devmethod-ai 0.2.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.agents/skills/decision-architecture/SKILL.md +10 -0
- package/.agents/skills/decision-architecture/assets/ADR.md +6 -3
- package/.agents/skills/project-foundation/SKILL.md +2 -0
- package/.agents/skills/project-foundation/assets/CADRAGE.md +11 -0
- package/.agents/skills/project-foundation/assets/EXISTANT.md +14 -0
- package/.agents/skills/project-foundation/assets/OPPORTUNITES.md +10 -0
- package/.agents/skills/project-foundation/assets/PROJECT_PROFILE.md +3 -2
- package/.agents/skills/project-foundation/assets/REGLES.md +6 -0
- package/.agents/skills/project-foundation/assets/START_HERE.md +2 -0
- package/.agents/skills/project-foundation/references/delivery-planning.md +11 -0
- package/.agents/skills/project-foundation/references/exploration.md +11 -0
- package/.agents/skills/project-foundation/references/mission-context.md +31 -4
- package/.agents/skills/project-foundation/references/operating-commands.md +12 -4
- package/.agents/skills/project-foundation/references/work-sizing.md +1 -1
- package/.agents/skills/scoped-delivery/SKILL.md +5 -1
- package/.agents/skills/scoped-delivery/assets/MISSION.md +1 -1
- package/.agents/skills/scoped-delivery/assets/PLAN.md +20 -0
- package/.agents/skills/scoped-delivery/assets/REPRISE.md +10 -0
- package/.agents/skills/scoped-delivery/assets/REVIEW.md +34 -0
- package/.agents/skills/scoped-delivery/assets/SLICE.md +5 -0
- package/.agents/skills/scoped-delivery/assets/TICKET.md +21 -0
- package/.agents/skills/scoped-delivery/references/review-workflow.md +29 -0
- package/COMPATIBILITY.md +1 -1
- package/README.md +20 -10
- package/START_HERE.md +2 -0
- package/dist/cli.js +122 -90
- package/dist/review-app.js +462 -0
- package/dist/review-browser.js +567 -0
- package/dist/review-cli.js +68 -0
- package/dist/review-model.js +101 -0
- package/dist/review-open.js +19 -0
- package/dist/review-ui.css +782 -0
- package/dist/review.js +13 -0
- package/docs/ADR-007-conversation-and-mission-ownership.md +13 -0
- package/docs/ADR-008-review-presentation.md +13 -0
- package/docs/MISSIONS.md +1 -1
- package/docs/RELEASE-0.2.0.md +14 -3
- package/docs/RELEASE-0.3.0.md +24 -0
- package/docs/REVIEW-SOURCES.md +13 -0
- package/docs/REVIEW-VALIDATION.md +34 -0
- package/docs/REVIEWS.md +75 -0
- package/docs/VISUAL-WORKFLOW.md +1 -1
- package/docs/WORKFLOW-0.3-VALIDATION.md +32 -0
- package/docs/WORKFLOW-0.3.md +34 -0
- package/docs/images/review-interface-desktop.jpg +0 -0
- package/docs/images/review-interface-mobile.jpg +0 -0
- package/docs/missions/workflow-0.3-reviews/interface/REVIEW.md +109 -0
- package/docs/missions/workflow-0.3-reviews/interface/review.json +255 -0
- package/docs/missions/workflow-0.3.md +17 -0
- package/examples/mission-dialogue/PROJECT_PROFILE.md +9 -0
- package/examples/mission-dialogue/architecture/decisions/001-storage.md +7 -0
- package/examples/mission-dialogue/docs/missions/first-save/PLAN.md +13 -0
- package/examples/mission-dialogue/docs/missions/first-save/REPRISE.md +6 -0
- package/examples/mission-dialogue/docs/missions/first-save/tickets/SAVE-1.md +14 -0
- package/examples/mission-dialogue/docs/missions/legacy-copy.md +9 -0
- package/examples/mission-dialogue/docs/produit/REGLES.md +5 -0
- package/examples/review/review.json +199 -0
- package/package.json +2 -2
- package/scripts/build-review.mjs +8 -0
- package/scripts/package-smoke.mjs +16 -3
package/dist/review.js
ADDED
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
import fs from 'node:fs';
|
|
2
|
+
import { createHash } from 'node:crypto';
|
|
3
|
+
import { sanitizedReview, redactReviewText } from './review-model.js';
|
|
4
|
+
export function renderReviewHTML(input) {
|
|
5
|
+
const review = input.review == null ? null : sanitizedReview(input.review);
|
|
6
|
+
const legacy = input.legacy == null ? null : redactReviewText(input.legacy);
|
|
7
|
+
const script = fs.readFileSync(new URL('./review-browser.js', import.meta.url), 'utf8');
|
|
8
|
+
const css = fs.readFileSync(new URL('./review-ui.css', import.meta.url), 'utf8');
|
|
9
|
+
const scriptHash = createHash('sha256').update(script).digest('base64');
|
|
10
|
+
const payload = JSON.stringify({ review, legacy, currentRevision: input.currentRevision ?? null, changedTargets: input.changedTargets ?? [] }).replace(/</g, '\\u003c').replace(/>/g, '\\u003e').replace(/&/g, '\\u0026');
|
|
11
|
+
return `<!doctype html>
|
|
12
|
+
<html lang="fr"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="referrer" content="no-referrer"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'sha256-${scriptHash}'; style-src 'unsafe-inline'; img-src data:; connect-src 'none'; font-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'"><title>DevMethod · Review</title><style>${css}</style></head><body><div id="app"><p class="loading">Chargement de la review…</p></div><noscript>Activez JavaScript pour les filtres et la consultation. Le rapport Markdown reste disponible via le CLI.</noscript><script id="review-data" type="application/json">${payload}</script><script>${script}</script></body></html>\n`;
|
|
13
|
+
}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
# ADR 007: Conversation before commitment and single-owner mission records
|
|
2
|
+
|
|
3
|
+
Status: accepted for this implementation, 2026-09-13, under the user's explicit specification and authorization to implement and release this scope.
|
|
4
|
+
|
|
5
|
+
The request explicitly selects research before product commitment, conversational structural decisions, delivery-scope discussion and a proposed multi-file mission layout. It preserves approved design, existing trackers, lightweight fixes and legacy missions. These requirements settle this kit change; they do not delegate future adopters' product decisions.
|
|
6
|
+
|
|
7
|
+
Keep guidance and Markdown templates in the six existing skills. An executable decision state machine or automatic tracker migration would add schemas, commands and compatibility risk without meeting a requested runtime need. A single larger mission template alone would retain ownership ambiguity for substantial work. Use PLAN for mission goals/order, tickets for task state and evidence, REPRISE for a dated handoff; link other domain owners. Preserve the legacy template and optional JSON schemas.
|
|
8
|
+
|
|
9
|
+
The installer already walks Markdown assets and references, profiles host paths and hashes the complete selected payload. New resources require distribution regression tests, not installer logic changes. The initial scope extended CLI help to distinguish model stages from offline JSON inspectors. The subsequently authorized review interface adds its own result/presentation contract; this does not change the mission/context schemas. No changes to the design module or its approved directions.
|
|
10
|
+
|
|
11
|
+
The inspected downstream correction established the need for conversation before architecture detail and explicit choice/delegation, not merely a PROPOSED ADR. Integrate that generic intent with the requested constraints and planning rules, without downstream project facts.
|
|
12
|
+
|
|
13
|
+
Revisit if real adoption reveals unresolved ownership, missing resources in host subsets, migration friction or repeated conversational failures. Automated content/distribution checks cannot certify model behavior; record scenario walkthroughs separately from fresh native-host transcripts.
