gsd-pi 2.29.0-dev.77f06e2 → 2.29.0-dev.953d788

package/dist/resources/extensions/gsd/tests/workflow-templates.test.ts

@@ -1,173 +0,0 @@
-// GSD Workflow Templates — Unit Tests
-//
-// Tests registry loading, template resolution, auto-detection, and listing.
-
-import { createTestContext } from './test-helpers.ts';
-import {
-  loadRegistry,
-  resolveByName,
-  autoDetect,
-  listTemplates,
-  getTemplateInfo,
-  loadWorkflowTemplate,
-} from '../workflow-templates.ts';
-
-const { assertEq, assertTrue, assertMatch, report } = createTestContext();
-
-// ═══════════════════════════════════════════════════════════════════════════
-// Registry Loading
-// ═══════════════════════════════════════════════════════════════════════════
-
-console.log('\n── Registry Loading ──');
-
-{
-  const registry = loadRegistry();
-  assertTrue(registry !== null, 'Registry should load');
-  assertEq(registry.version, 1, 'Registry version should be 1');
-  assertTrue(Object.keys(registry.templates).length >= 8, 'Should have at least 8 templates');
-
-  // Verify required template keys exist
-  const expectedIds = ['full-project', 'bugfix', 'small-feature', 'refactor', 'spike', 'hotfix', 'security-audit', 'dep-upgrade'];
-  for (const id of expectedIds) {
-    assertTrue(id in registry.templates, `Template "${id}" should exist in registry`);
-  }
-
-  // Verify each template has required fields
-  for (const [id, entry] of Object.entries(registry.templates)) {
-    assertTrue(typeof entry.name === 'string' && entry.name.length > 0, `${id}: name should be non-empty string`);
-    assertTrue(typeof entry.description === 'string' && entry.description.length > 0, `${id}: description should be non-empty`);
-    assertTrue(typeof entry.file === 'string' && entry.file.endsWith('.md'), `${id}: file should be a .md path`);
-    assertTrue(Array.isArray(entry.phases) && entry.phases.length > 0, `${id}: phases should be non-empty array`);
-    assertTrue(Array.isArray(entry.triggers) && entry.triggers.length > 0, `${id}: triggers should be non-empty array`);
-  }
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-// Resolve by Name
-// ═══════════════════════════════════════════════════════════════════════════
-
-console.log('\n── Resolve by Name ──');
-
-{
-  // Exact match
-  const bugfix = resolveByName('bugfix');
-  assertTrue(bugfix !== null, 'Should resolve "bugfix"');
-  assertEq(bugfix!.id, 'bugfix', 'ID should be "bugfix"');
-  assertEq(bugfix!.confidence, 'exact', 'Exact name should have exact confidence');
-
-  // Case-insensitive name match
-  const spike = resolveByName('Research Spike');
-  assertTrue(spike !== null, 'Should resolve "Research Spike" by name');
-  assertEq(spike!.id, 'spike', 'Should resolve to spike');
-
-  // Alias match
-  const bug = resolveByName('bug');
-  assertTrue(bug !== null, 'Should resolve "bug" alias');
-  assertEq(bug!.id, 'bugfix', 'Alias "bug" should map to bugfix');
-
-  const feat = resolveByName('feat');
-  assertTrue(feat !== null, 'Should resolve "feat" alias');
-  assertEq(feat!.id, 'small-feature', 'Alias "feat" should map to small-feature');
-
-  const deps = resolveByName('deps');
-  assertTrue(deps !== null, 'Should resolve "deps" alias');
-  assertEq(deps!.id, 'dep-upgrade', 'Alias "deps" should map to dep-upgrade');
-
-  // No match
-  const missing = resolveByName('nonexistent-template');
-  assertTrue(missing === null, 'Should return null for unknown template');
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-// Auto-Detection
-// ═══════════════════════════════════════════════════════════════════════════
-
-console.log('\n── Auto-Detection ──');
-
-{
-  // Should detect bugfix from "fix" keyword
-  const fixMatches = autoDetect('fix the login button');
