cc-devflow 4.3.0 → 4.4.1

package/.claude/skills/brainstorming/SKILL.md

@@ -1,161 +0,0 @@
----
-name: flow-brainstorming
-description: "在 /flow-init 阶段强制触发，用于捕捉需求的原始意图、探索方案、记录决策。确保后续流程有明确的北极星可追溯。"
----
-
-# Flow Brainstorming - 需求头脑风暴
-
-## Overview
-
-将用户的模糊想法转化为清晰的设计规格，通过自然对话捕捉原始意图。
-
-**核心原则**：需求的原始意图是整个开发流程的「北极星」，后续每个阶段都应能追溯并验证是否偏离。
-
-## The Iron Law
-
-```
-NO FLOW EXECUTION WITHOUT BRAINSTORM ALIGNMENT
-```
-
-每个后续 flow-* 阶段开始前，必须确认与 BRAINSTORM.md 一致。
-
-## The Process
-
-### Phase 1: Understanding the Idea
-
-**一次问一个问题**，不要用多个问题压垮用户：
-
-1. 检查项目现状（文件、文档、最近提交）
-2. 问问题来细化想法：
-   - 优先多选题（更容易回答）
-   - 一个消息只问一个问题
-   - 如果话题需要更多探索，分成多个问题
-3. 聚焦理解：**目的、约束、成功标准**
-
-**问题示例**：
-```
-这个需求主要解决什么问题？
-A) 新增功能
-B) 修复现有问题
-C) 性能优化
-D) 重构/技术债
-```
-
-### Phase 2: Exploring Approaches
-
-- 提出 2-3 种不同方案，说明取舍
-- 给出你的推荐方案及理由
-- 让用户做决策
-
-**方案呈现格式**：
-```markdown
-### 方案 A: {名称} ⭐ 推荐
-
-**描述**: ...
-**优势**: ...
-**劣势**: ...
-**适用场景**: ...
-
-### 方案 B: {名称}
-...
-```
-
-### Phase 3: Presenting the Design
-
-一旦理解了要构建什么：
-
-1. 分段呈现设计（每段 200-300 字）
-2. 每段后询问是否正确
-3. 涵盖：架构、组件、数据流、错误处理、测试
-4. 准备好返回澄清
-
-### Phase 4: Documentation
-
-将验证过的设计写入 BRAINSTORM.md：
-
-```
-devflow/requirements/${REQ}/BRAINSTORM.md
-```
-
-**必须包含**：
-- 原始需求（用户原话，一字不改）
-- 核心问题定义
-- 成功标准
-- 约束条件
-- 方案探索（2-3种）
-- 最终决策及理由
-
-## Key Principles
-
-| 原则 | 说明 |
-|------|------|
-| **一次一个问题** | 不要用多个问题压垮用户 |
-| **多选题优先** | 比开放问题更容易回答 |
-| **YAGNI 无情** | 从所有设计中移除不必要的功能 |
-| **探索替代方案** | 在确定前总是提出 2-3 种方案 |
-| **增量验证** | 分段呈现设计，验证每段 |
-| **灵活应变** | 有不明白的地方就返回澄清 |
-
-## Rationalization Prevention
-
-| Excuse | Reality |
-|--------|---------|
-| "需求已经很清楚了" | Brainstorm 确保没有遗漏假设 |
-| "用户赶时间，跳过吧" | 头脑风暴节省的是后续返工时间 |
-| "这是小需求" | 小需求也有核心问题和成功标准 |
-| "方案很明显" | 明显的选择也需要记录理由 |
-| "已经讨论过了" | 口头讨论不是文档，没有追溯性 |
-| "先做再说" | 先想清楚再做，节省 3 倍时间 |
-
-## Red Flags - STOP
-
-如果你发现自己：
-- 跳过问问题直接开始做
-- 用户说"我知道要什么"就不问了
-- 没有记录方案取舍就选定
-- 没有写 BRAINSTORM.md 就进入下一阶段
-
-**STOP。返回正确流程。**
-
-## Integration with CC-DevFlow
-
-### flow-init 阶段
-
-```yaml
-Entry Gate:
-  - 解析 REQ-ID 和标题
-  - 触发 flow-brainstorming skill
-
-Brainstorm Phase:
-  1. 问问题理解需求（一次一个）
-  2. 探索 2-3 种方案
-  3. 确认最终方案
-  4. 输出 BRAINSTORM.md
-
-Exit Gate:
-  - 验证 BRAINSTORM.md 存在
-  - 验证包含必要章节
-```
-
-### 后续 flow-* 阶段
-
-```yaml
-Entry Gate 添加:
-  step: Brainstorm Alignment Check
-    - read: devflow/requirements/${REQ}/BRAINSTORM.md
-    - verify:
-        - 原始问题是否仍然是解决目标？
-        - 选定方案是否仍然适用？
-        - 约束条件是否发生变化？
-    - if 发现偏离:
-        - ask_user: "发现与原始意图偏离，是否更新 BRAINSTORM.md？"
-        - action: 记录偏离原因，更新文档
-```
-
-## Output Template
-
-参见 `.claude/docs/templates/BRAINSTORM_TEMPLATE.md`
-
----
-
-**[PROTOCOL]**: 变更时更新此头部，然后检查 CLAUDE.md

package/.claude/skills/cc-devflow-orchestrator/SKILL.md

@@ -1,169 +0,0 @@
----
-name: cc-devflow-orchestrator
-description: CC-DevFlow workflow router and agent recommender. Use when starting requirements, running flow commands, or asking about devflow processes.
