code-ai-installer 1.5.6 → 2.1.0

package/.agents/skills/cloud-infrastructure-security/SKILL.md

@@ -0,0 +1,277 @@
+---
+name: cloud-infrastructure-security
+description: Security ревью облака/инфры/CI/CD — IAM, secrets manager, сеть, логирование/мониторинг, supply chain, CDN/WAF, backup/DR.
+---
+
+# Skill: Cloud & Infrastructure Security
+
+Ревью безопасности облачной инфраструктуры, CI/CD и edge.
+
+**Разделы:**
+1. [Когда активировать](#1-когда)
+2. [Checklist](#2-checklist)
+3. [Platform-Specific Examples](#3-examples)
+4. [CI/CD Security Pipeline](#4-cicd)
+5. [Pre-Deployment Gate](#5-pre-deploy)
+6. [Output Template](#6-output)
+
+---
+
+## 1. Когда активировать
+
+| Триггер | Focus |
+|---------|-------|
+| Deploy on AWS / GCP / Azure / Vercel / Railway | Full review |
+| IAM policies / roles changed | IAM section |
+| CI/CD pipeline modified | CI/CD section |
+| New infrastructure (Terraform / CloudFormation) | Full review |
+| Secrets management setup | Secrets section |
+| CDN / WAF configuration | CDN/WAF section |
+| Disaster recovery planning | Backup/DR section |
+| Docker / K8s deployment | → also apply `$docker-kubernetes-architecture` |
+
+---
+
+## 2. Checklist
+
+### 2.1 IAM & Access Control
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| INF-01 | Least privilege (no `*` in policies) | 🔴 P0 | ☐ |
+| INF-02 | MFA for privileged accounts (admin, deploy) | 🔴 P0 | ☐ |
+| INF-03 | No root account usage in production | 🔴 P0 | ☐ |
+| INF-04 | Service accounts: one per app, minimal scope | 🟠 P1 | ☐ |
+| INF-05 | Access review: quarterly, remove stale users | 🟠 P1 | ☐ |
+| INF-06 | SSO / federated identity (if org > 5 people) | 🟡 P2 | ☐ |
+
+### 2.2 Secrets Management
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| INF-07 | Platform secret manager (AWS SSM, GCP Secret Manager, Vault, Doppler) | 🟠 P1 | ☐ |
+| INF-08 | Rotation plan for DB credentials (90 days max) | 🟠 P1 | ☐ |
+| INF-09 | Audit log on secret access | 🟠 P1 | ☐ |
+| INF-10 | No secrets in CI logs, build output, Docker images | 🔴 P0 | ☐ |
+| INF-11 | `.env` files gitignored, `.env.example` committed | 🔴 P0 | ☐ |
+
+### 2.3 Network Security
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| INF-12 | Database not publicly accessible | 🔴 P0 | ☐ |
+| INF-13 | SSH/RDP only through VPN/bastion | 🟠 P1 | ☐ |
+| INF-14 | Security groups / firewalls: least privilege (no 0.0.0.0/0 on DB) | 🔴 P0 | ☐ |
+| INF-15 | TLS/HTTPS everywhere (no plain HTTP in prod) | 🔴 P0 | ☐ |
+| INF-16 | Internal services: private network only | 🟠 P1 | ☐ |
+
+### 2.4 Logging & Monitoring
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| INF-17 | Admin actions audited (who did what, when) | 🟠 P1 | ☐ |
+| INF-18 | Log retention ≥ 90 days (or per compliance) | 🟠 P1 | ☐ |
