create-issflow 1.1.0 → 1.2.0

package/README.md

@@ -25,7 +25,7 @@ Flags:
 The portable kit (every tool) in `<project>/.claude/`:
 
 - `agents/` — planner · researcher · implementer · test-author · debugger · e2e-runner · synthesizer
-- `commands/` — `/overview` `/propose` `/phase` `/change-request` `/replan` `/quick` `/synthesize` `/store-wisdom` `/log-issue` `/log-decision` `/unstuck`
+- `commands/` — `/overview` `/propose` `/phase` `/ui-audit` `/qa-audit` `/security-audit` `/change-request` `/replan` `/quick` `/synthesize` `/store-wisdom` `/log-issue` `/log-decision` `/unstuck`
 - `skills/` — caveman · grill-me · karpathy-guidelines · ux-design
 - `hooks/` — session-start · pre-compact · subagent-stop
 - `istartsoft-flow/METHODOLOGY.md` — the full methodology (single source of truth)

package/bin/cli.js

@@ -198,8 +198,9 @@ function agentsMd() {
     '## Roles — `.claude/agents/`', '',
     'planner · researcher · implementer · test-author · debugger · e2e-runner · synthesizer', '',
     '## Procedures — `.claude/commands/` (run as `/name`)', '',
-    '/overview · /propose · /phase · /change-request · /replan · /quick · /synthesize ·',
-    '/store-wisdom · /log-issue · /log-decision · /unstuck', '',
+    '/overview · /propose · /phase · /ui-audit · /qa-audit · /security-audit ·',
+    '/change-request · /replan · /quick · /synthesize · /store-wisdom · /log-issue ·',
+    '/log-decision · /unstuck', '',
     '## Skills — `.claude/skills/` (loaded on demand)', '',
     'caveman · grill-me · karpathy-guidelines · ux-design · security (Secure SDLC) · code-standards', '',
     '## Autonomy', '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-issflow",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Scaffold the iStartSoftFlow AI-coding workflow into a project. Stack-agnostic, tool-agnostic (Claude Code, Codex, Cursor, Gemini, Aider), non-destructive.",
   "bin": {
     "create-issflow": "bin/cli.js"

package/template/.claude/commands/qa-audit.md

@@ -0,0 +1,53 @@
+---
+description: Holistic QA audit — sweep the WHOLE product's functional quality (test-coverage gaps, regression health, flaky tests, critical-flow e2e, error/edge handling), score it, and produce a prioritized findings report. On-demand or before a release. NOT the per-phase gate — the phase gate runs one phase's real suite; this audits the entire test estate + behaviour.
+argument-hint: [optional scope]
+---
+
+Caveman ULTRA mode. You are the ORCHESTRATOR.
+
+Purpose: a whole-product FUNCTIONAL QA audit — the QA counterpart of `/ui-audit`.
+The per-phase gate (rule 5) proves ONE phase's real suite is green; this audit checks
+the health + coverage of the ENTIRE test estate and the product's behaviour, end to
+end. Run before a release, after big changes, or on request.
+
+QA = "does it WORK right?" — a DIFFERENT axis from UI audit ("does it LOOK / meet
+standards right?"). Passing one never implies the other.
+
+## PRE-FLIGHT
+Read `docs/ENDPOINTS.md` (the surface), `docs/PLAN.md` (acceptance specs), and the
+`tests/` + `e2e/` suites. The acceptance criteria + ENDPOINTS are the rubric.
+
+## STEP 1 — INVENTORY
+List the public surface (endpoints, exported functions, CLI, message contracts) and
+the critical user flows (from OVERVIEW). These are what MUST be covered.
+
+## STEP 2 — SWEEP  (dispatch a worker to keep context lean)
+- **Coverage** — every ENDPOINTS entry + acceptance criterion has a real-API
+  regression test? List gaps. Untested branches / error paths?
+- **Critical flows** — does e2e cover the must-work journeys (auth, the core slice,
+  payments / data)?
+- **Regression health** — run the full REAL corpus (`scripts/regression.sh --real`).
+  Any reds?
+- **Flakiness** — tests that pass only on rerun (timing) — flag; don't hide.
+- **Negative / edge** — are abuse cases + edge inputs asserted, not just the happy path?
+- **Contract drift** — do the mock suites still match the real API?
+- **Test integrity** — tests written BLIND from the spec (no overfit)? None edited to pass?
+
+## STEP 3 — SCORE + FINDINGS
+Rate each dimension PASS / WARN / FAIL. Per finding:
+- **severity**: BLOCKER (red real test · uncovered critical flow) · MAJOR (coverage
+  gap · flaky) · MINOR (polish)
+- **location**: suite + case (or the uncovered surface)
+- **issue** + **fix**: the concrete change
+
+## STEP 4 — REPORT
+Write `docs/qa-audit-<YYYY-MM-DD>.md`: coverage map · per-dimension scoreboard ·
+findings sorted by severity · prioritized fix list. Log BLOCKER / MAJOR to
+`docs/ISSUES.md`.
+**VERDICT: SHIP | FIX-FIRST** — never ship with a red real test or an uncovered
+critical flow.
+
+## STEP 5 — REMEDIATE
+AUTO: dispatch `test-author` (BLIND) to fill coverage gaps, `debugger` for reds
+(budget 3), then re-run. Park what's blocked + report. Tests are written by
+`test-author` for impartiality — never weaken a test to make it pass.

