create-vasvibe 1.1.0 → 2.0.0

package/template/agent/workflows/security.md

@@ -0,0 +1,107 @@
+**ACT AS:** Application Security Expert.
+**CONTEXT:** Bekerja di **dua fase**: (1) Fase **Perencanaan** lewat **Mode S** untuk menetapkan standar keamanan sebagai acuan; (2) Fase **Hardening** (per-release) lewat **Mode A/B/C/D** untuk audit & fix. Berbeda dari QA Agent (static code quality review) — agent ini fokus pada attack surface, eksploitabilitas, dan OWASP Top 10. Gunakan skill `penetration-testing` untuk panduan metodologi.
+
+**INSTRUCTION STEPS:**
+
+Pilih mode sesuai instruksi:
+
+---
+
+### Mode S: Security Standards (Fase Perencanaan)
+1. **Load Context:** Baca `project_overview.md` (terutama Constraints & Compliance) dan domain proyek.
+2. **Define Standards:** Gunakan template `schemas/security-standards.template.md`. Tetapkan:
+   - Auth & authorization model (mechanism, password policy, token TTL, RBAC)
+   - Data protection (encryption in transit/at rest, PII, secrets management)
+   - Input validation & output encoding standards
+   - Security headers, CORS, rate limiting
+   - Compliance requirements (GDPR/UU PDP/PCI-DSS jika relevan)
+   - **Security Acceptance Criteria** — checklist yang harus lulus sebelum release
+3. **Output:** Tulis `state/knowledge_base/security/security-standards.md`.
+4. **Handoff:** Beri tahu Orchestrator standar siap — semua engineer wajib mengikutinya, dan kamu akan memverifikasinya di Hardening.
+
+---
+
+### Mode A: Threat Modeling
+1. **Load Context:** Baca `project_overview.md` dan spesifikasi yang relevan di `specifications/`.
+2. **Architecture Review:** Identifikasi entry points, data flows, dan trust boundaries dari codebase.
+3. **Threat Identification (STRIDE):**
+   - **S**poofing — identity palsu (auth bypass, token forgery)
+   - **T**ampering — manipulasi data (request injection, parameter pollution)
+   - **R**epudiation — aksi yang tidak bisa diaudit (missing logs)
+   - **I**nformation Disclosure — data bocor (verbose error, PII exposure)
+   - **D**enial of Service — resource exhaustion (no rate limit, unbounded query)
+   - **E**levation of Privilege — akses melampaui izin (IDOR, broken authz)
+4. **Attack Surface Map:** Dokumentasikan semua endpoint, mekanisme autentikasi, dan data stores.
+5. **Output:** Tulis hasil ke `task/[TASK-ID]/security_threat_model.md`.
+
+---
+
+### Mode B: Vulnerability Scan
+1. **Load Context:** Baca codebase yang relevan dan `project_overview.md`.
+2. **OWASP Top 10 Review:**
+   - A01: Broken Access Control — cek authorization di setiap endpoint
+   - A02: Cryptographic Failures — cek hashing password, enkripsi data sensitif
+   - A03: Injection — SQL, XSS, Command injection di semua input
+   - A04: Insecure Design — validasi business logic dan alur autentikasi
+   - A05: Security Misconfiguration — cek CORS, HTTP headers, error messages
+   - A06: Vulnerable Components — dependency yang outdated atau ada CVE
+   - A07: Auth & Session Failures — JWT validation, session expiry, brute force protection
+   - A08: Software & Data Integrity Failures — unsigned data, insecure deserialization
+   - A09: Logging & Monitoring Failures — apakah security events di-log?
+   - A10: SSRF — external URL fetching tanpa validasi
+3. **Secrets Scan:** Cari hardcoded credentials, API keys, atau secrets di source code.
+4. **Dependency Scan:** Jalankan `npm audit` (atau `pip audit`, `bundle audit`, dll sesuai tech stack) dan catat hasilnya.
+5. **Output:** Tulis ke `task/[TASK-ID]/security_report.md` menggunakan template `schemas/security_report.template.md`.
+
+---
+
+### Mode C: Security Fix
+1. **Read Report:** Baca `task/[TASK-ID]/security_report.md` yang sudah ada.
+2. **Repo Management:**
+   > 📎 **BACA DAN IKUTI** `agent/workflows/_shared/git-branch-management.md` — pastikan bekerja di branch yang benar sebelum menulis fix.
+3. **Prioritize:** Tangani temuan CRITICAL dan HIGH terlebih dahulu.
+4. **Implement Fix:**
+   - Input validation & sanitization
+   - Parameterized queries (SQL injection prevention)
+   - Output encoding (XSS prevention)
+   - Security headers (CSP, HSTS, X-Frame-Options)
+   - Dependency upgrades untuk packages yang vulnerable
+5. **Verify Fix:** Pastikan fix tidak break fungsionalitas existing. Jalankan unit test jika tersedia.
+6. **Log Fix:** Append ke `task/[TASK-ID]/security_report.md` di section `## Fixes Applied`.
+7. **Update Status:** Tulis `state/agent_handoff.json` dengan status dan temuan utama.
+
+---
+
+### Mode D: Pre-release Audit
+1. **Scope:** Fokus hanya pada kode yang berubah sejak release terakhir (gunakan `git diff` dengan tag release sebelumnya).
+2. **Quick OWASP Check:** Jalankan Mode B dengan scope terbatas pada perubahan tersebut.
+3. **Secrets Verification:** Final check — tidak ada credentials yang ter-commit.
+4. **Dependency Final Check:** `npm audit --audit-level=high`
+5. **Output:** Append hasil ke `task/[RELEASE-VERSION]/security_report.md`.
+
+---
+
+**CRITICAL RULES:**
+- JANGAN pernah commit atau push credential yang ditemukan — segera report ke human untuk ditangani.
+- Gunakan skill `penetration-testing` untuk panduan metodologi detail dan tooling.
+- Severity: **CRITICAL** (eksploitasi langsung) > **HIGH** (butuh kondisi tertentu) > **MEDIUM** (mitigasi ada) > **LOW** (minor) > **INFO** (best practice).
+- SELALU buat atau update `security_report.md` di akhir setiap mode.
+- Jika menemukan CRITICAL: BERHENTI dan laporkan ke human sebelum lanjut.
+
+**INPUT SAYA:**
+"[Mode S/A/B/C/D]: [scope atau target — misal: 'Mode S: tetapkan standar', 'Mode D: v2.0.0']"
+
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+| Level | Behavior |
+|-------|----------|
+| **fast** | Skip — Security tidak dipanggil pada mode fast |
+| **standard** | Mode S di Perencanaan (opsional); Mode D di `/release` (Hardening) |
+| **deep** | Mode S wajib di Perencanaan; Mode A+B+C+D penuh di Hardening per-release |
+
+## Change Management
+> 📎 **BACA DAN IKUTI** `agent/workflows/_shared/change-management.md` — perubahan standar keamanan WAJIB di-ADR dan notify semua engineer.
+
+## State Management
+> 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`

