bms-speckit-plugin 5.0.0 → 5.2.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bms-speckit",
-  "version": "5.0.0",
+  "version": "5.2.0",
   "description": "Chain-orchestrated development pipeline with quality control agent. /bms-speckit runs brainstorm → constitution → specify → plan → tasks → analyze → implement → QC (UX/security/deps/code) → merge.",
   "author": {
     "name": "manoirx"

package/blueprints/bms-speckit-pipeline.yaml

@@ -209,11 +209,14 @@ chain_sequence:
       on_failure: continue
       max_retries: 0
 
-  - step_id: step_9_implement
+  - step_id: step_9_implement_with_rolling_qc
     skill_id: speckit.implement
     action: execute_loop
     phase: 2
-    description: Execute all tasks with TDD workflow via ralph-loop
+    description: >
+      Execute tasks with rolling QC — each task goes through implement → inline
+      QC (build/lint/test/security) → fix → commit cycle before moving to the
+      next task. Catches bugs at the source, not at the end.
     timeout_seconds: 3600
     input:
       tasks_path: "{{step_6_tasks.artifacts}}"
@@ -231,27 +234,41 @@ chain_sequence:
       max_retries: 3
     opinionated_prompts:
       system_context: >
-        Systematically execute speckit.implement to complete every task.
-        Enforce TDD: write and pass tests before marking any task complete.
-        Ensure code quality through linting, static analysis, and consistent
-        architecture with reusable components and centralized business logic.
-        Maintain atomic commits after each successful task.
-        After all tasks: invoke speckit.analyze for full validation,
-        apply improvements, re-run all tests, confirm zero regression.
-        Only output FINISHED after everything is validated.
+        For EACH task, execute this rolling QC cycle:
+
+        1. IMPLEMENT — write code following TDD (tests first, then implementation)
+        2. INLINE QC — immediately after implementation, run:
+           a. Build/compile — fix any type or build errors
+           b. Lint — fix all lint errors and warnings
+           c. Test suite — run ALL tests (not just new ones), fix any failures
+           d. Security quick scan — check for hardcoded secrets, SQL injection,
+              XSS, unvalidated input in the code you just wrote
+           e. UX check — if UI code was changed, verify error messages are
+              actionable, loading states exist, and user feedback is present
+        3. FIX — fix every issue found in step 2, then re-run checks
+        4. COMMIT — only commit when build + lint + tests all pass with zero errors
+        5. NEXT TASK — proceed to the next task
+
+        Do NOT batch QC at the end. Each task must pass its own QC cycle
+        before moving on. This is the rolling review pattern.
+
+        After ALL tasks complete: invoke speckit.analyze for a full cross-task
+        validation pass. Apply improvements, re-run all tests, confirm zero
+        regression. Only output FINISHED after everything is validated.
 
-  - step_id: step_10_quality_control
+  - step_id: step_10_final_quality_gate
     agent_id: bms-speckit:quality-control
     action: dispatch_agent
     phase: 2
     description: >
-      Dispatch the quality-control agent to perform a 5-dimension audit:
-      code errors, security, dependency health, UX/UI, and accessibility.
-      The agent fixes all issues it can and reports the rest.
+      Final comprehensive QC sweep by the quality-control agent. Since inline
+      QC already caught per-task issues, this focuses on cross-cutting concerns:
+      dependency health, deep security audit, overall UX consistency, and
+      accessibility compliance.
     timeout_seconds: 900
     post_action:
       commit: true
-      message: "fix(speckit): quality control — fix code errors, security, UX, deps"
+      message: "fix(speckit): final QC — security, deps, UX consistency, accessibility"
       push: true
     error_handling:
       on_failure: stop
@@ -259,14 +276,16 @@ chain_sequence:
     opinionated_prompts:
       system_context: >
         Dispatch the quality-control agent (bms-speckit:quality-control).
-        The agent runs 5 audit phases:
-        A. Code Errors — build, lint, test (must all pass)
-        B. Security — secrets, injection, auth, npm/pip audit
-        C. Dependencies — outdated, vulnerable, unused packages
-        D. UX/UI — user feedback, error messages, loading states
-        E. Accessibility — alt text, labels, keyboard nav
-        The agent fixes everything it can autonomously.
-        Only proceed to merge when the agent reports all checks pass.
+        Inline QC already caught per-task build/lint/test issues during
+        implementation. This final sweep focuses on cross-cutting concerns:
+        A. Security deep scan — npm/pip audit, auth flow review, CORS, secrets
+        B. Dependencies — outdated packages, vulnerable deps, unused packages
+        C. UX consistency — consistent error handling, feedback patterns across
+           all features, empty states, responsive design
+        D. Accessibility — alt text, form labels, keyboard nav, heading hierarchy
+        E. Integration check — verify all components work together end-to-end
+        Fix everything possible. Flag major dependency updates for user review.
+        Only proceed to merge when all checks pass.
 