package/template/.claude/commands/security-audit.md

@@ -0,0 +1,56 @@
+---
+description: Holistic security audit — sweep the WHOLE product against the security cookbook (OWASP Top 10 / ASVS / WSTG / secrets / SCA / SAST / supply chain), score it, and produce a prioritized findings report. On-demand or before a release. NOT the per-phase gate — rule 11 checks one phase while coding; this audits the whole attack surface.
+argument-hint: [optional scope]
+---
+
+Caveman ULTRA mode. You are the ORCHESTRATOR.
+
+Purpose: a whole-product SECURITY audit — the security counterpart of `/ui-audit`
+and `/qa-audit`. The per-phase gate (rule 11) checks secrets/SCA/SAST + secure coding
+on ONE phase; this audit sweeps the ENTIRE attack surface and the product's security
+posture. Run before a release, after auth/data changes, or on request — and before
+the pre-deploy pentest, not instead of it.
+
+Security = "is it SAFE?" — a different axis from QA ("does it work?") and UI
+("does it look right?"). Passing those never implies this.
+
+## PRE-FLIGHT
+Read the rubric: `.claude/skills/security/SKILL.md` (the Secure SDLC cookbook) and
+its `references/` (OWASP Top 10 / ASVS / WSTG / ISO 27001 / SLSA). The cookbook IS the
+checklist — audit against it; don't invent criteria.
+
+## STEP 1 — INVENTORY (attack surface)
+Map it from `docs/ENDPOINTS.md` + the code: entry points (routes, inputs, file
+uploads, webhooks), trust boundaries, auth/session, data stores + PII, secrets,
+third-party deps, and outbound calls.
+
+## STEP 2 — SWEEP  (dispatch a worker to keep context lean)
+- **OWASP Top 10** — broken access control, crypto failures, injection (SQLi/XSS/
+  cmd), insecure design, misconfiguration, vulnerable components, auth failures,
+  integrity failures, logging/monitoring gaps, SSRF.
+- **AuthN / AuthZ** — every protected route enforces it; no IDOR; least privilege.
+- **Secrets** — none in code/history/config/prompts (run gitleaks/trufflehog if present).
+- **Dependencies (SCA)** — known CVEs (run `npm audit` / `pip-audit` / `osv-scanner`).
+- **SAST** — run semgrep / CodeQL if present; review hotspots otherwise.
+- **Input validation + output encoding** at every boundary; safe file handling.
+- **Crypto** — strong algorithms, no hardcoded keys, secrets at rest/in transit.
+- **Supply chain (SLSA)** — pinned deps, build integrity, no untrusted scripts.
+- **Logging / monitoring** — security events logged; no sensitive data in logs.
+- **Threat-model coverage** — were the design-stage abuse cases actually tested?
+
+## STEP 3 — SCORE + FINDINGS
+Rate each area PASS / WARN / FAIL. Per finding:
+- **severity**: CRITICAL · HIGH · MEDIUM · LOW (map to CVSS where it helps)
+- **location**: endpoint / file / dependency
+- **issue** + the OWASP/ASVS reference it breaks + **fix**
+
+## STEP 4 — REPORT
+Write `docs/security-audit-<YYYY-MM-DD>.md`: attack-surface map · per-area scoreboard ·
+findings sorted by severity · prioritized remediation. Log HIGH/CRITICAL to
+`docs/ISSUES.md`.
+**VERDICT: SHIP | FIX-FIRST** — never ship with an open HIGH or CRITICAL.
+
+## STEP 5 — REMEDIATE
+A security fix is security-sensitive (autonomy hard-stop): in AUTO, fix and re-audit
+but SURFACE the change for human sign-off before it lands. Park what's blocked +
+report. A clean `/security-audit` is a precondition for the pre-deploy pentest gate.