-  assertTrue(fixMatches.length > 0, 'Should detect matches for "fix the login button"');
-  assertTrue(fixMatches.some(m => m.id === 'bugfix'), 'Should include bugfix in matches');
-
-  // Should detect spike from "research" keyword
-  const researchMatches = autoDetect('research authentication libraries');
-  assertTrue(researchMatches.length > 0, 'Should detect matches for "research"');
-  assertTrue(researchMatches.some(m => m.id === 'spike'), 'Should include spike in matches');
-
-  // Should detect hotfix from "urgent" keyword
-  const urgentMatches = autoDetect('urgent production is down');
-  assertTrue(urgentMatches.length > 0, 'Should detect matches for "urgent"');
-  assertTrue(urgentMatches.some(m => m.id === 'hotfix'), 'Should include hotfix in matches');
-
-  // Should detect dep-upgrade from "upgrade" keyword
-  const upgradeMatches = autoDetect('upgrade react to v19');
-  assertTrue(upgradeMatches.length > 0, 'Should detect matches for "upgrade"');
-  assertTrue(upgradeMatches.some(m => m.id === 'dep-upgrade'), 'Should include dep-upgrade in matches');
-
-  // Multi-word triggers should score higher
-  const projectMatches = autoDetect('create a new project from scratch');
-  const projectMatch = projectMatches.find(m => m.id === 'full-project');
-  assertTrue(projectMatch !== undefined, 'Should detect full-project for "from scratch"');
-
-  // Empty input should return no matches
-  const emptyMatches = autoDetect('');
-  assertEq(emptyMatches.length, 0, 'Empty input should return no matches');
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-// List Templates
-// ═══════════════════════════════════════════════════════════════════════════
-
-console.log('\n── List Templates ──');
-
-{
-  const output = listTemplates();
-  assertTrue(output.includes('Workflow Templates'), 'Should have header');
-  assertTrue(output.includes('bugfix'), 'Should list bugfix');
-  assertTrue(output.includes('spike'), 'Should list spike');
-  assertTrue(output.includes('hotfix'), 'Should list hotfix');
-  assertTrue(output.includes('/gsd start'), 'Should include usage hint');
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-// Template Info
-// ═══════════════════════════════════════════════════════════════════════════
-
-console.log('\n── Template Info ──');
-
-{
-  const info = getTemplateInfo('bugfix');
-  assertTrue(info !== null, 'Should return info for bugfix');
-  assertTrue(info!.includes('Bug Fix'), 'Should include template name');
-  assertTrue(info!.includes('triage'), 'Should include phase names');
-  assertTrue(info!.includes('Triggers'), 'Should include triggers section');
-
-  const missing = getTemplateInfo('nonexistent');
-  assertTrue(missing === null, 'Should return null for unknown template');
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-// Load Workflow Template Content
-// ═══════════════════════════════════════════════════════════════════════════
-
-console.log('\n── Load Workflow Template ──');
-
-{
-  const content = loadWorkflowTemplate('bugfix');
-  assertTrue(content !== null, 'Should load bugfix template');
-  assertTrue(content!.includes('Bugfix Workflow'), 'Should contain workflow title');
-  assertTrue(content!.includes('Phase 1: Triage'), 'Should contain triage phase');
-  assertTrue(content!.includes('Phase 4: Ship'), 'Should contain ship phase');
-
-  const hotfixContent = loadWorkflowTemplate('hotfix');
-  assertTrue(hotfixContent !== null, 'Should load hotfix template');
-  assertTrue(hotfixContent!.includes('Hotfix Workflow'), 'Should contain hotfix title');
-
-  const missingContent = loadWorkflowTemplate('nonexistent');
-  assertTrue(missingContent === null, 'Should return null for unknown template');
-}
-
-// ═══════════════════════════════════════════════════════════════════════════
-
-report();