----
-
-# CC-DevFlow Orchestrator
-
-## Purpose
-Guide users to the correct command/skill without duplicating detailed implementation standards.
-
-## Workflow Map
-
-### Project-Level (run once per project)
-
-```text
-/core:roadmap      → ROADMAP.md + BACKLOG.md
-/core:architecture → ARCHITECTURE.md
-/core:guidelines   → frontend/backend guidelines
-/core:style        → STYLE.md
-```
-
-## Project-Level Harness Protocol (Long-running)
-
-For `/core:*` commands, enforce a two-session model before declaring completion:
-
-1. Initializer session
-   - establish/update `devflow/.core-harness/<command>/checklist.json`, `progress.md`, `session-handoff.md`
-   - convert high-level goal into structured acceptance checks (default all failing)
-2. Worker session(s)
-   - resume from `session-handoff.md` + `progress.md`
-   - execute one smallest deliverable per session
-   - update checklist status only after command-specific validation
-3. Completion gate
-   - completion is allowed only when checklist is fully passing and command validation gates pass
-   - never declare success from “looks complete”; require artifact evidence
-
-### Core Route Defaults
-
-- no `devflow/ROADMAP.md` → route to `/core:roadmap` (initializer first)
-- roadmap exists but architecture missing/stale → route to `/core:architecture`
-- architecture exists but guidelines missing/stale → route to `/core:guidelines`
-- style missing/stale → route to `/core:style`
-- interrupted core command → rerun same command from handoff (`/core:roadmap --resume` if supported; otherwise run command again and continue from `session-handoff.md`)
-
-### Requirement-Level Canonical Mainline (v6)
-
-```text
-/flow:init    → harness:init + harness:pack
-             → context-package.md + harness-state.json
-     ↓
-/flow:spec    → harness:plan
-             → task-manifest.json
-     ↓
-/flow:dev     → harness:dispatch / harness:resume
-             → runtime events + checkpoints + manifest status
-     ↓
-/flow:verify  → harness:verify
-             → report-card.json (quick/strict gates)
-     ↓
-/flow:release → harness:release + harness:janitor
-             → RELEASE_NOTE.md + released state
-```
-
-### Bug Workflow
-
-```text
-/flow:fix "BUG-123|描述" → 系统化调试与修复
-```
-
-### Deprecated Migrations (keep for compatibility)
-
-```text
-/flow:new       → /flow:init → /flow:spec → /flow:dev → /flow:verify → /flow:release
-/flow:clarify   → merged into /flow:spec
-/flow:checklist → merged into /flow:verify --strict
-/flow:quality   → merged into /flow:verify
-```
-
-## Routing Guide
-
-### Requirement kickoff
-- Recommend: `/flow:init "REQ-123|Title|URLs?"`
-- Then: `/flow:spec "REQ-123"`
-
-### Planning/specification questions
-- Recommend: `/flow:spec`
-- Notes: this is the unified planning stage for executable task-manifest generation.
-
-### Development execution / interrupted execution
-- Recommend: `/flow:dev "REQ-123"`
-- If interrupted/failed: `/flow:dev "REQ-123" --resume`
-
-### QA/security/release readiness
-- Recommend: `/flow:verify "REQ-123"`
-- Strict gate: `/flow:verify "REQ-123" --strict`
-
-### Release
-- Recommend: `/flow:release "REQ-123"`
-- Release is blocked when report-card overall is fail.
-
-### Code review requests
-- Recommend: `/flow:verify "REQ-123" --strict`
-- Optional deep review: `/util:code-review "<diff>"`
-
-## Phase Gates (Quick Reference)
-
-### Entry Gates
-- `flow:init`: repository and requirement id are valid.