+| INF-19 | Alerts on: failed auth attempts, permission changes, unusual traffic | 🟠 P1 | ☐ |
+| INF-20 | No PII/secrets in infrastructure logs | 🔴 P0 | ☐ |
+
+### 2.5 CI/CD Pipeline Security
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| INF-21 | OIDC for deploy (no long-lived credentials) | 🟠 P1 | ☐ |
+| INF-22 | Secret scanning in CI (secretlint, gitleaks) | 🟠 P1 | ☐ |
+| INF-23 | Dependency audit in CI (`npm audit --audit-level=high`) | 🟠 P1 | ☐ |
+| INF-24 | Container image scanning (trivy, grype) | 🟠 P1 | ☐ |
+| INF-25 | Branch protection: required reviews, no force push | 🟠 P1 | ☐ |
+| INF-26 | CI env isolated from production | 🔴 P0 | ☐ |
+
+### 2.6 CDN / WAF / Edge
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| INF-27 | WAF managed rules enabled (OWASP Core Rule Set) | 🟠 P1 | ☐ |
+| INF-28 | Rate limiting on public endpoints | 🟠 P1 | ☐ |
+| INF-29 | Bot protection / challenge mode | 🟡 P2 | ☐ |
+| INF-30 | Security headers at edge (HSTS, X-Frame-Options, CSP) | 🟠 P1 | ☐ |
+| INF-31 | Strict TLS 1.2+ (no SSL v3, TLS 1.0/1.1) | 🔴 P0 | ☐ |
+| INF-32 | Origin server not directly accessible (CDN proxy only) | 🟠 P1 | ☐ |
+
+### 2.7 Backup & DR
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| INF-33 | Automated backups (DB, configs) | 🟠 P1 | ☐ |
+| INF-34 | Backup retention defined (30+ days) | 🟠 P1 | ☐ |
+| INF-35 | Restore tested (at least once) | 🟠 P1 | ☐ |
+| INF-36 | RPO / RTO documented | 🟠 P1 | ☐ |
+| INF-37 | PITR enabled (if available) | 🟡 P2 | ☐ |
+
+---
+
+## 3. Platform-Specific Examples
+
+### AWS IAM Policy (least privilege)
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:PutObject"
+      ],
+      "Resource": "arn:aws:s3:::my-app-uploads/*"
+    }
+  ]
+}
+```
+
+```
+// ❌ DON'T
+"Action": "*"
+"Resource": "*"
+
+// ✅ DO
+"Action": ["s3:GetObject", "s3:PutObject"]
+"Resource": "arn:aws:s3:::specific-bucket/*"
+```
+
+### Cloudflare WAF Rule
+
+```
+Expression: (http.request.uri.path contains "/api/" and
+             not http.request.uri.path contains "/health/")
+Action: Challenge
+Rate limit: 100 req/min per IP
+```
+
+### Security Headers (Cloudflare / Caddy)
+
+```
+# Caddy security headers
+header {
+    X-Content-Type-Options    "nosniff"
+    X-Frame-Options           "SAMEORIGIN"
+    X-XSS-Protection          "1; mode=block"
+    Strict-Transport-Security "max-age=31536000; includeSubDomains"
+    Referrer-Policy            "strict-origin-when-cross-origin"
+    Permissions-Policy         "camera=(), microphone=(), geolocation=()"
+}
+```
+
+### Docker Compose Network Isolation
+
+```yaml
+services:
+  api:
+    networks: [frontend, backend]
+  gateway:
+    networks: [frontend]
+  mongo:
+    networks: [backend]    # Not accessible from gateway!
