jumpstart-mode 1.1.13 → 1.1.14

package/.github/skills/php-developer/templates/Dockerfile.php-fpm

@@ -0,0 +1,22 @@
+FROM php:8.3-fpm-alpine
+
+RUN apk add --no-cache \
+    bash \
+    git \
+    libpq-dev \
+    oniguruma-dev \
+    unzip \
+    icu-dev \
+    $PHPIZE_DEPS
+
+RUN docker-php-ext-install pdo pdo_mysql pdo_pgsql intl
+
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+
+WORKDIR /var/www/html
+
+COPY . .
+
+RUN composer install --no-interaction --prefer-dist
+
+CMD ["php-fpm"]

package/.github/skills/php-developer/templates/composer.legacy-modernization.json

@@ -0,0 +1,26 @@
+{
+  "name": "acme/legacy-modernization",
+  "type": "project",
+  "require": {
+    "php": "^8.1"
+  },
+  "require-dev": {
+    "phpunit/phpunit": "^10.5",
+    "phpstan/phpstan": "^1.11",
+    "rector/rector": "^1.2"
+  },
+  "autoload": {
+    "psr-4": {
+      "App\\": "src/",
+      "Legacy\\": "legacy/"
+    },
+    "files": [
+      "legacy/bootstrap.php"
+    ]
+  },
+  "scripts": {
+    "test": "phpunit",
+    "analyse": "phpstan analyse --memory-limit=1G",
+    "rector-dry": "rector process --dry-run"
+  }
+}

package/.github/skills/php-developer/templates/composer.modern.json

@@ -0,0 +1,27 @@
+{
+  "name": "acme/php-app",
+  "type": "project",
+  "require": {
+    "php": "^8.2"
+  },
+  "require-dev": {
+    "phpunit/phpunit": "^11.0",
+    "phpstan/phpstan": "^1.11",
+    "friendsofphp/php-cs-fixer": "^3.0"
+  },
+  "autoload": {
+    "psr-4": {
+      "App\\": "src/"
+    }
+  },
+  "autoload-dev": {
+    "psr-4": {
+      "Tests\\": "tests/"
+    }
+  },
+  "scripts": {
+    "test": "phpunit",
+    "analyse": "phpstan analyse",
+    "audit": "composer audit"
+  }
+}

package/.github/skills/php-developer/templates/docker-compose.laravel.yml

@@ -0,0 +1,40 @@
+version: '3.9'
+services:
+  php:
+    build:
+      context: .
+      dockerfile: .github/skills/php-developer/templates/Dockerfile.php-fpm
+    volumes:
+      - ./:/var/www/html
+    depends_on:
+      - postgres
+      - redis
+
+  nginx:
+    image: nginx:1.27-alpine
+    ports:
+      - "8080:80"
+    volumes:
+      - ./:/var/www/html
+      - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      - php
+
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: app
+      POSTGRES_USER: app
+      POSTGRES_PASSWORD: app
+    ports:
+      - "5432:5432"
+
+  redis:
+    image: redis:7-alpine
+    ports:
+      - "6379:6379"
+
+  mailpit:
+    image: axllent/mailpit:v1.20
+    ports:
+      - "8025:8025"

package/.github/skills/php-developer/templates/docker-compose.symfony.yml

@@ -0,0 +1,34 @@
+version: '3.9'
+services:
+  php:
+    build:
+      context: .
+      dockerfile: .github/skills/php-developer/templates/Dockerfile.php-fpm
+    volumes:
+      - ./:/var/www/html
+    depends_on:
+      - postgres
+
+  nginx:
+    image: nginx:1.27-alpine
+    ports:
+      - "8081:80"
+    volumes:
+      - ./:/var/www/html
+      - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      - php
+
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: symfony
+      POSTGRES_USER: symfony
+      POSTGRES_PASSWORD: symfony
+    ports:
+      - "5433:5432"
+
+  redis:
+    image: redis:7-alpine
+    ports:
+      - "6380:6379"

package/.github/skills/php-developer/templates/github-actions-php.yml

@@ -0,0 +1,26 @@
+name: php-ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          coverage: none
+      - name: Install dependencies
+        run: composer install --no-interaction --prefer-dist
+      - name: Validate composer
+        run: composer validate
+      - name: Security audit
+        run: composer audit
+      - name: Static analysis
+        run: vendor/bin/phpstan analyse
+      - name: Run tests
+        run: vendor/bin/phpunit

