ma-agents 3.4.8 → 3.5.0

package/.opencode/skills/js-ts-security-skill/SKILL.md

@@ -1,64 +0,0 @@
----
-name: JS/TS Security
-description: Verify security of JavaScript and TypeScript codebases against OWASP Top 10 2025 standards
----
-
-# JS/TS Security Skill
-
-This skill provides a set of tools and best practices to ensure that JavaScript and TypeScript code (both client-side and server-side) is secure and compliant with the latest security standards, specifically the **OWASP Top 10 2025**.
-
-## When to Use
-- Before committing code to a repository.
-- During a security audit of an existing codebase.
-- When adding new dependencies or updating CI/CD pipelines.
-- When implementing critical features like authentication, authorization, or error handling.
-
-## Security Checks (OWASP 2025 Mapping)
-
-### A01:2025 - Broken Access Control
-- Verification of authorization logic.
-- **SSRF (Server-Side Request Forgery)**: Detecting unvalidated URL fetching in `fetch`, `axios`, `http.get`.
-
-### A02:2025 - Security Misconfiguration
-- Auditing configuration files (`.env`, `docker-compose.yml`).
-- Checking for insecure defaults and exposed debug endpoints.
-
-### A03:2025 - Software Supply Chain Failures
-- **NEW**: Focusing on dependency integrity.
-- Verification of lockfiles (`package-lock.json`, `yarn.lock`).
-- Checking for insecure registry URLs (HTTP).
-
-### A04:2025 - Cryptographic Failures
-- Detecting weak hashing (MD5, SHA1).
-- Checking for insecure randomness (`Math.random()`).
-
-### A05:2025 - Injection
-- Expanded detection for OS commands (`child_process.exec`), SQL injection, and NoSQL injection.
-
-### A06:2025 - Insecure Design
-- Documentation on secure design principles (e.g., Fail Secure, Least Privilege).
-
-### A07:2025 - Authentication Failures
-- Checking for insecure cookies (`httpOnly: false`).
-- Hardcoded credentials and weak session management.
-
-### A08:2025 - Software or Data Integrity Failures
-- Detecting unsafe deserialization (`unserialize`, `JSON.parse` of untrusted input).
-
-### A09:2025 - Logging & Alerting Failures
-- Identifying lack of security logging.
-- Empty catch blocks that swallow security errors.
-
-### A10:2025 - Mishandling of Exceptional Conditions
-- **NEW**: Identifying insecure error handling.
-- Detecting empty `catch` blocks and `console.log(err)` in critical paths.
-
-## Usage
-
-### Run OWASP 2025 Security Scan
-The primary method for automated security verification is the `verify-security.sh` script. This script executes multiple scanning phases (SAST, Audit, Secret Scanning) and maps all findings directly to OWASP 2025 categories.
-
-Run the scan from the project root:
-```bash
-/d/Code/agents/skills/js-ts-security-skill/scripts/verify-security.sh
-```