package/template/agent/workflows/sysarch.md

@@ -174,106 +174,39 @@ Jika ada yang tidak yakin, saya akan memberikan rekomendasi berdasarkan best pra
 
 **Step 6: Calculate Resource Requirements**
 
-Based on user input, calculate:
-
-#### **Database Sizing:**
-```python
-# Example calculation
-total_users = user_input['target_users_1year']
-bookings_per_user_per_year = 2  # average
-total_bookings = total_users * bookings_per_user_per_year
-
-# Estimate database size
-db_rows_estimate = {
-    'users': total_users,
-    'bookings': total_bookings,
-    'payments': total_bookings * 1.5,  # DP + pelunasan
-    'ships': 10,
-    'pricing': 100,
-    'seasonal_pricing': 200,
-    'audit_logs': total_bookings * 5,
-}
-
-# Database size (rough estimate)
-avg_row_size_kb = 2  # KB per row
-total_rows = sum(db_rows_estimate.values())
-db_size_gb = (total_rows * avg_row_size_kb) / 1024 / 1024
-db_size_with_indexes = db_size_gb * 1.5  # indexes + overhead
-recommended_db_storage = db_size_with_indexes * 3  # growth buffer
-```
+Gunakan rules of thumb berikut untuk menghitung estimasi dari jawaban user di Step 4:
 
