cclaw-cli 0.48.28 → 0.48.30
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/artifact-linter.js +16 -5
- package/dist/artifact-paths.d.ts +28 -0
- package/dist/artifact-paths.js +261 -0
- package/dist/content/stage-schema.js +26 -11
- package/dist/content/stages/brainstorm.js +5 -5
- package/dist/content/stages/design.js +5 -5
- package/dist/content/stages/plan.js +153 -143
- package/dist/content/stages/review.js +212 -202
- package/dist/content/stages/scope.js +4 -4
- package/dist/content/stages/ship.js +132 -122
- package/dist/content/stages/spec.js +131 -121
- package/dist/content/stages/tdd.d.ts +2 -2
- package/dist/content/stages/tdd.js +237 -214
- package/dist/gate-evidence.js +7 -17
- package/dist/internal/advance-stage.js +9 -3
- package/package.json +1 -1
|
@@ -2,212 +2,222 @@
|
|
|
2
2
|
// REVIEW — reference: superpowers code-review + gstack /review
|
|
3
3
|
// ---------------------------------------------------------------------------
|
|
4
4
|
export const REVIEW = {
|
|
5
|
+
schemaShape: "v2",
|
|
5
6
|
stage: "review",
|
|
7
|
+
complexityTier: "standard",
|
|
6
8
|
skillFolder: "two-layer-review",
|
|
7
9
|
skillName: "two-layer-review",
|
|
8
10
|
skillDescription: "Two-layer review stage: spec compliance first, then code quality and production readiness. Section-by-section with severity discipline.",
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
"
|
|
90
|
-
"
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
],
|
|
111
|
-
stopGate: true
|
|
112
|
-
},
|
|
113
|
-
{
|
|
114
|
-
title: "Layer 2a: Correctness",
|
|
115
|
-
evaluationPoints: [
|
|
116
|
-
"Logic errors and boundary violations",
|
|
117
|
-
"Race conditions and concurrency issues",
|
|
118
|
-
"Null/undefined handling",
|
|
119
|
-
"Error propagation and recovery paths"
|
|
120
|
-
],
|
|
121
|
-
stopGate: true
|
|
122
|
-
},
|
|
123
|
-
{
|
|
124
|
-
title: "Layer 2b: Security",
|
|
125
|
-
evaluationPoints: [
|
|
126
|
-
"Input validation completeness",
|
|
127
|
-
"Authorization boundary enforcement",
|
|
128
|
-
"Secrets exposure risk",
|
|
129
|
-
"Injection vector assessment"
|
|
130
|
-
],
|
|
131
|
-
stopGate: true
|
|
132
|
-
},
|
|
133
|
-
{
|
|
134
|
-
title: "Layer 2c: Performance",
|
|
135
|
-
evaluationPoints: [
|
|
136
|
-
"N+1 query patterns",
|
|
137
|
-
"Memory leak potential",
|
|
138
|
-
"Missing caching opportunities",
|
|
139
|
-
"Hot path complexity analysis"
|
|
140
|
-
],
|
|
141
|
-
stopGate: true
|
|
142
|
-
},
|
|
143
|
-
{
|
|
144
|
-
title: "Layer 2d: Architecture Fit",
|
|
145
|
-
evaluationPoints: [
|
|
146
|
-
"Does implementation match the locked design?",
|
|
147
|
-
"Coupling and cohesion assessment",
|
|
148
|
-
"Interface contract compliance",
|
|
149
|
-
"Unintended architectural drift"
|
|
150
|
-
],
|
|
151
|
-
stopGate: true
|
|
152
|
-
},
|
|
153
|
-
{
|
|
154
|
-
title: "Layer 2e: External Safety Checklist",
|
|
155
|
-
evaluationPoints: [
|
|
156
|
-
"SQL/database: parameterized queries, no raw string interpolation, migration safety",
|
|
157
|
-
"Concurrency: race conditions in shared state, lock ordering, timeout handling",
|
|
158
|
-
"Secrets: no hardcoded tokens, no secrets in logs, env vars for sensitive config",
|
|
159
|
-
"Enum/constant completeness: grep for sibling values OUTSIDE the diff — are all cases handled?",
|
|
160
|
-
"Trust boundaries: if LLM/AI output is used, is it validated before acting on it?"