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
# ADR 008: Versioned review results and local presentation
|
|
2
|
+
|
|
3
|
+
Status: accepted through explicit user delegation, 2026-09-13.
|
|
4
|
+
|
|
5
|
+
The user explicitly requested a versioned validated review record, common derived counters/report/interface, safe local browser consultation from the npm package, legacy Markdown support and the supplied visual direction. The existing kit accepts strict TypeScript, Node.js >=22, no runtime dependencies, offline operation and no automatic migrations.
|
|
6
|
+
|
|
7
|
+
The implemented shared components are independent of the final opening mode: a pure format-1 model/validator used by Node and the browser, derived Markdown, and an HTML rendering with bundled CSS/program/data. The CLI can generate that required report artifact. It does not execute checks or read arbitrary evidence paths. Explicit reviewed raster data and HTTPS navigation avoid exposing the project filesystem. Text is rendered as text; CSP pins the shipped program. Legacy Markdown stays historical text.
|
|
8
|
+
|
|
9
|
+
The decision brief was presented in conversation: a self-contained HTML report is portable and offline, requires no service lifecycle and matches existing dependency constraints. A loopback server is an alternative for future live refresh and controlled local-resource access, but adds process, route and filesystem security responsibilities. Recommendation: self-contained HTML for this release, with snapshot freshness and deliberately included evidence; revisit if real usage requires live refresh or local evidence linking. No account, external hosting or dashboard scope is introduced.
|
|
10
|
+
|
|
11
|
+
The user explicitly delegated this choice in conversation (“je te delegue le choix”), on 2026-09-13. Under that delegation, select the self-contained offline HTML report. `review --output report.html --open` requests opening through the operating system's browser handler, with fixed executable/argument boundaries and no shell. Opening failure preserves the generated report and explains manual recovery. No server is needed. Revisit this decision if live refresh or controlled local evidence access becomes an actual requirement.
|
|
12
|
+
|
|
13
|
+
Browser verification found and corrected a real focus-loss defect. Direct file:// reopening is blocked by the browser tool's URL policy; that limitation remains recorded, without a workaround or a claim of successful offline-browser reopening. The opening adapter is checked without launching a browser; the remaining offline reopening limitation must stay explicit in release evidence. Publication follows the authorized repository gates.
|
package/docs/MISSIONS.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
A mission is one authorized user outcome with observable acceptance, scope/exclusions, invariants, selected sources, uncertainties, dependencies, ownership, verification, stop conditions and an exact next action. Quick work can keep this inline. Standard work benefits from a reusable record. Major work splits dependent missions after resolving structural decisions. JSON is optional; it does not replace your tracker or project policy.
|
|
4
4
|
|
|
5
|
-
For storage, status ownership and criterion-to-review links, follow [mission context](../.agents/skills/project-foundation/references/mission-context.md). Prefer existing conventions;
|
|
5
|
+
For storage, status ownership and criterion-to-review links, follow [mission context](../.agents/skills/project-foundation/references/mission-context.md). Prefer existing conventions; substantial work without conventions uses a proposed `docs/missions/<mission-id>/PLAN.md`, `tickets/<ticket-id>.md` and dated `REPRISE.md`, with `preuves/` only when useful. Existing single-file `docs/missions/<mission-id>.md` records remain supported. See [migration and ownership](WORKFLOW-0.3.md). This is guidance for the agent, not a new CLI tracker, auto-discovery path or schema validation feature.
|
|
6
6
|
|
|
7
7
|
Move Quick to Standard when a second component, uncertain dependency or changed contract needs an explicit record. Move to Major for structural decisions or migrations. Failed verification returns to implementation or design at the affected boundary; preserve the failure. Evaluation/status reads do not imply implementation, review does not imply integration, and integration does not imply publication.
|
|
8
8
|
|
package/docs/RELEASE-0.2.0.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# DevMethod 0.2.0 — visual design through verified delivery
|
|
2
2
|
|
|
3
|
-
Status:
|
|
3
|
+
Status: published on npm as `devmethod-ai@0.2.0` under `latest`. The registry archive matches the reviewed candidate and passed package smoke after publication.
|
|
4
4
|
|
|
5
5
|
## Changes
|
|
6
6
|
|
|
@@ -14,13 +14,13 @@ Image generation requires an available host tool; it is not bundled. The film co
|
|
|
14
14
|
|
|
15
15
|
## Adopt without overwriting project work
|
|
16
16
|
|
|
17
|
-
|
|
17
|
+
To pin a reviewed GitHub revision:
|
|
18
18
|
|
|
19
19
|
```sh
|
|
20
20
|
npx --yes --package=github:montassarkhalloufi/DevMethod#<reviewed-commit> devmethod init --tool codex --dest ../devmethod-staging
|
|
21
21
|
```
|
|
22
22
|
|
|
23
|
-
|
|
23
|
+
Install the published version:
|
|
24
24
|
|
|
25
25
|
```sh
|
|
26
26
|
npx --yes devmethod-ai@0.2.0 init --tool codex --dest ../devmethod-staging
|
|
@@ -35,3 +35,14 @@ Local candidate checks passed: locked installation, 72 core tests, 24 greenfield
|
|
|
35
35
|
Native workflow evidence is retained in the [Lisière execution record](media/visual-chain/execution.fr.md) and [visual pilot](../examples/visual-pilot/README.md). The release reuses that evidence for the unchanged skills; it does not claim fresh model runs.
|
|
36
36
|
|
|
37
37
|
Publish only the reviewed archive with an explicit `latest` tag for an authorized final release. After publication, download the registry tarball, compare its integrity and run package smoke again. Keep 0.1.0 available as a rollback reference.