package/.github/skills/php-developer/templates/laravel-controller.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\StoreCustomerRiskRequest;
+use App\Services\CustomerRiskService;
+use Illuminate\Http\JsonResponse;
+
+final class CustomerRiskController extends Controller
+{
+    public function __construct(private readonly CustomerRiskService $riskService)
+    {
+    }
+
+    public function store(StoreCustomerRiskRequest $request, string $customerId): JsonResponse
+    {
+        $result = $this->riskService->scoreCustomer($customerId, $request->validated());
+
+        return response()->json([
+            'data' => [
+                'customer_id' => $customerId,
+                'risk_score' => $result['score'],
+                'risk_level' => $result['level'],
+            ],
+        ], 201);
+    }
+}

package/.github/skills/php-developer/templates/laravel-form-request.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+final class StoreCustomerRiskRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()?->can('score-customer-risk') ?? false;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'base_score' => ['required', 'integer', 'between:0,100'],
+            'reason' => ['nullable', 'string', 'max:1000'],
+        ];
+    }
+}

package/.github/skills/php-developer/templates/laravel-service.php

@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services;
+
+use App\Repositories\CustomerRepository;
+
+final readonly class CustomerRiskService
+{
+    public function __construct(private CustomerRepository $customers)
+    {
+    }
+
+    public function scoreCustomer(string $customerId, array $payload): array
+    {
+        $customer = $this->customers->findOrFail($customerId);
+
+        $score = (int) (($payload['base_score'] ?? 0) + ($customer->tenure_months ?? 0));
+
+        return [
+            'score' => $score,
+            'level' => $score >= 80 ? 'high' : ($score >= 40 ? 'medium' : 'low'),
+        ];
+    }
+}

package/.github/skills/php-developer/templates/legacy-characterization-test.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+use PHPUnit\Framework\TestCase;
+
+final class LegacyInvoiceEndpointCharacterizationTest extends TestCase
+{
+    public function test_invoice_endpoint_returns_current_response_shape(): void
+    {
+        $response = include __DIR__ . '/../../legacy/endpoints/invoice.php';
+
+        $this->assertIsArray($response);
+        $this->assertArrayHasKey('invoice_id', $response);
+        $this->assertArrayHasKey('status', $response);
+        $this->assertArrayHasKey('total', $response);
+    }
+}

package/.github/skills/php-developer/templates/pdo-repository.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Repository;
+
+use PDO;
+
+final readonly class UserRepository
+{
+    public function __construct(private PDO $pdo)
+    {
+    }
+
+    /**
+     * @return array<string, mixed>|null
+     */
+    public function findByEmail(string $email): ?array
+    {
+        $statement = $this->pdo->prepare(
+            'SELECT id, email, created_at FROM users WHERE email = :email LIMIT 1'
+        );
+
+        $statement->execute(['email' => $email]);
+        $result = $statement->fetch(PDO::FETCH_ASSOC);
+
+        return $result === false ? null : $result;
+    }
+}

package/.github/skills/php-developer/templates/pest.php

@@ -0,0 +1,6 @@
+<?php
+
+declare(strict_types=1);
+
+uses()->group('feature')->in('tests/Feature');
+uses()->group('unit')->in('tests/Unit');

package/.github/skills/php-developer/templates/phpstan.neon

@@ -0,0 +1,11 @@
+parameters:
+  level: 6
+  paths:
+    - src
+    - app
+  checkMissingIterableValueType: true
+  checkMissingCallableSignature: true
+  reportUnmatchedIgnoredErrors: true
+
+includes:
+  - vendor/phpstan/phpstan/conf/bleedingEdge.neon

package/.github/skills/php-developer/templates/phpunit.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit bootstrap="vendor/autoload.php" cacheDirectory=".phpunit.cache" colors="true">
+  <testsuites>
+    <testsuite name="Unit">
+      <directory>tests/Unit</directory>
+    </testsuite>
+    <testsuite name="Feature">
+      <directory>tests/Feature</directory>
+    </testsuite>
+  </testsuites>
+  <coverage>
+    <include>
+      <directory suffix=".php">src</directory>
+      <directory suffix=".php">app</directory>
+    </include>
+  </coverage>
+</phpunit>

package/.github/skills/php-developer/templates/symfony-controller.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Api;
+
+use App\Service\RiskScoringService;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Routing\Attribute\Route;
+
+final class RiskController extends AbstractController
+{
+    public function __construct(private readonly RiskScoringService $riskScoringService)
+    {
+    }
+
+    #[Route('/api/v1/customers/{customerId}/risk-score', name: 'api_customer_risk_score', methods: ['POST'])]
+    public function __invoke(string $customerId, Request $request): JsonResponse
+    {
+        $payload = json_decode((string) $request->getContent(), true, 512, JSON_THROW_ON_ERROR);
+        $result = $this->riskScoringService->scoreCustomer($customerId, is_array($payload) ? $payload : []);
+
+        return $this->json(['data' => $result], 201);
+    }
+}

