code-ai-installer 1.3.0 → 1.4.0

package/.agents/skills/qa_test_plan/SKILL.md

@@ -0,0 +1,203 @@
+---
+name: qa_test_plan
+description: Составить тест-план и матрицу покрытия по PRD/UX — роли, критичные user flows, состояния UI, негативные кейсы, критерии приёмки.
+---
+
+# Skill: QA Test Plan
+
+Тест-план с coverage matrix по PRD/UX flows.
+
+**Разделы:**
+1. [Workflow](#1-workflow)
+2. [Test Plan Structure](#2-structure)
+3. [Coverage Matrix](#3-matrix)
+4. [Risk-Based Prioritization](#4-priority)
+5. [Entry/Exit Criteria](#5-criteria)
+6. [Пример](#6-пример)
+7. [Output Template](#7-output)
+
+---
+
+## 1. Workflow
+
+```
+1. Прочитай PRD / UX Spec / Architecture Doc
+   └── Выдели user flows и acceptance criteria
+
+2. Определи scope:
+   ├── Что тестируем (in scope)
+   └── Что НЕ тестируем (out of scope + почему)
+
+3. Разбей на test suites по категориям:
+   ├── Functional (happy + edge + error paths)
+   ├── API contracts
+   ├── Security smoke
+   ├── UI/a11y smoke
+   └── Performance baseline
+
+4. Для каждого flow → test cases (section 3)
+
+5. Приоритизация (section 4)
+
+6. Определи entry/exit criteria (section 5)
+```
+
+---
+
+## 2. Test Plan Structure
+
+| Section | Content |
+|---------|---------|
+| **Scope** | What's included, what's excluded (with rationale) |
+| **Assumptions** | Prerequisites, test environment conditions |
+| **Test suites** | Groups of test cases by feature/area |
+| **Coverage matrix** | Flow → test cases mapping |
+| **Test data** | Required data setup / seed / fixtures |
+| **Environment** | URLs, credentials, infra requirements |
+| **Blockers/Risks** | What could prevent testing |
+| **Schedule** | When each suite runs (CI / manual / release) |
+
+---
+
+## 3. Coverage Matrix
+
+### Test case format
+
+| Field | Description | Example |
+|-------|-------------|---------|
+| **TC-ID** | Unique ID | TC-COUPON-01 |
+| **Flow** | User flow being tested | Create coupon |
+| **Type** | happy / edge / error / security | happy |
+| **Preconditions** | Required state | User logged in, app installed |
+| **Steps** | Numbered actions | 1. Open settings 2. Fill form 3. Click Save |
+| **Expected Result** | What should happen | Coupon saved, toast shown |
+| **Priority** | P0 / P1 / P2 | P0 |
+| **Automation** | Unit / Integration / E2E / Manual | Integration |
+
+### Coverage matrix example
+
+| Flow | Happy | Edge | Error | Security | Total |
+|------|:-----:|:----:|:-----:|:--------:|:-----:|
+| Install webhook | TC-01 | TC-02 | TC-03, TC-04 | TC-05 | 5 |
+| Settings CRUD | TC-06 | TC-07, TC-08 | TC-09, TC-10 | TC-11 | 6 |
+| Coupon create | TC-12 | TC-13, TC-14 | TC-15, TC-16, TC-17 | TC-18 | 7 |
+| Widget render | TC-19 | TC-20 | TC-21 | TC-22 | 4 |
+| **Total** | 4 | 6 | 7 | 4 | **22** |
+
+---
+
+## 4. Risk-Based Prioritization
+
+| Priority | Criteria | Example |
+|----------|---------|---------|
+| 🔴 **P0** | Core functionality, data loss, security | Auth flow, payment, CRUD on main entities |
+| 🟠 **P1** | Important but recoverable, edge cases | Duplicate handling, pagination, error states |