|
|
161
|
-
],
|
|
162
|
-
stopGate: true
|
|
163
|
-
},
|
|
164
|
-
{
|
|
165
|
-
title: "Specialist Lens: Data & Migration Safety",
|
|
166
|
-
evaluationPoints: [
|
|
167
|
-
"Schema/data migrations are reversible and include backfill/rollback strategy",
|
|
168
|
-
"Idempotency expectations are explicit for retryable flows",
|
|
169
|
-
"Data-loss scenarios (truncate/overwrite/drop) are guarded by checks or dry-runs",
|
|
170
|
-
"Boundary contracts (API/schema/event payload) maintain backward compatibility or are versioned"
|
|
171
|
-
],
|
|
172
|
-
stopGate: false
|
|
173
|
-
},
|
|
174
|
-
{
|
|
175
|
-
title: "Specialist Lens: Developer Experience",
|
|
176
|
-
evaluationPoints: [
|
|
177
|
-
"New behavior includes discoverable docs/usage notes where needed",
|
|
178
|
-
"Error messages are actionable for on-call and local debugging",
|
|
179
|
-
"Default configuration remains safe and unsurprising",
|
|
180
|
-
"Change footprint stays minimal and avoids hidden coupling"
|
|
181
|
-
],
|
|
182
|
-
stopGate: false
|
|
11
|
+
philosophy: {
|
|
12
|
+
hardGate: "Do NOT ship, merge, or release until both review layers complete with an explicit verdict. No exceptions for urgency. Critical blockers MUST be resolved before handoff.",
|
|
13
|
+
ironLaw: "NO SHIP VERDICT UNTIL BOTH REVIEW LAYERS COMPLETE AND EVERY CRITICAL IS RESOLVED OR EXPLICITLY ACCEPTED.",
|
|
14
|
+
purpose: "Validate that implementation matches spec and meets quality/security/performance bar through structured two-layer review.",
|
|
15
|
+
whenToUse: [
|
|
16
|
+
"After TDD stage completes",
|
|
17
|
+
"Before any ship action",
|
|
18
|
+
"When release risk must be assessed explicitly"
|
|
19
|
+
],
|
|
20
|
+
whenNotToUse: [
|
|
21
|
+
"There is no implementation diff to review",
|
|
22
|
+
"TDD stage evidence is missing or stale"
|
|
23
|
+
],
|
|
24
|
+
commonRationalizations: [
|
|
25
|
+
"Single generic review without layered structure",
|
|
26
|
+
"No severity classification",
|
|
27
|
+
"Shipping with open criticals",
|
|
28
|
+
"Batching multiple findings into one report without individual resolution",
|
|
29
|
+
"Skipping Layer 2 sections because Layer 1 passed"
|
|
30
|
+
]
|
|
31
|
+
},
|
|
32
|
+
executionModel: {
|
|
33
|
+
checklist: [
|
|
34
|
+
"Diff Scope — Run `git diff` against base branch. If no diff, exit early with APPROVED (no changes to review). Scope the review to changed files unless blast-radius analysis requires wider inspection.",
|
|
35
|
+
"Change-Size Check — ~100 lines = normal. ~300 lines = consider splitting. ~1000+ lines = strongly recommend stacked PRs. Flag large diffs to the user.",
|
|
36
|
+
"Adversarial Trigger Check — compute changed-line count (`git diff --shortstat <base>..HEAD`), files-touched count, and whether trust boundaries changed (auth/secrets/external inputs/permissions). If `lines > 100` OR `files > 10` OR `trust boundary changed`, **dispatch a SECOND reviewer agent with the `adversarial-review` skill loaded** and reconcile its findings into the review army (treat the conditional dispatch as mandatory whenever the trigger holds; record the trigger that fired in the dashboard).",
|
|
37
|
+
"Load upstream evidence — read TDD artifact (RED + GREEN + REFACTOR), spec, and plan. Verify evidence chain is unbroken.",
|
|
38
|
+
"Run traceability matrix — execute `cclaw internal trace-matrix` (or equivalent helper) and confirm there are no orphaned criteria/tasks/tests before declaring ship readiness.",
|
|
39
|
+
"Layer 1: Spec Compliance — check every acceptance criterion against implementation. Verdict: pass/fail per criterion.",