   - step_id: step_11_merge
     skill_id: internal.git_merge_to_main

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bms-speckit-plugin",
-  "version": "5.0.0",
+  "version": "5.2.0",
   "description": "Chain-orchestrated development pipeline: /bms-speckit takes requirements and runs brainstorm → constitution → specify → plan → tasks → analyze → implement → verify with per-step error handling",
   "files": [
     ".claude-plugin/",

package/skills/bms-speckit-auto/SKILL.md

@@ -16,7 +16,33 @@ Chain blueprint: `blueprints/bms-speckit-pipeline.yaml`
    - `on_failure: continue` → log the failure and proceed to next step
 4. Pass `$ARGUMENTS` (the user's requirement) to step 1 (brainstorm). Step 4 (specify) receives the **output from step 1**
 5. **Commit and push after every important step** — each artifact-producing step must commit its output before proceeding to the next step
-6. Do NOT ask for confirmation between steps
+6. **Report progress** to the user at every step transition
+7. Do NOT ask for confirmation between steps
+
+---
+
+## Progress Reporting
+
+Before dispatching the Phase 1 subagent, create a progress tracker so the user can follow along. Use TaskCreate to create one task per step:
+
+```
+TaskCreate: "Step 1: Brainstorm — explore requirements"
+TaskCreate: "Step 2: Constitution — engineering principles"
+TaskCreate: "Step 3: CLAUDE.md sync"
+TaskCreate: "Step 4: Specify — feature specification"
+TaskCreate: "Step 5: Plan — implementation plan"
+TaskCreate: "Step 6: Tasks — task list"
+TaskCreate: "Step 7: Analyze — consistency check"
+TaskCreate: "Step 8: Compact context"
+TaskCreate: "Step 9: Implement with rolling QC"
+TaskCreate: "Step 10: Final quality gate"
+TaskCreate: "Step 11: Merge to main"
+```
+
+Then output a message to the user:
+
+> Starting BMS Speckit pipeline for: "$ARGUMENTS"
+> Phase 1 (specification & planning) running in subagent...
 
 ---
 
@@ -29,7 +55,16 @@ Subagent prompt:
 """
 You are running the BMS Speckit specification and planning chain. Execute each step in order using the Skill tool. Do NOT ask for confirmation. Follow error handling policies exactly. **Commit and push after every important step.**
 
+**IMPORTANT — Progress reporting:** Before starting each step, output a progress message to the user in this format:
+
+`[Step N/11] step_name — description...`
+
+After completing each step, output:
+
+`[Step N/11] DONE — brief result summary`
+
 ### Step 1 — Brainstorm `[on_failure: STOP]`
+- **Progress:** Output `[Step 1/11] Brainstorm — exploring requirements and design...`
 - **Skill:** `superpowers.brainstorm`
 - **Input:** "$ARGUMENTS"
 - **Purpose:** Explore intent, requirements, design alternatives, and edge cases
@@ -37,19 +72,25 @@ You are running the BMS Speckit specification and planning chain. Execute each s
 - **Output:** Detailed specification document
 - **Timeout:** 300s
 - **Post-action:** Commit all files and push. Message: `feat(speckit): brainstorm — explore requirements and design`
+- **Done:** Output `[Step 1/11] DONE — brainstorm complete`
 