+| 🟡 **P2** | Nice-to-have, cosmetic, rare paths | Tooltip text, animation timing, unusual screen sizes |
+
+### Priority distribution guideline
+
+| Priority | % of total test cases |
+|----------|:-----:|
+| P0 | 40-50% |
+| P1 | 30-40% |
+| P2 | 10-20% |
+
+---
+
+## 5. Entry/Exit Criteria
+
+### Entry criteria (start testing when)
+
+| # | Criterion | Status |
+|---|----------|--------|
+| 1 | Build successful | ☐ |
+| 2 | CI lint + unit tests pass | ☐ |
+| 3 | Environment accessible (dev/staging) | ☐ |
+| 4 | Test data seeded | ☐ |
+| 5 | All P0 dev tasks completed | ☐ |
+
+### Exit criteria (release when)
+
+| # | Criterion | Status |
+|---|----------|--------|
+| 1 | All P0 test cases PASS | ☐ |
+| 2 | All P1 test cases PASS (or waiver) | ☐ |
+| 3 | No open P0 bugs | ☐ |
+| 4 | Security smoke PASS | ☐ |
+| 5 | API contract compliance PASS | ☐ |
+
+---
+
+## 6. Пример
+
+```markdown
+# Test Plan: SaaS Admin Panel — v1
+
+## Scope
+- IN: Settings CRUD, Product CRUD, Public content rendering
+- OUT: Analytics, multi-language (not in MVP)
+
+## Test Suites
+1. API Contract Tests (8 cases) → $qa_api_contract_tests
+2. Manual Functional (12 cases) → $qa_manual_run
+3. Security Smoke (6 cases) → $qa_security_smoke_tests
+4. UI/a11y Smoke (4 cases) → $qa_ui_a11y_smoke
+
+## Coverage: 30 test cases (P0: 12, P1: 13, P2: 5)
+## Entry: CI green, staging up, test data seeded
+## Exit: All P0 pass, no open P0 bugs
+```
+
+---
+
+## 7. Output Template
+
+```markdown
+# QA Test Plan: <feature/sprint>
+
+**Date:** YYYY-MM-DD
+**PRD:** <reference>
+**UX Spec:** <reference>
+
+## Scope
+- **In scope:** <list>
+- **Out of scope:** <list + rationale>
+
+## Assumptions
+- <list>
+
+## Test Suites
+| Suite | Cases | Priority mix | Method |
+|-------|:-----:|-------------|--------|
+| Functional | 15 | 6×P0, 6×P1, 3×P2 | Manual + Unit |
+| API Contract | 8 | 4×P0, 4×P1 | Integration |
+| Security Smoke | 6 | 4×P0, 2×P1 | Manual + Grep |
+| UI/a11y | 4 | 1×P0, 2×P1, 1×P2 | Manual |
+
+## Coverage Matrix
+<section 3 table>
+
+## Test Data
+- <required fixtures/seed data>
+
+## Environment
+- URL: <staging URL>
+- Credentials: <how to get>
+
+## Entry/Exit Criteria
+<section 5 tables>
+
+## Risks & Blockers
+| Risk | Impact | Mitigation |
+|------|--------|-----------|
+| Wix API down | P0: Install flow blocked | Skip, retest later |
+```
+
+---
+
+## См. также
+- `$qa_manual_run` — execute manual test cases
+- `$qa_api_contract_tests` — API contract test execution
+- `$qa_security_smoke_tests` — security smoke execution
+- `$qa_ui_a11y_smoke` — UI/a11y smoke execution
+- `$qa_browser_testing` — browser-based visual testing

package/.agents/skills/release_gate/SKILL.md

@@ -0,0 +1,213 @@
+---
+name: release_gate
+description: Финальный релиз-гейт — собрать отчёты Reviewer+Tester+CI, проверить DoD, классифицировать риски, принять решение GO/NO-GO и сформировать план закрытия.
+---
+
+# Skill: Release Gate
+
+Финальное решение GO / NO-GO / GO-with-conditions.