|
|
40
|
+
"Layer 2a: Correctness — logic errors, race conditions, boundary violations, null handling.",
|
|
41
|
+
"Layer 2b: Security — input validation, auth boundaries, secrets exposure, injection vectors. **Mandatory:** also load and execute the `.cclaw/skills/security-audit/SKILL.md` utility skill (proactive pattern sweep across diff + touched modules, not just the diff itself) and merge findings into the review army. The Layer 2 security pass is not complete until the audit sweep records a finding count (0 acceptable) with file:line evidence for every Critical.",
|
|
42
|
+
"Layer 2c: Performance — N+1 queries, memory leaks, missing caching, hot paths.",
|
|
43
|
+
"Layer 2d: Architecture Fit — does the implementation match the locked design? Coupling, cohesion, interface contracts.",
|
|
44
|
+
"Layer 2e: External Safety — SQL safety, concurrency, secrets in logs, enum completeness (grep outside diff), LLM trust boundaries.",
|
|
45
|
+
"Incoming Feedback Intake — when human reviewer comments, bot findings, or CI annotations exist, run `.cclaw/skills/receiving-code-review/SKILL.md`, keep a per-comment disposition queue, and mirror outcomes into `07-review.md` + `07-review-army.json` before final verdict.",
|
|
46
|
+
"Review Army reconciliation — normalize findings into structured records, dedup by fingerprint, and mark multi-specialist confirmations.",
|
|
47
|
+
"Meta-Review — Were tests actually run? Do test names match what they test? Are there real assertions?",
|
|
48
|
+
"Classify findings — Critical (blocks ship), Important (should fix), Suggestion (optional improvement).",
|
|
49
|
+
"Produce verdict — APPROVED, APPROVED_WITH_CONCERNS, or BLOCKED.",
|
|
50
|
+
"If verdict is BLOCKED, emit remediation route token `ROUTE_BACK_TO_TDD` and include `/cc-ops rewind tdd \"review_blocked_by_critical\"` with the blocking finding IDs."
|
|
51
|
+
],
|
|
52
|
+
interactionProtocol: [
|
|
53
|
+
"Run Layer 1 (spec compliance) completely before starting Layer 2.",
|
|
54
|
+
"In each review section, present findings ONE AT A TIME. Do NOT batch.",
|
|
55
|
+
"Classify every finding as Critical, Important, or Suggestion.",
|
|
56
|
+
"For each Critical finding: use the Decision Protocol — present resolution options (A/B/C) with trade-offs, and mark one as (recommended). Do NOT use a numeric Completeness rubric; recommend the option that fully closes the finding with no carry-over risk and the smallest blast radius. If the harness's native structured-ask tool is available (`AskUserQuestion` on Claude, `AskQuestion` on Cursor, `question` on OpenCode with `permission.question: \"allow\"`, `request_user_input` on Codex in Plan/Collaboration mode), send exactly ONE question per call, validate fields against the runtime schema, and on schema error immediately fall back to a plain-text lettered list instead of retrying guessed payloads.",
|
|
57
|
+
"Resolve all critical blockers before ship.",
|
|
58
|
+
"When verdict is BLOCKED, do not end with a passive stop: explicitly route remediation to TDD via `ROUTE_BACK_TO_TDD` and point to `/cc-ops rewind tdd` with the blocking IDs.",
|
|
59
|
+
"For final verdict: use the native structured-ask tool (`AskUserQuestion` / `AskQuestion` / `question` / `request_user_input`) only if runtime schema is confirmed; otherwise collect verdict with a plain-text single-choice prompt (APPROVED / APPROVED_WITH_CONCERNS / BLOCKED).",
|
|
60
|
+
"**STOP.** Do NOT proceed to ship until the user provides an explicit verdict."
