bigpowers 2.59.9 → 2.61.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.59.9",
+  "version": "2.61.0",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/check-blind-spots.sh

@@ -2,10 +2,11 @@
 # story: e38s04
 # check-blind-spots.sh — TEA-inspired heuristic blind-spot detector.
 # Thin bash wrapper — the detection engine lives in scripts/lib/blind-spots.py.
-# Reads execution-status.yaml + traceability-matrix.json, runs 6 structural
+# Reads execution-status.yaml + traceability-matrix.json, runs 7 structural
 # quality checks, and emits specs/blind-spots.json.
+# Also detects SC- scenario gaps (sc-gap).
 #
-# Checks: verify-gap, test-gap, epic-orphan, stale-tag, double-tag, bootstrap-testless.
+# Checks: verify-gap, test-gap, epic-orphan, stale-tag, double-tag, bootstrap-testless, sc-gap.
 # Severities: HIGH / MEDIUM / LOW. Exit 1 on HIGH findings.
 
 set -euo pipefail
@@ -23,12 +24,12 @@ while [[ $# -gt 0 ]]; do
       cat <<'USAGE'
 Usage: check-blind-spots.sh [flags]
 
-Run 6 heuristic blind-spot checks on the codebase.
+Run 7 heuristic blind-spot checks on the codebase.
 
 Flags:
   --help   Print this message and exit.
 
-Checks: verify-gap, test-gap, epic-orphan, stale-tag, double-tag, bootstrap-testless.
+Checks: verify-gap, test-gap, epic-orphan, stale-tag, double-tag, bootstrap-testless, sc-gap.
 Output: specs/blind-spots.json
 Exit: 0 = no HIGH findings, 1 = HIGH findings or input files missing.
 USAGE

package/scripts/lib/blind-spots.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 """story: e38s04 — TEA-inspired heuristic blind-spot detector (Python engine).
 
-Reads execution-status.yaml + traceability-matrix.json, runs 6 structural
+Reads execution-status.yaml + traceability-matrix.json, runs 7 structural
 quality checks, and emits specs/blind-spots.json.
 
 Usage: called by scripts/check-blind-spots.sh with positional args:
@@ -193,6 +193,42 @@ for sid in sorted(dev_status.keys()):
                     "remediation": f"Add test files for: {', '.join(code_only[:3])}"
                 })
 
+# Check G: sc-gap
+TECH_ARCH_DIR = ROOT / "specs" / "tech-architecture"
+if EPICS_DIR.exists():
+    for epic_dir in sorted(EPICS_DIR.iterdir()):
+        if not epic_dir.is_dir() or epic_dir.name == "archive": continue
+        epic_match = re.match(r"(e\d+)", epic_dir.name)
+        if not epic_match: continue
+        epic_id = epic_match.group(1)
+        
+        test_plan = TECH_ARCH_DIR / f"{epic_id}-TEST_PLAN_LATEST.md"
+        if not test_plan.exists(): continue
+        
+        for task_file in sorted(epic_dir.glob("e*s[0-9]*-tasks.yaml")):
+            sid_match = re.match(r"(e\d+s\d+)", task_file.name)
+            if not sid_match: continue
+            sid = sid_match.group(1)
+            
+            content = task_file.read_text(encoding="utf-8")
+            if "risk: P0" in content:
+                found_sc = False
+                for f in tagged_files.get(sid, []):
+                    fpath = ROOT / f
+                    if fpath.exists():
+                        fcontent = fpath.read_text(encoding="utf-8", errors="ignore")
+                        if re.search(rf"SC-{sid}-P0", fcontent):
+                            found_sc = True
+                            break
+                if not found_sc:
+                    findings.append({
+                        "check": "sc-gap",
+                        "story_id": sid,
+                        "severity": "MEDIUM",
+                        "description": f"P0 story {sid} has a TEST_PLAN but no `scenario: SC-{sid}-P0-*` tags found in its implementing files",
+                        "remediation": f"Add `// scenario: SC-{sid}-P0-XX` tags to the test files for this story"
+                    })
+
 # Deduplicate
 seen: set[tuple] = set()
 deduped: list[dict] = []

package/skills/develop-tdd/SKILL.md

@@ -37,6 +37,7 @@ If you catch yourself thinking these, stop and reconsider — you are likely dev
 ### 1. Planning
 