-- `flow:spec`: `context-package.md` and `harness-state.json` exist.
-- `flow:dev`: `task-manifest.json` exists and is schema-valid.
-- `flow:verify`: task dispatch completed or at least one dispatch/resume run exists.
-- `flow:release`: `report-card.json.overall == pass`.
-
-### Exit Gates
-- `flow:init`: requirement context packaged.
-- `flow:spec`: task-manifest generated.
-- `flow:dev`: task statuses updated with runtime checkpoints/events.
-- `flow:verify`: report-card emitted (quick/strict/review sections).
-- `flow:release`: release note generated and harness state marked released.
-
-## State → Recommended Command
-
-```yaml
-no_requirement_context:
-  recommend: /flow:init
-
-initialized_or_context_packed:
-  recommend: /flow:spec
-
-manifest_exists_with_pending_or_failed:
-  recommend: /flow:dev
-  alternative: /flow:dev --resume
-
-manifest_all_passed_without_report_card:
-  recommend: /flow:verify --strict
-
-report_card_fail:
-  recommend: /flow:dev --resume
-  then: /flow:verify --strict
-
-report_card_pass:
-  recommend: /flow:release
-
-released:
-  recommend: /flow:archive (optional)
-```
-
-## Auxiliary Commands
-
-### Progress and recovery
-- `/flow:status` - query requirement progress
-- `/flow:update "REQ-123" "T012"` - update task progress
-- `/flow:restart "REQ-123" --from=dev` - recover interrupted workflow state
-
-### Upgrade and governance
-- `/flow:upgrade "REQ-123" --analyze` - PRD version impact analysis
-- `/flow:constitution` - constitution governance
-- `/flow:verify "REQ-123"` - consistency and quality verification
-
-## Design Principle
-
-This skill only does routing:
-- Which command to run next
-- Which gate blocks progress
-- Which migration path applies for deprecated commands
-- Prefer incremental convergence over one-shot generation
-- Require artifact-backed completion for long-running sessions
-
-Detailed quality standards stay in command files and workflow skills.

package/.claude/skills/constitution-guardian/SKILL.md

@@ -1,306 +0,0 @@
----
-name: constitution-guardian
-description: Real-time Constitution compliance checker for devflow documents. Blocks partial implementations and hardcoded secrets during file editing.
----
-
-# Constitution Guardian
-
-## Purpose
-Enforce CC-DevFlow Constitution compliance by detecting violations in real-time during document editing, preventing non-compliant content from being saved.
-
-**Trigger**: PreToolUse hook when editing devflow documents (PRD.md, EPIC.md, TASKS.md, TECH_DESIGN.md)
-
-## Enforcement Scope
-
-**Focus Articles** (Real-time prevention):
-- **Article I.1**: Quality First - No Partial Implementation
-- **Article III.1**: Security First - No Hardcoded Secrets
-
-**Note**: Full Constitution has 10 Articles. This guardrail focuses on the most critical real-time violations. Batch validation by `validate-constitution.sh` covers all Articles.
-
-## Violation Patterns
-
-### Article I.1: No Partial Implementation
-
-#### Pattern 1: TODO placeholders
-```markdown
-# ❌ BLOCKED
-## User Stories
-### US1: User Registration
-TODO later: Add email verification flow
-FIXME: Implement password strength validation
-```
-
-**Regex Patterns**:
-- `TODO.*later`
-- `FIXME`
-- `\[placeholder\]`
-- `// TODO:.*later`
-- `# FIXME:.*`
-
-#### Pattern 2: Simplified/Partial notes
-```markdown
-# ❌ BLOCKED
-## Implementation Notes
-This is simplified for now, complete implementation would require...