|
|
61
|
+
],
|
|
62
|
+
process: [
|
|
63
|
+
"Layer 1: check acceptance criteria and requirement coverage.",
|
|
64
|
+
"Layer 2a: check correctness — logic, races, boundaries, null handling.",
|
|
65
|
+
"Layer 2b: check security — validation, auth, secrets, injection.",
|
|
66
|
+
"Layer 2c: check performance — queries, memory, caching, hot paths.",
|
|
67
|
+
"Layer 2d: check architecture fit — design compliance, coupling, interfaces.",
|
|
68
|
+
"Reconcile multi-agent findings into `.cclaw/artifacts/07-review-army.json` (dedup + confidence + conflict notes + source tags from spec/correctness/security/performance/architecture/external-safety passes).",
|
|
69
|
+
"Classify and prioritize all findings.",
|
|
70
|
+
"Write review report artifact with explicit verdict.",
|
|
71
|
+
"If verdict is BLOCKED, include the remediation route token `ROUTE_BACK_TO_TDD` and the rewind command payload."
|
|
72
|
+
],
|
|
73
|
+
requiredGates: [
|
|
74
|
+
{ id: "review_layer1_spec_compliance", description: "Spec compliance check completed with per-criterion verdict." },
|
|
75
|
+
{ id: "review_layer2_security", description: "Security review completed." },
|
|
76
|
+
{ id: "review_layer_coverage_complete", description: "Layer coverage map in 07-review-army.json confirms spec/correctness/security/performance/architecture/external-safety passes." },
|
|
77
|
+
{ id: "review_criticals_resolved", description: "No unresolved critical blockers remain." },
|
|
78
|
+
{ id: "review_army_json_valid", description: "07-review-army.json passes schema validation (validateReviewArmy)." },
|
|
79
|
+
{ id: "review_trace_matrix_clean", description: "Trace matrix has no orphaned criteria/tasks/test slices for the active run." }
|
|
80
|
+
],
|
|
81
|
+
requiredEvidence: [
|
|
82
|
+
"Artifact written to `.cclaw/artifacts/07-review.md`.",
|
|
83
|
+
"Artifact written to `.cclaw/artifacts/07-review-army.json`.",
|
|
84
|
+
"Traceability matrix run recorded (no orphaned criteria/tasks/tests for enforced tracks).",
|
|
85
|
+
"Layer 1 verdict captured with per-criterion pass/fail.",
|
|
86
|
+
"Layer 2 sections completed with findings.",
|
|
87
|
+
"Severity log includes critical/important/suggestion buckets.",
|
|
88
|
+
"Explicit final verdict: APPROVED, APPROVED_WITH_CONCERNS, or BLOCKED.",
|
|
89
|
+
"If BLOCKED: include explicit remediation route (`ROUTE_BACK_TO_TDD`) with blocking finding IDs."
|
|
90
|
+
],
|
|
91
|
+
inputs: ["implementation diff", "spec and plan artifacts", "test/build evidence"],
|
|
92
|
+
requiredContext: ["spec criteria", "tdd artifact", "rulebook constraints"],
|
|
93
|
+
blockers: [
|
|
94
|
+
"layer 1 failed",
|
|
95
|
+
"critical findings unresolved",
|
|
96
|
+
"missing regression evidence"
|
|
97
|
+
],
|
|
98
|
+
exitCriteria: [
|
|
99
|
+
"both layers completed",
|
|
100
|
+
"all review sections evaluated",
|
|
101
|
+
"critical blockers resolved",
|
|
102
|
+
"ship readiness explicitly stated"
|
|
103
|
+
]
|
|
104
|
+
},
|
|
105
|
+
artifactRules: {
|
|
106
|
+
artifactFile: "07-review.md",
|
|
107
|
+
completionStatus: ["APPROVED", "APPROVED_WITH_CONCERNS", "BLOCKED"],
|
|
108
|
+
crossStageTrace: {
|
|
109
|
+
readsFrom: [".cclaw/artifacts/06-tdd.md", ".cclaw/artifacts/04-spec.md", ".cclaw/artifacts/05-plan.md"],
|
|
110
|
+
writesTo: [".cclaw/artifacts/07-review.md", ".cclaw/artifacts/07-review-army.json"],
|
|
111
|
+
traceabilityRule: "Review verdict must reference specific spec criteria and TDD evidence. Downstream ship stage must reference review verdict."