+
+**Разделы:**
+1. [Workflow](#1-workflow)
+2. [Inputs](#2-inputs)
+3. [Decision Matrix](#3-decision)
+4. [NO-GO Criteria](#4-nogo)
+5. [DoD Checklist](#5-dod)
+6. [Post-Release Verification](#6-post)
+7. [Пример: Release Report](#7-пример)
+8. [Output Template](#8-output)
+
+---
+
+## 1. Workflow
+
+```
+1. Prereq: Generate RG checklist ($release_gate_checklist_template)
+2. Collect inputs (section 2)
+3. Fill RG checklist statuses
+4. Run DoD checklist (section 5)
+5. Apply decision matrix (section 3)
+6. Generate Release Report (section 8)
+7. Submit to user for GO / NO-GO sign-off
+8. If GO → post-release verification (section 6)
+```
+
+---
+
+## 2. Inputs
+
+| Input | Source | Required |
+|-------|--------|:--------:|
+| Reviewer Report | REV gate | ✅ |
+| Tester Report | TEST gate | ✅ |
+| CI Results (tests, lint) | CI pipeline / terminal | ✅ |
+| RG Checklist (filled) | $release_gate_checklist_template | ✅ |
+| Release scope (what's shipping) | Board / backlog | ✅ |
+| Version / tag / commit | Git | ✅ |
+| Rollback plan | OPS gate | ✅ |
+
+---
+
+## 3. Decision Matrix
+
+| Condition | Decision |
+|-----------|----------|
+| All RG checks DONE + 0 P0 + 0 P1 | **✅ GO** |
+| All RG checks DONE + 0 P0 + P1 with tracked tasks | **⚠️ GO with conditions** |
+| Any P0 from Reviewer or Tester | **❌ NO-GO** |
+| CI tests fail | **❌ NO-GO** |
+| Secrets in code/logs | **❌ NO-GO** |
+| Critical UX flow broken | **❌ NO-GO** |
+| No runbook / deploy instructions | **❌ NO-GO** |
+| API contract violation (breaking) | **❌ NO-GO** |
+
+### GO with conditions rules
+
+```markdown
+Allowed ONLY when ALL of:
+1. Zero P0 issues
+2. P1 issues have:
+   - [ ] Workaround documented
+   - [ ] Fix task created with owner + deadline
+   - [ ] Risk accepted by user
+3. No security P1 (security P1 = treat as P0)
+```
+
+---
+
+## 4. NO-GO Criteria (hard stops)
+
+| # | Criterion | How to check |
+|---|----------|-------------|
+| NG-01 | P0 from Reviewer | Review report: P0 count > 0 |
+| NG-02 | P0 from Tester | Test report: P0 bugs open |
+| NG-03 | Unit/Integration tests fail | CI output |
+| NG-04 | Secrets in code | grep: password, apiKey, token in source |
+| NG-05 | Secrets in logs | grep: password, token in log output |
+| NG-06 | No runbook | Missing deploy/verify instructions |
+| NG-07 | Critical flow blocked | TEST: P0 test case BLOCKED |
+| NG-08 | Breaking API change | API contract compliance: P0 mismatch |
+
+---
+
+## 5. DoD Checklist
+
+| # | Check | Source | Status |
+|---|-------|--------|--------|
+| RG-DoD-01 | Unit tests PASS | CI | ☐ |
+| RG-DoD-02 | Integration tests PASS | CI | ☐ |
+| RG-DoD-03 | Lint/format PASS | CI | ☐ |
+| RG-DoD-04 | 0 P0 from Reviewer | REV report | ☐ |
+| RG-DoD-05 | 0 P0 from Tester | TEST report | ☐ |
+| RG-DoD-06 | No secrets in code/logs | Security scan | ☐ |
+| RG-DoD-07 | Runbook exists and is current | docs/ | ☐ |
+| RG-DoD-08 | API matches contracts | API compliance | ☐ |
+| RG-DoD-09 | Containers built + healthy | OPS report | ☐ |
+| RG-DoD-10 | RG checklist complete | RG-01..RG-22 | ☐ |
+
+---
+