package/.opencode/skills/js-ts-security-skill/scripts/verify-security.sh

@@ -1,136 +0,0 @@
-#!/bin/bash
-
-# JS/TS Security Verification Script (OWASP Top 10 2025)
-# This script performs a series of security checks on a JavaScript/TypeScript project.
-
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-CYAN='\033[0;36m'
-NC='\033[0m' # No Color
-
-echo -e "${CYAN}====================================================${NC}"
-echo -e "${CYAN}   JS/TS Security Audit - OWASP Top 10 2025         ${NC}"
-echo -e "${CYAN}====================================================${NC}\n"
-
-# A03:2025 - Software Supply Chain Failures
-echo -e "${YELLOW}[1/5] A03:2025 - Software Supply Chain Failures${NC}"
-SUPPLY_CHAIN_ISSUES=0
-if [ ! -f "package-lock.json" ] && [ ! -f "yarn.lock" ] && [ ! -f "pnpm-lock.yaml" ]; then
-    echo -e "${RED}✗ CRITICAL: No lockfile found (package-lock.json, yarn.lock, or pnpm-lock.yaml).${NC}"
-    echo "  Impact: Non-deterministic builds increase supply chain vulnerability."
-    SUPPLY_CHAIN_ISSUES=$((SUPPLY_CHAIN_ISSUES + 1))
-fi
-
-HTTP_REGISTRY=$(grep -r "http://" package.json 2>/dev/null)
-if [ ! -z "$HTTP_REGISTRY" ]; then
-    echo -e "${RED}✗ WARNING: Insecure registry found in package.json (using HTTP instead of HTTPS).${NC}"
-    echo "$HTTP_REGISTRY"
-    SUPPLY_CHAIN_ISSUES=$((SUPPLY_CHAIN_ISSUES + 1))
-fi
-
-if [ $SUPPLY_CHAIN_ISSUES -eq 0 ]; then
-    echo -e "${GREEN}✓ No immediate supply chain issues found.${NC}\n"
-else
-    echo -e "${RED}✗ Total supply chain issues: $SUPPLY_CHAIN_ISSUES${NC}\n"
-fi
-
-# A03:2025 / A06:2021 - Dependency Audit
-echo -e "${YELLOW}[2/5] A03:2025 - Vulnerable Components (Audit)${NC}"
-if [ -f "package-lock.json" ]; then
-    npm audit --audit-level=high
-    AUDIT_EXIT=$?
-elif [ -f "yarn.lock" ]; then
-    yarn audit --level high
-    AUDIT_EXIT=$?
-else
-    echo -e "${YELLOW}  Skipping dependency audit: No lockfile found.${NC}"
-    AUDIT_EXIT=0
-fi
-
-if [ $AUDIT_EXIT -eq 0 ]; then
-    echo -e "${GREEN}✓ No high-severity vulnerabilities in dependencies.${NC}\n"
-else
-    echo -e "${RED}✗ Vulnerabilities found. Run 'npm audit fix'.${NC}\n"
-fi
-
-# A01/A04/A05/A08 - Static Analysis (SAST)
-echo -e "${YELLOW}[3/5] Static Analysis (OWASP A01, A04, A05, A08)${NC}"
-declare -A DANGEROUS_PATTERNS
-DANGEROUS_PATTERNS["A01: SSRF/Access Control"]="fetch\(\`|axios\.get\(\`|http\.get\(\`"
-DANGEROUS_PATTERNS["A05: Injection"]="eval\(|new Function\(|child_process\.exec\(|require\('child_process'\)\.exec"
-DANGEROUS_PATTERNS["A04: Cryptographic Failures"]="crypto\.createHash\('md5'\)|crypto\.createHash\('sha1'\)|Math\.random\(\)"
-DANGEROUS_PATTERNS["A08: Software/Data Integrity"]="unserialize\(|JSON\.parse\("
-DANGEROUS_PATTERNS["A07: Authentication Failures"]="res\.cookie\(.*httpOnly: false|res\.cookie\(.*secure: false"
-
-FOUND_ISSUES=0
-for cat in "A01: SSRF/Access Control" "A05: Injection" "A04: Cryptographic Failures" "A08: Software/Data Integrity" "A07: Authentication Failures"; do
-    pattern=${DANGEROUS_PATTERNS[$cat]}
-    MATCHES=$(grep -rnE "$pattern" --include="*.js" --include="*.ts" --exclude-dir=node_modules . 2>/dev/null)
-    if [ ! -z "$MATCHES" ]; then
-        echo -e "${RED}✗ Found Risk: [$cat]${NC}"