|
|
183
112
|
},
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
113
|
+
artifactValidation: [
|
|
114
|
+
{ section: "Layer 1 Verdict", required: true, validationRule: "Per-criterion pass/fail with references." },
|
|
115
|
+
{ section: "Layer 2 Findings", required: false, validationRule: "Each finding has severity, description, and resolution status. Security coverage must include either explicit security findings or `NO_CHANGE_ATTESTATION: <reason>` when no security-relevant changes were found." },
|
|
116
|
+
{ section: "Review Army Contract", required: true, validationRule: "Structured findings include id/severity/confidence/fingerprint/reportedBy/status and source tags from {spec, correctness, security, performance, architecture, external-safety} with dedup reconciliation summary." },
|
|
117
|
+
{ section: "Review Readiness Dashboard", required: false, validationRule: "Includes a per-pass table (Layer 1 / Layer 2 / Adversarial / Schema) with a 'Completed at' column, a Delegation log snapshot block (path .cclaw/state/delegation-log.json with required/completed/waived/pending), a Staleness signal block (commit at last review pass and current commit), and a Headline with open critical blockers + ship recommendation. At minimum, the section text must contain the substrings 'Completed at', 'delegation-log.json', 'commit at last review pass', and 'Ship recommendation'." },
|
|
118
|
+
{ section: "Completeness Score", required: false, validationRule: "Records AC coverage, task coverage, test-slice coverage, and adversarial-review pass status as numeric or boolean values. At minimum, a line like 'AC coverage: N/M' or 'AC coverage: 100%'." },
|
|
119
|
+
{ section: "Incoming Feedback Queue", required: false, validationRule: "When external review feedback exists, include a queue summary with per-item disposition (resolved / accepted-risk / rejected-with-evidence) and evidence refs." },
|
|
120
|
+
{ section: "Trace Matrix Check", required: false, validationRule: "Records criteria/tasks/tests orphan counts (all zero on enforced tracks) with command output reference." },
|
|
121
|
+
{ section: "Blocked Route", required: false, validationRule: "When Final Verdict is BLOCKED: includes `ROUTE_BACK_TO_TDD`, rewind target `tdd`, and blocked finding IDs." },
|
|
122
|
+
{ section: "Severity Summary", required: true, validationRule: "Per-severity count lines for critical, important, and suggestion buckets." },
|
|
123
|
+
{ section: "Final Verdict", required: true, validationRule: "Exactly one of: APPROVED, APPROVED_WITH_CONCERNS, BLOCKED." }
|
|
124
|
+
]
|
|
125
|
+
},
|
|
126
|
+
reviewLens: {
|
|
127
|
+
outputs: ["review verdict", "severity-indexed findings", "reconciled review-army findings", "ship readiness decision"],
|
|
128
|
+
reviewSections: [
|
|
129
|
+
{
|
|
130
|
+
title: "Layer 1: Spec Compliance",
|
|
131
|
+
evaluationPoints: [
|
|
132
|
+
"For each acceptance criterion: does the implementation satisfy it?",
|
|
133
|
+
"Are there spec requirements with no corresponding implementation?",
|
|
134
|
+
"Are there implementations with no corresponding spec requirement (scope creep)?",
|
|
135
|
+
"Is every edge case from the spec handled?"