+
+networks:
+  frontend:
+  backend:
+    internal: true  # No external access
+```
+
+---
+
+## 4. CI/CD Security Pipeline
+
+```yaml
+# GitHub Actions security job
+security:
+  runs-on: ubuntu-latest
+  steps:
+    - uses: actions/checkout@v4
+
+    # Secret scanning
+    - name: Gitleaks
+      uses: gitleaks/gitleaks-action@v2
+
+    # Dependency audit
+    - name: npm audit
+      run: npm audit --audit-level=high
+
+    # Container scanning
+    - name: Trivy
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: 'app-api:latest'
+        severity: 'CRITICAL,HIGH'
+        exit-code: '1'
+
+    # SAST (static analysis)
+    - name: CodeQL
+      uses: github/codeql-action/analyze@v3
+```
+
+---
+
+## 5. Pre-Deployment Gate
+
+### Security sign-off checklist
+
+| # | Category | Check | Status |
+|---|----------|-------|--------|
+| 1 | IAM | Least privilege verified | ☐ |
+| 2 | Secrets | All in secret manager, rotation documented | ☐ |
+| 3 | Network | DB private, TLS everywhere, firewalls set | ☐ |
+| 4 | Logging | Audit logging enabled, no PII | ☐ |
+| 5 | CI/CD | Secret scan + dep audit + image scan pass | ☐ |
+| 6 | CDN/WAF | WAF rules active, rate limits set | ☐ |
+| 7 | Encryption | TLS 1.2+, data at rest encrypted | ☐ |
+| 8 | Backup | Backups scheduled, restore tested | ☐ |
+| 9 | Runbooks | Deploy, rollback, incident docs exist | ☐ |
+| 10 | Incident plan | Contact list, escalation path defined | ☐ |
+
+---
+
+## 6. Output Template
+
+```markdown
+# Cloud & Infrastructure Security Review
+
+**Scope:** <infrastructure/platform>
+**Reviewer:** Reviewer Agent
+**Date:** YYYY-MM-DD
+
+## Findings
+
+| # | Severity | Category | Finding | Fix | Status |
+|---|----------|----------|---------|-----|--------|
+| 1 | 🔴 P0 | Network | MongoDB port 27017 publicly accessible | Restrict to private network | ☐ |
+| 2 | 🟠 P1 | CI/CD | No secret scanning in pipeline | Add gitleaks step | ☐ |
+| 3 | 🟠 P1 | CDN | No WAF rules configured | Enable OWASP Core Rule Set | ☐ |
+
+## Checklist Summary
+| Section | Pass | Fail | Total |
+|---------|:----:|:----:|:-----:|
+| IAM | 5 | 1 | 6 |
+| Secrets | 4 | 1 | 5 |
+| Network | 3 | 2 | 5 |
+| Logging | 3 | 1 | 4 |
+| CI/CD | 4 | 2 | 6 |
+| CDN/WAF | 3 | 3 | 6 |
+| Backup | 4 | 1 | 5 |
+
+## Pre-Deployment Gate
+<section 5 checklist with status>
+
+## Verdict
+- ✅ SECURE — all P0 passed, P1 tracked
+- ⚠️ CONDITIONAL — fix P0 items before deploy
+- ❌ BLOCKED — critical infrastructure vulnerabilities
+```
+
+---
+
+## См. также
+- `$docker-kubernetes-architecture` — container/K8s security details
+- `$k8s-manifests-conventions` — K8s security policies
+- `$threat-model-baseline` — application-level threat model
+- `$deployment-ci-plan` — CI pipeline setup

