ccg-ros2-workflow 2.2.2 → 3.0.0

package/templates/rules/ccg-skill-routing.md

@@ -0,0 +1,91 @@
+# CCG Domain Knowledge — Auto-routing Rules
+
+When the user's request matches trigger keywords below, automatically READ the corresponding skill file to gain domain expertise before responding. These knowledge files are installed at `~/.claude/skills/ccg/domains/`.
+
+**IMPORTANT**: Read the skill file FIRST, then respond. Do NOT fabricate domain knowledge from training data when a skill file exists.
+
+## Security Domain (`domains/security/`) — NOT installed by default
+
+> Security domain files contain red team/pentest reference content that may trigger antivirus false positives.
+> They are NOT installed by default. To enable, manually copy from the npm package:
+> `cp -r $(npm root -g)/ccg-ros2-workflow/templates/skills/domains/security/ ~/.claude/skills/ccg/domains/security/`
+
+| Trigger Keywords | Skill File | Description |
+|------------------|-----------|-------------|
+| pentest, red team, exploit, C2, lateral movement, privilege escalation, evasion, persistence | `~/.claude/skills/ccg/domains/security/red-team.md` | Red team attack techniques |
+| blue team, alert, IOC, incident response, forensics, SIEM, EDR, containment | `~/.claude/skills/ccg/domains/security/blue-team.md` | Blue team defense & incident response |
+| web pentest, API security, OWASP, SQLi, XSS, SSRF, RCE, injection | `~/.claude/skills/ccg/domains/security/pentest.md` | Web & API penetration testing |
+| code audit, dangerous function, taint analysis, sink, source | `~/.claude/skills/ccg/domains/security/code-audit.md` | Source code security audit |
+| binary, reversing, PWN, fuzzing, stack overflow, heap overflow, ROP | `~/.claude/skills/ccg/domains/security/vuln-research.md` | Vulnerability research & exploitation |
+| OSINT, threat intelligence, threat modeling, ATT&CK, threat hunting | `~/.claude/skills/ccg/domains/security/threat-intel.md` | Threat intelligence & OSINT |
+
+## ROS2 Domain (`domains/ros2-*/`) — Robotics Specialization
+
+> CCG-ROS2 specialized routing for ROS2 Humble robotics development.
+> Routes upper-layer tasks (Launch/Python/RViz) to Antigravity, low-level tasks (C++/drivers) to Codex.
+
+| Trigger Keywords | Skill File | Authority Model |
+|------------------|-----------|-----------------|
+| LiDAR, RPLidar, Velodyne, Ouster, Livox, point cloud, PointCloud2, PCL, voxel, RANSAC, camera calibration, RealSense, ZED, depth image, sensor fusion, TF2 sync | `~/.claude/skills/ccg/domains/ros2-perception/SKILL.md` | Codex (low-level driver) + Antigravity (config) |
+| PID controller, MPC, LQR, trajectory tracking, Pure Pursuit, Stanley, ros2_control, controller_manager, hardware_interface, motor driver, encoder, CAN motor, Modbus motor | `~/.claude/skills/ccg/domains/ros2-control/SKILL.md` | Codex (real-time control) |
+| Nav2, navigation_stack, SLAM, slam_toolbox, Cartographer, RTAB-Map, AMCL, costmap, planner, NavfnPlanner, SmacPlanner, DWB, RPP, MPPI, behavior tree | `~/.claude/skills/ccg/domains/ros2-navigation/SKILL.md` | Antigravity (config) + Codex (custom planner) |
+| MoveIt, MoveIt2, move_group, manipulator, arm, grasp, pick, place, IK, FK, kinematics, URDF, SRDF, xacro, OMPL, CHOMP, STOMP | `~/.claude/skills/ccg/domains/ros2-manipulation/SKILL.md` | Codex (kinematics) + Antigravity (config) |
+| serial, ttyUSB, ttyACM, RS232, RS485, CAN, SocketCAN, can0, candump, I2C, SPI, GPIO, udev rules, device permission, dialout group, modbus | `~/.claude/skills/ccg/domains/ros2-hardware/SKILL.md` | Codex (driver) |
+| launch file, launch.py, IncludeLaunchDescription, launch_arguments, FindPackageShare, PathJoinSubstitution, PushRosNamespace, GroupAction | `~/.claude/skills/ccg/domains/ros2-upper-app/launch-files.md` | Antigravity (orchestration) |
+| params.yaml, ros__parameters, declare_parameter, parameter override, ParameterDescriptor, on_set_parameters_callback | `~/.claude/skills/ccg/domains/ros2-upper-app/parameters.md` | Antigravity (config) |