package/dist/resources/extensions/gsd/workflow-templates/bugfix.md

@@ -1,87 +0,0 @@
-# Bugfix Workflow
-
-<template_meta>
-name: bugfix
-version: 1
-requires_project: false
-artifact_dir: .gsd/workflows/bugfixes/
-</template_meta>
-
-<purpose>
-Fix a bug from identification through to PR submission. Designed for issues reported
-via GitHub, user reports, or developer discovery. Emphasizes root cause analysis
-before jumping to fixes.
-</purpose>
-
-<phases>
-1. triage    — Identify root cause, reproduce the bug
-2. fix       — Implement the fix with tests
-3. verify    — Run full test suite, check for regressions
-4. ship      — Create PR with detailed explanation
-</phases>
-
-<process>
-
-## Phase 1: Triage
-
-**Goal:** Understand the bug before touching any code.
-
-1. **Gather context:**
-   - If a GitHub issue was referenced, read the issue description, labels, and comments
-   - Identify the expected behavior vs actual behavior
-   - Note any error messages, stack traces, or reproduction steps provided
-
-2. **Reproduce:**
-   - Find the minimal reproduction path
-   - Identify the affected code paths (files, functions, lines)
-   - If the bug is intermittent, note the conditions that trigger it
-
-3. **Root cause analysis:**
-   - Trace the bug to its root cause (not just the symptom)
-   - Identify when the bug was introduced if possible (git blame/log)
-   - Assess blast radius: what else could be affected?
-
-4. **Produce:** Write a brief `TRIAGE.md` in the artifact directory with:
-   - Root cause explanation
-   - Reproduction steps
-   - Affected files/functions
-   - Proposed fix approach
-
-5. **Gate:** Present the triage findings and proposed fix to the user for confirmation.
-
-## Phase 2: Fix
-
-**Goal:** Implement a clean, tested fix.
-
-1. **Plan the fix:** Write a brief plan (1-3 tasks max)
-2. **Write the fix:** Implement the code change
-3. **Write tests:** Add or update tests that:
-   - Reproduce the original bug (test fails without fix)
-   - Verify the fix works
-   - Cover edge cases
-4. **Commit:** Atomic commit with message: `fix(<scope>): <description>`
-
-## Phase 3: Verify
-
-**Goal:** Ensure the fix doesn't break anything else.
-
-1. Run the project's full test suite
-2. Run the build (if applicable)
-3. Run the linter (if applicable)
-4. Check for regressions in related functionality
-5. If any failures, fix them before proceeding
-
-## Phase 4: Ship
-
-**Goal:** Create a well-documented PR.
-
-1. Ensure all changes are committed on the workflow branch
-2. Build the PR body:
-   - Link to the original issue (if applicable)
-   - Explain the root cause
-   - Describe the fix approach
-   - List the test coverage added
-3. Present the PR details to the user for review
-4. Create the PR via `gh pr create` (with user approval)
-
-</process>

package/dist/resources/extensions/gsd/workflow-templates/dep-upgrade.md

@@ -1,74 +0,0 @@
-# Dependency Upgrade Workflow
-
-<template_meta>
-name: dep-upgrade
-version: 1
-requires_project: false
-artifact_dir: .gsd/workflows/upgrades/
-</template_meta>
-
-<purpose>
-Upgrade project dependencies safely. Assess breaking changes before upgrading,
-fix issues incrementally, and verify everything works. Handles both single-package
-upgrades and bulk dependency refresh.
-</purpose>
-
-<phases>
-1. assess  — Analyze what's outdated and what will break
-2. upgrade — Apply upgrades incrementally
-3. fix     — Resolve breaking changes
-4. verify  — Full test suite and build validation
-</phases>
-
-<process>
-
-## Phase 1: Assess
-
-**Goal:** Know what you're getting into before changing versions.
-
-1. **List outdated dependencies:** Run `npm outdated` / equivalent
-2. **For each target upgrade:**
-   - Read the changelog / release notes
-   - Identify breaking changes
-   - Check for known migration guides
-   - Assess impact on the codebase (grep for affected APIs)
-3. **Prioritize:** Which upgrades to do now, which to defer
-4. **Produce:** Write `ASSESSMENT.md` with:
-   - Dependency list with current → target versions
-   - Breaking changes per dependency
-   - Upgrade order (dependencies before dependents)
-   - Risk assessment
-
-5. **Gate:** Review assessment with user. Confirm upgrade scope.
-
-## Phase 2: Upgrade
-
-**Goal:** Apply version bumps incrementally.
-
-1. Upgrade one dependency (or one group of related dependencies) at a time
-2. Run tests after each upgrade
-3. Commit each upgrade: `chore(deps): upgrade <package> to <version>`
-4. If tests fail, move to Phase 3 for that dependency before continuing
-
-## Phase 3: Fix
-
-**Goal:** Resolve any breaking changes from upgrades.
-
-1. Fix API changes, type errors, deprecations
-2. Update configuration if needed
-3. Commit fixes separately from the upgrade: `fix(deps): adapt to <package> v<version> changes`
-
-## Phase 4: Verify
-
-**Goal:** Ensure everything works together.
-
-1. Run the full test suite
-2. Run the build
-3. Run the linter
-4. Check for deprecation warnings in output
-5. **Produce:** Write `SUMMARY.md` with:
-   - Dependencies upgraded (from → to)
-   - Breaking changes encountered and how they were resolved
-   - Any deferred upgrades and why
-
-</process>