package/.agents/skills/cloud-infrastructure-security/agents/claude.json

@@ -0,0 +1,19 @@
+{
+  "name": "cloud-infrastructure-security",
+  "display_name": "Безопасность облака и инфраструктуры",
+  "description": "Security ревью облака/инфры/CI/CD — IAM, secrets manager, сеть, логирование/мониторинг, supply chain, CDN/WAF, backup/DR.",
+  "default_prompt": "Используй $cloud-infrastructure-security, когда задача относится к навыку \"Безопасность облака и инфраструктуры\".",
+  "triggers": [
+    "cloud-infrastructure-security",
+    "cloud infrastructure security",
+    "Безопасность облака и инфраструктуры",
+    "Security ревью облака/инфры/CI/CD — IAM, secrets manager, сеть, логирование/мониторинг, supply chain, CDN/WAF, backup/DR"
+  ],
+  "capabilities": [
+    "cloud",
+    "infrastructure",
+    "security"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/.agents/skills/cloud-infrastructure-security/agents/copilot.json

@@ -0,0 +1,19 @@
+{
+  "name": "cloud-infrastructure-security",
+  "display_name": "Безопасность облака и инфраструктуры",
+  "description": "Security ревью облака/инфры/CI/CD — IAM, secrets manager, сеть, логирование/мониторинг, supply chain, CDN/WAF, backup/DR.",
+  "default_prompt": "Используй $cloud-infrastructure-security, когда задача относится к навыку \"Безопасность облака и инфраструктуры\".",
+  "triggers": [
+    "cloud-infrastructure-security",
+    "cloud infrastructure security",
+    "Безопасность облака и инфраструктуры",
+    "Security ревью облака/инфры/CI/CD — IAM, secrets manager, сеть, логирование/мониторинг, supply chain, CDN/WAF, backup/DR"
+  ],
+  "capabilities": [
+    "cloud",
+    "infrastructure",
+    "security"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/.agents/skills/cloud-infrastructure-security/agents/gemini.json

@@ -0,0 +1,19 @@
+{
+  "name": "cloud-infrastructure-security",
+  "display_name": "Безопасность облака и инфраструктуры",
+  "description": "Security ревью облака/инфры/CI/CD — IAM, secrets manager, сеть, логирование/мониторинг, supply chain, CDN/WAF, backup/DR.",
+  "default_prompt": "Используй $cloud-infrastructure-security, когда задача относится к навыку \"Безопасность облака и инфраструктуры\".",
+  "triggers": [
+    "cloud-infrastructure-security",
+    "cloud infrastructure security",
+    "Безопасность облака и инфраструктуры",
+    "Security ревью облака/инфры/CI/CD — IAM, secrets manager, сеть, логирование/мониторинг, supply chain, CDN/WAF, backup/DR"
+  ],
+  "capabilities": [
+    "cloud",
+    "infrastructure",
+    "security"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/.agents/skills/cloud-infrastructure-security/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "Безопасность облака и инфраструктуры"
+  short_description: "Security ревью облака/инфры/CI/CD — IAM, secrets manager, сеть, логирование/мониторинг, supply…"
+  default_prompt: "Используй $cloud-infrastructure-security, когда задача относится к навыку \"Безопасность облака и инфраструктуры\"."
+dependencies:
+  tools: []
+policy:
+  allow_implicit_invocation: true

package/.agents/skills/cloud-infrastructure-security/agents/qwen.json

@@ -0,0 +1,19 @@
+{
+  "name": "cloud-infrastructure-security",
+  "display_name": "Безопасность облака и инфраструктуры",
+  "description": "Security ревью облака/инфры/CI/CD — IAM, secrets manager, сеть, логирование/мониторинг, supply chain, CDN/WAF, backup/DR.",
+  "default_prompt": "Используй $cloud-infrastructure-security, когда задача относится к навыку \"Безопасность облака и инфраструктуры\".",
+  "triggers": [
+    "cloud-infrastructure-security",
+    "cloud infrastructure security",
+    "Безопасность облака и инфраструктуры",
+    "Security ревью облака/инфры/CI/CD — IAM, secrets manager, сеть, логирование/мониторинг, supply chain, CDN/WAF, backup/DR"
+  ],
+  "capabilities": [
+    "cloud",
+    "infrastructure",
+    "security"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/.agents/skills/cloud-infrastructure-security/agents/skill.yaml

@@ -0,0 +1,23 @@
+version: 1
+name: "cloud-infrastructure-security"
+display_name: "Безопасность облака и инфраструктуры"
+description: "Security ревью облака/инфры/CI/CD — IAM, secrets manager, сеть, логирование/мониторинг, supply chain, CDN/WAF, backup/DR."
+default_prompt: "Используй $cloud-infrastructure-security, когда задача относится к навыку \"Безопасность облака и инфраструктуры\"."
+triggers:
+  - "cloud-infrastructure-security"
+  - "cloud infrastructure security"
+  - "Безопасность облака и инфраструктуры"
+  - "Security ревью облака/инфры/CI/CD — IAM, secrets manager, сеть, логирование/мониторинг, supply chain, CDN/WAF, backup/DR"
+capabilities:
+  - "cloud"
+  - "infrastructure"
+  - "security"
+tools: []
+invocation:
+  explicit: true
+  implicit: true
+localization:
+  default_locale: "ru"
+  available_locales:
+    - "ru"
+    - "en"