+| rviz, rviz2, .rviz config, displays, TF tree, Fixed Frame, RobotModel display, costmap visualization | `~/.claude/skills/ccg/domains/ros2-upper-app/rviz-config.md` | Antigravity (config) |
+| rclpy, Python ROS2 node, MultiThreadedExecutor, callback group, ReentrantCallbackGroup, ActionClient, Lifecycle Python | `~/.claude/skills/ccg/domains/ros2-upper-app/python-nodes.md` | Antigravity (upper-layer) |
+| Gazebo, gz sim, Ignition, ros_gz_bridge, sdf world, robot_state_publisher, gz_ros2_control, simulation time, use_sim_time | `~/.claude/skills/ccg/domains/ros2-upper-app/simulation.md` | Antigravity (simulation config) |
+
+## Architecture Domain (`domains/architecture/`)
+
+| Trigger Keywords | Skill File |
+|------------------|-----------|
+| API design, REST, GraphQL, gRPC, endpoint, versioning | `~/.claude/skills/ccg/domains/architecture/api-design.md` |
+| caching, Redis, Memcached, cache invalidation, CDN | `~/.claude/skills/ccg/domains/architecture/caching.md` |
+| cloud native, Kubernetes, Docker, microservice, service mesh | `~/.claude/skills/ccg/domains/architecture/cloud-native.md` |
+| message queue, Kafka, RabbitMQ, event driven, pub/sub | `~/.claude/skills/ccg/domains/architecture/message-queue.md` |
+| security architecture, zero trust, defense in depth, IAM | `~/.claude/skills/ccg/domains/architecture/security-arch.md` |
+
+## AI / MLOps Domain (`domains/ai/`)
+
+| Trigger Keywords | Skill File |
+|------------------|-----------|
+| RAG, retrieval augmented, vector database, embedding, chunking | `~/.claude/skills/ccg/domains/ai/rag-system.md` |
+| AI agent, tool use, function calling, agent framework, orchestration | `~/.claude/skills/ccg/domains/ai/agent-dev.md` |
+| LLM security, prompt injection, jailbreak, guardrail | `~/.claude/skills/ccg/domains/ai/llm-security.md` |
+| prompt engineering, model evaluation, benchmark, fine-tuning | `~/.claude/skills/ccg/domains/ai/prompt-and-eval.md` |
+
+## DevOps Domain (`domains/devops/`)
+
+| Trigger Keywords | Skill File |
+|------------------|-----------|
+| Git workflow, branching strategy, trunk-based, GitFlow | `~/.claude/skills/ccg/domains/devops/git-workflow.md` |
+| testing strategy, unit test, integration test, e2e, test pyramid | `~/.claude/skills/ccg/domains/devops/testing.md` |
+| database, migration, schema design, indexing, query optimization | `~/.claude/skills/ccg/domains/devops/database.md` |
+| performance, profiling, load test, latency, throughput | `~/.claude/skills/ccg/domains/devops/performance.md` |
+| observability, logging, tracing, metrics, Prometheus, Grafana | `~/.claude/skills/ccg/domains/devops/observability.md` |
+| DevSecOps, CI security, SAST, DAST, supply chain | `~/.claude/skills/ccg/domains/devops/devsecops.md` |
+| cost optimization, cloud cost, FinOps, resource right-sizing | `~/.claude/skills/ccg/domains/devops/cost-optimization.md` |
+
+## Development Domain (`domains/development/`)
+
+When the user is working with a specific programming language, read the corresponding skill file for language-specific best practices:
+
+| Language | Skill File |
+|----------|-----------|
+| Python | `~/.claude/skills/ccg/domains/development/python.md` |
+| Go | `~/.claude/skills/ccg/domains/development/go.md` |
+| Rust | `~/.claude/skills/ccg/domains/development/rust.md` |
+| TypeScript / JavaScript | `~/.claude/skills/ccg/domains/development/typescript.md` |
+| Java / Kotlin | `~/.claude/skills/ccg/domains/development/java.md` |
+| C / C++ | `~/.claude/skills/ccg/domains/development/cpp.md` |
+| Shell / Bash | `~/.claude/skills/ccg/domains/development/shell.md` |
+
+## Routing Rules
+
+1. **Keyword match is fuzzy** — match on intent, not exact string. "How to do SQL injection testing" triggers `pentest.md`.
+2. **Multiple matches** — if a request spans two domains, read both skill files.