package/.github/skills/php-developer/templates/symfony-service.php

@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Service;
+
+use App\Repository\CustomerRepository;
+
+final readonly class RiskScoringService
+{
+    public function __construct(private CustomerRepository $customers)
+    {
+    }
+
+    /**
+     * @param array<string, mixed> $payload
+     * @return array<string, mixed>
+     */
+    public function scoreCustomer(string $customerId, array $payload): array
+    {
+        $customer = $this->customers->findOneByExternalId($customerId);
+
+        if ($customer === null) {
+            throw new \RuntimeException('Customer not found.');
+        }
+
+        $score = (int) (($payload['base_score'] ?? 0) + $customer->getTenureMonths());
+
+        return [
+            'customer_id' => $customerId,
+            'risk_score' => $score,
+            'risk_level' => $score >= 80 ? 'high' : ($score >= 40 ? 'medium' : 'low'),
+        ];
+    }
+}

package/.github/skills/pilot-to-production-gate/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: pilot-to-production-gate
+description: Define entry and exit criteria for graduating a Jump Start prototype into AI Innovation Pod production delivery, covering use case clarity, evaluation results, data and integration readiness, governance and security sign-off, observability, cost posture, change management, sponsor commitment, and commercial readiness. Use this whenever the user needs pilot-to-production criteria, a graduation gate, prototype-to-Pod handoff checklist, AI production readiness review, or a structured way to decide whether to scale a pilot, even when phrased as "is this ready for production," "should we move from Jump Start to Pod," "what's left," or "what's the go / no-go."
+argument-hint: Paste the prototype use case, evaluation results, data and integration status, governance posture, sponsor commitment, and any commercial signals (budget, timeline, executive air cover).
+---
+
+# Pilot-to-Production Gate
+
+## Positioning
+
+Use this skill to put a defensible, AI-aware gate between a Jump Start prototype and an AI Innovation Pod production build. The output should give sponsors, sellers, and Pod leads a clear go / fix / no-go verdict with the specific work items required to graduate.
+
+Bias toward concrete, evidence-bound criteria over generic "is it ready" judgment.
+
+## When To Use This
+
+- A Jump Start prototype is finishing and the team is debating whether to scale it.
+- The Pod is shaping a follow-on engagement and needs to know what must be true before commit.
+- Phrased as "go or no-go," "is this ready for production," "what's the gap to Pod," "what's left," or "should we scale."
+
+## When Not To Use This Alone
+
+- Do not use this as a substitute for full production-readiness design (architecture, ops, observability). Pair with `../devops-rollout-plan/SKILL.md` and `../agent-governance/SKILL.md`.
+- Do not use this for use case prioritization across many candidates. Use `../use-case-prioritization/SKILL.md`.
+- Do not use this for Pod effort allocation. Use `../pod-effort-allocation/SKILL.md`.
+
+## Required Inputs
+
+- the prototype use case and current state,
+- evaluation results (eval set, metrics, edge cases),
+- data and integration status (what's real, what's mocked),
+- security, privacy, and governance status (DPIA, RAI, threat model),
+- observability and cost posture,
+- adoption / change management signals,
+- sponsor commitment and budget signal,
+- known regulatory or contractual gates.
+
+## Gate Dimensions
+
+For each, capture status (Met / Partial / Not Met), evidence, and gap-to-meet:
+
+1. Use case clarity — sponsor-confirmed problem, user, and outcome.
+2. Evaluation — eval set covering core, edge, and adversarial cases; thresholds met; trend stable across changes.
+3. Data — real (not mocked) data path; access approved; quality verified; classification scanned.
+4. Integration — auth, throughput, and failure paths verified, not assumed.
+5. Architecture — pattern fit; scaling and tenancy understood; documented.
+6. Security — threat model done; secrets, identity, and tool-permissioning sound.
+7. Privacy and compliance — DPIA / RAI / regulatory checks complete or scoped.
+8. Governance — guardrails, HITL, audit, escalation paths defined.
+9. Observability — tracing, eval logging, cost metrics, drift signals in place.
+10. Cost posture — per-call and per-workflow costs measured against budget envelope.
+11. Reliability — failure modes and fallbacks designed; SLO target articulated.
+12. Adoption and change — sponsor visible; pilot users engaged; training plan named.
+13. Operating model — who runs it, who fixes it, who improves it after launch.
+14. Commercial — budget, timeline, executive air cover; SOW / order form ready.
+15. Acceptance — explicit production acceptance criteria agreed.
+
+See [references/gate-criteria-rubric.md](./references/gate-criteria-rubric.md) for anchor descriptions and probing questions per dimension.
+
+## Workflow
+
+1. Restate the prototype scope, what was proven, and what was deliberately deferred.
+2. Walk each gate dimension. Capture status, evidence, and concrete gap.
+3. Identify the smallest credible gap-closure plan (effort, owner, dependency, target date).
+4. Issue an overall verdict: `Go`, `Conditional Go (with named pre-launch closures)`, `Fix-then-go`, or `No-go (return to discovery / re-scope)`.
+5. Make the operating model explicit. A prototype with no run-team does not graduate.
+6. Produce the gate review using [templates/pilot-to-production-gate-template.md](./templates/pilot-to-production-gate-template.md).
+
+## Output Mode
+
+Default artifact:
+
+- Executive summary (verdict, top three gaps, recommended path).
+- Prototype recap (what was proven, what was deferred).
+- Gate dimension table (status, evidence, gap, owner, target date).
+- Gap-closure plan with sequencing.
+- Operating model (run, fix, improve).
+- Commercial and acceptance posture.
+- Verdict and conditions.
+
+## Working Rules
+
+1. Met means evidence, not opinion.
+2. A prototype with mocked data, no observability, or no run-team is never `Go`.
+3. Distinguish must-haves at launch from fast-followers, and put fast-followers on a dated plan.
+4. Treat governance, privacy, and adoption gaps as scope, not concerns.
+5. Be explicit about what changes when moving from Jump Start posture (learn fast) to Pod posture (run reliably).