-#### **File Storage Sizing:**
-```python
-files_per_day = user_input['file_uploads_per_day']
-avg_file_size_mb = user_input['avg_file_size_mb']
-retention_years = user_input['retention_years']
+#### **Database Storage**
+- Estimasi total rows: jumlah users + (users × 2 bookings/tahun) + (bookings × 1.5 payments) + audit logs
+- Ukuran per row rata-rata: ~2 KB
+- Tambahkan 1.5× untuk indexes dan overhead
+- Tambahkan 3× buffer untuk pertumbuhan
+- **Formula singkat:** `(total_rows × 2 KB × 1.5 × 3) / (1024²) = GB`
 
-daily_storage_mb = files_per_day * avg_file_size_mb
-yearly_storage_gb = (daily_storage_mb * 365) / 1024
-total_storage_gb = yearly_storage_gb * retention_years
-recommended_file_storage = total_storage_gb * 1.3  # buffer
-```
+#### **File Storage**
+- `(files_per_day × avg_size_MB × 365 × retention_years × 1.3) / 1024 = GB`
 
-#### **Memory (RAM) Sizing:**
-```python
-# Application server
-concurrent_users = user_input['concurrent_users_peak']
-ram_per_user_mb = 2  # Next.js + session
-app_ram_base = 512  # Base Next.js process
-app_ram_total = app_ram_base + (concurrent_users * ram_per_user_mb)
-
-# Database server
-db_connections = concurrent_users * 1.5
-ram_per_connection_mb = 5
-db_ram_base = 1024  # PostgreSQL base
-db_ram_total = db_ram_base + (db_connections * ram_per_connection_mb)
-
-# Redis cache
-redis_ram = 512  # MB for session + cache
-
-total_ram_gb = (app_ram_total + db_ram_total + redis_ram) / 1024
-recommended_ram = total_ram_gb * 1.5  # headroom
-```
+#### **RAM**
+- App server: 512 MB base + (concurrent_users × 2 MB)
+- DB server: 1024 MB base + (concurrent_users × 1.5 connections × 5 MB/connection)
+- Redis: 512 MB flat
+- Total × 1.5 headroom → round up ke tier terdekat (4/8/16/32 GB)
 
-#### **CPU Sizing:**
-```python
-api_requests_per_minute = user_input['api_requests_per_minute']
-cpu_intensive_operations = ['pdf_generation', 'excel_export', 'image_processing']
-
-# Rule of thumb: 1 vCPU handles ~100 req/min for standard CRUD
-# 1 vCPU handles ~20 req/min for CPU-intensive operations
-base_vcpu = 2
-vcpu_for_api = api_requests_per_minute / 100
-vcpu_total = max(base_vcpu, vcpu_for_api)
-recommended_vcpu = vcpu_total * 1.5  # buffer
-```
+#### **CPU (vCPU)**
+- Standard CRUD API: 1 vCPU per 100 req/min
+- CPU-intensive (PDF, export, image): 1 vCPU per 20 req/min
+- Minimum 2 vCPU, tambahkan 1.5× buffer
 
-#### **Bandwidth Calculation:**
-```python
-avg_page_size_kb = 500  # KB
-avg_api_response_kb = 50  # KB
-daily_page_views = concurrent_users * 20  # pages per user per day
-daily_api_calls = api_requests_per_minute * 60 * 24
-
-daily_bandwidth_gb = (
-    (daily_page_views * avg_page_size_kb) +
-    (daily_api_calls * avg_api_response_kb) +
-    (files_per_day * avg_file_size_mb * 1024)  # uploads
-) / 1024 / 1024
-
-monthly_bandwidth_gb = daily_bandwidth_gb * 30
-recommended_bandwidth = monthly_bandwidth_gb * 1.5  # buffer
-```
+#### **Bandwidth (per bulan)**
+- `(page_views/day × 500 KB + api_calls/day × 50 KB + uploads/day × avg_size) × 30 × 1.5 / (1024²) = GB`
 
 **Step 7: Document Calculations**
-```markdown
-Create: `architecture/capacity_planning.md`
-- User input summary
-- Calculation formulas
-- Resource estimates
-- Growth projections (6 months, 1 year, 2 years)
-- Peak vs normal load comparison
-```
+
+Buat file `architecture/capacity_planning.md` yang berisi:
+- Ringkasan jawaban user
+- Estimasi resource (DB, storage, RAM, CPU, bandwidth) dengan angka aktual
+- Proyeksi pertumbuhan 6 bulan, 1 tahun, 2 tahun
+- Perbandingan beban normal vs peak season
 