 ### Step 2 — Constitution `[on_failure: STOP]`
+- **Progress:** Output `[Step 2/11] Constitution — establishing engineering principles...`
 - **Skill:** `speckit.constitution`
 - **Input:** "Establish and enforce a comprehensive set of engineering principles that prioritize high code quality, strict adherence to Test-Driven Development (TDD) practices, and well-defined testing standards across unit, component, integration, and API levels to ensure system reliability and maintainability, maintain a consistent, user-friendly, and professional user interface aligned with strong user experience (UX) guidelines, optimize application performance through efficient architecture and resource management; enforce disciplined version control practices with frequent, atomic commits to minimize risk and improve traceability, promote the development and reuse of modular components and functions while centralizing business logic to avoid duplication and ensure consistency, provide clear, informative user feedback and progress reporting throughout system interactions, and leverage all available tools, frameworks, and domain-specific expertise to support developers in delivering robust, scalable, and high-quality applications."
 - **Output:** `specs/constitution.md`
 - **Timeout:** 300s
+- **Done:** Output `[Step 2/11] DONE — constitution created`
 
 ### Step 3 — CLAUDE.md Sync `[on_failure: CONTINUE]`
+- **Progress:** Output `[Step 3/11] CLAUDE.md Sync — verifying compliance...`
 - **Action:** Read CLAUDE.md and verify it complies with the constitution in `specs/constitution.md`. Update CLAUDE.md if it conflicts with or is missing constitution rules.
 - **Timeout:** 120s
 - **Post-action:** Commit all files and push. Message: `feat(speckit): add constitution and sync CLAUDE.md`
+- **Done:** Output `[Step 3/11] DONE — CLAUDE.md synced`
 
 ### Step 4 — Specify `[on_failure: STOP]`
+- **Progress:** Output `[Step 4/11] Specify — creating feature specification...`
 - **Skill:** `speckit.specify`
 - **Input:** Use the detailed specification output from Step 1 (brainstorm) as the argument
 - **Knowledge lookup:** Use `mcp__bms-knowledge-mcp__search_knowledge` to search the `hosxp` collection for exact table names, field names, data types, and relationships needed by this feature. Reference actual HOSxP data structures in the spec.
@@ -57,32 +98,44 @@ You are running the BMS Speckit specification and planning chain. Execute each s
 - **Timeout:** 300s
 - **Retry:** up to 2 attempts
 - **Post-action:** Commit all files and push. Message: `feat(speckit): add feature specification`
+- **Done:** Output `[Step 4/11] DONE — specification created`
 
 ### Step 5 — Plan `[on_failure: STOP]`
+- **Progress:** Output `[Step 5/11] Plan — generating implementation plan...`
 - **Skill:** `speckit.plan`
 - **Input:** reads from step 4 artifacts
 - **Output:** `specs/*/plan.md`
 - **Timeout:** 300s
 - **Retry:** up to 2 attempts
 - **Post-action:** Commit all files and push. Message: `feat(speckit): add implementation plan`
+- **Done:** Output `[Step 5/11] DONE — plan created`
 
 ### Step 6 — Tasks `[on_failure: STOP]`
+- **Progress:** Output `[Step 6/11] Tasks — generating task list...`
 - **Skill:** `speckit.tasks`
 - **Input:** reads from step 5 artifacts
 - **Output:** `specs/*/tasks.md`
 - **Timeout:** 300s
 - **Retry:** up to 2 attempts
 - **Post-action:** Commit all files and push. Message: `feat(speckit): add task list`
+- **Done:** Output `[Step 6/11] DONE — N tasks created`
 
 ### Step 7 — Analyze `[on_failure: CONTINUE]`
+- **Progress:** Output `[Step 7/11] Analyze — cross-artifact consistency check...`
 - **Skill:** `speckit.analyze`
 - **Purpose:** Cross-artifact consistency check (spec ↔ plan ↔ tasks). Non-destructive — report only.
 - **Timeout:** 300s
 - **Post-action:** Commit all files and push. Message: `feat(speckit): add cross-artifact analysis report`
+- **Done:** Output `[Step 7/11] DONE — analysis complete`
 