-        echo "$MATCHES" | sed 's/^/  /'
-        FOUND_ISSUES=$((FOUND_ISSUES + 1))
-    fi
-done
-
-if [ $FOUND_ISSUES -eq 0 ]; then
-    echo -e "${GREEN}✓ No dangerous patterns detected via SAST.${NC}\n"
-else
-    echo -e "${RED}✗ Total dangerous patterns: $FOUND_ISSUES${NC}\n"
-fi
-
-# A10:2025 - Mishandling of Exceptional Conditions
-echo -e "${YELLOW}[4/5] A10:2025 - Mishandling of Exceptional Conditions${NC}"
-EMPTY_CATCH=$(grep -rnE "catch\s*\(\w*\)\s*\{\s*\}" --include="*.js" --include="*.ts" --exclude-dir=node_modules . 2>/dev/null)
-FOUND_EXCEPTION_ISSUES=0
-if [ ! -z "$EMPTY_CATCH" ]; then
-    echo -e "${RED}✗ Found Risk: Empty catch blocks (Swallowing exceptions)${NC}"
-    echo "$EMPTY_CATCH" | sed 's/^/  /'
-    FOUND_EXCEPTION_ISSUES=$((FOUND_EXCEPTION_ISSUES + 1))
-fi
-
-if [ $FOUND_EXCEPTION_ISSUES -eq 0 ]; then
-    echo -e "${GREEN}✓ Exception handling patterns appear secure.${NC}\n"
-else
-    echo -e "${RED}✗ Total exception handling issues: $FOUND_EXCEPTION_ISSUES${NC}\n"
-fi
-
-# Secret Detection (A01/A07)
-echo -e "${YELLOW}[5/5] A01/A07 - Hardcoded Secrets Scanning${NC}"
-SECRET_PATTERNS=("AIza[0-9A-Za-z-_]{35}" "sk_live_[0-9a-zA-Z]{24}" "xox[pb]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32}" "-----BEGIN RSA PRIVATE KEY-----")
-
-FOUND_SECRETS=0
-for pattern in "${SECRET_PATTERNS[@]}"; do
-    MATCHES=$(grep -rnE "$pattern" --include="*.js" --include="*.ts" --include="*.env" --exclude-dir=node_modules . 2>/dev/null)
-    if [ ! -z "$MATCHES" ]; then
-        echo -e "${RED}✗ Found Risk: Potential secret leakage ($pattern)${NC}"
-        echo "$MATCHES" | sed 's/^/  /'
-        FOUND_SECRETS=$((FOUND_SECRETS + 1))
-    fi
-done
-
-if [ $FOUND_SECRETS -eq 0 ]; then
-    echo -e "${GREEN}✓ No hardcoded secrets detected.${NC}\n"
-else
-    echo -e "${RED}✗ Total secrets found: $FOUND_SECRETS${NC}\n"
-fi
-
-# Summary
-echo -e "${CYAN}----------------------------------------------------${NC}"
-echo -e "${CYAN}   OWASP 2025 Audit Summary                         ${NC}"
-echo -e "${CYAN}----------------------------------------------------${NC}"
-[ $SUPPLY_CHAIN_ISSUES -eq 0 ] && echo -e "A03: Supply Chain        - ${GREEN}PASS${NC}" || echo -e "A03: Supply Chain        - ${RED}FAIL${NC}"
-[ $AUDIT_EXIT -eq 0 ]           && echo -e "A03: Vulnerabilities     - ${GREEN}PASS${NC}" || echo -e "A03: Vulnerabilities     - ${RED}FAIL${NC}"
-[ $FOUND_ISSUES -eq 0 ]        && echo -e "A01/04/05/08: Code Patterns - ${GREEN}PASS${NC}" || echo -e "A01/04/05/08: Code Patterns - ${RED}FAIL${NC}"
-[ $FOUND_EXCEPTION_ISSUES -eq 0 ] && echo -e "A10: Exception Handling  - ${GREEN}PASS${NC}" || echo -e "A10: Exception Handling  - ${RED}FAIL${NC}"
-[ $FOUND_SECRETS -eq 0 ]       && echo -e "A01/A07: Secrets         - ${GREEN}PASS${NC}" || echo -e "A01/A07: Secrets         - ${RED}FAIL${NC}"
-echo -e "${CYAN}----------------------------------------------------${NC}"
-
-if [ $AUDIT_EXIT -eq 0 ] && [ $FOUND_ISSUES -eq 0 ] && [ $FOUND_SECRETS -eq 0 ] && [ $SUPPLY_CHAIN_ISSUES -eq 0 ] && [ $FOUND_EXCEPTION_ISSUES -eq 0 ]; then
-    echo -e "${GREEN}Final Result: SECURE${NC}"
-    exit 0
-else
-    echo -e "${RED}Final Result: VULNERABLE${NC}"
-    exit 1
-fi