|
|
38
|
+
|
|
39
|
+
## Exact published artifact — 2026-09-13
|
|
40
|
+
|
|
41
|
+
- Release preparation and review: [PR #17](https://github.com/montassarkhalloufi/DevMethod/pull/17), merged as `f374c5a02f2e339c47e126a8f8e5c2f28d785f9d`.
|
|
42
|
+
- [Platform CI](https://github.com/montassarkhalloufi/DevMethod/actions/runs/34767104314): Linux, macOS and Windows passed.
|
|
43
|
+
- [Fullstack CI](https://github.com/montassarkhalloufi/DevMethod/actions/runs/34767104287): passed.
|
|
44
|
+
- Archive: `devmethod-ai-0.2.0.tgz`, 230 files. SHA-256: `f8fa3ffe9c6d9cb0072dd3540a016dd8d36a582bde386a816eb5bd9bda0eca07`.
|
|
45
|
+
- npm SHA-1: `5e40705ce120987e3e3c271d1d00bca1a5be39a3`.
|
|
46
|
+
- npm integrity: `sha512-vV6DGt8v6xu6p42s7IaGKPPwcOMTBuUnH97E8W+FR809YFQtUw+n1hTZdoF3+5bq8tAvyslYMNGzAuBQ8bXVTg==`.
|
|
47
|
+
|
|
48
|
+
After browser authentication, npm confirmed publication. The fresh registry download matched the reviewed archive byte for byte and passed installation smoke for all host layouts, subset installation, preservation of customizations and context/planning checks. The `latest` tag is 0.2.0; 0.1.0 remains available. This post-publication record is not inside the immutable published archive.
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
# DevMethod 0.3.0 — research and decisions before commitment
|
|
2
|
+
|
|
3
|
+
Release scope: 0.3.0. Offline HTML was selected under explicit user delegation in [ADR 008](ADR-008-review-presentation.md). GitHub and npm provide publication status.
|
|
4
|
+
|
|
5
|
+
Open the packaged demo: `npx devmethod-ai@0.3.0 review --demo --output review-demo.html --open`.
|
|
6
|
+
|
|
7
|
+
This minor release extends the workflow and its distributed resources while retaining the public CLI contracts, six skills, fourteen stages, JSON schemas and existing mission compatibility. The exact publication and CI evidence is recorded in the release PR and GitHub release; package metadata alone is not proof of publication.
|
|
8
|
+
|
|
9
|
+
- explore researches existing solutions proportionately, traces dated sources, distinguishes claims and hypotheses, and discusses what to do next.
|
|
10
|
+
- architecture presents credible options and recommendations in conversation before dependent detail; explicit choice or scoped delegation is recorded. Open decisions keep plans conditional.
|
|
11
|
+
- plan discusses useful delivery scope, learning, trade-offs and uncertain effort before tickets; milestones carry demonstrations, exit criteria and authorized continuation.
|
|
12
|
+
- New optional research/product and PLAN/TICKET/REPRISE templates provide one owner per fact, progressive reading and ticket-owned verification. Existing single-file missions and trackers remain supported.
|
|
13
|
+
- Review adds official-source/version-aware inspection guidance, validated format-1 results, derived Markdown and a functional local browser viewer. Findings and checks remain distinct; the viewer covers search/filters, evidence, coverage, source provenance, exports, responsive keyboard navigation and historical/invalid states.
|
|
14
|
+
- The design module and approved visual workflow remain unchanged. Installer resource discovery and integrity manifest formats stay compatible; the new review CLI presents results without executing repository checks. See [review usage and limits](REVIEWS.md).
|
|
15
|
+
|
|
16
|
+
## Adoption and migration
|
|
17
|
+
|
|
18
|
+
Use `npx --yes devmethod-ai@0.3.0 init --tool codex --dest ../devmethod-staging` after registry publication; choose claude or cursor as needed. Compare staged files and update-preview results before adoption. Do not overwrite divergent skills, profiles or existing instructions. See [explicit migration steps](WORKFLOW-0.3.md#non-destructive-migration). No migration or empty project document creation runs automatically.
|
|
19
|
+
|
|
20
|
+
## Verification and limits
|
|
21
|
+
|
|
22
|
+
Required local checks: locked install, complete test suite/build, greenfield tests, local Markdown links, committed build drift, actual package inspection and smoke from its archive. Platform CI validates installation on Linux, macOS and Windows and runs the fullstack fixture. These do not certify coding-agent behavior.
|
|
23
|
+
|
|
24
|
+
The [scenario record](WORKFLOW-0.3-VALIDATION.md) is an authored workflow walkthrough plus manual inspection, not fresh native-host transcripts. No native-host parity or comparative improvement claim is made. Keep 0.2.0 available as a rollback reference. Publication uses the reviewed archive and explicit latest tag; no CI publishing workflow exists.
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
# Sources inspected for the review interface
|
|
2
|
+
|
|
3
|
+
Consulted 2026-09-13. Installed compiler: TypeScript 5.9.3; @types/node 22.20.2 (package-lock.json). Package baseline Node.js >=22, CI Node.js 22; local runtime Node.js 24.18.0. Keep NodeNext/ES2022 and existing strictness; no version migration is required.
|
|
4
|
+
|
|
5
|
+
| Source | Publisher / provenance | Applicable version and use | Limits |
|
|
6
|
+
|---|---|---|---|
|
|
7
|
+
| [Node filesystem documentation](https://nodejs.org/download/release/v22.17.0/docs/api/fs.html) | Node.js official site | Node 22 baseline, bounded regular-file reads and exclusive output creation | Path validation remains application responsibility; not a concurrency sandbox |
|
|
8
|
+
| [TypeScript 5.9 notes](https://www.typescriptlang.org/docs/handbook/release-notes/typescript-5-9.html) | TypeScript official site | Installed 5.9.3; preserve project NodeNext configuration and DOM typing | Newer compiler documentation is not a migration requirement |
|
|
9
|
+
| [DOM textContent](https://developer.mozilla.org/en-US/docs/Web/API/Node/textContent) | MDN Web Docs, web-platform documentation | Text rendering of untrusted report content | Setting safe text does not validate navigation destinations |
|
|
10
|
+
| [Tabs pattern](https://www.w3.org/WAI/ARIA/apg/patterns/tabs/) | W3C WAI | Keyboard focus, selection and panel association | Authoring guidance, not proof of an accessibility audit |
|
|
11
|
+
| [TypeScript maintainer skills](https://github.com/microsoft/TypeScript-Maintainer-Skills) | Microsoft-owned repository; inspected README and intended scope | Compiler-issue maintenance, not a general application review skill | Discovered, not installed or executed; not adopted for this app |
|
|
12
|
+
|
|
13
|
+
Searches included Node.js organization skill sources and Microsoft TypeScript maintainer skill sources. No suitable general Node.js/application review skill was verified in this search. That is a bounded search result, not proof no such skill exists. Use relevant official documentation directly. No third-party skill was automatically installed. A reference in an example fixture is labelled unverified unless that example actually records consultation.