+3. **Language detection** — automatically detect the programming language from file extensions or context, then read the corresponding development skill.
+4. **Read once per conversation** — no need to re-read the same skill file within the same conversation.
+5. **Skill files are authoritative** — when a skill file contradicts training data, the skill file wins.

package/templates/rules/ccg-skills.md

@@ -0,0 +1,65 @@
+# CCG Quality Gates — Auto-trigger Rules
+
+When working in a project, automatically invoke the corresponding quality gate skills based on the scenario below. These skills are installed at `~/.claude/skills/ccg/` and can be called directly.
+
+**IMPORTANT**: Skill names do NOT have a `ccg:` prefix. Use exactly: `verify-security`, `verify-quality`, `verify-change`, `verify-module`, `gen-docs`. Do NOT call `ccg:verify-security` — that will fail with "Unknown skill".
+
+## Trigger Rules
+
+### New Module Created
+
+When a new module/package/directory is created with source code:
+
+```
+/gen-docs <module-path>        → Generate README.md + DESIGN.md skeleton
+  ↓ (after development)
+/verify-module <module-path>   → Check structure completeness
+  ↓
+/verify-security <module-path> → Scan for security vulnerabilities
+```
+
+### Code Changes > 30 Lines
+
+When a single task produces code changes exceeding 30 lines:
+
+```
+/verify-change                 → Analyze change impact, check doc sync
+  ↓
+/verify-quality <changed-path> → Check complexity, code smells, naming
+```
+
+### Security-Related Changes
+
+When changes involve authentication, authorization, encryption, input validation, or secrets management:
+
+```
+/verify-security <changed-path> → Scan for vulnerabilities
+```
+
+### Refactoring
+
+When refactoring existing code:
+
+```
+/verify-change                  → Ensure docs reflect the refactoring
+  ↓
+/verify-quality <refactored-path> → Verify quality improved
+  ↓
+/verify-security <refactored-path> → No new vulnerabilities introduced
+```
+
+## Execution Rules
+
+1. **Non-blocking** — Quality gates produce reports but do NOT block delivery unless Critical issues are found
+2. **Chainable** — Run gates in the order specified above; skip if previous gate fails
+3. **Silent on pass** — Only report findings; do not output "all clear" messages for every gate
+4. **Critical = must fix** — Only `Critical` / `High` severity findings require action before delivery
+5. **Idempotent** — Safe to re-run; same input produces same output
+
+## Multi-Agent Coordination
+
+When a task involves 3+ independent files/modules or 2+ parallel workflows, refer to the multi-agent orchestration skill at `~/.claude/skills/ccg/orchestration/multi-agent/SKILL.md` for:
+
+- Agent role assignment (Lead / Scout / Worker / Soldier / Drone)
+- File ownership locking (one writer per file at any time)
+- Task decomposition strategy (by file, by module, or by pipeline)

package/templates/skills/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: ccg-skills
+description: CCG Skills - Quality gates, documentation generator, and multi-agent orchestration. Auto-installed by CCG workflow system.
+license: MIT
+user-invocable: false
+disable-model-invocation: false
+---
+
+# CCG Skills
+
+## Directory Structure
+
+```
+skills/
+├── tools/            # Quality gate tools
+│   ├── verify-security/   # Security vulnerability scanning
+│   ├── verify-quality/    # Code quality checking
+│   ├── verify-change/     # Change analysis & doc sync
+│   ├── verify-module/     # Module completeness validation
+│   ├── gen-docs/          # README.md & DESIGN.md generator
+│   └── lib/               # Shared utilities
+├── orchestration/    # Multi-agent coordination
+│   └── multi-agent/       # Ant colony-inspired coordination
+├── run_skill.js      # Unified skill runner
+└── SKILL.md          # This file
+```
+
+## Quick Navigation
+
+| Category | Description | Entry |
+|----------|-------------|-------|
+| **Quality Gates** | Module completeness, security, quality, change validation | [Quality Gates](#quality-gates) |
+| **Multi-Agent** | Multi-agent coordination and task decomposition | [Multi-Agent](#multi-agent-orchestration) |
+
+---
+
+## Quality Gates
+
+**Mandatory quality checkpoints to ensure deliverable standards.**
+
+| Skill | Trigger | Description |
+|-------|---------|-------------|
+| `/verify-module` | New module completed | Module structure & documentation completeness |
+| `/verify-security` | New module / security changes / refactoring | Security vulnerability scanning |
+| `/verify-change` | Design-level changes / refactoring | Document sync & change impact analysis |
+| `/verify-quality` | Complex modules / refactoring | Code quality metrics checking |
+| `/gen-docs` | New module created | README.md & DESIGN.md skeleton generator |
+
+### Auto-trigger Rules
+
+```
+New module:     /gen-docs → develop → /verify-module → /verify-security
+Code changes:   develop → /verify-change → /verify-quality
+Security tasks: execute → /verify-security
+Refactoring:    refactor → /verify-change → /verify-quality → /verify-security
+```
+
+### Running Skills
+
+```bash
+# Unified runner
+node ~/.claude/skills/ccg/run_skill.js <skill-name> [args...]