-```
-
-**Regex Pattern**: `simplified for now`
-
-#### Pattern 3: Version deferral
-```markdown
-# ❌ BLOCKED
-## Acceptance Criteria
-- [ ] Basic login (v1)
-- [ ] Remember me (defer to v2)
-```
-
-**Regex Pattern**: `defer to v\d|will complete in v\d`
-
-### Article III.1: No Hardcoded Secrets
-
-#### Pattern 1: Environment variables with secrets
-```markdown
-# ❌ BLOCKED
-## Configuration
-API_KEY=sk-abc123def456
-JWT_SECRET=mysecretkey123
-PASSWORD=admin123
-```
-
-**Regex Patterns**:
-- `API_KEY\s*=\s*['"]?[a-zA-Z0-9_-]{10,}`
-- `SECRET\s*=\s*['"]?[a-zA-Z0-9_-]+`
-- `PASSWORD\s*=\s*['"]?[^\s]+`
-- `TOKEN\s*=\s*['"]?[a-zA-Z0-9_-]{10,}`
-
-#### Pattern 2: Code snippets with hardcoded secrets
-```typescript
-// ❌ BLOCKED
-const config = {
-  apiKey: "sk-abc123def456",
-  dbPassword: "postgres123"
-};
-```
-
-**Regex Patterns**:
-- `apiKey:\s*['"][^'"]+['"]`
-- `password:\s*['"][^'"]+['"]`
-- `secret:\s*['"][^'"]+['"]`
-
-## Blocking Message
-
-When violation detected, PreToolUse hook returns **exit code 2** (blocks file save):
-
-```
-⚠️ BLOCKED - Constitution Violation
-
-Detected:
-- [Line 42] TODO placeholder (Article I.1 - No Partial Implementation)
-- [Line 58] Hardcoded API key (Article III.1 - No Hardcoded Secrets)
-
-📋 ACTION:
-1. Complete all TODOs/FIXMEs before saving
-2. Move secrets to environment variables (.env, not committed)
-3. Review `.claude/rules/project-constitution.md` v2.0.0
-4. Run /flow-verify for comprehensive check
-
-Source: Constitution Articles I.1, III.1
-File: {file_path}
-
-Constitutional Basis:
-  Article I.1: "NO PARTIAL IMPLEMENTATION: Complete implementation or no implementation"
-  Article III.1: "NO HARDCODED SECRETS: Use environment variables or secret management"
-
-💡 SKIP: Add `@constitution-verified` comment or set SKIP_CONSTITUTION_CHECK=1
-```
-
-## Constitutional Basis
-
-### Article I: Quality First
-
-```yaml
-I.1 Complete Implementation Mandate:
-  Prohibition: Any form of partial implementation or placeholder code
-  Requirement: Complete implementation or no implementation
-  Examples:
-    ❌ Forbidden: "// TODO: Implement this later"
-    ❌ Forbidden: "// Simplified for now, will complete in v2"
-    ✅ Required: Fully functional, production-ready code
-```
-
-**Enforcement**:
-- **Generation time**: prd-writer, tech-architect, planner agents check output
-- **Edit time**: constitution-guardian guardrail blocks save (this skill)
-- **Phase completion**: validate-constitution.sh batch validation
-
-### Article III: Security First
-
-```yaml
-III.1 No Hardcoded Secrets:
-  Prohibited:
-    ❌ API_KEY = "sk-abc123..." in source code
-    ❌ PASSWORD = "admin123" in config files
-    ❌ JWT_SECRET embedded in code
-
-  Required:
-    ✅ Environment variables (.env files, not committed)
-    ✅ Secret management services (AWS Secrets Manager, etc.)
-    ✅ Configuration injection at runtime
-
-  Detection: Pre-push guard scans for secret patterns
-```
-
-**Enforcement**:
-- **Generation time**: All agents avoid secrets in generated docs
-- **Edit time**: constitution-guardian guardrail blocks save (this skill)
-- **Pre-push**: Git pre-push hook scans for secrets
-
-## Skip Conditions
-
-Users can bypass Constitution guardian in specific scenarios:
-
-### 1. Session Skip (One-time per session)
-- **Mechanism**: `sessionSkillUsed: true` in skill-rules.json
-- **Behavior**: Guardrail only triggers once per Claude session
-- **Use case**: User acknowledged violation, working on fix
-
-### 2. File Marker (Permanent skip for specific file)
-- **Marker**: Add `@constitution-verified` comment in document
-- **Example**:
-  ```markdown
-  <!-- @constitution-verified: Legacy doc migration, compliance review completed -->
-  ```
-- **Use case**: Legacy documentation, special cases
-
-### 3. Environment Variable (Temporary global skip)
-- **Variable**: `SKIP_CONSTITUTION_CHECK=1`
-- **Scope**: Current terminal session
-- **Use case**: Bulk imports, automated migrations
-
-## Relationship with Other Components
-
-### validate-constitution.sh (Script)
-- **Purpose**: Batch validation of all 10 Constitutional Articles