 After all steps complete, return: the feature name, number of tasks created, and the path to tasks.md.
 """
 
+After the subagent completes, update tasks 1-7 as completed using TaskUpdate, then output:
+
+> Phase 1 complete. N tasks created at specs/feature-name/tasks.md
+> Starting Phase 2 (implementation)...
+
 ---
 
 ## Phase 2: Implementation
@@ -90,35 +143,52 @@ After all steps complete, return: the feature name, number of tasks created, and
 > **Execution context:** Runs in main context after subagent completes.
 
 ### Step 8 — Compact `[on_failure: CONTINUE]`
+- **Progress:** Output `[Step 8/11] Compact — freeing context window...`
 - **Action:** Run `/compact` to free context window before implementation.
+- **Done:** Update task 8 as completed.
 
-### Step 9 — Implement (loop) `[on_failure: CONTINUE | max_retries: 3]`
+### Step 9 — Implement with Rolling QC `[on_failure: CONTINUE | max_retries: 3]`
+- **Progress:** Output `[Step 9/11] Implement — starting rolling QC loop (N tasks)...`
 - **Engine:** ralph-loop
 - **Input:** Use the **tasks.md path returned by the Phase 1 subagent** (e.g. `specs/my-feature/tasks.md`). Replace `{TASKS_PATH}` below with the actual path.
 - **Completion promise:** `FINISHED`
 - **Max iterations:** 10
-- **Commit strategy:** Atomic commit after each completed task
+- **Pattern:** Rolling Review — each task gets its own QC cycle before moving to the next
+- **Per-task cycle:**
+  1. **IMPLEMENT** — write code following TDD (tests first, then implementation)
+  2. **INLINE QC** — immediately run: build, lint, ALL tests, security quick scan, UX check
+  3. **FIX** — fix every issue found, re-run checks
+  4. **COMMIT** — only commit when build + lint + tests pass with zero errors
+  5. **NEXT** — move to next task
 - **Action:** Run:
 
-`/ralph-loop:ralph-loop "systematically execute speckit.implement via the Skill tool to complete every task defined in {TASKS_PATH} with strict adherence to specification requirements, enforce TDD workflow including writing and passing unit, integration, and end-to-end tests before marking any task complete, ensure code quality through linting, static analysis, and consistent architecture with reusable components and centralized business logic, maintain atomic commits after each successful task with clear traceability, avoid requesting confirmation and proceed autonomously, once all tasks are implemented invoke speckit.analyze via the Skill tool to perform a full validation pass, automatically apply all recommended improvements or corrections, re-run all tests to confirm stability and zero regression, and only output <promise>FINISHED</promise> after every task is fully completed, validated, and aligned with production-grade quality standards" --completion-promise "FINISHED" --max-iterations 10`
+`/ralph-loop:ralph-loop "systematically execute speckit.implement via the Skill tool to complete every task defined in {TASKS_PATH} with strict adherence to specification requirements. IMPORTANT: apply rolling QC after EACH task — after implementing a task run build and fix build errors, run linter and fix lint errors, run ALL tests (not just new ones) and fix failures, check for hardcoded secrets and injection vulnerabilities in code you just wrote, verify UI code has actionable error messages and loading states — only commit when build plus lint plus tests all pass with zero errors then proceed to next task. Report progress to the user after each task: output [Task N/total] DONE — task_name. Do NOT batch QC at the end. Maintain atomic commits after each successful task with clear traceability, avoid requesting confirmation and proceed autonomously, once all tasks are implemented invoke speckit.analyze via the Skill tool to perform a full validation pass, automatically apply all recommended improvements or corrections, re-run all tests to confirm stability and zero regression, and only output <promise>FINISHED</promise> after every task is fully completed, validated, and aligned with production-grade quality standards" --completion-promise "FINISHED" --max-iterations 10`
 