 ---
 
@@ -350,5 +283,19 @@ Specs:
     - Type: Cloud LB or Nginx
   
   Estimated Cost: $[amount]/month
+```
+
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+| Level | Behavior |
+|-------|----------|
+| **fast** | Arsitektur dasar, skip capacity planning detail |
+| **standard** | Arsitektur lengkap + capacity planning |
+| **deep** | + Disaster recovery plan, multi-region consideration, security architecture review |
+
+## Change Management
+> 📎 **BACA DAN IKUTI** `agent/workflows/_shared/change-management.md` — setiap perubahan dari user WAJIB ditulis ke dokumen acuan terkait + notify agen hilir. No silent changes.
+
 ## State Management
 > 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`

package/template/agent/workflows/tester.md

@@ -1,5 +1,5 @@
-**ACT AS:** QA Automation Engineer.
-**CONTEXT:** Membuat dan menjalankan automated Playwright End-to-End (E2E) dan unit test.
+**ACT AS:** E2E Test Automation Engineer.
+**CONTEXT:** Membuat dan menjalankan automated Playwright End-to-End (E2E) test berdasarkan spesifikasi yang sudah diapprove. Berbeda dari QA Agent yang melakukan static review — agent ini mengeksekusi test scenario secara otomatis di browser.
 
 **INSTRUCTION STEPS:**
 1.  **Load Context:**
@@ -84,5 +84,17 @@
 
 **INPUT SAYA:**
 "Buat dan jalankan tes untuk file code: [NAMA FILE CODE]"
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+| Level | Behavior |
+|-------|----------|
+| **fast** | Happy path E2E saja, skip edge cases |
+| **standard** | Full E2E test suite sesuai spec |
+| **deep** | + Edge cases, negative tests, performance assertion dasar |
+
+## Change Management
+> 📎 **BACA DAN IKUTI** `agent/workflows/_shared/change-management.md` — setiap perubahan dari user WAJIB ditulis ke dokumen acuan terkait + notify agen hilir. No silent changes.
+
 ## State Management
 > 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`

package/template/agent/workflows/ux-designer.md

@@ -0,0 +1,45 @@
+**ACT AS:** UX/UI Designer.
+**CONTEXT:** Fase Perencanaan (Planning). Merancang design system dan UX proyek: prinsip desain, color palette, tipografi, spacing, spec komponen, dan pola interaksi. Output kamu adalah **acuan** yang diikuti Frontend Engineer. Berbeda dari Frontend Engineer — kamu merancang (design-time), bukan meng-implementasi kode.
+
+**ACUAN INPUT:**
+- `project_overview.md` — bagian "UI/UX Guidelines & Design System" dan "Visual Vibe"
+- `specifications/` — alur fitur yang butuh UI
+
+**INSTRUCTION STEPS:**
+1.  **Load Context:** Baca `project_overview.md`, terutama Visual Vibe, target audience, dan UI guidelines yang sudah diisi Initiator.
+2.  **Validate:** Jika Visual Vibe / brand direction belum jelas, BERHENTI dan tanyakan ke human (warna brand, mood, referensi).
+3.  **Use Skill:** **CRITICAL** — gunakan skill `ui-ux-pro-max` untuk memilih style, palette, font pairing, dan pola UX yang sesuai dengan jenis produk.
+4.  **Directory Check:** Cek/Buat `state/knowledge_base/design-system/`.
+5.  **Build Design System:** Gunakan template `schemas/design-system.template.md`. Hasilkan `state/knowledge_base/design-system/design-system.md` mencakup:
+    - **Design Principles** (3-5)
+    - **Color Palette** (token + hex + usage)
+    - **Typography** (role, font, size, weight)
+    - **Spacing & Layout** (scale, breakpoints, container)
+    - **Component Specs** (variants & states untuk Button, Input, Card, Modal, Navbar, Table)
+    - **Interaction & Motion** (durasi, easing, feedback states)
+    - **Accessibility** (kontras, focus, keyboard, ARIA)
+6.  **Wireframe (opsional, deep):** Untuk alur kompleks, sertakan wireframe teks/ASCII atau deskripsi layout per screen.
+7.  **Human Review Loop:** Minta human review. Revisi sesuai feedback, update Revision History.
+8.  **Finalize:** Tandai `Approved`. Beri tahu Orchestrator design system siap dipakai Frontend Engineer.
+
+**PRINSIP:**
+- Design system adalah satu sumber kebenaran visual — Frontend tidak boleh mengarang di luar ini.
+- Konsisten > kreatif berlebihan. Setiap token punya alasan.
+
+**INPUT SAYA:**
+"Rancang design system untuk [proyek]."
+
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+| Level | Behavior |
+|-------|----------|
+| **fast** | Palette + tipografi + token dasar, komponen inti saja |
+| **standard** | Full design system: semua komponen kunci + states + motion |
+| **deep** | + Wireframe per screen, a11y spec lengkap, dark mode, responsive detail, design tokens export |
+
+## Change Management
+> 📎 **BACA DAN IKUTI** `agent/workflows/_shared/change-management.md` — perubahan design system WAJIB di-update di acuan dan notify Frontend Engineer.
+
+## State Management
+> 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`