package/.agents/skills/code-review-checklist/SKILL.md

@@ -0,0 +1,200 @@
+---
+name: code-review-checklist
+description: Универсальный чек-лист ревью — качество кода, читаемость, тестируемость, безопасность, контракты, DoD.
+---
+
+# Skill: Code Review Checklist
+
+Систематическое ревью PR/кода на соответствие стандартам проекта.
+
+**Разделы:**
+1. [Workflow](#1-workflow)
+2. [Checklist](#2-checklist)
+3. [Automated Checks](#3-automated)
+4. [Severity](#4-severity)
+5. [Output Template](#5-output)
+
+---
+
+## 1. Workflow
+
+```
+1. Прочитай PR description / задачу
+   └── Что должно измениться? Какие acceptance criteria?
+
+2. Автоматические проверки (section 3)
+   └── grep patterns, lint, tests, audit
+
+3. Пройди по checklist (section 2)
+   └── Для каждого пункта: PASS / FINDING (P0/P1/P2)
+
+4. Сформируй review report (section 5)
+   └── Summary + findings + verdict
+```
+
+---
+
+## 2. Checklist
+
+### 2.1 Code Quality
+
+| # | Check | Guidance | Status |
+|---|-------|---------|--------|
+| Q1 | Ясные имена | Функции = глагол+объект (`createCoupon`), переменные = существительное (`activeCount`). Нет `data`, `temp`, `x` | ☐ |
+| Q2 | Маленькие функции | Одна ответственность, < 40 строк. Если > 60 → split | ☐ |
+| Q3 | Нет дублирования | DRY без фанатизма. 3+ повторения = extract to helper | ☐ |
+| Q4 | Нет магии | Никаких implicit side effects, hidden globals, undocumented hooks с бизнес-логикой | ☐ |
+| Q5 | JSDoc на функциях | `@param`, `@returns`, описание. Обязательно для public API | ☐ |
+| Q6 | Нет `console.log` | Заменить на pino logger. Исключение: тесты | ☐ |
+| Q7 | Нет `any` / `@ts-ignore` | Каждое использование = осознанное исключение с комментарием | ☐ |
+
+### 2.2 Architecture
+
+| # | Check | Guidance | Status |
+|---|-------|---------|--------|
+| A1 | Соответствует Architecture Doc / ADR | Новый модуль → проверь что он в диаграмме | ☐ |
+| A2 | Нет tight coupling | Модуль A не импортирует internals модуля B. Только public API | ☐ |
+| A3 | Нет God Object | Файл < 500 строк, класс < 10 public methods | ☐ |
+| A4 | Layer boundaries | Router → Controller → Service → Repository. Нет DB calls в router | ☐ |
+| A5 | Новые решения → ADR | Если ввёл новый паттерн, библиотеку, стратегию → ADR required | ☐ |
+
+### 2.3 API & Data
+
+| # | Check | Guidance | Status |
+|---|-------|---------|--------|
+| D1 | API контракты | Request/Response match `$api-contracts` spec. Новые endpoints documented | ☐ |
+| D2 | Validation на границе | Zod schema в middleware, до бизнес-логики | ☐ |
+| D3 | Error format | Единый `{ error: { code, message, details } }`. Нет stack/DB errors in response | ☐ |
+| D4 | Status codes | 201 для create, 204 для delete, 409 для duplicate. Не всё 200 | ☐ |
+| D5 | Data model consistent | Schema changes + migration present. Indexes added for new queries | ☐ |
+
+### 2.4 Tests
+
+| # | Check | Guidance | Status |
+|---|-------|---------|--------|
+| T1 | Tests added/updated | Новый код = новые тесты. Changed code = updated tests | ☐ |
+| T2 | Happy path covered | Основной сценарий работает | ☐ |
+| T3 | Edge cases | Empty input, max values, boundary conditions | ☐ |
+| T4 | Error paths | Invalid input → 400, not found → 404, auth → 401 | ☐ |
+| T5 | No flaky tests | Нет `setTimeout`, нет order dependency, стабильные тесты | ☐ |
+| T6 | AAA pattern | Arrange → Act → Assert. Один assert per concept | ☐ |
+| T7 | No test magic | Нет hardcoded IDs, no shared mutable state between tests | ☐ |
+
+### 2.5 Security
+
+| # | Check | Guidance | Status |
+|---|-------|---------|--------|
+| S1 | AuthZ on server | `req.appInstanceId` verified before data access. No IDOR | ☐ |
+| S2 | No secrets in code | No hardcoded passwords, API keys, tokens | ☐ |
+| S3 | Safe error messages | No stack trace, no DB error, no PII in response | ☐ |
+| S4 | Input sanitization | No `eval()`, no `dangerouslySetInnerHTML` without sanitize | ☐ |