|
|
136
|
+
],
|
|
137
|
+
stopGate: true
|
|
138
|
+
},
|
|
139
|
+
{
|
|
140
|
+
title: "Layer 2a: Correctness",
|
|
141
|
+
evaluationPoints: [
|
|
142
|
+
"Logic errors and boundary violations",
|
|
143
|
+
"Race conditions and concurrency issues",
|
|
144
|
+
"Null/undefined handling",
|
|
145
|
+
"Error propagation and recovery paths"
|
|
146
|
+
],
|
|
147
|
+
stopGate: true
|
|
148
|
+
},
|
|
149
|
+
{
|
|
150
|
+
title: "Layer 2b: Security",
|
|
151
|
+
evaluationPoints: [
|
|
152
|
+
"Input validation completeness",
|
|
153
|
+
"Authorization boundary enforcement",
|
|
154
|
+
"Secrets exposure risk",
|
|
155
|
+
"Injection vector assessment"
|
|
156
|
+
],
|
|
157
|
+
stopGate: true
|
|
158
|
+
},
|
|
159
|
+
{
|
|
160
|
+
title: "Layer 2c: Performance",
|
|
161
|
+
evaluationPoints: [
|
|
162
|
+
"N+1 query patterns",
|
|
163
|
+
"Memory leak potential",
|
|
164
|
+
"Missing caching opportunities",
|
|
165
|
+
"Hot path complexity analysis"
|
|
166
|
+
],
|
|
167
|
+
stopGate: true
|
|
168
|
+
},
|
|
169
|
+
{
|
|
170
|
+
title: "Layer 2d: Architecture Fit",
|
|
171
|
+
evaluationPoints: [
|
|
172
|
+
"Does implementation match the locked design?",
|
|
173
|
+
"Coupling and cohesion assessment",
|
|
174
|
+
"Interface contract compliance",
|
|
175
|
+
"Unintended architectural drift"
|
|
176
|
+
],
|
|
177
|
+
stopGate: true
|
|
178
|
+
},
|
|
179
|
+
{
|
|
180
|
+
title: "Layer 2e: External Safety Checklist",
|
|
181
|
+
evaluationPoints: [
|
|
182
|
+
"SQL/database: parameterized queries, no raw string interpolation, migration safety",
|
|
183
|
+
"Concurrency: race conditions in shared state, lock ordering, timeout handling",
|
|
184
|
+
"Secrets: no hardcoded tokens, no secrets in logs, env vars for sensitive config",
|
|
185
|
+
"Enum/constant completeness: grep for sibling values OUTSIDE the diff — are all cases handled?",
|
|
186
|
+
"Trust boundaries: if LLM/AI output is used, is it validated before acting on it?"
|
|
187
|
+
],
|
|
188
|
+
stopGate: true
|
|
189
|
+
},
|
|
190
|
+
{
|
|
191
|
+
title: "Specialist Lens: Data & Migration Safety",
|
|
192
|
+
evaluationPoints: [
|
|
193
|
+
"Schema/data migrations are reversible and include backfill/rollback strategy",
|
|
194
|
+
"Idempotency expectations are explicit for retryable flows",
|
|
195
|
+
"Data-loss scenarios (truncate/overwrite/drop) are guarded by checks or dry-runs",
|
|
196
|
+
"Boundary contracts (API/schema/event payload) maintain backward compatibility or are versioned"
|
|
197
|
+
],
|
|
198
|
+
stopGate: false
|
|
199
|
+
},
|
|
200
|
+
{
|
|
201
|
+
title: "Specialist Lens: Developer Experience",
|
|
202
|
+
evaluationPoints: [
|
|
203
|
+
"New behavior includes discoverable docs/usage notes where needed",
|
|
204
|
+
"Error messages are actionable for on-call and local debugging",
|
|
205
|
+
"Default configuration remains safe and unsurprising",
|
|
206
|
+
"Change footprint stays minimal and avoids hidden coupling"
|
|
207
|
+
],
|
|
208
|
+
stopGate: false
|
|
209
|
+
},
|
|
210
|
+
{
|
|
211
|
+
title: "Meta-Review: Verify the Verification",
|
|
212
|
+
evaluationPoints: [
|
|
213
|
+
"Were tests actually run (not just assumed to pass)?",
|
|
214
|
+
"Do the test names match what they actually test?",
|
|
215
|
+
"Is there test coverage for the specific changes in this diff?",
|
|
216
|
+
"Are there assertions, or do tests just run without checking results?"
