compound-workflow 0.1.1

package/src/.agents/skills/audit-traceability/SKILL.md

@@ -0,0 +1,260 @@
+---
+name: audit-traceability
+description: Append-only audit logging with actor attribution and correlation IDs for regulated/financial workflows (Prisma + Postgres).
+---
+
+# Audit & Traceability Standard (Prisma + Postgres)
+
+## Purpose
+
+Define an audit system that supports forensic reconstruction of actions, suitable for regulated/financial products.
+
+This skill focuses on:
+
+- immutable append-only audit logs
+- actor attribution
+- correlation of events across services
+- safe handling of sensitive information
+
+---
+
+## Non-Negotiable Rules
+
+- MUST use append-only audit tables (no updates/deletes).
+- MUST record actor type and actor identity (when available).
+- MUST include correlation identifiers (request id / trace id / workflow run id).
+- MUST NOT store plaintext PII in audit logs.
+- MUST capture state transitions and decisions.
+- MUST ensure audit writes happen in the same transaction as the business change when feasible.
+
+---
+
+## Data Model
+
+### application_audit_log (baseline)
+
+```sql
+CREATE TYPE audit_actor_type AS ENUM ('USER','SYSTEM','ADMIN','WORKFLOW');
+
+CREATE TABLE application_audit_log (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  application_id uuid NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
+
+  event_type text NOT NULL,
+  actor_type audit_actor_type NOT NULL,
+  actor_id text NULL,
+
+  correlation_id text NULL,
+  request_ip inet NULL,
+  user_agent text NULL,
+
+  previous_state jsonb NULL,
+  new_state jsonb NULL,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX application_audit_app_idx ON application_audit_log(application_id);
+CREATE INDEX application_audit_created_idx ON application_audit_log(created_at);
+CREATE INDEX application_audit_event_idx ON application_audit_log(event_type);
+CREATE INDEX application_audit_correlation_idx ON application_audit_log(correlation_id);
+```
+
+Operational enforcement options (choose at least one):
+
+- DB permissions: app role granted only INSERT/SELECT on audit tables
+- triggers: forbid UPDATE/DELETE with a raising trigger
+- schema separation: place audit tables in a dedicated schema with restricted roles
+
+---
+
+## Recommended `event_type` taxonomy
+
+Keep it consistent and searchable:
+
+- `APPLICATION_CREATED`
+- `DRAFT_UPDATED`
+- `SUBMITTED`
+- `STATUS_CHANGED`
+- `PII_UPDATED` (no plaintext)
+- `REVIEW_APPROVED`
+- `REVIEW_REJECTED`
+- `PAYMENT_AUTHORIZED`
+- `PAYMENT_CAPTURED`
+- `NOTIFICATION_SENT`
+- `ADMIN_VIEWED_PII` (if applicable)
+
+---
+
+## What to Store (and What Not to)
+
+### Allowed in `previous_state` / `new_state`
+
+- status
+- current step
+- non-PII derived flags
+- submission ids
+- workflow run ids
+- numeric amounts only if required and non-sensitive for your context
+
+### MUST NOT store
+
+- names, emails, addresses, DOB
+- identity document numbers
+- bank account numbers
+- free-text user input likely to contain PII
+
+Instead store:
+
+- field names changed
+- hashes (where necessary)
+- references to secure stores
+
+Example metadata for PII update:
+
+```json
+{
+  "fields_changed": ["address", "dob"],
+  "schema_version": 1,
+  "kek_key_id": "pii-kek-v4"
+}
+```
+
+---
+
+## Transactional Audit Pattern
+
+### Rule
+
+If you update business state, write the audit row in the same DB transaction when possible.
+
+Pattern (conceptual):
+
+1. Load previous state (minimal, non-PII)
+2. Perform version-guarded update to business table
+3. Insert audit row referencing previous/new state + metadata
+
+This prevents "state changed but audit missing" scenarios.
+
+If a change spans systems and cannot be fully transactional, emit an event/outbox entry and write a compensating audit record when the change is finalized.
+
+---
+
+## Correlation IDs
+
+### Minimum requirement
+
+- Every inbound request has a `correlation_id` (UUID or equivalent).
+- Propagate `correlation_id` across:
+  - workflow runs
+  - queue messages
+  - downstream calls
+
+Store correlation id in audit logs and idempotency rows.
+
+---
+
+## Actor Attribution
+
+### Standard actor model
+
+- `USER`: authenticated end user
+- `ADMIN`: internal staff with elevated privilege
+- `SYSTEM`: background job/service
+- `WORKFLOW`: orchestrator run id
+
+Always include `actor_type`. Include `actor_id` where available.
+
+---
+
+## Privileged Access Auditing (PII Views)
+
+If you allow staff/support access, log `ADMIN_VIEWED_PII` with:
+
+- admin id
+- reason code / ticket id
+- application id
+- correlation id
+
+This is critical for regulated contexts.
