create-agdf 0.1.1 → 0.1.2

package/README.md

@@ -23,8 +23,13 @@ If the target repository already has an `AGENTS.md`, `create-agdf` preserves it
 
 ## Single source of truth
 
-The AGDF skill contracts are maintained in `plugin/skills/`.
-The published package assets are generated from the repository sources only at pack/publish time. The package does not keep a second manually maintained template tree.
+The repository-facing AGDF sources are maintained in:
+
+- `AGENTS.md`
+- `plugin/skills/`
+- `plugin/meta/agdf-runtime-contract.md`
+
+The published package assets are generated from these repository sources only at pack/publish time. The package does not keep a second manually maintained template tree.
 
 ```bash
 npm run sync-package-assets

package/bin/create-agdf.js

@@ -18,6 +18,7 @@ const copilotSkillFiles = [
   join(".github", "skills", "agdf-brownfield-analysis", "SKILL.md"),
   join(".github", "skills", "agdf-task-plan-review", "SKILL.md"),
   join(".github", "skills", "agdf-clean-implementation-review", "SKILL.md"),
+  join(".github", "skills", "agdf-code-review", "SKILL.md"),
   join(".github", "skills", "agdf-qa-gate", "SKILL.md"),
   join(".github", "skills", "agdf-release-or", "SKILL.md"),
   join(".github", "skills", "agdf-delivery-closeout", "SKILL.md"),

package/generated/.github/skills/README.md

@@ -1,11 +1,12 @@
 # AGDF repository skills
 
-These repository skills are generated from `plugin/skills/`, which is the single source of truth for the AGDF skill contracts.
+These repository skills were generated from the AGDF source repository and are intended to be checked into this repository.
 
 ## Skills
 
 - `agdf-brownfield-analysis`
 - `agdf-clean-implementation-review`
+- `agdf-code-review`
 - `agdf-delivery-closeout`
 - `agdf-gate-check`
 - `agdf-qa-gate`
@@ -14,4 +15,4 @@ These repository skills are generated from `plugin/skills/`, which is the single
 
 ## Runtime contract
 
-Shared output and gate rules live in `agdf-runtime-contract.md`.
+Shared output and gate rules for this checkout live in `agdf-runtime-contract.md`.

package/generated/.github/skills/agdf-clean-implementation-review/SKILL.md

@@ -49,7 +49,7 @@ Use what is available:
 - Code Deliverables
 - changed files
 - tests and test results
-- Code Review Report
+- `agdf-code-review` or Code Review Report
 - QA Report
 - Brownfield Analysis findings
 - PRD or SD architecture notes

package/generated/.github/skills/agdf-code-review/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: agdf-code-review
+description: Use this skill after code changes and before QA to produce the mandatory Code Review Report for correctness, regression, security, and maintainability findings in the actual diff. It standardizes the CR step without replacing TP review, clean review, or QA.
+---
+
+# code-review
+
+## Purpose
+Produce the mandatory Code Review Report (CR) for a relevant run.
+
+It answers:
+
+- whether the changed code shows functional defects, security issues, regression risks, or maintainability problems that matter
+- whether findings are blocking, revisable, or advisory
+- which concrete evidence in files, diffs, tests, or runtime observations supports each finding
+- which issues must be fixed before QA
+- whether Brownfield, TP, or clean-review follow-up remains open
+
+## Runtime Contract
+Use `../agdf-runtime-contract.md` for Quality Contract output, Context Graph fields, gate terms, and non-duplication rules.
+
+Code-review-specific output must make actual findings, missing review scope, evidence strength, and the next required step visible.
+
+## Rules
+1. Review the actual diff and impacted code, not intent alone.
+2. Findings require concrete evidence.
+3. Prioritize correctness, safety, data integrity, compatibility, and maintainability over style.
+4. Do not generate style-only noise.
+5. Missing review scope or evidence must stay visible.
+6. Brownfield owners and existing conventions are binding unless deviation is justified.
+7. Distinguish blocking defects from fixable review findings.
+8. CR does not grant QA pass.
+
+## When To Use
+- after `CD+Tests`
+- before `QA`
+- when code changes exist
+- when multiple agents or contributors touched the same area
+- when a commit-near change needs explicit review evidence
+
+## Inputs
+Use what is available:
+
+- changed files and diff
+- affected neighbouring code
+- test/build results
+- Brownfield Analysis
+- Task Plan and TP Review
+- Clean Implementation Review
+- runtime or UI evidence
+- known risks or follow-up decisions