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
# Review interface verification
|
|
2
|
+
|
|
3
|
+
This record distinguishes automated checks, browser interactions and authored workflow scenarios. Exact candidate revision, package digest and platform CI are recorded in PR #19 and the release after the complete expanded candidate is verified.
|
|
4
|
+
|
|
5
|
+
## Automated checks
|
|
6
|
+
|
|
7
|
+
The format tests cover required/versioned fields, unknown fields, duplicate/dangling IDs, consultation dates, resolution evidence, counts independent from filters, policy-derived conclusions, selective changed-target signalling, link protocols, text redaction, unsafe image types and derived Markdown. Renderer tests cover inert JSON embedding, script CSP and absent remote program/style loads. CLI tests cover generated reports, output preflight/conflict preservation, bounded explicit paths, symlink refusal, legacy reading, invalid JSON without source disclosure, empty and packaged demo modes.
|
|
8
|
+
|
|
9
|
+
These tests check code, not whether a reviewing model follows the workflow or whether author-supplied evidence is true.
|
|
10
|
+
|
|
11
|
+
## Browser inspection — 2026-09-13
|
|
12
|
+
|
|
13
|
+
Real Codex in-app browser at 1586×992 and 390×844: inspected the implemented rendering against the user-approved artistic reference, composed filters, selected findings, evidence/correction tabs, coverage, mobile list/detail return and absence of horizontal overflow. A real focus-loss defect was observed when selecting a finding updated the hash and rebuilt the page twice. The fix uses a single render and restores focus; verified focus on detail-title and keyboard ArrowRight to the Correction tab. Mobile back restores the selected result and retains query/confidence filters.
|
|
14
|
+
|
|
15
|
+
Imported an adversarial JSON fixture through the real file picker: HTML-like title displayed literally, no script dialog or console warning/error. Unit tests independently verify redaction and escaped report embedding. Inspected a changed-revision page with targeted C-01/R-01 reassessment and an empty-viewer page. Also verified invalid-format, legacy inert Markdown, partial and blocked states, missing-finding mobile recovery, and an embedded real JPEG screenshot. Chrome produced an actual HTML download: inspected the last downloaded file, validated its format-1 data, saved query/selected finding/detail section and CSP program hash. The browser download-event listener timed out despite the actual file being created. Direct file:// reopening was rejected by the browser tool policy and was not bypassed; no successful offline-browser reopen is claimed. Post-package checks belong to the final candidate evidence.
|
|
16
|
+
|
|
17
|
+
## Authored workflow scenarios
|
|
18
|
+
|
|
19
|
+
| Scenario | Expected response under the revised workflow |
|
|
20
|
+
|---|---|
|
|
21
|
+
| Official docs describe a newer incompatible version | Keep installed version and accepted conventions; find matching docs, record compatibility limits; no automatic migration |
|
|
22
|
+
| “Official” skill lacks reliable publisher provenance | Mark unverified, do not install/execute; use verified documentation independently |
|
|
23
|
+
| No suitable official skill found | Record the bounded search limitation and consult official docs directly |
|
|
24
|
+
| Suspected issue cannot be reproduced | Keep suspected confidence and verification next step; no demonstrated vulnerability claim |
|
|
25
|
+
| Automated tests pass but visual defect is observed | Record the actual screenshot/interaction finding and its impact; automated success does not override it |
|
|
26
|
+
| A check cannot run | Record blocked or not-run with reason; preserve unrelated executed results |
|
|
27
|
+
| A correction is applied | Retain original evidence and require fresh relevant verification before resolved |
|
|
28
|
+
| No findings with limited coverage | State verified scope and uncovered surfaces; no completeness inference |
|
|
29
|
+
|
|
30
|
+
These are authored scenario walkthroughs, not transcripts of new authenticated model executions.
|
|
31
|
+
|
|
32
|
+
The [actual structured review](missions/workflow-0.3-reviews/interface/review.json) records the observed focus defect, original and post-fix evidence, and the blocked offline-browser check. Its [Markdown report](missions/workflow-0.3-reviews/interface/REVIEW.md) is generated from that source. This is separate from the fictional interface demo.
|
|
33
|
+
|
|
34
|
+
Actual rendering (fictional demo data): [desktop capture](images/review-interface-desktop.jpg), [mobile capture](images/review-interface-mobile.jpg). The user reference image is a design source, not an execution result.
|
package/docs/REVIEWS.md
ADDED
|
@@ -0,0 +1,75 @@
|
|
|
1
|
+
# Review results, reports and browser consultation
|
|
2
|
+
|
|
3
|
+
The agent's `project-foundation review` stage performs project-aware inspection under [the review workflow](../.agents/skills/scoped-delivery/references/review-workflow.md). The CLI `devmethod review` only validates and presents recorded results. It never runs repository commands, discovers evidence on disk, or performs the review itself.
|
|
4
|
+
|
|
5
|
+
## Use the installed package
|
|
6
|
+
|
|
7
|
+
After 0.3.0 publication, from a temporary or project directory:
|
|
8
|
+
|
|
9
|
+
```sh
|
|
10
|
+
npx --yes devmethod-ai@0.3.0 review --demo --output review.html
|
|
11
|
+
```
|
|
12
|
+
|
|
13
|
+
Open the generated `review.html` in a browser. It includes the browser program, styles and explicitly included data, independent of the DevMethod checkout. The demo is fictional, with different findings from the artistic reference. It is not evidence of a real product review.
|
|
14
|
+
|
|
15
|
+
For a real review, paths are relative to `--dest` (current directory by default):
|
|
16
|
+
|
|
17
|
+
```sh
|
|
18
|
+
npx --yes devmethod-ai@0.3.0 review --review docs/missions/my-mission/reviews/review-1/review.json --output review.html --markdown REVIEW.md
|
|
19
|
+
npx --yes devmethod-ai@0.3.0 review --review review.json --json
|
|
20
|
+
npx --yes devmethod-ai@0.3.0 review --review review.json --current-revision inspected-new-revision --changed-targets save-status --output recheck.html
|
|
21
|
+
npx --yes devmethod-ai@0.3.0 review --legacy old-review.md --output historical.html
|
|
22
|
+
npx --yes devmethod-ai@0.3.0 review --output empty-viewer.html
|
|
23
|
+
```
|
|
24
|
+
|
|
25
|
+
Existing outputs are never overwritten. Choose a fresh path for a newer snapshot. `--json` validates/reports without writing unless output flags are also explicitly given. Exit 0 means valid presentation/inspection, **not** a passed review; inspect `status`/`summary`. Exit 2 means invalid invocation, result schema or filesystem input/output. Missing revisions remain unknown. `--changed-targets` compares exact logical target names; it does not infer all semantic dependencies. Independent historical checks are preserved.