 - [ ] Read active `specs/epics/*/epic.yaml` story tasks or `specs/bugs/BUG-*.md` — understand verify steps
+- [ ] If `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` exists for the active epic, read it before writing the first test. Implement P0 scenarios (`SC-*-P0-*`) before P1. P2/P3 scenarios are optional per time budget.
 - [ ] Confirm interface changes and behaviors to test (prioritize)
 - [ ] Design interfaces for testability — identify [deep modules](deep-modules.md) opportunities
 - [ ] Get user approval on the plan

package/skills/gate-trace/SKILL.md

@@ -18,6 +18,7 @@ Deterministic quality gate that combines traceability coverage and blind-spot da
 | R2 | Any story done but no verify evidence | CONCERNS |
 | R3 | P0 story (top WSJF quartile) with 0% coverage | FAIL |
 | R4 | Overall coverage < 60% | CONCERNS |
+| R6 | P0 story + eNN-TEST_PLAN_LATEST.md exists + zero SC-eNNsYY-P0-* in test files | CONCERNS |
 | R5 | Overall ≥ 80% + no critical gaps + all verify → PASS | PASS |
 
 ## Oracle Confidence Downgrade

package/skills/orchestrate-project/SKILL.md

@@ -47,7 +47,7 @@ See [REFERENCE.md](REFERENCE.md) for detailed phase specifications and gate type
 
 1. **Maintains state.yaml** — Tracks current phase, `active_epic`, `active_flow`, decisions, risks.
 2. **Spawns appropriate skills** — Routes by `model:` frontmatter. Decisions pass only via `specs/state.yaml` `handoff` between spawns.
-3. **Methodology lenses** — If `specs/tech-architecture/TEST_PLAN_LATEST.md` or ADRs exist, apply at phase gates.
+3. **Methodology lenses** — If `specs/tech-architecture/e*-TEST_PLAN_LATEST.md` or ADRs exist, apply at phase gates.
 4. **Enforces gates** — Hard stops if success criteria not met.
 5. **The Gatekeeper** — Between stories in BUILD: read `specs/execution-status.yaml`; previous story must be `done` before starting the next; use `build-epic` for the 8-step epic cycle.
 6. **Pauses for confirmation** — After each phase, asks "Ready to proceed?".

package/skills/plan-tests/REFERENCE.md

@@ -0,0 +1,31 @@
+# Plan Tests — Reference
+
+## Test Plan Template (`specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`)
+
+```markdown
+# Test Design: [eNN-slug]
+
+## 1. Risk Matrix & Scenarios
+| Scenario ID | Behavior Description | Risk | Test Level | Target File/Module |
+|-------------|----------------------|------|------------|--------------------|  
+| SC-P0-01    | Primary checkout     | P0   | Integration | checkout.spec.ts  |
+
+## 2. Fixture Architecture & Isolation
+- Data Factories: (e.g. UserFactory)
+- Network Intercepts: (e.g. MSW handlers)
+- Database State: (e.g. in-memory SQLite)
+
+## 3. NFR Verification
+| NFR Type | Requirement | Verification Command |
+|----------|-------------|----------------------|
+| Perf     | < 200ms     | `npm run test:perf`  |
+
+## 4. Out of Scope
+- [Explicitly excluded testing areas]
+```
+
+## Fixture Planning Guidance
+
+- **Data Factories**: Prefer factory functions over manual object construction.
+- **Network Intercepts**: For frontend integration tests, use tools like Mock Service Worker (MSW) to intercept and mock HTTP requests.
+- **Database State**: For backend tests, use a clean database state per test or an in-memory database to ensure isolation.