+
+# Examples
+node ~/.claude/skills/ccg/run_skill.js verify-security ./src
+node ~/.claude/skills/ccg/run_skill.js verify-quality ./src -v
+node ~/.claude/skills/ccg/run_skill.js verify-change --mode staged
+node ~/.claude/skills/ccg/run_skill.js verify-module ./my-module
+node ~/.claude/skills/ccg/run_skill.js gen-docs ./new-module --force
+```
+
+---
+
+## Multi-Agent Orchestration
+
+| Skill | Trigger | Description |
+|-------|---------|-------------|
+| `multi-agent` | TeamCreate, parallel tasks, multi-agent | Ant colony-inspired multi-agent coordination |
+
+Provides:
+- Agent role system (Lead/Scout/Worker/Soldier/Drone)
+- Pheromone-based indirect communication
+- File ownership locking & conflict avoidance
+- Adaptive concurrency control
+- TeamCreate vs single-agent decision tree
+
+---
+
+## Installed by CCG
+
+These skills are automatically installed during `npx ccg-ros2-workflow` initialization.
+To update: run `npx ccg-ros2-workflow update` or `npx ccg-ros2-workflow` again.

package/templates/skills/domains/ai/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: ai
+description: AI/LLM 能力索引。Agent 开发、LLM 安全、RAG 系统。当用户提到 AI、LLM、Agent、RAG、Prompt 时路由到此。
+license: MIT
+user-invocable: false
+disable-model-invocation: false
+---
+
+# 丹鼎秘典 · AI/LLM 能力中枢
+
+## 能力矩阵
+
+| Skill | 定位 | 核心能力 |
+|-------|------|----------|
+| [agent-dev](agent-dev.md) | Agent 开发 | 多 Agent 编排、工具调用、RAG |
+| [llm-security](llm-security.md) | LLM 安全 | Prompt 注入、越狱防护、输出安全 |
+| [rag-system](rag-system.md) | RAG 系统 | 向量数据库、检索策略、重排算法 |
+| [prompt-and-eval](prompt-and-eval.md) | Prompt 工程与模型评估 | Few-shot、CoT、ReAct、RAGAS、LLM-as-Judge |
+
+## AI 工程原则
+
+```yaml
+设计原则:
+  - 人机协作，AI 增强而非替代
+  - 可解释性优先
+  - 安全边界明确
+  - 渐进式自主
+
+开发原则:
+  - Prompt 即代码，需版本控制
+  - 输入输出都需验证
+  - 成本与效果平衡
+  - 持续评估与迭代
+```

package/templates/skills/domains/ai/agent-dev.md

@@ -0,0 +1,242 @@
+---
+name: agent-dev
+description: AI Agent 开发。多 Agent 编排、工具调用、RAG 系统、Prompt 工程。当用户提到 Agent、RAG、Prompt、LangChain、向量数据库时使用。
+---
+
+# 🔮 丹鼎秘典 · AI Agent 开发
+
+
+## Agent 架构
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                      Agent 系统                              │
+├─────────────────────────────────────────────────────────────┤
+│  用户输入 → 意图理解 → 规划 → 执行 → 反思 → 输出            │
+│              │          │      │      │                      │
+│           Prompt     Planner  Tools  Memory                  │
+└─────────────────────────────────────────────────────────────┘
+```
+
+## 核心组件
+
+### 1. Prompt 工程
+
+```yaml
+结构化 Prompt:
+  - System: 角色定义、能力边界、行为规范
+  - Context: 背景信息、相关知识
+  - Task: 具体任务、输出格式
+  - Examples: Few-shot 示例
+
+技巧:
+  - 明确角色和边界
+  - 分步骤引导思考
+  - 提供输出格式示例
+  - 设置安全护栏
+```
+
+### 2. 工具调用
+
+```python
+# 工具定义
+tools = [
+    {
+        "name": "search",
+        "description": "搜索知识库",
+        "parameters": {