|
|
217
|
+
],
|
|
218
|
+
stopGate: false
|
|
219
|
+
}
|
|
220
|
+
]
|
|
200
221
|
},
|
|
201
|
-
|
|
202
|
-
{ section: "Layer 1 Verdict", required: true, validationRule: "Per-criterion pass/fail with references." },
|
|
203
|
-
{ section: "Layer 2 Findings", required: false, validationRule: "Each finding has severity, description, and resolution status. Security coverage must include either explicit security findings or `NO_CHANGE_ATTESTATION: <reason>` when no security-relevant changes were found." },
|
|
204
|
-
{ section: "Review Army Contract", required: true, validationRule: "Structured findings include id/severity/confidence/fingerprint/reportedBy/status and source tags from {spec, correctness, security, performance, architecture, external-safety} with dedup reconciliation summary." },
|
|
205
|
-
{ section: "Review Readiness Dashboard", required: false, validationRule: "Includes a per-pass table (Layer 1 / Layer 2 / Adversarial / Schema) with a 'Completed at' column, a Delegation log snapshot block (path .cclaw/state/delegation-log.json with required/completed/waived/pending), a Staleness signal block (commit at last review pass and current commit), and a Headline with open critical blockers + ship recommendation. At minimum, the section text must contain the substrings 'Completed at', 'delegation-log.json', 'commit at last review pass', and 'Ship recommendation'." },
|
|
206
|
-
{ section: "Completeness Score", required: false, validationRule: "Records AC coverage, task coverage, test-slice coverage, and adversarial-review pass status as numeric or boolean values. At minimum, a line like 'AC coverage: N/M' or 'AC coverage: 100%'." },
|
|
207
|
-
{ section: "Incoming Feedback Queue", required: false, validationRule: "When external review feedback exists, include a queue summary with per-item disposition (resolved / accepted-risk / rejected-with-evidence) and evidence refs." },
|
|
208
|
-
{ section: "Trace Matrix Check", required: false, validationRule: "Records criteria/tasks/tests orphan counts (all zero on enforced tracks) with command output reference." },
|
|
209
|
-
{ section: "Blocked Route", required: false, validationRule: "When Final Verdict is BLOCKED: includes `ROUTE_BACK_TO_TDD`, rewind target `tdd`, and blocked finding IDs." },
|
|
210
|
-
{ section: "Severity Summary", required: true, validationRule: "Per-severity count lines for critical, important, and suggestion buckets." },
|
|
211
|
-
{ section: "Final Verdict", required: true, validationRule: "Exactly one of: APPROVED, APPROVED_WITH_CONCERNS, BLOCKED." }
|
|
212
|
-
]
|
|
222
|
+
next: "ship",
|
|
213
223
|
};
|
|
@@ -93,7 +93,7 @@ export const SCOPE = {
|
|
|
93
93
|
{ id: "scope_user_approved", description: "User approved the final scope direction." }
|
|
94
94
|
],
|
|
95
95
|
requiredEvidence: [
|
|
96
|
-
"Artifact written to `.cclaw/artifacts/02-scope
|
|
96
|
+
"Artifact written to `.cclaw/artifacts/02-scope-<slug>.md`.",
|
|
97
97
|
"Pre-Scope System Audit findings are captured (git log/diff/stash/debt markers).",
|
|
98
98
|
"In-scope and out-of-scope lists are explicit.",
|
|
99
99
|
"Discretion areas are explicit (or marked as `None`).",
|
|
@@ -131,11 +131,11 @@ export const SCOPE = {
|
|
|
131
131
|
]
|
|
132
132
|
},
|
|
133
133
|
artifactRules: {
|
|
134
|
-
artifactFile: "02-scope
|
|
134
|
+
artifactFile: "02-scope-<slug>.md",
|
|
135
135
|
completionStatus: ["DONE", "DONE_WITH_CONCERNS", "BLOCKED"],
|
|
136
136
|
crossStageTrace: {
|
|
137
|
-
readsFrom: [".cclaw/artifacts/01-brainstorm
|
|
138
|
-
writesTo: [".cclaw/artifacts/02-scope
|
|
137
|
+
readsFrom: [".cclaw/artifacts/01-brainstorm-<slug>.md"],
|
|
138
|
+
writesTo: [".cclaw/artifacts/02-scope-<slug>.md"],
|
|
139
139
|
traceabilityRule: "Every scope boundary must be traceable to a brainstorm decision. Every downstream design choice must stay within the scope contract."
|
|
140
140
|
},
|
|
141
141
|
artifactValidation: [
|