package/dist/resources/extensions/gsd/workflow-templates/full-project.md

@@ -1,41 +0,0 @@
-# Full Project Workflow
-
-<template_meta>
-name: full-project
-version: 1
-requires_project: true
-artifact_dir: .gsd/
-</template_meta>
-
-<purpose>
-The complete GSD workflow with full ceremony: roadmap, milestones, slices, tasks,
-research, planning, execution, and verification. Use for greenfield projects or
-major features that need the full planning apparatus.
-
-This template wraps the existing GSD workflow for registry completeness.
-When selected, it routes to the standard /gsd init → /gsd auto pipeline.
-</purpose>
-
-<phases>
-1. init    — Initialize project, detect stack, create .gsd/
-2. discuss — Define requirements, decisions, and architecture
-3. plan    — Create roadmap with milestones and slices
-4. execute — Execute slices: research → plan → implement → verify per slice
-5. verify  — Milestone-level verification and completion
-</phases>
-
-<process>
-
-## Routing to Standard GSD
-
-This template is a convenience entry point. When selected via `/gsd start full-project`,
-it should route to the standard GSD workflow:
-
-1. If `.gsd/` doesn't exist: Run `/gsd init` to bootstrap the project
-2. If `.gsd/` exists but no milestones: Start the discuss phase via `/gsd discuss`
-3. If milestones exist: Resume via `/gsd auto` or `/gsd next`
-
-The full GSD workflow protocol is defined in `GSD-WORKFLOW.md` and handles all
-phases, state tracking, and agent orchestration.
-
-</process>

package/dist/resources/extensions/gsd/workflow-templates/hotfix.md

@@ -1,45 +0,0 @@
-# Hotfix Workflow
-
-<template_meta>
-name: hotfix
-version: 1
-requires_project: false
-artifact_dir: null
-</template_meta>
-
-<purpose>
-Minimal ceremony for urgent fixes. Fix it, test it, ship it. No planning artifacts,
-no research phase, no lengthy documentation. For when production is broken and
-speed matters.
-</purpose>
-
-<phases>
-1. fix  — Identify and fix the issue
-2. ship — Test, commit, and create PR
-</phases>
-
-<process>
-
-## Phase 1: Fix
-
-**Goal:** Find and fix the issue as fast as possible.
-
-1. Identify the broken behavior
-2. Locate the root cause
-3. Implement the minimal fix
-4. Add a regression test if possible (don't block on this if the fix is urgent)
-5. Commit: `fix(<scope>): <description>`
-
-## Phase 2: Ship
-
-**Goal:** Get the fix deployed.
-
-1. Run tests — fix any failures
-2. Run the build
-3. Push and create PR with:
-   - What broke
-   - What the fix does
-   - How to verify
-4. Present PR to user for approval
-
-</process>