package/skills/plan-tests/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: plan-tests
+description: "Design a risk-scaled test architecture for an epic before implementation begins. Produces prioritized scenarios, test level distribution, and fixture plans based on TEA and bigpowers principles."
+model: opus
+effort: standard
+---
+
+# Plan Tests
+
+> **Spine position:** Between `slice-tasks` and `plan-work` for epics with `risk: P0|P1`. Optional (can be waived in `state.yaml`) for P2/P3.
+
+Bridges the gap between slicing and planning by systematically designing the test suite as a first-class system. Produces `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`.
+
+## Pre-flight
+- Read `specs/epics/eNN-*/` story list.
+
+## Core Workflow
+1. **Analyze Epic**: Read sliced stories in the active epic capsule.
+2. **Risk Assessment**: Map behaviors to P0–P3 risk tiers.
+3. **Level Strategy**: Classify each scenario (Unit, Integration, E2E).
+4. **Fixture Design**: Plan factories, network intercepts, mocks (see REFERENCE.md).
+5. **NFR Plan**: Define verifiable commands for Non-Functional Requirements. Skip if `--lite`.
+6. **Publish**: Generate `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`.
+
+## Hard Gates & Guardrails
+- **DO NOT** write test code or production code during this skill.
+- Scenario ID format MUST be: `SC-eNNsYY-P{0|1|2|3}-NN`.
+- `plan-work` MUST reference these scenario IDs in its §17 Gherkin acceptance criteria.
+- Default to pushing tests to the lowest possible level.
+
+## Execution Modes
+- `$bmad plan-tests`: Standard execution.
+- `$bmad plan-tests --lite`: Skips NFRs and complex fixture planning.
+
+## Verify
+
+→ verify: `test -f specs/tech-architecture/$(echo $EPIC | sed "s|.*/||")-TEST_PLAN_LATEST.md && echo OK`
+
+## Handoff
+
+Gate: READY -> next: plan-work
+Writes: state.yaml handoff.next_skill = plan-work

