsYY-P0-NN`). Otherwise, apply these heuristics based on BCP and story type:
+
+- **P0**: Critical path, data loss risk, auth/security boundary, external integration, or high BCP (≥ 5).
+- **P1**: Core feature logic, state mutations, standard business value (BCP 3-4).
+- **P2**: Utility functions, UI layout changes, display-only data, low risk (BCP 2).
+- **P3**: Documentation, cosmetic tweaks, CSS variables, zero behavioral change (BCP 1).
+
+`verify-work` scales its UAT depth based on this field.
+
 ### Define Success
 
 Before planning, convert task statements into observable "step → verify: <cmd>" pairs:

package/.pi/skills/verify-work/SKILL.md

@@ -19,25 +19,34 @@ Review answers "is the code good?"; Verify answers "does the built thing do what
 - --smoke: Cold-start only plus one happy-path flow. Use for hotfixes.
 - --cli: CLI tool verification — replaces cold-start with binary smoke checklist. Use for CLI tools with no server process.
 
+## Risk-Scaled Depth
+
+`verify-work` reads the `risk:` field from the story template (defaults to `P1` if absent) to scale verification rigor:
+- **P0**: Full verify-work multi-phase + `security-review` (step 5) + NFR evidence gate (step 5b).
+- **P1**: Standard verify-work (build, test, lint, step-by-step manual).
+- **P2**: Smoke, typecheck, lint only. Skip tests, security scan, and step-by-step manual UAT.
+- **P3**: Typecheck and lint only. Skip smoke, tests, security scan, and step-by-step manual UAT.
+
 ## Process
 
 > **Timing:** `bash scripts/bp-timing.sh start verify-work` at invocation; `bash scripts/bp-timing.sh end verify-work` before handoff.
 
 0. **Branch check** — must not be `main`/`master`.
 
-1. Read active story tasks from `specs/epics/<capsule>/eNNsYY-tasks.yaml` and story spec from `specs/epics/<capsule>/eNNsYY-<slug>.md` (countable-story-format, Gherkin in §17).
+1. Read active story tasks from `specs/epics/<capsule>/eNNsYY-tasks.yaml` and story spec from `specs/epics/<capsule>/eNNsYY-<slug>.md` (countable-story-format, Gherkin in §17). Note the `risk:` level (`P0`–`P3`).
 1a. **Pre-UAT verify validation** — for each task's `verify:` command, run it and detect pattern mismatches before UAT begins. If a grep/awk/jq command fails, check whether the pattern is wrong vs. a genuine failure:
     ```bash
     # For a failing grep -q 'PATTERN' FILE, check what is actually in FILE
     grep 'PATTERN' FILE || grep -n '' FILE | head -20   # show nearest lines
     ```
     Report: `"Pattern 'X' not found. Nearest match: 'Y' at line N"` and ask `"Update verify command? [Y/n]"`. Fix before proceeding — a mismatched verify command produces false failures during UAT.
-2. **Cold-start smoke** (if app): stop server, clear caches, boot from scratch.
+2. **Cold-start smoke** (if app; skip if P3): stop server, clear caches, boot from scratch.
 3. **AGENTS.md preflight** — before running default checks, call `bash scripts/bp-read-agents.sh` to detect project-specific commands. If `BP_PREFLIGHT` is set, run it instead of the default mechanical gates (or in addition to them if the project requires both). Output: `"Using preflight from AGENTS.md: <cmd>"`. Fall back to `CLAUDE.md` commands if AGENTS.md is absent.
-4. Mechanical gates: build → typecheck → lint → tests (from `CLAUDE.md` or AGENTS.md).
-5. **Security scan** — run `security-review` against the git diff (working tree vs merge-base). Parse findings report. If any HIGH findings with confidence ≥ 8 exist → **block the gate**. Write findings to `specs/security/REVIEW.md`. Allow documented exceptions via `specs/security/EXCEPTIONS.md`. MEDIUM/LOW findings warn but don't block.
+4. Mechanical gates: build → typecheck → lint → tests (from `CLAUDE.md` or AGENTS.md). Skip tests if P2/P3.
+5. **Security scan** (skip if P2/P3) — run `security-review` against the git diff (working tree vs merge-base). Parse findings report. If any HIGH findings with confidence ≥ 8 exist → **block the gate**. Write findings to `specs/security/REVIEW.md`. Allow documented exceptions via `specs/security/EXCEPTIONS.md`. MEDIUM/LOW findings warn but don't block.
 5a. **Blind-spot check** — run `bash scripts/check-blind-spots.sh`. This detects structural quality gaps (verify-gap, test-gap, stale-tag, etc.) beyond percentage coverage. If any HIGH-severity findings exist → **block the verify-work PASS gate**. Findings are written to `specs/blind-spots.json`. MEDIUM/LOW findings warn but don't block.
-6. **Step-by-step UAT** — one user-observable action at a time.
+5b. **NFR Evidence Gate** (P0 only) — Produces go/no-go output on three dimensions: Performance (response time, throughput), Reliability (error rate, recovery), and Operability (logging, health checks). Reads thresholds from `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` and writes evidence as OKF verification-report bundles to `specs/verifications/NFR-eNNsYY.json`. FAIL on any dimension blocks the gate.
+6. **Step-by-step UAT** (skip if P2/P3) — one user-observable action at a time.
 7. **Gaps loop** — failures → log → `plan-work` → re-verify. Unaddressed HIGH findings from step 5 feed into this loop alongside other quality gaps.
 