+
+If no code changes are present, do not invent a CR result.
+
+## Workflow
+1. Inspect the changed files and directly impacted neighbours.
+2. Check correctness, edge cases, and error paths.
+3. Check security, data handling, and state ownership risks.
+4. Check regression and compatibility risks.
+5. Check maintainability only where it creates real defect or change-risk exposure.
+6. Classify the overall result:
+   - `pass`
+   - `revise`
+   - `block`
+   - `not_applicable`
+7. Set exactly one required next step.
+
+## Output
+Use this compact structure:
+
+```text
+## Code Review
+- decision: pass | revise | block | not_applicable
+- findings:
+  - [severity] file/path - issue - evidence
+- missing_evidence:
+- risks:
+- required_next_step:
+```
+
+## Decision Guidance
+- `pass`: no meaningful review finding remains evident in reviewed scope.
+- `revise`: fixable correctness, regression, or maintainability issues remain.
+- `block`: a hard defect, security risk, data-integrity risk, or unresolved critical uncertainty remains.
+- `not_applicable`: no code changes were present for review.
+
+## Forbidden
+This skill must not:
+
+- decide final QA
+- accept a green build as sufficient review evidence
+- hide missing review scope
+- generate style-only findings
+- duplicate TP Review or QA as if they were the same step

package/generated/.github/skills/agdf-qa-gate/SKILL.md

@@ -40,7 +40,7 @@ QA-specific `decision` is exactly `pass | revise | block`.
 
 ## When To Use
 - after `CD+Tests`
-- after Code Review
+- after `agdf-code-review`
 - after `agdf-task-plan-review`
 - after `agdf-clean-implementation-review`
 - before UAT
@@ -58,7 +58,7 @@ Use what is available:
 - approved TP and TP Review
 - Brownfield Analysis
 - Clean Implementation Review
-- Code Review Report
+- `agdf-code-review` or Code Review Report
 - test/build results
 - documentation impact review
 - runtime or UI evidence

package/generated/.github/skills/agdf-release-or/SKILL.md

@@ -46,7 +46,7 @@ OR-specific output must make gate status, delivered and intentionally not delive
 - after artefact creation
 - when a gate blocks
 - after `CD+Tests`
-- after CR
+- after `agdf-code-review`
 - after QA
 - after UAT
 - whenever a compact audit closeout is needed
@@ -62,6 +62,7 @@ Use what is available:
 - `agdf-task-plan-review`
 - `agdf-brownfield-analysis`
 - `agdf-clean-implementation-review`
+- `agdf-code-review`
 - QA Report
 - UAT Report
 - documentation impact review

package/generated/.github/skills/agdf-runtime-contract.md

@@ -22,6 +22,7 @@ Structured Delivery must not bypass missing approvals.
 - Implicit consent is not approval.
 - The earliest blocking gate wins.
 - `CD+Tests` is implementation and test status only, not a delivery signal.
+- `agdf-code-review` standardizes the mandatory `CR` step, but does not replace QA.
 - `agdf-qa-gate` decides final `pass | revise | block`.
 - `agdf-release-or` reports the run, but does not replace QA.
 

package/generated/AGENTS.md

@@ -44,6 +44,7 @@ Evidence overrides assumptions and memory. If evidence is missing, state the unc
 | `agdf-brownfield-analysis` | before non-trivial implementation in existing systems | clarifies reuse, owners, risks |
 | `agdf-task-plan-review` | after implementation and before QA, verify TP coverage | no final QA decision |
 | `agdf-clean-implementation-review` | inspect workarounds, fallbacks, parallel structures, or symptom fixes | not a TP or QA substitute |
+| `agdf-code-review` | mandatory CR step after code changes, focused on defects, regression, and security findings | does not replace TP review, clean review, or QA |
 | `agdf-qa-gate` | final QA decision | only instance for `pass | revise | block` |
 | `agdf-release-or` | auditable closeout for every relevant run | not a QA substitute |
 | `agdf-delivery-closeout` | commit/PR-near handoff after QA/OR/UAT | never performs VCS actions automatically |
@@ -52,7 +53,7 @@ Select exactly one primary skill first. Add more only when they cover a distinct
 
 ## Skill Contract
 For repeated output, gate, Quality Contract, and Context Graph rules, use:
-`plugin/meta/agdf-runtime-contract.md`
+the repository-local `agdf-runtime-contract.md` artifact.
 
 Skills may include short runtime reminders, but must not carry a second complete rule or code table.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agdf",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Bootstrap AGDF for GitHub Copilot, Claude Code, or both.",
   "type": "module",
   "files": [