|
|
26
|
+
|
|
27
|
+
## One versioned source
|
|
28
|
+
|
|
29
|
+
Use existing conventions, or `docs/missions/<mission-id>/reviews/<review-id>/review.json`, with generated `REVIEW.md` and deliberately included `preuves/`. Tickets link stable finding IDs; the report and UI derive results from the JSON. Do not maintain another independent score or status table.
|
|
30
|
+
|
|
31
|
+
Format 1 is validated by the same pure model in the CLI and browser. See the [complete fictional example](../examples/review/review.json) and [compiled validator](../dist/review-model.js). Unknown formats, unknown/missing fields, duplicate IDs, invalid destinations and dangling references are rejected with errors that omit source contents. Arrays are bounded to 256 items, text fields to 16,384 characters, and input to 4 MiB. Image data has a separate limit of approximately 1 MiB per PNG/JPEG.
|
|
32
|
+
|
|
33
|
+
| Object | Required fields and ownership |
|
|
34
|
+
|---|---|
|
|
35
|
+
| Review | format, id, title, project, mission, tickets, date, scope, exclusions, revision, technologies, sources, checks, findings, evidence, limits, policy, summary |
|
|
36
|
+
| revision | commit (recorded revision label), dirty (explicit uncommitted changes); no automatic Git execution |
|
|
37
|
+
| technologies | name, version, detectedFrom (actual manifest/lockfile/source evidence) |
|
|
38
|
+
| ticket | id, title, url (HTTPS or null; local/unpublished destinations remain unavailable) |
|
|
39
|
+
| source | id, title, kind (documentation/skill/project), publisher, technology, version, url, consultedAt, access (consulted/unavailable/unverified), usage, compatibility, provenance; consulted requires a date |
|
|
40
|
+
| check | id, title, domain, kind (automated/manual), status (passed/failed/not-run/blocked/out-of-scope), result, reason, evidenceIds, revision, targets; unexecuted/excluded checks need a reason |
|
|
41
|
+
| finding | id, title, domain, severity (critical/major/moderate/minor), severityReason, confidence (confirmed/suspected), resolution (open/in-progress/resolved/accepted-risk), location, trigger, expected, observed, impact, reproduction, evidenceIds, correction, tradeoffs, sourceIds, ticketIds, verification, resolutionEvidenceIds, targets |
|
|
42
|
+
| location | path or component description, line (positive integer or null), component (text or null); display metadata, never arbitrary file access |
|
|
43
|
+
| evidence | id, title, kind (text/log/screenshot/diagram), content (text alternative or excerpt), url (HTTPS or null), image (null or explicit PNG/JPEG object) |
|
|
44
|
+
| image | mime=image/png or image/jpeg, base64, alt, origin=captured/explanatory, privacyReviewed=true; only deliberately included reviewed images, not filesystem paths or remote images |
|
|
45
|
+
| policy | blockingSeverities, requireAllChecks, rationale; project-owned explicit policy, no numeric risk score |
|
|
46
|
+
|
|
47
|
+
A confirmed finding still needs evidence or reproduction. A resolved finding requires resolution evidence IDs; schema validation checks the references, **not the truth of execution or whether the fix really works**. Authors must retain the original evidence and supply fresh verification. Closing a panel never changes resolution. Finding counts include all resolution states and stay independent from filtered results; uncertain unresolved findings have a separate count. Failed-check counts are separate from finding counts.
|
|
48
|
+
|
|
49
|
+
A blocking confirmed open finding or a failed check requires corrections. Otherwise a blocked check yields blocked; no passed checks, an unresolved suspected finding, or required unrun checks yields incomplete. Otherwise the conclusion is ready **on the verified scope**, with exclusions and limits still visible. This conclusion does not authorize integration/deployment or replace repository policy.
|
|
50
|
+
|
|
51
|
+
## Browser journey
|
|
52
|
+
|
|
53
|
+
Use Constats to search and combine domain/severity/confidence/resolution filters. Select a finding with keyboard or pointer; its header shows severity, confidence, resolution, impact and location. Preuve shows reproduction, expected/observed behavior, text logs, PNG/JPEG images or explanatory flow text. Correction shows proposed action/trade-offs/verification and a ticket link only when supplied. Références shows provenance, actual consultation and compatibility.
|
|
54
|
+
|
|
55
|
+
Couverture groups controls by domain, with kind, result, revision, reason and evidence. Sources distinguishes consulted, inaccessible and unverified references. Uninspected surfaces never receive a green indicator. A link ending `#finding=R-01` opens that finding in the same local review; the file must be available to its recipient.
|
|
56
|
+
|
|
57
|
+
Mobile list/detail navigation retains filters and selection. Tabs support arrows/Home/End, buttons and links use native keyboard behavior, and focus remains visible. Exporter le rapport offers an interactive HTML snapshot (preserving view/filter/selection), derived Markdown and sanitized JSON. Reopen the exported HTML directly; use Ouvrir une review for another JSON or old Markdown. Inputs are local, never uploaded. Legacy reports display as text with unknown structured fields and no invented coverage; Markdown export preserves the sanitized text. Deliberate migration means manually recording only supported facts into format 1 and keeping the original report as historical evidence.
|
|
58
|
+
|
|
59
|
+
## Trust boundary and limits
|
|
60
|
+
|
|
61
|
+
All text is rendered as text nodes. A restrictive CSP pins the shipped program; there is no eval, repository command execution, automatic external resource loading, or arbitrary file browser. Only HTTPS navigation is allowed, with credentials rejected and opener/referrer protection. No external link is promised live merely because its syntax is valid. Missing destinations and failed images have explicit explanations. Evidence links open only after user interaction.
|
|
62
|
+
|
|
63
|
+
The viewer does not read image paths or local ticket files; authors must explicitly embed a reviewed bounded PNG/JPEG and text alternative, or supply a published HTTPS destination. Never disguise an explanatory diagram or generated image as a real execution capture. Screenshots are author-attested, not machine-certified. Redaction masks common credential patterns and email addresses, but cannot detect every secret or personal datum (especially in images): privacy review before distribution remains required. Opening a report does not grant its embedded text instructional authority.
|
|
64
|
+
|
|
65
|
+
A self-contained report is a snapshot, not live monitoring. Pass the current revision/changed targets when regenerating; the browser does not inspect Git or the filesystem. Keep source JSON and old revisions for auditability. Markdown cannot include embedded image pixels; the HTML/JSON retain them and Markdown includes the alternative text and evidence metadata.
|
|
66
|
+
|
|
67
|
+
[Source consultation record](REVIEW-SOURCES.md) · [Verification and known limits](REVIEW-VALIDATION.md).