+| S5 | Dependency audit | No known high/critical vulnerabilities | ☐ |
+
+### 2.6 Observability & Ops
+
+| # | Check | Guidance | Status |
+|---|-------|---------|--------|
+| O1 | Structured logging | pino with level, message, context fields | ☐ |
+| O2 | requestId correlation | All logs in request chain include requestId | ☐ |
+| O3 | No PII in logs | No email, password, token, creditCard logged | ☐ |
+| O4 | Health endpoints | `/health/live` and `/health/ready` working | ☐ |
+| O5 | Build/run instructions | README or comments explain how to run changed code | ☐ |
+
+---
+
+## 3. Automated Checks
+
+### Grep patterns (run during review)
+
+```bash
+# Security
+grep_search: Query="console.log"              → P1: replace with pino
+grep_search: Query="eval("                    → P0: code injection risk
+grep_search: Query="dangerouslySetInnerHTML"   → P0: XSS risk
+grep_search: Query="password.*=.*\""          → P0: hardcoded secret
+grep_search: Query="@ts-ignore"               → P1: type safety bypass
+grep_search: Query="any"  Includes=["*.ts"]   → P1: weak typing
+grep_search: Query="eslint-disable"           → P1: rule bypass
+grep_search: Query="TODO|FIXME|HACK|XXX"      → P2: track tech debt
+
+# Architecture
+grep_search: Query="mongoose" Includes=["*/routes/*","*/controllers/*"]  → P1: DB in wrong layer
+grep_search: Query="req.body" Includes=["*/services/*"]                  → P1: HTTP in service layer
+
+# Tests
+find_by_name: Pattern="*.test.*" → count test files vs source files
+find_by_name: Pattern="*.spec.*" → same
+```
+
+---
+
+## 4. Severity
+
+| Level | Description | Action |
+|-------|-----------|--------|
+| 🔴 **P0** | Security vulnerability, data loss, broken core flow | Block merge. Fix immediately |
+| 🟠 **P1** | Tech debt, missing validation, no tests, architecture violation | Request fix before merge |
+| 🟡 **P2** | Style, naming, minor optimization, nice-to-have | Optional. Note for future |
+
+---
+
+## 5. Output Template
+
+```markdown
+# Code Review Report
+
+**PR/Task:** <title>
+**Reviewer:** Reviewer Agent
+**Date:** YYYY-MM-DD
+**Files reviewed:** <count>
+
+## Summary
+<1-2 sentences: what this PR does, overall quality assessment>
+
+## Automated Checks
+| Check | Result |
+|-------|--------|
+| Lint (biome) | ✅ Pass |
+| Tests (vitest) | ✅ Pass (42/42) |
+| npm audit | ⚠️ 1 moderate |
+| Secret scan | ✅ Clean |
+
+## Findings
+
+| # | Severity | Category | File | Finding | Recommendation |
+|---|----------|----------|------|---------|----------------|
+| 1 | 🔴 P0 | Security | `api/routes/settings.js:32` | No authZ check — any user can update any settings | Add appInstanceId ownership check |
+| 2 | 🟠 P1 | Tests | `api/services/coupon.test.js` | No error path test for duplicate coupon | Add test: POST with duplicate code → 409 |
+| 3 | 🟡 P2 | Quality | `dashboard/components/Timer.jsx:15` | Magic number `60` | Extract to constant `SECONDS_PER_MINUTE` |
+
+## Checklist Summary
+
+| Section | Pass | Findings | Total |
+|---------|:----:|:--------:|:-----:|
+| Code Quality | 6 | 1 | 7 |
+| Architecture | 5 | 0 | 5 |
+| API & Data | 4 | 1 | 5 |
+| Tests | 5 | 2 | 7 |
+| Security | 4 | 1 | 5 |
+| Observability | 5 | 0 | 5 |
+| **Total** | **29** | **5** | **34** |
+
+## Verdict
+- ✅ **APPROVED** — no P0/P1, minor P2 notes
+- ⚠️ **CHANGES REQUESTED** — P0/P1 must be fixed before merge
+- ❌ **REJECTED** — fundamental issues, needs redesign
+
+## DoD Verification
+- [x] CI green (lint + tests + audit)
+- [x] Acceptance criteria met
+- [ ] P0/P1 findings resolved ← blocking
+- [x] Documentation updated
+```
+
+---
+
+## См. также
+- `$security-review` — deep security review (when S1-S5 need more depth)
+- `$tests-quality-review` — deep test quality review
+- `$api-contract-compliance-review` — API contract verification
+- `$review-reference-snippets` — DO/DON'T code examples