package/dist/resources/extensions/gsd/workflow-templates/refactor.md

@@ -1,83 +0,0 @@
-# Refactor / Migration Workflow
-
-<template_meta>
-name: refactor
-version: 1
-requires_project: false
-artifact_dir: .gsd/workflows/refactors/
-</template_meta>
-
-<purpose>
-Systematic code transformation with inventory-driven planning. Designed for
-renames, restructures, pattern migrations, and API modernization. Executes in
-waves to minimize risk and enable incremental verification.
-</purpose>
-
-<phases>
-1. inventory — Catalog everything that needs to change
-2. plan      — Group changes into safe waves
-3. migrate   — Execute waves with verification between each
-4. verify    — Full regression testing and cleanup
-</phases>
-
-<process>
-
-## Phase 1: Inventory
-
-**Goal:** Know the full scope before changing anything.
-
-1. **Scan the codebase:** Find all instances of what needs to change
-   - Files, functions, types, imports, tests, docs, config
-   - Use grep/glob to be exhaustive — don't rely on memory
-2. **Categorize:** Group by type (source, test, config, docs)
-3. **Identify dependencies:** What order must changes happen in?
-4. **Produce:** Write `INVENTORY.md` with:
-   - Complete list of files/locations that need changes
-   - Dependency relationships
-   - Estimated scope (number of files, lines affected)
-
-5. **Gate:** Review inventory with user. Confirm nothing is missing.
-
-## Phase 2: Plan
-
-**Goal:** Break the migration into safe, independently-verifiable waves.
-
-1. **Define waves:** Group related changes so each wave:
-   - Leaves the codebase in a working state
-   - Can be committed and tested independently
-   - Handles dependencies (change the definition before the consumers)
-2. **Typical wave structure:**
-   - Wave 1: Types/interfaces
-   - Wave 2: Core implementation
-   - Wave 3: Consumers/callers
-   - Wave 4: Tests
-   - Wave 5: Documentation and config
-3. **Produce:** Write `PLAN.md` with waves and per-wave file lists
-
-4. **Gate:** Confirm plan with user.
-
-## Phase 3: Migrate
-
-**Goal:** Execute waves one at a time with verification between each.
-
-1. For each wave:
-   - Make the changes
-   - Run tests (at minimum, the build must pass)
-   - Commit: `refactor(<scope>): wave N — <description>`
-2. If a wave introduces failures, fix them before moving to the next wave
-3. If unexpected scope is discovered, update the inventory and plan
-
-## Phase 4: Verify
-
-**Goal:** Ensure the full refactor is complete and clean.
-
-1. Run the complete test suite
-2. Run the build
-3. Run the linter — fix any new warnings
-4. Search for any remnants of the old pattern (grep for old names/patterns)
-5. **Produce:** Write `SUMMARY.md` with:
-   - What was changed and why
-   - Files modified (count and list)
-   - Any remaining follow-up items
-
-</process>

package/dist/resources/extensions/gsd/workflow-templates/registry.json

@@ -1,85 +0,0 @@
-{
-  "version": 1,
-  "templates": {
-    "full-project": {
-      "name": "Full Project",
-      "description": "Complete GSD workflow with roadmap, milestones, slices, and full ceremony",
-      "file": "full-project.md",
-      "phases": ["init", "discuss", "plan", "execute", "verify"],
-      "triggers": ["new project", "greenfield", "from scratch", "build an app", "create a new"],
-      "artifact_dir": ".gsd/",
-      "estimated_complexity": "high",
-      "requires_project": true
-    },
-    "bugfix": {
-      "name": "Bug Fix",
-      "description": "Triage, reproduce, fix, test, and ship a bug fix",
-      "file": "bugfix.md",
-      "phases": ["triage", "fix", "verify", "ship"],
-      "triggers": ["bug", "issue", "fix", "broken", "regression", "error", "crash", "failing", "github.com/*/issues/*"],
-      "artifact_dir": ".gsd/workflows/bugfixes/",
-      "estimated_complexity": "low",
-      "requires_project": false
-    },
-    "small-feature": {
-      "name": "Small Feature",
-      "description": "Lightweight feature development with optional discussion and research",
-      "file": "small-feature.md",
-      "phases": ["scope", "plan", "implement", "verify"],
-      "triggers": ["add", "feature", "implement", "build", "create", "new command", "new endpoint"],
-      "artifact_dir": ".gsd/workflows/features/",
-      "estimated_complexity": "medium",
-      "requires_project": false
-    },
-    "refactor": {
-      "name": "Refactor / Migration",
-      "description": "Systematic code transformation with inventory and wave-based execution",
-      "file": "refactor.md",
-      "phases": ["inventory", "plan", "migrate", "verify"],
-      "triggers": ["refactor", "migrate", "rename", "restructure", "move", "reorganize", "clean up"],
-      "artifact_dir": ".gsd/workflows/refactors/",
-      "estimated_complexity": "medium",
-      "requires_project": false
-    },
-    "spike": {
-      "name": "Research Spike",
-      "description": "Investigate a question, prototype, and document findings",
-      "file": "spike.md",
-      "phases": ["scope", "research", "synthesize"],
-      "triggers": ["research", "investigate", "explore", "spike", "compare", "evaluate", "should we", "what if", "how does"],
-      "artifact_dir": ".gsd/workflows/spikes/",
-      "estimated_complexity": "low",
-      "requires_project": false
-    },
-    "hotfix": {
-      "name": "Hotfix",
-      "description": "Minimal ceremony: fix the thing, test it, ship it",
-      "file": "hotfix.md",
-      "phases": ["fix", "ship"],
-      "triggers": ["hotfix", "urgent", "critical", "asap", "production down", "p0"],
-      "artifact_dir": null,
-      "estimated_complexity": "minimal",
-      "requires_project": false
-    },
-    "security-audit": {
-      "name": "Security Audit",
-      "description": "Scan for vulnerabilities, triage findings, remediate, and verify",
-      "file": "security-audit.md",
-      "phases": ["scan", "triage", "remediate", "re-scan"],
-      "triggers": ["security", "audit", "vulnerability", "owasp", "cve", "penetration", "hardening"],
-      "artifact_dir": ".gsd/workflows/audits/",
-      "estimated_complexity": "medium",
-      "requires_project": false
-    },
-    "dep-upgrade": {
-      "name": "Dependency Upgrade",
-      "description": "Assess impact, upgrade dependencies, fix breaking changes",
-      "file": "dep-upgrade.md",
-      "phases": ["assess", "upgrade", "fix", "verify"],
-      "triggers": ["upgrade", "update", "dependency", "deps", "bump", "outdated", "npm update", "renovate"],
-      "artifact_dir": ".gsd/workflows/upgrades/",
-      "estimated_complexity": "medium",
-      "requires_project": false
-    }
-  }
-}