package/skills/plan-work/REFERENCE.md

@@ -17,6 +17,7 @@ tasks:
   - id: 1
     description: "Add login form component tests"
     verify: "npm test -- login-form.test.tsx"
+    risk: P1
     status: todo
 ```
 
@@ -28,6 +29,7 @@ Update `specs/epics/<capsule>/epic.yaml` manifest to list the story and its BCPs
 ### Story [X.Y]: [title] — Implementation Steps
 
 **type:** feat | fix | refactor
+**risk:** P0 | P1 | P2 | P3
 **context:** domain | infra
 **Context**: [One paragraph: what this story implements and why]
 
@@ -76,6 +78,17 @@ N. <What to do> → verify: <runnable command that proves it worked>
 
 ## Sub-operations
 
+### Risk Assignment Heuristics
+
+Every task and story MUST be assigned a `risk:` level (P0, P1, P2, P3). When `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` exists for the epic, defer to its scenario risk mapping (`SC-eNNsYY-P0-NN`). Otherwise, apply these heuristics based on BCP and story type:
+
+- **P0**: Critical path, data loss risk, auth/security boundary, external integration, or high BCP (≥ 5).
+- **P1**: Core feature logic, state mutations, standard business value (BCP 3-4).
+- **P2**: Utility functions, UI layout changes, display-only data, low risk (BCP 2).
+- **P3**: Documentation, cosmetic tweaks, CSS variables, zero behavioral change (BCP 1).
+
+`verify-work` scales its UAT depth based on this field.
+
 ### Define Success
 
 Before planning, convert task statements into observable "step → verify: <cmd>" pairs:

package/skills/plan-work/SKILL.md

@@ -44,7 +44,7 @@ If this plan touches an existing module, run `assess-impact` first to understand
 
 2. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
 
-3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
+3. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task MUST include a `risk:` field (`P0` | `P1` | `P2` | `P3`) based on BCP + story type heuristics (see REFERENCE.md). If a test plan artifact (`specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`) exists, read it and inherit its P0/P1 risk classifications and scenario IDs (`SC-eNNsYY-P0-NN`). Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps.
 
 4. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
 

package/skills/verify-work/SKILL.md

@@ -20,25 +20,34 @@ Review answers "is the code good?"; Verify answers "does the built thing do what
 - --smoke: Cold-start only plus one happy-path flow. Use for hotfixes.
 - --cli: CLI tool verification — replaces cold-start with binary smoke checklist. Use for CLI tools with no server process.
 
+## Risk-Scaled Depth
+
+`verify-work` reads the `risk:` field from the story template (defaults to `P1` if absent) to scale verification rigor:
+- **P0**: Full verify-work multi-phase + `security-review` (step 5) + NFR evidence gate (step 5b).
+- **P1**: Standard verify-work (build, test, lint, step-by-step manual).
+- **P2**: Smoke, typecheck, lint only. Skip tests, security scan, and step-by-step manual UAT.
+- **P3**: Typecheck and lint only. Skip smoke, tests, security scan, and step-by-step manual UAT.
+
 ## Process
 
 > **Timing:** `bash scripts/bp-timing.sh start verify-work` at invocation; `bash scripts/bp-timing.sh end verify-work` before handoff.
 
 0. **Branch check** — must not be `main`/`master`.
 
-1. Read active story tasks from `specs/epics/<capsule>/eNNsYY-tasks.yaml` and story spec from `specs/epics/<capsule>/eNNsYY-<slug>.md` (countable-story-format, Gherkin in §17).
+1. Read active story tasks from `specs/epics/<capsule>/eNNsYY-tasks.yaml` and story spec from `specs/epics/<capsule>/eNNsYY-<slug>.md` (countable-story-format, Gherkin in §17). Note the `risk:` level (`P0`–`P3`).
 1a. **Pre-UAT verify validation** — for each task's `verify:` command, run it and detect pattern mismatches before UAT begins. If a grep/awk/jq command fails, check whether the pattern is wrong vs. a genuine failure:
     ```bash
     # For a failing grep -q 'PATTERN' FILE, check what is actually in FILE
     grep 'PATTERN' FILE || grep -n '' FILE | head -20   # show nearest lines
     ```
     Report: `"Pattern 'X' not found. Nearest match: 'Y' at line N"` and ask `"Update verify command? [Y/n]"`. Fix before proceeding — a mismatched verify command produces false failures during UAT.
-2. **Cold-start smoke** (if app): stop server, clear caches, boot from scratch.
+2. **Cold-start smoke** (if app; skip if P3): stop server, clear caches, boot from scratch.
 3. **AGENTS.md preflight** — before running default checks, call `bash scripts/bp-read-agents.sh` to detect project-specific commands. If `BP_PREFLIGHT` is set, run it instead of the default mechanical gates (or in addition to them if the project requires both). Output: `"Using preflight from AGENTS.md: <cmd>"`. Fall back to `CLAUDE.md` commands if AGENTS.md is absent.