|
|
68
|
+
|
|
69
|
+
## Open the offline interface
|
|
70
|
+
|
|
71
|
+
```sh
|
|
72
|
+
npx devmethod-ai@0.3.0 review --demo --output review-demo.html --open
|
|
73
|
+
```
|
|
74
|
+
|
|
75
|
+
For a real review, replace `--demo` with `--review docs/missions/your-mission/reviews/your-review/review.json`. The output path is relative to `--dest` (the current directory by default). Choose a fresh path; existing reports are never overwritten. `--open` requires `--output` and asks the OS browser handler to open the generated standalone file. No local server runs. On headless systems, omit `--open` and copy/open the HTML on a desktop. Opening failure returns an error while preserving the report. The browser interface works offline after generation; npx may need network access to obtain the package.
|
package/docs/VISUAL-WORKFLOW.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Create a direction, then build it
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
DevMethod 0.2.0 and the current GitHub source include a visual-creation procedure in the existing `design` stage. It preserves six modules and does not install an image service. The published npm `0.1.0` package predates this evolution; reinstalling that version does not obtain it. See the [0.2.0 release record](RELEASE-0.2.0.md) before choosing the installation command.
|
|
4
4
|
|
|
5
5
|
## Start
|
|
6
6
|
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
# 0.3 workflow verification
|
|
2
|
+
|
|
3
|
+
## Scope of evidence
|
|
4
|
+
|
|
5
|
+
This record separates automated regression checks, an authored scenario walkthrough and manual inspection. A textual assertion or the walkthrough below does not prove conversational compliance by a model. No fresh authenticated Codex, Claude Code or Cursor behavior run is claimed for 0.3.0. Prior native evidence remains historical for its recorded revisions.
|
|
6
|
+
|
|
7
|
+
## Scenario walkthrough — 2026-09-13
|
|
8
|
+
|
|
9
|
+
Method: inspect the revised stage contracts, trace the input through its responsible stage and check the expected next action against templates and the fictional linked fixture. These are authored simulations, not captured user/model executions.
|
|
10
|
+
|
|
11
|
+
| Input / scenario | Expected route and inspected outcome |
|
|
12
|
+
|---|---|
|
|
13
|
+
| New product with unclear alternatives | explore opens research guidance; compares direct, adjacent and informal alternatives, dates claims and presents a synthesis before framing |
|
|
14
|
+
| Isolated technical correction | work-sizing Quick keeps inline readiness and focused checks; no market research or mission scaffold |
|
|
15
|
+
| Research tools unavailable | disclose access limit, distinguish supplied evidence from hypotheses, propose research; no invented results |
|
|
16
|
+
| Sources contradict | retain both dated claims and their scope; state uncertainty and resolution experiment; missing feature stays unverified |
|
|
17
|
+
| User refuses architecture recommendation | return to objection and viable options; no dependent architecture built around the rejected option |
|
|
18
|
+
| User proposes alternative | evaluate it on the same cost, operating, durability and user criteria; revise recommendation if warranted |
|
|
19
|
+
| User explicitly delegates storage choice | record delegation scope/source and chosen rationale; detail dependent architecture without reconfirmation |
|
|
20
|
+
| Ambiguous “ok” after several options | clarify only if needed to select dependent work; no inferred adoption |
|
|
21
|
+
| plan invoked with open storage | fictional PLAN remains conditional and SAVE-1 points directly to architecture; no correct-course detour |
|
|
22
|
+
| Accepted decision changes | link replacement and impacted contracts/tickets; reassess readiness and invalidate dependent evidence/review only |
|
|
23
|
+
| Resume multi-file mission | profile → PLAN → SAVE-1 → linked rule and decision; REPRISE is a dated pointer, ticket owns blocker/evidence |
|
|
24
|
+
| Resume legacy single file | legacy-copy retains scope, task, criterion and handoff inline; no move required |
|
|
25
|
+
| First useful delivery / scope edit | delivery-planning requests useful outcome/learning, real scope choices and effort uncertainty; milestones carry demos, exits and authorized continuation |
|
|
26
|
+
| Existing approved design | design-to-code files unchanged; foundation only links product and decision owners |
|
|
27
|
+
|
|
28
|
+
## Automated and manual checks
|
|
29
|
+
|
|
30
|
+
Automated tests exercise the installer across three host profiles, actual resource/manifest/link completeness, subset installation, all-or-nothing divergence preservation, and unchanged legacy/multi-file mission bytes. Package smoke checks the archive, help and resources, three host layouts and optional upgrade from an actual prior tarball. The existing JSON and resumption suites still apply without schema changes.
|
|
31
|
+
|
|
32
|
+
Manual inspection covers the downstream skill diff, generic intent without project content, owner uniqueness, migration instructions, design-module diff and final change review. Exact test counts, revisions, platform CI results and package integrity belong in the release PR/release evidence, not in an independently maintained ticket-status table.
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
# Research, decisions and mission ownership
|
|
2
|
+
|
|
3
|
+
DevMethod 0.3.0 keeps six skills, fourteen workflow stages and the existing JSON inspector schemas. The `design-to-code` module is unchanged. This update changes model guidance, not a deterministic conversational engine.
|
|
4
|
+
|
|
5
|
+
## Before committing to a solution
|
|
6
|
+
|
|
7
|
+
`explore` researches direct, adjacent and informal alternatives when product uncertainty warrants it. Use dated traceable sources, distinguish facts, interpretations and hypotheses, and separate testimonials from demonstrated trends. Not finding a feature is not proof of absence or opportunity. Discuss a synthesis and whether to continue, reposition, reduce, deepen or abandon. Unavailable research must be disclosed; a technical fix does not inherit a competitive-study requirement. See [exploration guidance](../.agents/skills/project-foundation/references/exploration.md).
|
|
8
|
+
|
|
9
|
+
`frame` owns the resulting need, scope, success criteria and business rules. Preserve approved design and its existing workflow.
|
|
10
|
+
|
|
11
|
+
`architecture` collects constraints and compares credible options in the conversation before detailing dependent architecture. The user may challenge, supply alternatives, choose or explicitly delegate. Record the choice/delegation and rationale in the decision owner. Silence, an ambiguous “ok”, invoking `plan` or a PROPOSED label does not replace this exchange. Preserve accepted decisions, scoped delegations and autonomy for routine reversible details.
|
|
12
|
+
|
|
13
|
+
`plan` discusses the first useful outcome and learning, actual scope alternatives, benefits, exclusions, risks, dependencies and uncertain effort. Record priorities, milestone demonstrations, exit and continuation conditions under current authorization. Detail near-term vertical slices. With open architecture, make the plan conditional and resume the discussion directly in architecture. Changed decisions require reassessing dependent tickets and evidence. See [delivery planning](../.agents/skills/project-foundation/references/delivery-planning.md).