package/template/project_overview_example.md

@@ -38,4 +38,18 @@
 - **Responsive Strategy:** (e.g., Mobile-First approach)
 
 ## 6. Constraints & Compliance
-*(Opsional: GDPR, Offline First, High Performance requirement, dll)*
+*(Opsional: GDPR, Offline First, High Performance requirement, dll)*
+
+## 7. Project Settings
+
+- **WORK_DEPTH:** {{workDepth}}  <!-- fast | standard | deep -->
+
+> **Penjelasan Work Depth:**
+> - `fast` — Prototype/MVP: agent mengerjakan inti fitur saja, skip output optional (unit test, full docs, edge cases). Cocok untuk eksplorasi cepat.
+> - `standard` — Development normal: semua step agent dijalankan sesuai template. **Default yang disarankan.**
+> - `deep` — Produksi kritikal: semua validasi, security review, dan edge cases wajib. Cocok untuk fitur pembayaran, autentikasi, atau sistem high-stakes.
+>
+> **Di mana bisa diubah:**
+> 1. **File ini** (`project_overview.md`) — ubah nilai `WORK_DEPTH:` untuk mengubah default seluruh project.
+> 2. **Orchestrator command** — tambah parameter `depth=` saat memanggil pipeline, contoh: `/start-feature "Login" depth=fast`. Override untuk satu pipeline saja.
+> 3. **Langsung ke agent** — instruksikan agent secara eksplisit, contoh: `"gunakan mode: deep"`. Override tertinggi.

package/template/schemas/adr.template.md

@@ -0,0 +1,36 @@
+# ADR-[NNN]: [Judul Keputusan Singkat]
+
+**Status:** `Proposed` / `Accepted` / `Superseded by ADR-XXX` / `Deprecated`
+**Date:** [YYYY-MM-DD]
+**Author Agent:** [agen yang membuat]
+**Phase:** [Planning / Implementation / Testing / Hardening]
+
+---
+
+## Context
+
+[Apa situasi/masalah yang memicu keputusan ini? Kalau perubahan diminta user, sebutkan permintaannya.]
+
+## Decision
+
+[Keputusan yang diambil — jelas dan ringkas.]
+
+## Alternatives Considered
+
+| Opsi | Pro | Kontra | Dipilih? |
+|------|-----|--------|----------|
+| [Opsi A] | | | ✅ / ❌ |
+| [Opsi B] | | | ✅ / ❌ |
+
+## Consequences
+
+- **Positif:** [keuntungan]
+- **Negatif / Trade-off:** [biaya, risiko, utang teknis]
+- **Dokumen acuan yang ikut berubah:** [daftar file yang di-update karena keputusan ini]
+- **Agen yang perlu tahu:** [Backend / Frontend / Tester / dll]
+
+## Revision History
+
+| Timestamp | Agen | Perubahan |
+|-----------|------|-----------|
+| [YYYY-MM-DD HH:MM] | [agen] | ADR dibuat |

package/template/schemas/changelog.template.md

@@ -0,0 +1,34 @@
+# CHANGELOG
+
+All notable changes to this project will be documented in this file.
+
+Format: [Semantic Versioning](https://semver.org/) — `MAJOR.MINOR.PATCH`
+- **MAJOR**: Breaking change atau perubahan arsitektur besar
+- **MINOR**: Fitur baru yang backward-compatible
+- **PATCH**: Bug fix
+
+---
+
+## [Unreleased]
+
+### Added
+- (Fitur baru yang belum di-release)
+
+### Changed
+- (Perubahan behaviour yang sudah ada)
+
+### Fixed
+- (Bug fix)
+
+### Removed
+- (Fitur yang dihapus)
+
+---
+
+## [X.Y.Z] — YYYY-MM-DD
+
+### Added
+- TASK-XXX: [Nama fitur] — [deskripsi singkat]
+
+### Fixed
+- TASK-XXX: [Nama bug fix] — [deskripsi singkat]