-4. Mechanical gates: build → typecheck → lint → tests (from `CLAUDE.md` or AGENTS.md).
-5. **Security scan** — run `security-review` against the git diff (working tree vs merge-base). Parse findings report. If any HIGH findings with confidence ≥ 8 exist → **block the gate**. Write findings to `specs/security/REVIEW.md`. Allow documented exceptions via `specs/security/EXCEPTIONS.md`. MEDIUM/LOW findings warn but don't block.
+4. Mechanical gates: build → typecheck → lint → tests (from `CLAUDE.md` or AGENTS.md). Skip tests if P2/P3.
+5. **Security scan** (skip if P2/P3) — run `security-review` against the git diff (working tree vs merge-base). Parse findings report. If any HIGH findings with confidence ≥ 8 exist → **block the gate**. Write findings to `specs/security/REVIEW.md`. Allow documented exceptions via `specs/security/EXCEPTIONS.md`. MEDIUM/LOW findings warn but don't block.
 5a. **Blind-spot check** — run `bash scripts/check-blind-spots.sh`. This detects structural quality gaps (verify-gap, test-gap, stale-tag, etc.) beyond percentage coverage. If any HIGH-severity findings exist → **block the verify-work PASS gate**. Findings are written to `specs/blind-spots.json`. MEDIUM/LOW findings warn but don't block.
-6. **Step-by-step UAT** — one user-observable action at a time.
+5b. **NFR Evidence Gate** (P0 only) — Produces go/no-go output on three dimensions: Performance (response time, throughput), Reliability (error rate, recovery), and Operability (logging, health checks). Reads thresholds from `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` and writes evidence as OKF verification-report bundles to `specs/verifications/NFR-eNNsYY.json`. FAIL on any dimension blocks the gate.
+6. **Step-by-step UAT** (skip if P2/P3) — one user-observable action at a time.
 7. **Gaps loop** — failures → log → `plan-work` → re-verify. Unaddressed HIGH findings from step 5 feed into this loop alongside other quality gaps.
 
 ## Verify sub-operations

package/skills-lock.json

@@ -78,7 +78,7 @@
     },
     "develop-tdd": {
       "description": "Test-driven development with red-green-refactor loop using vertical slices. Use for features (epic tasks) or bugs (specs/bugs/BUG-*.md).",
-      "sha256": "63ae8ea76c99564f",
+      "sha256": "bd73cb58145ce1c1",
       "path": "skills/develop-tdd/SKILL.md"
     },
     "diagnose-root": {
@@ -128,7 +128,7 @@
     },
     "gate-trace": {
       "description": "\"Deterministic traceability quality gate — reads coverage matrix + blind-spot data, applies decision rules with oracle confidence downgrade, emits PASS/CONCERNS/FAIL/WAIVED verdict. Use before release-branch to gate merges on traceability.\"# story: e38s06",
-      "sha256": "636810f46c6d0b93",
+      "sha256": "7326525dc3d5d51f",
       "path": "skills/gate-trace/SKILL.md"
     },
     "grill-me": {
@@ -183,7 +183,7 @@
     },
     "orchestrate-project": {
       "description": "Meta-skill that enforces the 6-phase core loop (discover → elaborate → plan → build → verify → release) with hard gates. Use to coordinate multi-phase projects with guaranteed quality checkpoints. One-time command for the entire project lifecycle.",
-      "sha256": "ba15cd263bad8ddf",
+      "sha256": "4e53cd83ac296735",
       "path": "skills/orchestrate-project/SKILL.md"
     },
     "organize-workspace": {
@@ -201,9 +201,14 @@
       "sha256": "62dc272a091c8d7f",
       "path": "skills/plan-release/SKILL.md"
     },
+    "plan-tests": {
+      "description": "\"Design a risk-scaled test architecture for an epic before implementation begins. Produces prioritized scenarios, test level distribution, and fixture plans based on TEA and bigpowers principles.\"",
+      "sha256": "3f43a105b860105a",
+      "path": "skills/plan-tests/SKILL.md"
+    },
     "plan-work": {
       "description": "\"PLANNING SPINE STEP 3 of 3 — Plan the work: write detailed implementation tasks into the active epic capsule (specs/epics/eNN-slug/). Produces countable-story-format .md specs and runnable -tasks.yaml files. Use after slice-tasks (step 2). Not a substitute for scope-work (step 1) or slice-tasks (step 2).\"",
-      "sha256": "4c30ce3c1c0b2895",
+      "sha256": "29792e9d4499cc1e",
       "path": "skills/plan-work/SKILL.md"
     },
     "publish-package": {
@@ -343,7 +348,7 @@
     },
     "verify-work": {
       "description": "Multi-phase UAT gate — cold-start smoke, build, typecheck, lint, tests, step-by-step manual verification, gaps-closure loop. Use after execute-plan or develop-tdd, before audit-code.",
-      "sha256": "b2828b807467e5c7",
+      "sha256": "030622528b2bf5ed",
       "path": "skills/verify-work/SKILL.md"
     },
     "visual-dashboard": {