package/.agents/skills/code-review-checklist/agents/claude.json

@@ -0,0 +1,19 @@
+{
+  "name": "code-review-checklist",
+  "display_name": "Чек-лист код-ревью",
+  "description": "Универсальный чек-лист ревью — качество кода, читаемость, тестируемость, безопасность, контракты, DoD.",
+  "default_prompt": "Используй $code-review-checklist, когда задача относится к навыку \"Чек-лист код-ревью\".",
+  "triggers": [
+    "code-review-checklist",
+    "code review checklist",
+    "Чек-лист код-ревью",
+    "Универсальный чек-лист ревью — качество кода, читаемость, тестируемость, безопасность, контракты, DoD"
+  ],
+  "capabilities": [
+    "code",
+    "review",
+    "checklist"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/.agents/skills/code-review-checklist/agents/copilot.json

@@ -0,0 +1,19 @@
+{
+  "name": "code-review-checklist",
+  "display_name": "Чек-лист код-ревью",
+  "description": "Универсальный чек-лист ревью — качество кода, читаемость, тестируемость, безопасность, контракты, DoD.",
+  "default_prompt": "Используй $code-review-checklist, когда задача относится к навыку \"Чек-лист код-ревью\".",
+  "triggers": [
+    "code-review-checklist",
+    "code review checklist",
+    "Чек-лист код-ревью",
+    "Универсальный чек-лист ревью — качество кода, читаемость, тестируемость, безопасность, контракты, DoD"
+  ],
+  "capabilities": [
+    "code",
+    "review",
+    "checklist"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/.agents/skills/code-review-checklist/agents/gemini.json

@@ -0,0 +1,19 @@
+{
+  "name": "code-review-checklist",
+  "display_name": "Чек-лист код-ревью",
+  "description": "Универсальный чек-лист ревью — качество кода, читаемость, тестируемость, безопасность, контракты, DoD.",
+  "default_prompt": "Используй $code-review-checklist, когда задача относится к навыку \"Чек-лист код-ревью\".",
+  "triggers": [
+    "code-review-checklist",
+    "code review checklist",
+    "Чек-лист код-ревью",
+    "Универсальный чек-лист ревью — качество кода, читаемость, тестируемость, безопасность, контракты, DoD"
+  ],
+  "capabilities": [
+    "code",
+    "review",
+    "checklist"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/.agents/skills/code-review-checklist/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "Чек-лист код-ревью"
+  short_description: "Универсальный чек-лист ревью — качество кода, читаемость, тестируемость, безопасность, контракт…"
+  default_prompt: "Используй $code-review-checklist, когда задача относится к навыку \"Чек-лист код-ревью\"."
+dependencies:
+  tools: []
+policy:
+  allow_implicit_invocation: true