package/dist/resources/extensions/gsd/workflow-templates/security-audit.md

@@ -1,73 +0,0 @@
-# Security Audit Workflow
-
-<template_meta>
-name: security-audit
-version: 1
-requires_project: false
-artifact_dir: .gsd/workflows/audits/
-</template_meta>
-
-<purpose>
-Systematic security review of the codebase. Scan for vulnerabilities, triage
-findings by severity, remediate issues, and verify fixes. Covers OWASP Top 10,
-dependency vulnerabilities, and project-specific security concerns.
-</purpose>
-
-<phases>
-1. scan       — Identify potential vulnerabilities
-2. triage     — Prioritize findings by severity and exploitability
-3. remediate  — Fix critical and high-severity issues
-4. re-scan    — Verify fixes and document remaining items
-</phases>
-
-<process>
-
-## Phase 1: Scan
-
-**Goal:** Identify potential security issues across the codebase.
-
-1. **Dependency audit:** Run `npm audit` / `pip audit` / equivalent
-2. **Code review for common vulnerabilities:**
-   - Injection (SQL, command, XSS)
-   - Authentication/authorization flaws
-   - Sensitive data exposure (hardcoded secrets, logs)
-   - Insecure configuration
-   - Missing input validation at boundaries
-3. **Check security headers and CORS** (if web application)
-4. **Review secrets management:** .env files, config, environment variables
-5. **Produce:** Write `SCAN-RESULTS.md` with all findings
-
-## Phase 2: Triage
-
-**Goal:** Prioritize what to fix now vs later.
-
-1. **Rate each finding:**
-   - Critical: exploitable, high impact, fix immediately
-   - High: likely exploitable, fix in this workflow
-   - Medium: lower risk, fix if time allows
-   - Low: informational, document for later
-2. **Assess exploitability:** Is this theoretical or practically exploitable?
-3. **Produce:** Update `SCAN-RESULTS.md` with severity ratings and triage decisions
-
-4. **Gate:** Review triage with user. Agree on what to remediate now.
-
-## Phase 3: Remediate
-
-**Goal:** Fix critical and high-severity issues.
-
-1. Fix each issue with proper testing
-2. Commit each fix individually: `fix(security): <description>`
-3. Don't introduce new functionality — security fixes only
-
-## Phase 4: Re-scan
-
-**Goal:** Verify fixes and document the final state.
-
-1. Re-run the scans from Phase 1
-2. Verify all targeted issues are resolved
-3. **Produce:** Write `AUDIT-REPORT.md` with:
-   - Summary of findings and fixes
-   - Remaining medium/low items for future attention
-   - Recommendations for ongoing security practices
-
-</process>