package/.opencode/skills/logging-best-practices/SKILL.md

@@ -1,50 +0,0 @@
----
-name: Logging Best Practices
-description: Standardizes structured logging across Backend, Frontend, Realtime, and Algorithmic domains with mandatory exception handling.
----
-# Logging Best Practices
-
-Enforce structured, context-rich logging according to market standards (OpenTelemetry) across all application domains.
-
-## Policy
-
-**All logs must be structured (preferably JSON) and include mandatory context. Every exception MUST be logged with its full stack trace.**
-
-## Core Mandatory Fields
-
-Every log entry must contain:
-- `datetime`: ISO 8601 timestamp with timezone.
-- `severity`: Standard level (DEBUG, INFO, WARN, ERROR, CRITICAL).
-- `message`: Clear, concise description of the event.
-- `placement`: File name and line number where the log was triggered.
-- `process_name`: Name of the service or application.
-- `container_id`: (If applicable) Docker/K8s container identifier.
-- `trace_id` / `span_id`: For distributed tracing and request correlation.
-
-## Domain-Specific Requirements
-
-### 1. Backend Systems
-- **Log**: Incoming/outgoing requests (method, status, duration).
-- **Log**: Database query latencies and connection states.
-- **Mandatory**: Full exception details in catch blocks.
-
-### 2. Frontend Applications
-- **Log**: Client-side errors (JS runtime, UI crashes).
-- **Log**: User interaction context (last clicked component, breadcrumbs).
-- **Context**: Browser version, OS, Resolution.
-
-### 3. Realtime & Algorithmic Work
-- **Log**: Iteration throughput and step-by-step latency.
-- **Log**: Mathematical anomalies or convergence failures.
-- **Mandatory**: Timeout exceptions and resource exhaustion warnings.
-
-## Rules
-
-- **No PII/Secrets**: Never log passwords, keys, or private user data.
-- **Asynchronous**: Prefer non-blocking logging to maintain performance.
-- **Traceability**: Always include `trace_id` in logs that are part of a request flow.
-- **Exception Policy**: Use the `ERROR` level for caught exceptions that affect flow, and `CRITICAL` for system-wide failures.
-
-## Reference
-
-See [logging-standards.md](./references/logging-standards.md) for detailed field definitions and level guidance.

package/.opencode/skills/logging-best-practices/examples/cpp.md

@@ -1,36 +0,0 @@
-# C++ Logging Examples
-
-## Structured Logging with `spdlog`
-
-```cpp
-#include "spdlog/spdlog.h"
-#include "spdlog/sinks/stdout_color_sinks.h"
-#include <exception>
-
-void run_realtime_loop() {
-    auto logger = spdlog::get("realtime_logger");
-    
-    try {
-        // Realtime/Algorithmic domain logging
-        logger->info("Computation step started. Input size: {}. Placement: {}:{}", 
-                     1024, __FILE__, __LINE__);
-        
-        if (check_anomaly()) {
-            logger->warn("Numerical anomaly detected! Severity: WARN");
-        }
-        
-    } catch (const std::exception& e) {
-        // Mandatory Exception Logging
-        logger->critical("Critical failure in realtime loop! Error: {}. File: {}. Line: {}", 
-                        e.what(), __FILE__, __LINE__);
-        throw;
-    }
-}
-
-// Global setup for JSON output
-void setup_logging() {
-    // Note: spdlog requires a custom formatter or sink for pure JSON output 
-    // to match OTel standards perfectly.
-    spdlog::set_pattern("{\"datetime\":\"%Y-%m-%dT%H:%M:%SZ\",\"severity\":\"%l\",\"message\":\"%v\",\"process_name\":\"engine_v1\"}");
-}
-```

package/.opencode/skills/logging-best-practices/examples/csharp.md

@@ -1,49 +0,0 @@
-# C# Logging Examples
-
-## Structured Logging with Serilog
-
-```csharp
-using Serilog;
-using System;
-
-public class DataService
-{
-    private readonly ILogger _logger = Log.ForContext<DataService>();
-
-    public void ProcessAlgorithm(double[] data)
-    {
-        try
-        {
-            _logger.Information("Algorithm iteration started. Data points: {Count}. Placement: {Placement}", 
-                data.Length, "DataService.cs:45");
-
-            // Realtime/Algorithmic specific logging
-            var startTime = DateTime.UtcNow;
-            RunComplexMath(data);
-            var duration = (DateTime.UtcNow - startTime).TotalMilliseconds;
-
-            _logger.Information("Iteration complete. Latency: {Latency}ms", duration);
-        }
-        catch (Exception ex)
-        {
-            // Mandatory Exception Logging
-            _logger.Error(ex, "Algorithm execution failed at {Placement}. Container: {ContainerId}", 
-                "DataService.cs:55", Environment.GetEnvironmentVariable("HOSTNAME"));
-        }
-    }
-}
-```
-
-## Microsoft.Extensions.Logging (JSON Console)
-
-```csharp
-// In Program.cs
-builder.Logging.AddJsonConsole(options => {
-    options.TimestampFormat = "yyyy-MM-ddTHH:mm:ssZ ";
-    options.JsonWriterOptions = new JsonWriterOptions { Indented = true };
-});
-
-// Usage
-_logger.LogError(exception, "Request failed at {Placement}. TraceId: {TraceId}", 
-    "OrderController.cs:120", HttpContext.TraceIdentifier);
-```