 ## Verify sub-operations

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [2.61.0](https://github.com/danielvm-git/bigpowers/compare/v2.60.0...v2.61.0) (2026-07-04)
+
+
+### Features
+
+* **e32:** add bigpowers-mcp semantic context server ([f0f95b7](https://github.com/danielvm-git/bigpowers/commit/f0f95b7a790d7b4a5e056fb88fa6a771717ce29f))
+
+# [2.60.0](https://github.com/danielvm-git/bigpowers/compare/v2.59.9...v2.60.0) (2026-07-04)
+
+
+### Features
+
+* **e46:** add plan-tests skill, NFR gate, and SC scenario IDs ([6c19b8e](https://github.com/danielvm-git/bigpowers/commit/6c19b8eb2d21e4b862a5a00e1df570a2277728b8))
+
 ## [2.59.9](https://github.com/danielvm-git/bigpowers/compare/v2.59.8...v2.59.9) (2026-07-04)
 
 

package/CONVENTIONS.md

@@ -56,6 +56,7 @@ You are operating within the `bigpowers` spec-driven development methodology.
 - **Verification Mandate:** Every story implementation MUST end with a step-by-step manual verification script provided to the user. You must wait for the user to confirm behavioral correctness (UAT) before declaring the story done or moving to the next.
 - **Verification:** You MUST verify every change with tests. Code generation without a corresponding plan in `specs/` is strictly forbidden.
 - **Traceability Mandate:** Every story MUST have at least one `story: eNNsNN` tag in its implementing code or test file. `trace-stories.sh --strict` runs in CI to enforce this. Untagged stories fail the CI traceability gate.
+- **Scenario ID Format (e46s04+):** When a `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` exists for the epic, critical-path scenarios use the format `SC-eNNsYY-P{0|1|2|3}-NN` (e.g. `SC-e46s04-P0-01`). These IDs are referenced inside test files as `// scenario: SC-eNNsYY-P0-NN` comments alongside the existing `// story: eNNsNN` tag. SC gaps detected via check-blind-spots.sh; no separate SC tracing script required. gate-trace treats a P0 story with zero `SC-*-P0-*` references in test files as a CONCERNS finding (waivable via `state.yaml`). P2/P3 epics may set `test_plan: waived` in `state.yaml` to skip the `plan-tests` skill.
 - **Stream Continuity:** When writing large files or long documents, you MUST output continuously in chunks of ~200 lines. Do not pause between sections. Continue immediately until complete. If you need time to process, emit a placeholder comment or heading rather than going silent to prevent stream idle timeouts.
 
 ## specs/ — All Planning Output Goes Here
@@ -93,7 +94,9 @@ Missing timestamps are a gate violation — do not advance past `release-branch`
 
 ### next_skill signaling mandate (v2.0.0)
 
-Every critical-path skill (survey-context, plan-work, kickoff-branch, develop-tdd, verify-work, audit-code, commit-message, release-branch) MUST write `handoff.next_skill` to `specs/state.yaml` as its last action. Agents MUST read `state.yaml` and follow `handoff.next_skill` before asking "what comes next?".
+Every critical-path skill (survey-context, plan-tests, plan-work, kickoff-branch, develop-tdd, verify-work, audit-code, commit-message, release-branch) MUST write `handoff.next_skill` to `specs/state.yaml` as its last action. Agents MUST read `state.yaml` and follow `handoff.next_skill` before asking "what comes next?".
+
+`plan-tests` is an optional planning-spine step: after `slice-tasks`, before `plan-work`, for epics whose stories carry `risk: P0|P1`. It is skipped (set `test_plan: waived` in `state.yaml`) for P2/P3-dominant epics.
 