+
+---
+
+## Retention & Redaction
+
+Retention is policy-dependent:
+
+- audit logs are often retained long-term
+- PII may be deleted/redacted earlier
+
+Design so you can delete/redact PII while keeping audit entries (audit has no plaintext PII).
+
+---
+
+## Failure Modes
+
+### Audit write fails
+
+For critical actions:
+
+- fail closed (do not change business state without audit)
+
+For non-critical actions:
+
+- queue an audit repair job
+- still emit an incident/security event (no PII)
+
+Define which events are critical.
+
+---
+
+## Prisma Models (Baseline)
+
+```prisma
+enum AuditActorType {
+  USER
+  SYSTEM
+  ADMIN
+  WORKFLOW
+}
+
+model ApplicationAuditLog {
+  id            String @id @default(uuid()) @db.Uuid
+  applicationId String @db.Uuid
+
+  eventType     String
+  actorType     AuditActorType
+  actorId       String?
+
+  correlationId String?
+  requestIp     String? @db.Inet
+  userAgent     String?
+
+  previousState Json?
+  newState      Json?
+  metadata      Json   @default("{}")
+
+  createdAt     DateTime @default(now())
+
+  @@index([applicationId])
+  @@index([createdAt])
+  @@index([eventType])
+  @@index([correlationId])
+}
+```
+
+---
+
+## PR Review Checklist
+
+- [ ] Audit row added for all state transitions.
+- [ ] Audit row added for all approvals/decisions.
+- [ ] No plaintext PII stored in audit.
+- [ ] `correlation_id` propagated and persisted.
+- [ ] Privileged access events audited (if applicable).
+- [ ] Append-only is enforced (permissions and/or triggers).
+
+---
+
+End of Skill.

package/src/.agents/skills/brainstorming/SKILL.md

@@ -0,0 +1,250 @@
+---
+name: brainstorming
+description: This skill should be used before implementing features, building components, or making changes. It guides exploring user intent, approaches, and design decisions before planning. Triggers on "let's brainstorm", "help me think through", "what should we build", "explore approaches", ambiguous feature requests, or when the user's request has multiple valid interpretations that need clarification.
+---
+
+# Brainstorming
+
+This skill provides detailed process knowledge for effective brainstorming sessions that clarify **WHAT** to build before diving into **HOW** to build it.
+
+## When to Use This Skill
+
+Brainstorming is valuable when:
+
+- Requirements are unclear or ambiguous
+- Multiple approaches could solve the problem
+- Trade-offs need to be explored with the user
+- The user hasn't fully articulated what they want
+- The feature scope needs refinement
+
+Brainstorming can be skipped when:
+
+- Requirements are explicit and detailed
+- The user knows exactly what they want
+- The task is a straightforward bug fix or well-defined change
+
+## Core Process
+
+### Phase 0: Assess Requirement Clarity
+
+Before diving into questions, assess whether brainstorming is needed.
+
+**Signals that requirements are clear:**
+
+- User provided specific acceptance criteria
+- User referenced existing patterns to follow
+- User described exact behavior expected
+- Scope is constrained and well-defined
+
+**Signals that brainstorming is needed:**
+
+- User used vague terms ("make it better", "add something like")
+- Multiple reasonable interpretations exist
+- Trade-offs haven't been discussed
+- User seems unsure about the approach
+
+If requirements are clear, suggest: "Your requirements seem clear. Consider proceeding directly to planning or implementation."
+
+### Phase 1: Understand the Idea
+
+Default to **discussion-first**. Questions are a tool of last resort to unblock discussion, not the main loop.
+
+**Default cadence (per iteration):**
+
+1. **Synthesize current understanding** (2--4 bullets)
+2. **Ask at most ONE high-leverage clarifying question** (only if needed)
+3. **Surface tensions & unknowns** via 3--5 **discussion prompts** (not interrogation)
+4. **Capture assumptions + tentative decisions** (bullets)
+
+**Hard rules:**
+
+- Ask **no more than one** clarifying question per iteration.
+- Do **not** ask follow-up questions in the same turn.
+- If ambiguity is blocking progress, ask **one** additional clarifying question max, then return to discussion prompts.
+
+**First response template (copy/paste shape):**
+
+```markdown
+**What I think you're aiming for (so far):**
+- ...
+- ...
+
+**One question to anchor us:**
+<single sentence>
+
+**Prompts to react to (pick any):**
+- Tradeoff: ...
+- Edge area: ...
+- UX vs architecture: ...
+- Scale implication: ...
+- Short-term vs long-term: ...
+
+**Working assumptions (tell me what’s wrong):**
+- ...
+- ...
+```
+
+**Choosing the ONE question (when needed):**
+
+- **Do not open with multiple-choice.** Open with synthesis and discussion prompts. Multiple-choice applies only when you have already done a dialogue iteration and are asking that one allowed question.
+
+1. **Prefer multiple choice when natural options exist** (only after a dialogue iteration)
+
+   - Good: "Should the notification be: (a) email only, (b) in-app only, or (c) both?"