package/.opencode/skills/logging-best-practices/examples/javascript.md

@@ -1,77 +0,0 @@
-# JavaScript/TypeScript Logging Examples
-
-## Backend (Node.js with `pino` or `winston`)
-
-```typescript
-import pino from 'pino';
-
-const logger = pino({
-  level: process.env.LOG_LEVEL || 'info',
-  formatters: {
-    level: (label) => {
-      return { severity: label.toUpperCase() };
-    },
-  },
-  base: {
-    process_name: 'api-gateway',
-    container_id: process.env.HOSTNAME || 'unknown'
-  }
-});
-
-async function handleRequest(req, res) {
-  const traceId = req.headers['x-trace-id'];
-  try {
-    logger.info({ 
-      msg: 'Handling incoming request', 
-      trace_id: traceId,
-      path: req.path,
-      placement: 'router.ts:12'
-    });
-    
-    // ... logic
-  } catch (error) {
-    // Mandatory Exception Logging
-    logger.error({
-      msg: 'Request handler failed',
-      trace_id: traceId,
-      err: error, // Pino automatically formats the stack trace
-      severity: 'ERROR',
-      placement: 'router.ts:25'
-    });
-    res.status(500).send('Internal Server Error');
-  }
-}
-```
-
-## Frontend (Browser)
-
-```javascript
-const logToServer = async (logEntry) => {
-  try {
-    await fetch('/api/logs', {
-      method: 'POST',
-      body: JSON.stringify({
-        ...logEntry,
-        datetime: new Date().toISOString(),
-        browser: navigator.userAgent,
-        process_name: 'frontend-spa'
-      })
-    });
-  } catch (e) {
-    console.error('Failed to ship logs', e);
-  }
-};
-
-// Global error handler
-window.onerror = function(msg, url, lineNo, columnNo, error) {
-  logToServer({
-    severity: 'ERROR',
-    message: msg,
-    placement: `${url}:${lineNo}`,
-    exception: {
-      message: error?.message,
-      stack: error?.stack
-    }
-  });
-};
-```

package/.opencode/skills/logging-best-practices/examples/python.md

@@ -1,57 +0,0 @@
-# Python Logging Examples
-
-## Structured Logging with `structlog`
-
-```python
-import structlog
-import os
-
-logger = structlog.get_logger()
-
-def process_data(data):
-    try:
-        # Algorithmic step logging
-        logger.info("calculation_step_started",
-                    step="matrix_multiplication",
-                    data_size=len(data),
-                    placement="processor.py:45")
-        
-        result = perform_complex_math(data)
-        return result
-    except Exception as e:
-        # Mandatory Exception Logging
-        logger.error("calculation_failed",
-                     exception_type=type(e).__name__,
-                     exception_msg=str(e),
-                     stack_trace=True, # structlog captures this
-                     severity="ERROR",
-                     placement="processor.py:52",
-                     container_id=os.getenv("HOSTNAME"))
-        raise
-```
-
-## Standard Library with JSON Formatter
-
-```python
-import logging
-import json
-from datetime import datetime
-
-class JsonFormatter(logging.Formatter):
-    def format(self, record):
-        log_entry = {
-            "datetime": datetime.utcnow().isoformat(),
-            "severity": record.levelname,
-            "message": record.getMessage(),
-            "placement": f"{record.filename}:{record.lineno}",
-            "process_name": record.processName,
-            "trace_id": getattr(record, 'trace_id', 'none')
-        }
-        if record.exc_info:
-            log_entry["exception"] = self.formatException(record.exc_info)
-        return json.dumps(log_entry)
-
-# usage
-logger = logging.getLogger("backend_service")
-logger.error("Database connection failed", exc_info=True)
-```