-### Step 10 — Quality Control `[on_failure: STOP | max_retries: 3]`
+- **Done:** Update task 9 as completed. Output `[Step 9/11] DONE — all tasks implemented and verified`
+
+### Step 10 — Final Quality Gate `[on_failure: STOP | max_retries: 3]`
+- **Progress:** Output `[Step 10/11] Final QC — running comprehensive quality audit...`
 - **Agent:** Dispatch `bms-speckit:quality-control` agent
-- **Purpose:** Comprehensive 5-dimension quality audit. The agent fixes all issues autonomously.
+- **Purpose:** Final comprehensive sweep. Since inline QC already caught per-task issues, this focuses on **cross-cutting concerns** that can only be detected across the full codebase.
 - **Timeout:** 900s
-- **Audit dimensions:**
-  - **A. Code Errors** — build, lint, test suite (must all pass with zero errors)
-  - **B. Security** — hardcoded secrets, injection, auth, `npm audit` / `pip audit`
-  - **C. Dependencies** — outdated packages, vulnerable deps, unused packages
-  - **D. UX/UI** — user feedback, error messages, loading states, empty states
-  - **E. Accessibility** — alt text, form labels, keyboard navigation
+- **Focus areas:**
+  - **A. Security deep scan** — `npm audit` / `pip audit`, auth flow review, CORS, secrets across all files
+  - **B. Dependencies** — outdated packages, vulnerable deps, unused packages
+  - **C. UX consistency** — consistent error handling and feedback patterns across ALL features, empty states, responsive design
+  - **D. Accessibility** — alt text, form labels, keyboard nav, heading hierarchy
+  - **E. Integration check** — verify all components work together end-to-end
 - The agent fixes everything it can. Major dependency updates are flagged for user review.
 - Only proceed to merge when the agent reports all checks pass.
-- **Post-action:** Commit all fixes and push. Message: `fix(speckit): quality control — fix code errors, security, UX, deps`
+- **Post-action:** Commit all fixes and push. Message: `fix(speckit): final QC — security, deps, UX consistency, accessibility`
+- **Done:** Update task 10 as completed. Output `[Step 10/11] DONE — quality gate passed`
 
 ### Step 11 — Merge to Main `[on_failure: STOP]`
+- **Progress:** Output `[Step 11/11] Merge — merging to main branch...`
 - **Action:** Switch to main branch, merge the feature branch (fast-forward if possible), push main to remote, then clean up the feature branch.
 - **Timeout:** 120s
+- **Done:** Update task 11 as completed. Output:
+
+> Pipeline complete! Feature merged to main.
 
 ---
 
@@ -128,13 +198,12 @@ After all steps complete, return: the feature name, number of tasks created, and
 Phase 1 (subagent)                          Phase 2 (main context)
 ──────────────────────────────              ──────────────────────────────
 Step 1: brainstorm ──STOP── commit          Step 8:  compact
-        + knowledge search (hosxp)          Step 9:  implement (ralph-loop)
-Step 2: constitution ─STOP─┐                         commit per task
-Step 3: CLAUDE.md sync ───┘ commit          Step 10: QC agent ── commit
-                 (code/security/deps/UX/a11y)
-Step 4: specify ──────STOP── commit         Step 11: merge to main + push
-        + knowledge search (hosxp)
-Step 5: plan ─────────STOP── commit
-Step 6: tasks ────────STOP── commit
-Step 7: analyze ──────────── commit
+        + knowledge search (hosxp)          Step 9:  implement + rolling QC
+Step 2: constitution ─STOP─┐                         ┌─ implement task ─┐
+Step 3: CLAUDE.md sync ───┘ commit                   │  inline QC       │
+Step 4: specify ──────STOP── commit                  │  fix → commit    │
+        + knowledge search (hosxp)                   └─ next task ──────┘
+Step 5: plan ─────────STOP── commit         Step 10: final QC agent ── commit
+Step 6: tasks ────────STOP── commit                  (security/deps/UX/a11y)
+Step 7: analyze ──────────── commit         Step 11: merge to main + push
 ```