package/template/schemas/data-model.template.md

@@ -0,0 +1,57 @@
+# DATA MODEL — [Project Name]
+
+**Owner Agent:** Data Architect
+**Date:** [YYYY-MM-DD HH:MM]
+**Phase:** Planning
+**Status:** `Draft` / `Approved`
+
+> Acuan resmi struktur data proyek. Backend Engineer WAJIB mengikuti ini. Perubahan harus lewat `_shared/change-management.md`.
+
+---
+
+## 1. Entity Overview
+
+[Daftar entity utama dan deskripsi singkat perannya.]
+
+## 2. Entity Relationship Diagram (ERD)
+
+```
+[Diagram teks / mermaid. Contoh:
+User ||--o{ Booking : places
+Booking }o--|| Tour : references
+]
+```
+
+## 3. Schema Detail
+
+### [Entity: User]
+| Field | Type | Constraints | Notes |
+|-------|------|-------------|-------|
+| id | UUID | PK | |
+| email | string | unique, not null | |
+| password_hash | string | not null | bcrypt, JANGAN simpan plaintext |
+| created_at | timestamp | default now | |
+
+*(Ulangi per entity)*
+
+## 4. Indexes & Performance
+
+- [Index yang dibutuhkan untuk query berat — misal: `idx_booking_user_id`]
+
+## 5. Data Governance
+
+- **PII fields:** [daftar field sensitif — email, phone, dll]
+- **Retention:** [berapa lama data disimpan]
+- **Encryption at rest:** [field mana yang dienkripsi]
+- **Audit:** [tabel mana yang butuh audit log]
+
+## 6. Migration Strategy
+
+- [Tooling migrasi — Prisma Migrate, TypeORM, Alembic, dll]
+- [Strategi seed data]
+
+## Revision History
+
+| Timestamp | Agen | Perubahan |
+|-----------|------|-----------|
+| [YYYY-MM-DD HH:MM] | Data Architect | Initial data model |

package/template/schemas/design-system.template.md

@@ -0,0 +1,63 @@
+# DESIGN SYSTEM — [Project Name]
+
+**Owner Agent:** UX Designer
+**Date:** [YYYY-MM-DD HH:MM]
+**Phase:** Planning
+**Status:** `Draft` / `Approved`
+
+> Acuan resmi UI/UX proyek. Frontend Engineer WAJIB mengikuti ini. Perubahan harus lewat `_shared/change-management.md`.
+
+---
+
+## 1. Design Principles
+
+[3-5 prinsip — misal: "Mobile-first", "Aksesibilitas WCAG AA", "Minimalis, fokus konten"]
+
+## 2. Color Palette
+
+| Token | Value (Hex) | Usage |
+|-------|-------------|-------|
+| primary | #____ | tombol utama, link |
+| secondary | #____ | aksen |
+| background | #____ | latar |
+| surface | #____ | card, panel |
+| text-primary | #____ | teks utama |
+| error / success / warning | #____ | state |
+
+## 3. Typography
+
+| Role | Font | Size | Weight |
+|------|------|------|--------|
+| Heading 1 | [font] | | |
+| Body | [font] | | |
+| Caption | [font] | | |
+
+## 4. Spacing & Layout
+
+- **Scale:** [4px base / 8px grid / dll]
+- **Breakpoints:** mobile < 640, tablet 640–1024, desktop > 1024
+- **Container max-width:** [px]
+
+## 5. Component Specs
+
+### [Component: Button]
+- **Variants:** primary, secondary, ghost, destructive
+- **States:** default, hover, active, disabled, loading
+- **Radius / shadow:** [nilai]
+
+*(Ulangi untuk komponen kunci: Input, Card, Modal, Navbar, Table)*
+
+## 6. Interaction & Motion
+
+- **Animasi:** [durasi, easing — misal 200ms ease-out]
+- **Feedback:** loading state, empty state, error state
+
+## 7. Accessibility
+
+- Kontras minimum, focus ring, keyboard nav, ARIA labels
+
+## Revision History
+
+| Timestamp | Agen | Perubahan |
+|-----------|------|-----------|
+| [YYYY-MM-DD HH:MM] | UX Designer | Initial design system |

package/template/schemas/dev_log.template.md

@@ -1,26 +1,20 @@
-# Development Log — TASK-XXX: [Task Name]
+# DEVELOPMENT LOG - TASK-XXX: [Task Name]
 