+## 6. Post-Release Verification
+
+After GO decision and deploy:
+
+| # | Check | How | Status |
+|---|-------|-----|--------|
+| POST-01 | Service is running | Health endpoint returns 200 | ☐ |
+| POST-02 | P0 flows work end-to-end | Quick manual smoke | ☐ |
+| POST-03 | No error spike in logs | Check last 5min of logs | ☐ |
+| POST-04 | Response times normal | Check latency (< 500ms) | ☐ |
+| POST-05 | Rollback tested (if first deploy) | Know how to roll back | ☐ |
+
+---
+
+## 7. Пример: Release Report
+
+```markdown
+# Release Report: SaaS Admin Panel v1.0
+
+## Decision: ⚠️ GO with conditions
+
+**Version:** v1.0.0
+**Commit:** abc1234
+**Date:** 2026-03-13
+**Scope:** Settings CRUD + Products CRUD + Content Widget
+
+## Evidence
+| Source | Status | Details |
+|--------|:------:|---------|
+| CI: Unit tests | ✅ PASS | 42/42 pass |
+| CI: Integration | ✅ PASS | 8/8 pass |
+| CI: Lint | ✅ PASS | 0 errors |
+| Reviewer | ✅ PASS | 0 P0, 2 P1 |
+| Tester | ✅ PASS | 0 P0, 1 P1 |
+| Security scan | ✅ PASS | No secrets found |
+| API compliance | ✅ PASS | All endpoints match |
+
+## DoD: 10/10 PASS
+
+## P1 Accepted (conditions)
+| # | Finding | Owner | Fix by | Workaround |
+|---|---------|-------|--------|-----------|
+| 1 | Timer NaN for 0 sec | DEV | v0.9.1 | Set min=1 |
+| 2 | Font preview missing | DEV | v0.9.1 | — (cosmetic) |
+| 3 | Empty state no illustration | UX | v0.9.1 | Has text CTA |
+
+## Rollback Plan
+- `docker compose down && git checkout v0.8 && docker compose up -d --build`
+
+## Post-Release
+- [ ] Health check OK
+- [ ] Settings CRUD works
+- [ ] Widget renders
+```
+
+---
+
+## 8. Output Template
+
+```markdown
+# Release Report: <Project> <Version>
+
+## Decision: ✅ GO / ⚠️ GO with conditions / ❌ NO-GO
+
+**Version:** <tag/commit>
+**Date:** YYYY-MM-DD
+**Scope:** <what's shipping>
+
+## Evidence
+| Source | Status | Details |
+|--------|:------:|---------|
+| CI: Unit | ✅/❌ | X/Y pass |
+| CI: Integration | ✅/❌ | X/Y pass |
+| Reviewer | ✅/❌ | P0: X, P1: Y |
+| Tester | ✅/❌ | P0: X, P1: Y |
+| Security | ✅/❌ | ... |
+| API Compliance | ✅/❌ | ... |
+
+## DoD Status
+<section 5 checklist — X/10 PASS>
+
+## Blocking Issues (if NO-GO)
+| # | Issue | Owner | Fix plan |
+|---|-------|-------|---------|
+| 1 | ... | ... | ... |
+
+## Accepted Risks (if GO with conditions)
+| # | Risk | Owner | Fix by | Workaround |
+|---|------|-------|--------|-----------|
+| 1 | ... | ... | ... | ... |
+
+## Rollback Plan
+<commands to rollback>
+
+## Post-Release Verification
+<section 6 checklist>
+```
+
+---
+
+## См. также
+- `$release_gate_checklist_template` — RG checklist (generate before this)
+- `$gates` — gate definitions
+- `$board` — project board tracking

package/.agents/skills/release_gate_checklist_template/SKILL.md

@@ -0,0 +1,182 @@
+---
+name: release_gate_checklist_template
+description: Генерирует перед релизом видимый чек-лист RG-01…RG-xx (Evidence/DoD/Security/Ops/Post-deploy/Rollback) и правила статусов.
+---
+
+# Skill: Release Gate Checklist Template (RG-01…RG-xx)
+
+Стандартный релизный чек-лист. Создавать перед каждым Release Gate.