package/.github/skills/pilot-to-production-gate/evals/evals.json

@@ -0,0 +1,30 @@
+{
+  "skill_name": "pilot-to-production-gate",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "We just finished a 6-week Jump Start prototype: an internal RAG assistant for our consulting practice that answers methodology questions over our SharePoint corpus. It uses mocked SSO in dev, has ~30 test prompts the team eyeballs, runs on a personal Azure subscription, and the partner who sponsored it wants to launch it firm-wide next month. Should we graduate to Pod production?",
+      "expected_output": "A gate review that issues a Fix-then-go or No-go verdict, with explicit gaps in evaluation (no real eval set, no thresholds), data (sensitivity not scanned), security (mocked SSO), observability, cost posture, governance, and operating model.",
+      "files": [],
+      "assertions": [
+        {"text": "Verdict is Fix-then-go or No-go, not Go"},
+        {"text": "Evaluation gap (eyeball testing, no eval set, no thresholds) is explicitly flagged Not Met"},
+        {"text": "Data classification scan is identified as a gap"},
+        {"text": "Operating model gap (personal Azure subscription, no run team) is flagged"},
+        {"text": "Output includes a gap-closure plan with owners and target dates"},
+        {"text": "Output distinguishes pre-launch must-haves from fast-followers"}
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "Same prototype, but the partner says 'this is internal, low-risk, just launch it.' How does that change the verdict?",
+      "expected_output": "Lower criticality lowers some bars but the AI-specific vetoes (no eval set, no observability, no run-team) still block Go status; output explains which bars move and which do not.",
+      "files": [],
+      "assertions": [
+        {"text": "Output acknowledges criticality affects some thresholds (HITL, redundancy)"},
+        {"text": "Output maintains AI-specific vetoes (eval set, observability, operating model) regardless of low-risk framing"},
+        {"text": "Output proposes the smallest credible closures that would justify Conditional Go"}
+      ]
+    }
+  ]
+}

package/.github/skills/pilot-to-production-gate/references/gate-criteria-rubric.md