|
|
14
|
+
|
|
15
|
+
## Proposed storage, only without an existing convention
|
|
16
|
+
|
|
17
|
+
For substantial work, [mission context](../.agents/skills/project-foundation/references/mission-context.md) defines the full proposed tree: compact PROJECT_PROFILE; docs/exploration/{EXISTANT,OPPORTUNITES}; docs/produit/{CADRAGE,REGLES}; docs/missions/<mission-id>/{PLAN,REPRISE,tickets/,preuves/}; design/; architecture/decisions/.
|
|
18
|
+
|
|
19
|
+
Each fact has one current owner. The profile links context; research owns sources and hypotheses; product owns need and rules; PLAN owns mission outcome, milestones/order and ticket links; tickets own scope, dependencies, status, acceptance and revision-labelled verification. REPRISE is the latest dated handoff, not a second status register. Bulky artifacts go in preuves when needed. Any status table is generated from tickets and labelled with its revision/time, never maintained independently. Do not create empty documents by ritual.
|
|
20
|
+
|
|
21
|
+
Read progressively: profile, active mission, active ticket, necessary references. Compare actual code and changed dependencies with evidence before resuming. A plan, ready ticket, verified implementation, integration and deployment are distinct states.
|
|
22
|
+
|
|
23
|
+
## Non-destructive migration
|
|
24
|
+
|
|
25
|
+
Existing `docs/missions/<mission-id>.md` records, inline Quick work and existing trackers remain valid. No automatic move, rewrite or JSON schema migration occurs.
|
|
26
|
+
|
|
27
|
+
1. Install the new kit into a fresh staging directory and compare using `update-preview` and a content diff. Keep customized skills, filled profiles and existing instructions; divergent files still block init before writes.
|
|
28
|
+
2. Keep the legacy mission as the active entry until extraction is useful. Inspect candidate target paths for existing content. Reconcile divergence intentionally; never overwrite it.
|
|
29
|
+
3. Extract outcome/milestones into PLAN, executable task fields and evidence into tickets, and the dated handoff into REPRISE only as needed. Keep stable criterion IDs, exact source links and historical revisions. Replace extracted live fields in the old location with links so ownership stays unique.
|
|
30
|
+
4. Verify links, criteria and the active ticket from the new entry. Update the profile's entry link after the comparison. Git retains history; avoid a duplicate live status table.
|
|
31
|
+
|
|
32
|
+
Installed resources live under each selected skill's assets/references. They are templates, not files automatically scaffolded into docs. Foundation includes the research/product resources even when delivery is not selected; resolve scoped-delivery by name when its templates are needed. The three host profiles transform skill paths and generate integrity manifests from the full selected payload. No manifest format change is needed.
|
|
33
|
+
|
|
34
|
+
The CLI `mission`, `context`, `context-check`, `resume` and `plan` still take explicit JSON paths. They do not parse Markdown mission directories, accept decisions or execute tickets. See the [fictional linked mission](../examples/mission-dialogue/PROJECT_PROFILE.md) and [verification scenarios](WORKFLOW-0.3-VALIDATION.md).
|
|
Binary file
|
|
Binary file
|
|
@@ -0,0 +1,109 @@
|
|
|
1
|
+
# Review de l’interface DevMethod
|
|
2
|
+
|
|
3
|
+
DevMethod · workflow-0.3 · 2026-09-13
|
|
4
|
+
Revision: 8d7cd3584c891c04d983f85279e14a2070ab621d + working changes; uncommitted changes: src/review-app.ts, src/review-model.ts, src/review-cli.ts, src/review.ts, src/review-ui.css, src/cli.ts
|
|
5
|
+
|
|
6
|
+
Conclusion: **Vérification bloquée**
|
|
7
|
+
Le défaut de focus observé a été corrigé et revérifié. La validation de livraison reste incomplète, avec ses limites explicites.
|
|
8
|
+
Policy: Corriger les défauts confirmés affectant le parcours et vérifier les contrôles de livraison avant publication.
|
|
9
|
+
|
|
10
|
+
## Scope
|
|
11
|
+
- Format de review, rendu sécurisé, navigation clavier/mobile et exports du candidat en cours.
|
|
12
|
+
|
|
13
|
+
## Exclusions and limits
|
|
14
|
+
- Audit exhaustif WCAG avec lecteur d’écran
|
|
15
|
+
- Exécution native du workflow conversationnel sur les trois hôtes
|
|
16
|
+
- La réouverture directe file:// est bloquée par la politique du navigateur de test ; elle n’est pas annoncée comme vérifiée.
|
|
17
|
+
- Les tests de format ne prouvent ni la vérité des preuves fournies ni le comportement d’un agent de review.
|
|
18
|
+
- Le mode d’ouverture final reste à choisir avant publication.
|
|
19
|
+
|
|
20
|
+
## Counts (whole review)
|
|
21
|
+
- Critique: 0
|
|
22
|
+
- Majeur: 1
|
|
23
|
+
- Modéré: 1
|
|
24
|
+
- Mineur: 0
|
|
25
|
+
- À vérifier: 0
|
|
26
|
+
- Réussi: 3
|
|
27
|
+
- En échec: 0
|
|
28
|
+
- Non exécuté: 0
|
|
29
|
+
- Bloqué: 1
|
|
30
|
+
- Hors périmètre: 0
|
|
31
|
+
|
|
32
|
+
## Coverage
|
|
33
|
+
- **UI-KEYBOARD — Clavier et retour mobile** (Interface, manual): Réussi. Focus après correction et conservation des filtres observés. Revision: 8d7cd3584c891c04d983f85279e14a2070ab621d + working changes. Evidence: E-FOCUS-AFTER
|
|
34
|
+
- **UI-EXPORT — Contenu de l’export HTML** (Interface, manual): Réussi. Résultats, état de sélection et empreinte CSP vérifiés dans le dernier export Chrome. Revision: 8d7cd3584c891c04d983f85279e14a2070ab621d + working changes. Evidence: E-EXPORT
|
|
35
|
+
- **UI-REOPEN — Réouverture file://** (Interface, manual): Bloqué. Non vérifiée dans le navigateur automatisé. Reason: La politique de l’outil interdit cette navigation ; aucun contournement effectué. Revision: 8d7cd3584c891c04d983f85279e14a2070ab621d + working changes. Evidence: none
|
|
36
|
+
- **SEC-REDACTION — Masquage des formats courants** (Confidentialité, automated): Réussi. Régression Bearer, variable préfixée et valeur entre guillemets réussie. Revision: fa84208 + redaction working changes. Evidence: E-REDACTION
|
|
37
|
+
|
|
38
|
+
## Findings
|
|
39
|
+
|
|
40
|
+
### FOCUS-01 — La sélection d’un constat perdait le focus clavier
|
|
41
|
+
Modéré / Confirmé / Résolu et vérifié
|
|
42
|
+
Severity rationale: La navigation clavier quittait le contenu attendu et rendait la poursuite du parcours difficile.