+
+**Разделы:**
+1. [Workflow](#1-workflow)
+2. [Checklist](#2-checklist)
+3. [Status Rules](#3-rules)
+4. [Timing Guide](#4-timing)
+5. [Пример: Filled Checklist](#5-пример)
+
+---
+
+## 1. Workflow
+
+```
+1. Conductor создаёт checklist (copy section 2 as-is)
+2. Заполняй статусы по мере сбора evidence
+3. Все blocking items (🔴) must be DONE для GO
+4. Advisory items (🟡) могут быть N/A с обоснованием
+5. Pass checklist to $release_gate для финального решения
+```
+
+---
+
+## 2. Checklist
+
+### Evidence (source data collection)
+
+| # | Category | Check | Blocking? | Status |
+|---|----------|-------|:---------:|--------|
+| RG-01 | Evidence | Scope релиза + version/tag/commit указаны | 🔴 | ☐ |
+| RG-02 | Evidence | CI: unit tests PASS | 🔴 | ☐ |
+| RG-03 | Evidence | CI: integration tests PASS | 🔴 | ☐ |
+| RG-04 | Evidence | CI: lint/format PASS | 🟡 | ☐ |
+| RG-05 | Evidence | Dependency/SCA audit PASS или риски зафиксированы | 🟡 | ☐ |
+| RG-06 | Evidence | Reviewer report получен (P0=0) + ссылка | 🔴 | ☐ |
+| RG-07 | Evidence | Tester report получен (P0=0) + ссылка | 🔴 | ☐ |
+
+### DoD (Definition of Done)
+
+| # | Category | Check | Blocking? | Status |
+|---|----------|-------|:---------:|--------|
+| RG-08 | DoD | Секреты не попали в код/логи | 🔴 | ☐ |
+| RG-09 | DoD | Runbook / инструкции запуска актуальны | 🔴 | ☐ |
+| RG-10 | DoD | Базовая безопасность: input validation + authz | 🔴 | ☐ |
+
+### Contracts & Data
+
+| # | Category | Check | Blocking? | Status |
+|---|----------|-------|:---------:|--------|
+| RG-11 | Contracts | API соответствует контрактам | 🔴 | ☐ |
+| RG-12 | Data | Миграции/данные: план + обратимость | 🟡 | ☐ |
+
+### Operations
+
+| # | Category | Check | Blocking? | Status |
+|---|----------|-------|:---------:|--------|
+| RG-13 | Ops | Observability: request_id + безопасные логи | 🟡 | ☐ |
+| RG-14 | Ops | Rate limiting / security headers | 🟡 | ☐ |
+
+### Release
+
+| # | Category | Check | Blocking? | Status |
+|---|----------|-------|:---------:|--------|
+| RG-15 | Release | Release notes подготовлены | 🟡 | ☐ |
+| RG-16 | Release | Feature flags / rollout strategy | 🟡 | ☐ |
+| RG-17 | Rollback | Rollback plan описан и понятен | 🔴 | ☐ |
+| RG-18 | Rollback | Backup/restore (если DB) | 🟡 | ☐ |
+
+### Post-deploy
+
+| # | Category | Check | Blocking? | Status |
+|---|----------|-------|:---------:|--------|
+| RG-19 | Post-deploy | Smoke test сценарии определены | 🔴 | ☐ |
+| RG-20 | Post-deploy | Smoke test выполнен на целевом env | 🔴 | ☐ |
+| RG-21 | Post-deploy | Мониторинг/логи проверены | 🟡 | ☐ |
+
+### Decision
+
+| # | Category | Check | Blocking? | Status |
+|---|----------|-------|:---------:|--------|
+| RG-22 | Decision | Итоговое решение: GO / NO-GO | 🔴 | ☐ |
+
+---
+
+## 3. Status Rules
+
+| Status | Meaning |
+|--------|---------|
+| `☐ TODO` | Not started |
+| `⏳ IN-PROGRESS` | Being checked |