+            "type": "object",
+            "properties": {
+                "query": {"type": "string", "description": "搜索关键词"}
+            },
+            "required": ["query"]
+        }
+    }
+]
+
+# 工具执行
+def execute_tool(name: str, args: dict) -> str:
+    if name == "search":
+        return search_knowledge_base(args["query"])
+    raise ValueError(f"Unknown tool: {name}")
+```
+
+### 3. 记忆系统
+
+```yaml
+短期记忆:
+  - 对话历史
+  - 当前任务上下文
+  - 工具调用结果
+
+长期记忆:
+  - 向量数据库存储
+  - 用户偏好
+  - 历史交互摘要
+
+记忆管理:
+  - 滑动窗口
+  - 摘要压缩
+  - 重要性排序
+```
+
+## RAG 系统
+
+### 架构
+
+```
+文档 → 分块 → 嵌入 → 向量库
+                        ↓
+查询 → 嵌入 → 检索 → 重排序 → 生成
+```
+
+### 实现
+
+```python
+from langchain.text_splitter import RecursiveCharacterTextSplitter
+from langchain.embeddings import OpenAIEmbeddings
+from langchain.vectorstores import Chroma
+
+# 文档处理
+splitter = RecursiveCharacterTextSplitter(
+    chunk_size=1000,
+    chunk_overlap=200,
+    separators=["\n\n", "\n", "。", "，", " "]
+)
+chunks = splitter.split_documents(documents)
+
+# 向量存储
+embeddings = OpenAIEmbeddings()
+vectorstore = Chroma.from_documents(chunks, embeddings)
+
+# 检索
+retriever = vectorstore.as_retriever(
+    search_type="mmr",  # 最大边际相关性
+    search_kwargs={"k": 5, "fetch_k": 20}
+)
+```
+
+### 优化策略
+
+```yaml
+分块策略:
+  - 语义分块 vs 固定长度
+  - 重叠避免信息丢失
+  - 保留元数据
+
+检索优化:
+  - 混合检索 (关键词 + 向量)
+  - 重排序 (Reranker)
+  - 查询扩展
+
+生成优化:
+  - 引用来源
+  - 置信度评估
+  - 幻觉检测
+```
+
+## 多 Agent 编排
+
+### 模式
+
+```yaml
+顺序执行:
+  Agent A → Agent B → Agent C
+
+并行执行:
+  Agent A ─┬─→ Agent B ─┬─→ 汇总
+           └─→ Agent C ─┘
+
+层级结构:
+  Orchestrator
+      ├── Planner Agent
+      ├── Executor Agent
+      └── Reviewer Agent
+
+对话式:
+  Agent A ←→ Agent B (多轮交互)
+```
+
+### 实现示例
+
+```python
+class Orchestrator:
+    def __init__(self):
+        self.planner = PlannerAgent()
+        self.executor = ExecutorAgent()
+        self.reviewer = ReviewerAgent()
+
+    async def run(self, task: str) -> str:
+        # 规划
+        plan = await self.planner.plan(task)
+
+        # 执行
+        results = []
+        for step in plan.steps:
+            result = await self.executor.execute(step)
+            results.append(result)
+
+        # 审查
+        final = await self.reviewer.review(task, results)
+        return final
+```
+
+## 评估与监控
+
+```yaml
+评估维度:
+  - 准确性: 答案正确率
+  - 相关性: 检索质量
+  - 完整性: 信息覆盖
+  - 一致性: 多次回答稳定性
+
+监控指标:
+  - 延迟 (P50/P95/P99)
+  - Token 消耗
+  - 工具调用成功率
+  - 用户满意度
+```
+
+## 框架选择
+
+```yaml
+LangChain:
+  - 优点: 生态丰富，组件多
+  - 缺点: 抽象层多，调试难
+  - 适合: 快速原型
+
+LlamaIndex:
+  - 优点: RAG 专精
+  - 缺点: Agent 能力弱
+  - 适合: 知识库应用
+
+原生实现:
+  - 优点: 完全可控
+  - 缺点: 开发成本高
+  - 适合: 生产系统
+```
+
+## 最佳实践
+
+```yaml
+开发:
+  - Prompt 版本控制
+  - 单元测试覆盖
+  - 成本预算控制
+  - 降级策略
+
+部署:
+  - 流式输出
+  - 超时处理
+  - 重试机制
+  - 缓存策略
+
+安全:
+  - 输入验证
+  - 输出过滤
+  - 权限控制
+  - 审计日志
+```
+
+---
+