package/.opencode/skills/logging-best-practices/references/logging-standards.md

@@ -1,29 +0,0 @@
-# Logging Standards Reference
-
-This document defines the semantic conventions and levels used in the Logging Best Practices skill.
-
-## Log Levels
-
-| Level | Usage |
-| :--- | :--- |
-| **TRACE** | Fine-grained informational events (mostly for debugging logic flows). |
-| **DEBUG** | Detailed information for developer troubleshooting. |
-| **INFO** | Regular operational events (startup, shutdown, successful requests). |
-| **WARN** | Potential issues or degraded states that don't stop the service. |
-| **ERROR** | Operational failures that affect a specific request or operation. |
-| **CRITICAL** | System-wide failures requiring immediate attention. |
-
-## OpenTelemetry Semantic Conventions
-
-To ensure interoperability, use the following field names where possible:
-
-- `timestamp`: The time when the event occurred.
-- `severity_text`: The string representation of the log level.
-- `body`: The primary log message.
-- `attributes.service.name`: The value of `process_name`.
-- `attributes.container.id`: The value of `container_id`.
-- `attributes.code.filepath`: Path to the source file.
-- `attributes.code.lineno`: Line number in the source file.
-- `attributes.exception.type`: Class name of the exception.
-- `attributes.exception.message`: Message from the exception.
-- `attributes.exception.stacktrace`: Full stack trace.

package/.opencode/skills/mil498-ocd/SKILL.md

@@ -1,30 +0,0 @@
----
-name: mil498-ocd
-description: Generate MIL-STD-498 Operational Concept Description (OCD)
-type: complex-workflow
-triggers:
-  - "generate OCD"
-  - "create operational concept description"
----
-
-# MIL-498: Operational Concept Description (OCD)
-
-> MIL-STD-498 Data Item Description: DI-IPSC-81430
-
-## Workflow
-
-This workflow generates a MIL-STD-498 OCD document through progressive steps.
-The OCD describes the system from the user's and stakeholder's perspective, extracting operational concepts from existing project artifacts.
-
-### Steps
-
-1. [Discover Project Artifacts](prompts/01-discover-project-artifacts.md)
-2. [Load Template](prompts/02-load-template.md)
-3. [Generate Document](prompts/03-generate-document.md)
-4. [Validate](prompts/04-validate.md)
-5. [Review](prompts/05-review.md)
-6. [Save](prompts/06-save.md)
-
-### Template
-
-Output template: [template.md](template.md)

package/.opencode/skills/mil498-ocd/bmad-skill-manifest.yaml

@@ -1,5 +0,0 @@
-type: skill
-name: mil498-ocd
-module: ma-skills
-description: Generate MIL-STD-498 Operational Concept Description (OCD)
-version: "1.0.0"

package/.opencode/skills/mil498-ocd/prompts/01-discover-project-artifacts.md

@@ -1,26 +0,0 @@
-# Step 1 — Discover Project Artifacts
-
-Search the project for the following artifacts. Communicate in {communication_language}. Inform {user_name} which artifacts were found and which are missing.
-
-| Priority | Artifact | Search Pattern |
-|----------|----------|----------------|
-| Required | PRD | `**/prd.md`, `**/prd-*.md` |
-| Recommended | Architecture | `**/architecture.md`, `**/architecture-*.md` |
-| Recommended | UX Designs | `**/ux-design*.md`, `**/ux-*.md` |
-| Optional | Product Brief | `**/product-brief*.md` |
-| Optional | Epics & Stories | `**/epics*.md`, `**/stories/*.md` |
-
-If the **PRD** is missing, warn the user and ask whether to proceed with available data or stop.
-
-## Document Dependencies
-
-The OCD is the **first document** in the MIL-STD-498 generation chain. It has no MIL-STD-498 predecessor documents — it draws from project artifacts (PRD, Product Brief, UX Designs) only.
-
-**Note**: The OCD feeds into the SSS and other downstream documents. Ensure the operational scenarios and user descriptions are thorough, as they will be referenced by:
-- **SSS** — for deriving system requirements from operational needs
-- **SSDD** — for understanding operational context behind design decisions
-- **SDP** — for understanding the operational environment
-
----
-
-**CONFIRMATION GATE**: Present the list of discovered artifacts to the user. Wait for the user to confirm before proceeding to the next step.

package/.opencode/skills/mil498-ocd/prompts/02-load-template.md

@@ -1,10 +0,0 @@
-# Step 2 — Load Template
-
-Read the OCD template from:
-[template.md](../template.md)
-
-This defines the required DID sections and content expectations for each paragraph.
-
----
-
-**CONFIRMATION GATE**: Confirm to the user that the template has been loaded and summarize the major sections. Wait for the user to confirm before proceeding to document generation.