+| `✅ DONE` | Check passed |
+| `⚠️ BLOCKED` | Check failed — requires fix |
+| `N/A` | Not applicable (with reason) |
+
+### Blocking rules
+
+| Condition | Result |
+|----------|--------|
+| Any 🔴 item = `⚠️ BLOCKED` | Release = **NO-GO** |
+| P0 from RG-06 or RG-07 | Release = **NO-GO** |
+| All 🔴 items = `✅ DONE` | Release = **GO** (or GO-with-conditions for P1) |
+| 🟡 item = `⚠️ BLOCKED` | Acceptable risk, document + track |
+
+---
+
+## 4. Timing Guide
+
+When to check each item:
+
+| Phase | Items | When |
+|-------|-------|------|
+| **Pre-collect** | RG-01 | Start of release gate |
+| **CI verification** | RG-02, RG-03, RG-04, RG-05 | After DEV complete |
+| **Reports collection** | RG-06, RG-07 | After REV + TEST gates |
+| **DoD verification** | RG-08, RG-09, RG-10 | During review/assessment |
+| **Contracts check** | RG-11, RG-12 | After API changes |
+| **Ops check** | RG-13, RG-14 | After OPS gate |
+| **Release prep** | RG-15, RG-16, RG-17, RG-18 | Pre-deploy |
+| **Post-deploy** | RG-19, RG-20, RG-21 | After deploy to target env |
+| **Final** | RG-22 | Last step |
+
+---
+
+## 5. Пример: Filled Checklist
+
+```markdown
+## Release Gate Checklist — SaaS Admin Panel v1.0
+
+### Evidence
+| # | Check | Blocking | Status | Notes |
+|---|-------|:--------:|:------:|-------|
+| RG-01 | Scope: Settings + Products + Content v1.0, commit abc1234 | 🔴 | ✅ | — |
+| RG-02 | Unit tests: 42/42 pass | 🔴 | ✅ | CI run #78 |
+| RG-03 | Integration tests: 8/8 pass | 🔴 | ✅ | CI run #78 |
+| RG-04 | Lint: 0 errors | 🟡 | ✅ | Biome |
+| RG-05 | npm audit: 0 high/critical | 🟡 | ✅ | — |
+| RG-06 | Reviewer: 0 P0, 2 P1 | 🔴 | ✅ | rev-01.md |
+| RG-07 | Tester: 0 P0, 1 P1, 22/24 pass | 🔴 | ✅ | test-report-iter1.md |
+
+### DoD
+| RG-08 | No secrets in code/logs | 🔴 | ✅ | grep clean |
+| RG-09 | Runbook: docs/runbook.md | 🔴 | ✅ | Updated |
+| RG-10 | Zod validation + auth middleware | 🔴 | ✅ | — |
+
+### Contracts
+| RG-11 | API matches contracts | 🔴 | ✅ | api-compliance.md |
+| RG-12 | No migrations needed | 🟡 | N/A | New app, no existing data |
+
+### Ops
+| RG-13 | Pino + request_id | 🟡 | ✅ | — |
+| RG-14 | Helmet security headers | 🟡 | ✅ | — |
+
+### Release
+| RG-15 | Release notes | 🟡 | ✅ | CHANGELOG.md |
+| RG-16 | No feature flags | 🟡 | N/A | — |
+| RG-17 | Rollback: docker compose revert | 🔴 | ✅ | Documented |
+| RG-18 | MongoDB backup | 🟡 | ✅ | mongodump before deploy |
+
+### Post-deploy
+| RG-19 | Smoke scenarios: 3 P0 flows | 🔴 | ✅ | Defined |
+| RG-20 | Smoke test PASS on staging | 🔴 | ✅ | All 3 pass |
+| RG-21 | Logs clean, no error spike | 🟡 | ✅ | — |
+
+### Decision
+| RG-22 | **⚠️ GO with conditions** | 🔴 | ✅ | 3 P1 tracked for v0.9.1 |
+
+### What's Missing to GO
+Nothing blocking. 3 P1 issues accepted with tasks + owners.
+```
+
+---
+
+## См. также
+- `$release_gate` — decision process (uses this checklist)
+- `$gates` — gate definitions