package/template/.claude/commands/ui-audit.md

@@ -0,0 +1,54 @@
+---
+description: Holistic UI audit — sweep the WHOLE product's UI against the ux-design cookbook (+ a11y / responsive / consistency), score it, and produce a prioritized findings report. On-demand or before a release. This is NOT the per-phase gate — the `ux-design` gate checks one screen at phase close (pass/block); this audit sweeps every screen and reports accumulated drift.
+argument-hint: [optional scope — a route, or "all"]
+---
+
+Caveman ULTRA mode. You are the ORCHESTRATOR.
+
+Purpose: a periodic, WHOLE-PRODUCT UI audit — distinct from the inline `ux-design`
+gate. The gate validates ONE screen at phase close; this AUDIT sweeps EVERY screen,
+scores the product, and surfaces drift that accumulated across changes. Run before a
+release, after big UI work, or on request.
+
+## PRE-FLIGHT
+Read the rubric: `.claude/skills/ux-design/SKILL.md` (the cookbook) and
+`references/wireframe-template.md` (the frame). The cookbook IS the checklist —
+do not invent new criteria; audit against it.
+
+## STEP 1 — INVENTORY
+List every screen / route / major component to audit (from the router, the
+wireframe baseline, or `$ARGUMENTS`). Audit shared components once.
+
+## STEP 2 — SWEEP  (dispatch a worker per area to keep context lean)
+Score each screen against the cookbook dimensions:
+- design tokens · 8-pt spacing · type scale (no raw hex/px)
+- iconography — a real SVG set, **NEVER emoji**
+- accessibility (WCAG 2.1 AA): contrast ≥ 4.5:1, visible focus, keyboard reach,
+  semantic HTML, labels / alt / aria, 44×44 targets, `prefers-reduced-motion`
+- state matrix: default · hover · focus · active · disabled · loading · empty · error
+- responsive breakpoints (no overflow / break)
+- content & i18n (no hardcoded strings; growth-safe)
+- consistency / wireframe conformance (no drift BETWEEN screens)
+Run automated tools if the project has them (axe-core / Lighthouse / pa11y) and fold
+their output in; otherwise do the manual cookbook sweep.
+
+## STEP 3 — SCORE + FINDINGS
+Rate each dimension PASS / WARN / FAIL. For every finding record:
+- **severity**: BLOCKER (a11y / contrast / unusable) · MAJOR (drift / missing state)
+  · MINOR (polish)
+- **location**: screen + element
+- **issue** + the cookbook rule it breaks
+- **fix**: the concrete change
+
+## STEP 4 — REPORT
+Write `docs/ui-audit-<YYYY-MM-DD>.md`:
+- coverage (screens audited) · a per-dimension scoreboard · the findings table sorted
+  by severity · a prioritized fix list.
+- Log BLOCKER / MAJOR findings to `docs/ISSUES.md`.
+- **VERDICT: SHIP | FIX-FIRST** — a release must not ship with open BLOCKERs.
+
+## STEP 5 — REMEDIATE
+AUTO: fix MINOR / MAJOR that don't change the visual direction, re-audit them, log.
+A new visual direction or a design-token change → confirm with the user first
+(hard rule 9 — UI conforms to the frame; new direction is a human call).
+Hand back the report + what was fixed vs parked.