 ### Intent vs delivery vs execution
 
@@ -129,6 +132,7 @@ When planning closes, copy to `specs/product/snapshots/release-<version>/` (`rel
 |----------|------|
 | Stack / architecture | `specs/tech-architecture/TECH_STACK_LATEST.md` |
 | Security / test / design plans | `specs/tech-architecture/*_PLAN_LATEST.md` |
+| Epic test plan (P0/P1 epics) | `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` — produced by `plan-tests` skill (e46s04); one per epic. |
 | Domain context + ADRs | `specs/tech-architecture/TECH_STACK_LATEST.md` or legacy `specs/CONTEXT.md` + `specs/adr/` |
 | Bug investigation | `specs/bugs/BUG-*.md` + `specs/bugs/registry.yaml` (generated) |
 | Refactor / impact | `specs/tech-architecture/REFACTOR_LATEST.md`, `specs/tech-architecture/IMPACT_LATEST.md` |

package/README.md

@@ -2,7 +2,7 @@
 
 ![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)
 ![npm version](https://img.shields.io/npm/v/bigpowers.svg)
-![Skills](https://img.shields.io/badge/skills-73-brightgreen.svg)
+![Skills](https://img.shields.io/badge/skills-74-brightgreen.svg)
 
 **Agent skills synthesizing 17 years of software engineering discipline — from Clean Code to AI-native architecture — into a single, prescriptive methodology for solo developers.**
 

package/SKILL-INDEX.md

@@ -3,7 +3,7 @@
 > **DO NOT EDIT** — This file is auto-generated by `scripts/generate-skill-index.sh`.
 > Edit `SKILL.md` source files or `skills-lock.json` instead. Run `bash scripts/sync-skills.sh` to regenerate.
 
-**Skills:** 73
+**Skills:** 74
 
 ---
 

package/bigpowers-mcp/build/config.d.ts

@@ -0,0 +1,7 @@
+/** Repo root: cwd when launched from workspace, else parent of bigpowers-mcp. */
+export declare function getRepoRoot(): string;
+export declare function getSkillsDir(repoRoot: string): string;
+export declare function getGraphPath(repoRoot: string): string;
+export declare const MAX_READ_SKILL_BYTES: number;
+export declare const SECRET_DENYLIST: RegExp[];
+export declare const GIT_SCOPE_DIRS: string[];

package/bigpowers-mcp/build/config.js

@@ -0,0 +1,35 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const packageDir = path.dirname(fileURLToPath(import.meta.url));
+/** Repo root: cwd when launched from workspace, else parent of bigpowers-mcp. */
+export function getRepoRoot() {
+    const fromEnv = process.env.BIGPOWERS_ROOT;
+    if (fromEnv)
+        return path.resolve(fromEnv);
+    const cwd = process.cwd();
+    if (isRepoRoot(cwd))
+        return cwd;
+    const parentOfPackage = path.resolve(packageDir, "../..");
+    if (isRepoRoot(parentOfPackage))
+        return parentOfPackage;
+    return cwd;
+}
+function isRepoRoot(dir) {
+    return (fs.existsSync(path.join(dir, "skills")) && fs.existsSync(path.join(dir, "specs")));
+}
+export function getSkillsDir(repoRoot) {
+    return path.join(repoRoot, "skills");
+}
+export function getGraphPath(repoRoot) {
+    return path.join(repoRoot, "bigpowers-mcp", "graph.jsonl");
+}
+export const MAX_READ_SKILL_BYTES = 512 * 1024;
+export const SECRET_DENYLIST = [
+    /\.env/i,
+    /\.pem$/i,
+    /secret/i,
+    /credentials/i,
+];
+export const GIT_SCOPE_DIRS = ["skills", "specs"];
+//# sourceMappingURL=config.js.map

package/bigpowers-mcp/build/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAEhE,iFAAiF;AACjF,MAAM,UAAU,WAAW;IACzB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC3C,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAEhC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,eAAe,CAAC;IAExD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,CACL,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAClF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE/C,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ;IACR,SAAS;IACT,SAAS;IACT,cAAc;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC"}

package/bigpowers-mcp/build/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/bigpowers-mcp/build/index.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createContext, registerTools } from "./tools/index.js";
+async function main() {
+    const ctx = createContext();
+    const server = new McpServer({
+        name: "bigpowers-mcp",
+        version: "0.1.0",
+    });
+    registerTools(server, ctx);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error("bigpowers-mcp started");
+}
+main().catch((err) => {
+    console.error("Fatal error:", err);
+    process.exit(1);
+});
+//# sourceMappingURL=index.js.map

package/bigpowers-mcp/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEhE,KAAK,UAAU,IAAI;IACjB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AACzC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/bigpowers-mcp/build/lib/git-context.d.ts

@@ -0,0 +1,12 @@
+export interface GitContextResult {
+    action: string;
+    changed_files: Record<string, string[]>;
+    commits?: Array<{
+        hash: string;
+        subject: string;
+        files: string[];
+    }>;
+    diffs?: Record<string, string>;
+}
+export declare function getGitContext(repoRoot: string, action: "status" | "log" | "diff"): GitContextResult;
+export declare function isGitRepo(repoRoot: string): boolean;