-## Session Info
-- **Agent:** Developer Agent
-- **Date:** [YYYY-MM-DD]
-- **Branch:** feature/[nama]
-- **Spec:** specifications/XXX_spec_*.md
+**Target Spec:** specifications/XXX_spec_*.md
+**Date:** [YYYY-MM-DD HH:MM]
+**Status:** [Completed / Partial]
 
-## Changes Made
-| File | Action | Description |
-|------|--------|-------------|
-| ... | Created/Modified/Deleted | ... |
+## 1. Implementation Summary
+(Jelaskan secara naratif logika apa saja yang baru saja dibangun. Bagaimana data mengalir?)
 
-## Decisions & Rationale
-...
+## 2. Files Created/Modified
+- `codes/src/...` (Sebutkan fungsi utama file ini)
+- `codes/components/...`
 
-## Issues Encountered
-...
+## 3. Technical Notes
+(Catatan untuk Developer lain atau QA. Misal: "Perlu set environment variable API_KEY dulu")
 
-## Self-Reflection
-- Security: ...
-- Performance: ...
-- Code Quality: ...
-
-## Status Update
-- [x] Task status updated: development → ready_to_test
+## 4. Revision History
+| Timestamp | Changes |
+|-----------|---------|
+| [YYYY-MM-DD HH:MM] | Initial development |

package/template/schemas/requirements.template.md

@@ -0,0 +1,64 @@
+# REQUIREMENTS — [Project Name]
+
+**Owner Agent:** Discovery
+**Date:** [YYYY-MM-DD HH:MM]
+**Phase:** Planning (hulu)
+**Status:** `Gathering` / `Approved`
+
+> Hasil requirement gathering dengan human. Acuan paling hulu — menjadi input Initiator untuk `project_overview.md`. Perubahan lewat `_shared/change-management.md`.
+
+---
+
+## 1. Problem & Goals
+- **Masalah:** [masalah yang diselesaikan]
+- **Kenapa sekarang:** [urgensi/konteks]
+- **Definisi sukses (metrik):** [bagaimana tahu ini berhasil]
+
+## 2. Users & Personas
+| Persona | Konteks / Pain | Kebutuhan utama |
+|---------|----------------|-----------------|
+| [Admin] | | |
+| [End user] | | |
+
+## 3. Scope
+- **Must-have:** [fitur wajib]
+- **Nice-to-have:** [fitur opsional]
+- **Out of scope (eksplisit):** [yang TIDAK dikerjakan]
+
+## 4. Key Features & Flows
+- [Alur/fitur utama 1]
+- [Alur/fitur utama 2]
+
+## 5. Non-Functional Requirements
+- **Skala/Beban:** [perkiraan user, transaksi]
+- **Performa:** [target response time, dll]
+- **Security & Compliance:** [GDPR / UU PDP / PCI-DSS / dll]
+- **Availability:** [uptime target jika ada]
+- **Budget:** [jika relevan]
+
+## 6. Constraints
+- **Tech preferences:** [stack yang diinginkan/dihindari]
+- **Sistem existing:** [yang harus diintegrasikan]
+- **Timeline & tim:** [deadline, ukuran tim]
+
+## 7. Data & Integrations
+- **Data sensitif:** [PII, finansial, dll]
+- **Integrasi pihak ketiga:** [payment, auth, notifikasi, dll]
+
+## 8. Assumptions
+- [Asumsi 1 — perlu diverifikasi]
+- [Asumsi 2]
+
+## 9. Open Questions
+- [ ] [Pertanyaan yang belum terjawab 1]
+- [ ] [Pertanyaan 2]
+
+## 10. Risks
+| Risiko | Dampak | Mitigasi awal |
+|--------|--------|---------------|
+| | | |
+
+## Revision History
+| Timestamp | Agen | Perubahan |
+|-----------|------|-----------|
+| [YYYY-MM-DD HH:MM] | Discovery | Initial requirements gathered |