package/template/.claude/istartsoft-flow/METHODOLOGY.md

@@ -174,6 +174,15 @@ Named procedures, each with a canonical body in `.claude/commands/<name>.md`.
   coverage gate.
 - **quick [change]** — small, obvious, non-phase change; no agent chain. Stays
   non-TDD. Runs the mock regression corpus after the change.
+- **ui-audit** — whole-product UI audit against the `ux-design` cookbook (a11y /
+  responsive / consistency); scored findings report. Periodic / pre-release. Distinct
+  from the per-phase ux-design gate (one screen) — this sweeps every screen.
+- **qa-audit** — whole-product FUNCTIONAL QA audit (coverage gaps, regression health,
+  flaky tests, critical-flow e2e, edge/error handling); scored report. The QA
+  counterpart of `ui-audit`. Distinct from the per-phase real-suite gate.
+- **security-audit** — whole-product SECURITY audit against the `security` cookbook
+  (OWASP/ASVS/WSTG/secrets/SCA/SAST/supply-chain); scored report. On-demand; a
+  precondition for the pre-deploy pentest. Distinct from the per-phase rule-11 gate.
 - **unstuck** — deep re-research after a circuit breaker (auto-run once in AUTO on
   first stuck; human-triggered in GUIDED).
 - **synthesize** — compress STATE.md, dedup ISSUES.md, prune snapshots. Run
@@ -332,6 +341,26 @@ development run that follows the spec and logs every problem so it never recurs.
 
 -----
 
+## Quality model (orthogonal axes — each audited)
+
+Quality is checked on independent axes. Passing one NEVER implies another. Each has a
+STANDARD, an inline GATE (per phase), and — for the user-facing ones — a holistic
+AUDIT (whole product, pre-release):
+
+| Axis | Question | Standard | Inline gate (per phase) | Whole-product audit |
+|------|----------|----------|-------------------------|---------------------|
+| **Functional / QA** | does it WORK? | blind TDD, RED-first (rules 5–6) | real suite green + regression corpus | full REAL corpus (final phase) · `/qa-audit` |
+| **UI / UX** | is it usable + on-brand? | `ux-design` cookbook | the ux-design check (rule 9) | `/ui-audit` |
+| **Security** | is it safe? | `security` cookbook (OWASP/ASVS/ISO) | secrets/SCA/SAST + secure coding (rule 11) | `/security-audit` · pentest + review before deploy |
+| **Code** | is it consistent? | `code-standards` (naming/architecture) | lint/format + idiom (rule 12) | — |
+
+**QA is the test discipline**, not a single agent: `test-author` (blind tests) +
+`e2e-runner` (functional E2E) + the phase gate + the regression corpus + `debugger`.
+UI audit checks *presentation*; QA checks *behaviour* — a button can pass one and
+fail the other.
+
+-----
+
 ## Shared KB (optional)
 
 If `.claude/kb-config.json` exists, the SESSION-OPEN ritual pulls the KB and loads

package/template/.claude/skills/ux-design/SKILL.md

@@ -31,6 +31,10 @@ confirmed with the user before building — design is where human taste matters.
 - Reviewing a UI diff (the "ตรวจ" pass).
 - CLOSE gate of any frontend phase — the cookbook check MUST pass.
 
+This skill is the STANDARD + the inline GATE (one screen, at phase close). For a
+WHOLE-PRODUCT sweep against this same cookbook — periodic or before a release — run
+`/ui-audit` (same rubric, broader scope, a scored report).
+
 Order: **wireframe first** (does the layout match the baseline frame?) ->
 **cookbook** (do the details obey the system?). Never invent layout the
 wireframe does not have. If the design truly needs a frame the wireframe lacks,