-- **Scope**: Complete document/codebase scan
-- **Timing**: Phase completion (e.g., /flow-prd Exit Gate)
-- **Articles**: I, II, III, IV, V, VI, VII, VIII, IX, X
-
-### constitution-guardian (Guardrail)
-- **Purpose**: Real-time prevention of critical violations
-- **Scope**: Single document being edited
-- **Timing**: During file editing (PreToolUse hook)
-- **Articles**: Focus on I.1, III.1 (most critical for documents)
-
-**Relationship**: **Complementary (互补)**
-- Guardrail: Real-time prevention (write-time, partial Articles)
-- Script: Batch validation (phase-time, all Articles)
-- Double insurance: Guardrail catches most issues, Script catches remaining
-
-### Constitution Document
-- **Source of Truth**: `.claude/rules/project-constitution.md` v2.0.0
-- **Contains**: All 10 Articles with detailed rules
-- **This guardrail**: Extracts Articles I.1, III.1 prohibition rules only
-
-## Configuration
-
-In `.claude/skills/skill-rules.json`:
-
-```json
-{
-  "constitution-guardian": {
-    "type": "guardrail",
-    "enforcement": "block",
-    "priority": "critical",
-    "description": "Real-time Constitution compliance, extracted from Constitution v2.0.0",
-    "fileTriggers": {
-      "pathPatterns": [
-        "devflow/requirements/**/PRD.md",
-        "devflow/requirements/**/EPIC.md",
-        "devflow/requirements/**/TASKS.md",
-        "devflow/requirements/**/TECH_DESIGN.md",
-        "devflow/requirements/**/contracts/**/*.yaml",
-        "devflow/requirements/**/data-model.md"
-      ],
-      "contentPatterns": [
-        "TODO.*later",
-        "FIXME",
-        "\\[placeholder\\]",
-        "simplified for now",
-        "defer to v\\d",
-        "API_KEY\\s*=\\s*['\"]?[a-zA-Z0-9_-]{10,}",
-        "SECRET\\s*=\\s*['\"]?[a-zA-Z0-9_-]+",
-        "PASSWORD\\s*=\\s*['\"]?[^\\s]+",
-        "TOKEN\\s*=\\s*['\"]?[a-zA-Z0-9_-]{10,}",
-        "apiKey:\\s*['\"][^'\"]+['\"]",
-        "password:\\s*['\"][^'\"]+['\"]"
-      ]
-    },
-    "blockMessage": "⚠️ BLOCKED - Constitution Violation\n\nDetected:\n- Partial implementation (Article I.1)\n- Hardcoded secrets (Article III.1)\n\n📋 ACTION:\n1. Complete all TODOs/FIXMEs\n2. Move secrets to config system\n3. Run /flow-verify\n\nSource: .claude/rules/project-constitution.md v2.0.0",
-    "skipConditions": {
-      "sessionSkillUsed": true,
-      "fileMarkers": ["@constitution-verified"],
-      "envOverride": "SKIP_CONSTITUTION_CHECK"
-    }
-  }
-}
-```
-
-## Line Number Reporting (Enhancement)
-
-**Goal**: Precise violation location reporting
-
-**Implementation** (in PreToolUse hook):
-```typescript
-function detectViolations(content: string, patterns: string[]) {
-  const lines = content.split('\n');
-  const violations: Array<{line: number, pattern: string, text: string}> = [];
-
-  lines.forEach((line, index) => {
-    patterns.forEach(pattern => {
-      if (new RegExp(pattern, 'i').test(line)) {
-        violations.push({
-          line: index + 1,
-          pattern: pattern,
-          text: line.trim()
-        });
-      }
-    });
-  });
-
-  return violations;
-}
-```
-
-**Enhanced Blocking Message**:
-```
-⚠️ BLOCKED - Constitution Violation
-
-Detected 3 violations:
-  [Line 42] TODO placeholder (Article I.1)
-    → "TODO later: Add email verification"
-
-  [Line 58] Hardcoded API key (Article III.1)
-    → "API_KEY=sk-abc123def456"
-
-  [Line 73] FIXME comment (Article I.1)
-    → "FIXME: Complete error handling"
-
-📋 ACTION: ...
-```
-
-## Design Principle
-
-**This guardrail does NOT contain**:
-- ❌ Complete Constitution (all 10 Articles are in project-constitution.md)
-- ❌ All violation patterns (only Articles I.1, III.1)
-- ❌ Batch validation logic (that's in validate-constitution.sh)
-
-**This guardrail ONLY contains**:
-- ✅ Articles I.1, III.1 prohibition rule extraction
-- ✅ Real-time violation detection (content pattern matching)
-- ✅ Blocking mechanism (PreToolUse hook, exit code 2)
-- ✅ Precise line number reporting
-- ✅ Links to full Constitution document
-
-**Rationale**: Avoid duplication ("不重不漏" principle). Constitution document owns full text, guardrail owns real-time enforcement of critical rules.