+   - Avoid: "How should users be notified?"
+
+2. **Make it high-leverage**
+
+   - Anchor on **purpose**, **users**, **success**, or a **hard constraint**
+   - Avoid implementation sequencing ("how will we build it?")
+
+3. **Validate assumptions explicitly**
+
+   - "I'm assuming users will be logged in. Is that correct?"
+
+4. **Prefer success criteria early**
+   - "What would make you say 'this worked'?"
+
+**Prompt menu (examples):**
+
+- Purpose: "What problem is painful enough to fix now?"
+- Users/context: "Who is the primary user and what’s their moment-of-need?"
+- Constraints: "What constraint should we treat as immovable?"
+- Success: "What does success look like (observable behavior)?"
+- Edges: "What must not happen? What failure would be unacceptable?"
+- Patterns: "What existing behavior/pattern do we want to preserve?"
+
+**Exit condition:** Continue until direction is clear OR the user says "proceed" / "move on".
+
+### Phase 2: Explore Approaches
+
+After understanding the idea, propose 2-3 concrete approaches.
+
+**Structure for Each Approach:**
+
+```markdown
+### Approach A: [Name]
+
+[2-3 sentence description]
+
+**Pros:**
+
+- [Benefit 1]
+- [Benefit 2]
+
+**Cons:**
+
+- [Drawback 1]
+- [Drawback 2]
+
+**Best when:** [Circumstances where this approach shines]
+```
+
+**Guidelines:**
+
+- Lead with a recommendation and explain why
+- Be honest about trade-offs
+- Consider YAGNI—simpler is usually better
+- Reference codebase patterns when relevant
+
+### Phase 3: Capture the Design
+
+Summarize key decisions in a structured format.
+
+**Design Doc Structure:**
+
+```markdown
+---
+date: YYYY-MM-DD
+topic: <kebab-case-topic>
+---
+
+# <Topic Title>
+
+## What We're Building
+
+[Concise description—1-2 paragraphs max]
+
+## Why This Approach
+
+[Brief explanation of approaches considered and why this one was chosen]
+
+## Key Decisions
+
+- [Decision 1]: [Rationale]
+- [Decision 2]: [Rationale]
+
+## Open Questions
+
+- [Any unresolved questions for the planning phase]
+
+## Next Steps
+
+→ `/workflow:plan` for implementation details
+```
+
+**Output Location:** `docs/brainstorms/YYYY-MM-DD-<topic>-brainstorm.md`
+
+Before handoff, review the `Open Questions` section.
+
+- Classify open questions as **blocking** vs **non-blocking**.
+- Ask the user about each **blocking** question (one at a time) when possible.
+- Move resolved items into a `Resolved Questions` section.
+- Keep non-blocking items in `Open Questions` to carry into planning, with clear ownership or a decision deadline.
+
+### Phase 4: Handoff
+
+Present clear options for what to do next:
+
+1. **Proceed to planning** → Run `/workflow:plan`
+2. **Refine further** → Continue exploring the design
+3. **Done for now** → User will return later
+
+## YAGNI Principles
+
+During brainstorming, actively resist complexity:
+
+- **Don't design for hypothetical future requirements**
+- **Choose the simplest approach that solves the stated problem**
+- **Prefer boring, proven patterns over clever solutions**
+- **Ask "Do we really need this?" when complexity emerges**
+- **Defer decisions that don't need to be made now**
+
+## Incremental Validation
+
+Keep sections short—200-300 words maximum. After each section of output, pause to validate understanding:
+
+- "What part feels most important / most wrong?"
+- "Which prompt should we dig into next?"
+- "Any assumption I should flip before we continue?"
+
+This prevents wasted effort on misaligned designs.
+
+## Anti-Patterns to Avoid
+
+| Anti-Pattern                          | Better Approach                             |
+| ------------------------------------- | ------------------------------------------- |
+| Asking many questions in a row        | Ask 1 high-leverage question, then prompts  |
+| Jumping to implementation details     | Stay focused on WHAT, not HOW               |
+| Proposing overly complex solutions    | Start simple, add complexity only if needed |
+| Ignoring existing codebase patterns   | Research what exists first                  |
+| Making assumptions without validating | State assumptions explicitly and confirm    |
+| Creating lengthy design documents     | Keep it concise—details go in the plan      |
+
+## Integration with Planning
+
+Brainstorming answers **WHAT** to build:
+
+- Requirements and acceptance criteria
+- Chosen approach and rationale
+- Key decisions and trade-offs
+
+Planning answers **HOW** to build it:
+
+- Implementation steps and file changes
+- Technical details and code patterns
+- Testing strategy and verification
+
+When brainstorm output exists, `/workflow:plan` should detect it and use it as input, skipping its own idea refinement phase.
+
+Brainstorming should avoid deep implementation sequencing. Leave execution design and step-by-step build order to planning.