@@ -0,0 +1,116 @@
+# Pilot-to-Production Gate Criteria Rubric
+
+For each gate dimension, use these anchors to assign Met / Partial / Not Met, and probing questions to surface evidence.
+
+## 1. Use case clarity
+
+- Met: sponsor confirms problem, user, outcome; aligned with business KPI.
+- Partial: outcome named but not measured; user persona generic.
+- Not Met: solution-led ("we want to use AI to do X"); no named user.
+- Probe: who hurts today, who benefits at launch, what number moves.
+
+## 2. Evaluation
+
+- Met: eval set covers core, edge, adversarial; thresholds defined and met; trend stable across last 3 changes.
+- Partial: eval set exists but missing edge or adversarial coverage; thresholds informal.
+- Not Met: vibes-based testing; no eval set under version control.
+- Probe: show me last 5 eval runs and the diff per change.
+
+## 3. Data
+
+- Met: real data path; access approved for production; quality verified; classification scanned.
+- Partial: real data in dev only; access not yet approved for prod; sensitivity scan partial.
+- Not Met: mocked data; no steward; no scan.
+- Probe: trace one production query from prompt to retrieved chunk to source system.
+
+## 4. Integration
+
+- Met: every integration tested in target environment; auth verified; rate limits known; failure paths defined.
+- Partial: happy path only; auth pattern verified in dev.
+- Not Met: assumed APIs; no live test calls.
+- Probe: show the integration test log and the failure-path runbook.
+
+## 5. Architecture
+
+- Met: pattern fit documented (RAG, agent, workflow); scaling, tenancy, isolation understood; ADRs in place.
+- Partial: pattern chosen but tradeoffs not documented.
+- Not Met: code-first, no design.
+- Probe: walk me through a request end to end on a whiteboard.
+
+## 6. Security
+
+- Met: threat model done; secrets vaulted; identity scoped; tool permissions least-privilege; prompt-injection defenses tested.
+- Partial: threat model started; some controls deferred.
+- Not Met: no threat model; secrets in code or env files; tools fully privileged.
+- Probe: what does the system do if a user pastes a hostile prompt?
+
+## 7. Privacy and compliance
+
+- Met: DPIA / RAI / sectoral checks complete; legal sign-off captured; disclosure / consent designed.
+- Partial: privacy review in flight; legal aware.
+- Not Met: not yet started.
+- Probe: which regimes apply, and which sign-offs are on file.
+
+## 8. Governance
+
+- Met: HITL placement matches risk class; audit trail captured per consequential decision; escalation defined.
+- Partial: HITL informal; audit trail partial.
+- Not Met: autonomous on irreversible actions with no audit.
+- Probe: name the action class that requires a human approver, and show the UX.
+
+## 9. Observability
+
+- Met: tracing for prompts/retrievals/tool calls; eval logging; cost metrics; drift signals; alerting on thresholds.
+- Partial: tracing exists; no drift or eval-log signal.
+- Not Met: app logs only; no AI-specific observability.
+- Probe: how would you know quality dropped this week?
+
+## 10. Cost posture
+
+- Met: per-call and per-workflow costs measured; within budget envelope; alarms set; routing strategies in place.
+- Partial: aggregate cost known; per-workflow not.
+- Not Met: cost not measured.
+- Probe: what does a 10x traffic spike cost, and what triggers cost alarms?
+
+## 11. Reliability
+
+- Met: failure modes catalogued; fallbacks designed; SLO target articulated; load tested at expected peak.
+- Partial: fallbacks partial; load not tested.
+- Not Met: single point of failure with no fallback.
+- Probe: what happens to users when the model provider is down?
+
+## 12. Adoption and change
+
+- Met: sponsor visible; pilot users engaged; training plan named with owner; comms drafted; works council / union briefed where applicable.
+- Partial: training and comms in flight.
+- Not Met: build-it-and-they-will-come.
+- Probe: what does the affected user's day look like in week 1 vs. week 4?
+
+## 13. Operating model
+
+- Met: named team to run, fix, improve; on-call rotation; eval and prompt change process; vendor management for model provider.
+- Partial: handoff team identified but not staffed.
+- Not Met: nobody owns it after launch.
+- Probe: who gets paged at 2 a.m., and who decides whether to roll back?
+
+## 14. Commercial
+
+- Met: budget approved; SOW or order form ready; sponsor air cover confirmed; timeline realistic.
+- Partial: budget likely; SOW in draft.
+- Not Met: no commercial vehicle yet.
+- Probe: when is the first invoice and against what milestone.
+
+## 15. Acceptance
+
+- Met: production acceptance criteria written; aligned with NFRs and eval thresholds; approver named.
+- Partial: criteria drafted; approver not confirmed.
+- Not Met: no criteria.
+- Probe: how will we know we are done.
+
+## Verdict logic
+
+- All Met → `Go`.
+- One or two Partial with named, dated closures → `Conditional Go`.
+- Any Not Met on data, security, privacy, governance, or operating model → `Fix-then-go` minimum.
+- Use case clarity Not Met → `No-go (return to discovery)`.
+- AI-specific veto: no eval set, no observability, or no run-team → never `Go`.