|
|
43
|
+
Location: src/review-app.ts
|
|
44
|
+
Impact: L’utilisateur au clavier perdait son point de navigation.
|
|
45
|
+
Trigger: Activer un constat avec Enter quand le fragment de lien doit changer.
|
|
46
|
+
Expected: Le focus arrive sur le titre du détail et permet de poursuivre au clavier.
|
|
47
|
+
Observed: Avant correction, le rendu immédiat était suivi d’un deuxième rendu lors de hashchange ; le titre focalisé était remplacé.
|
|
48
|
+
Reproduction:
|
|
49
|
+
- Activer R-01 avec Enter depuis la liste.
|
|
50
|
+
- Inspecter le focus après le changement du fragment.
|
|
51
|
+
Evidence: E-FOCUS-BEFORE
|
|
52
|
+
Correction: Mettre à jour le fragment avec history.pushState, rendre une seule fois, puis focaliser le titre. Restaurer aussi le focus après un changement d’onglet.
|
|
53
|
+
Trade-offs: Écouter popstate séparément pour les navigations historiques.
|
|
54
|
+
Resolution verification: Enter conserve le focus sur detail-title ; ArrowRight cible Correction ; le retour mobile restaure la liste filtrée.
|
|
55
|
+
Resolution evidence: E-FOCUS-AFTER
|
|
56
|
+
Sources: WAI-TABS
|
|
57
|
+
Tickets: PR-19
|
|
58
|
+
|
|
59
|
+
### REDACT-01 — Certains formats courants d’identifiants étaient partiellement masqués
|
|
60
|
+
Majeur / Confirmé / Résolu et vérifié
|
|
61
|
+
Severity rationale: Un rapport distribué pouvait conserver une valeur sensible dans un header standard ou un champ entre guillemets. Aucun identifiant réel n’a été exposé dans ce test.
|
|
62
|
+
Location: src/review-model.ts
|
|
63
|
+
Impact: Risque de divulguer une valeur sensible dans une copie de rapport si la revue de confidentialité ne la détecte pas.
|
|
64
|
+
Trigger: Importer une preuve contenant un header Bearer ou une valeur sensible avec espaces.
|
|
65
|
+
Expected: Masquer la valeur complète des formats courants pris en charge.
|
|
66
|
+
Observed: La première règle arrêtait le masquage au premier espace et ne reconnaissait pas certains préfixes de variables.
|
|
67
|
+
Reproduction:
|
|
68
|
+
- Utiliser exclusivement les cas synthétiques du test de régression du masquage.
|
|
69
|
+
Evidence: E-REDACTION
|
|
70
|
+
Correction: Reconnaître les schémas Bearer/Basic, les valeurs entre guillemets et les clés préfixées avant de produire la copie distribuée.
|
|
71
|
+
Trade-offs: Le masquage reste heuristique ; la confidentialité des images et des formats inconnus exige une inspection avant partage.
|
|
72
|
+
Resolution verification: Les valeurs synthétiques de ces trois formats sont absentes de sanitizedReview ; le document original reste inchangé.
|
|
73
|
+
Resolution evidence: E-REDACTION
|
|
74
|
+
Sources: none
|
|
75
|
+
Tickets: PR-19
|
|
76
|
+
|
|
77
|
+
## Evidence
|
|
78
|
+
|
|
79
|
+
### E-FOCUS-BEFORE — Observation réelle avant correction
|
|
80
|
+
log
|
|
81
|
+
Navigateur intégré, 2026-09-13 : activation clavier du constat R-01 puis lecture du focus. Résultat observé : document.activeElement.id vide après le second rendu déclenché par hashchange. Le lien direct devenait \#finding=R-01. Observation manuelle de cette session, pas un journal de test CI.
|
|
82
|
+
No external evidence destination.
|
|
83
|
+
|
|
84
|
+
### E-FOCUS-AFTER — Vérification réelle après correction
|
|
85
|
+
log
|
|
86
|
+
Navigateur intégré, 2026-09-13 : Enter sur le constat =\> focus detail-title. ArrowRight sur Preuve =\> focus detail-content-correction. En mobile 390x844, retour =\> focus sur le constat choisi ; query=silencieux et confidence=confirmed conservés ; aucun débordement horizontal.
|
|
87
|
+
No external evidence destination.
|
|
88
|
+
|
|
89
|
+
### E-EXPORT — Export Chrome inspecté sur disque
|
|
90
|
+
text
|
|
91
|
+
Le dernier export Chrome possède review format 1, uiState.selected=R-01, filters.query=silencieux et section=correction. Les données ont été validées et l’empreinte SHA-256 du programme correspond à la CSP. Réouverture navigateur file:// non exécutée : politique de l’outil.
|
|
92
|
+
No external evidence destination.
|
|
93
|
+
|
|
94
|
+
### E-REDACTION — Régression automatisée du masquage des identifiants
|
|
95
|
+
log
|
|
96
|
+
Cas synthétiques : header Authorization avec Bearer, variable NPM\_TOKEN et mot de passe entre guillemets contenant des espaces. Avant correction, la règle masquait seulement une partie de certaines valeurs. Le test dédié vérifie maintenant que les trois valeurs synthétiques sont totalement absentes de la source distribuée. Exécuté dans npm test : réussite.
|
|
97
|
+
No external evidence destination.
|
|
98
|
+
|
|
99
|
+
## Sources
|
|
100
|
+
- WAI-TABS: Tabs Pattern — W3C WAI; ARIA / DOM APG consulted 2026-09-13; consulted; 2026-09-13; https://www.w3.org/WAI/ARIA/apg/patterns/tabs/. Clavier, focus et association des onglets/panneaux. Compatibility: Guide de conception ; ne certifie pas une conformité WCAG complète. Provenance: Page du site officiel W3C consultée pendant cette session.
|
|
101
|
+
|
|
102
|
+
## Technologies
|
|
103
|
+
- TypeScript 5.9.3 (package-lock.json)
|
|
104
|
+
- Node.js 24.18.0 local / \>=22 package (node --version / package.json)
|
|
105
|
+
|
|
106
|
+
## Tickets
|
|
107
|
+
- PR-19 — Livraison du workflow et de la review: https://github.com/montassarkhalloufi/DevMethod/pull/19
|
|
108
|
+
|
|
109
|
+
Generated from review format 1. Counts describe the whole review. Historical evidence does not certify a later revision.
|