ma-agents 3.4.9 → 3.5.1

package/.opencode/skills/add-sprint/SKILL.md

@@ -1,207 +0,0 @@
----
-name: add-sprint
-description: Guided workflow to create a new sprint entity with capacity limits, optional ISO dates, and structured YAML schema for sprint planning
-type: skill
-triggers:
-  - "add sprint"
-  - "create sprint"
----
-
-# Add Sprint Workflow
-
-Guided workflow to create a new sprint entity with capacity limits, optional ISO dates, and structured YAML schema.
-
-<workflow>
-
-<step n="1" goal="Gather and validate sprint number and name">
-  <action>Ask the user for the sprint number</action>
-  <ask>What is the sprint number? (positive integer, e.g., 1, 2, 3)</ask>
-  <action>Store input as {{sprint_number_input}}</action>
-  <action>Validate {{sprint_number_input}} matches `^[1-9]\d*$` (positive integer, no leading zeros, no non-numeric characters)</action>
-  <action>Validate {{sprint_number_input}} is <= 9999</action>
-  <check if="{{sprint_number_input}} fails validation (zero, negative, non-numeric, leading zeros like '03', or > 9999)">
-    <output>❌ Invalid sprint number: "{{sprint_number_input}}". Must be a positive integer (1-9999), no leading zeros.</output>
-    <goto step="1" />
-  </check>
-  <action>Store as {{sprint_number}} (integer)</action>
-  <action>Construct {{sprint_id}} = "sprint-{{sprint_number}}"</action>
-
-  <!-- Smart default name: detect naming patterns from existing sprints -->
-  <action>Glob `_bmad-output/implementation-artifacts/sprints/sprint-*.yaml` to discover existing sprint files</action>
-  <action>If existing sprints found, read the `name` field from the most recent one (highest sprint number)</action>
-  <action>Infer a smart default name:
-    - If previous name follows a sequential pattern with a numeric suffix (e.g., "app04"), suggest the next increment (e.g., "app05")
-    - If previous name follows a date pattern (e.g., "2026-W14"), suggest the next date interval
-    - If previous name is "Sprint {n}", suggest "Sprint {{sprint_number}}"
-    - If no pattern detected or no existing sprints, default to "Sprint {{sprint_number}}"
-  </action>
-  <ask>Sprint name? (press Enter for "{{default_name}}", or type a custom name):</ask>
-  <action>If user presses Enter or leaves blank, set {{sprint_name}} = "{{default_name}}"</action>
-  <action>If user provides input, store as {{sprint_name}}</action>
-</step>
-
-<step n="2" goal="Gather capacity as positive integer">
-  <action>Explain capacity: the maximum number of items (stories + bugs) that can be assigned to this sprint</action>
-  <ask>What is the sprint capacity? (Enter a positive integer — the maximum number of stories/bugs for this sprint)</ask>
-  <action>Store input as {{capacity_input}}</action>
-  <action>Validate {{capacity_input}} is a positive integer (greater than zero, no decimals, no non-numeric characters)</action>
-  <check if="{{capacity_input}} is NOT a positive integer">
-    <output>❌ Invalid capacity: "{{capacity_input}}". Capacity must be a positive integer (e.g., 5, 10, 20). Zero and negative values are not allowed.</output>
-    <goto step="2" />
-  </check>
-  <action>Store as {{capacity}} (integer)</action>
-</step>
-
-<step n="3a" goal="Gather optional start date (ISO format)">
-  <action>Explain: start and end dates are optional ISO dates (YYYY-MM-DD format). Press Enter to skip.</action>
-  <ask>Optional — Sprint start date (YYYY-MM-DD, press Enter to skip):</ask>
-  <action>Store input as {{start_input}}</action>
-  <check if="{{start_input}} is not empty">
-    <action>Validate {{start_input}} matches regex `^\d{4}-\d{2}-\d{2}$`</action>
-    <action>Verify {{start_input}} resolves to a real calendar date (reject impossible dates like 2026-02-30, 2026-13-45, etc.)</action>
-    <check if="{{start_input}} fails date validation">
-      <output>❌ Invalid date: "{{start_input}}". Must be a valid date in YYYY-MM-DD format (e.g., 2026-04-01).</output>
-      <goto step="3a" />
-    </check>
-  </check>
-  <action>Store as {{start_date}} (valid ISO date string, or empty string "" if skipped)</action>
-</step>
-
-<step n="3b" goal="Gather optional end date (ISO format)">
-  <ask>Optional — Sprint end date (YYYY-MM-DD, press Enter to skip):</ask>
-  <action>Store input as {{end_input}}</action>
-  <check if="{{end_input}} is not empty">
-    <action>Validate {{end_input}} matches regex `^\d{4}-\d{2}-\d{2}$`</action>
-    <action>Verify {{end_input}} resolves to a real calendar date</action>
-    <check if="{{end_input}} fails date validation">
-      <output>❌ Invalid date: "{{end_input}}". Must be a valid date in YYYY-MM-DD format (e.g., 2026-04-14).</output>
-      <goto step="3b" />
-    </check>
-  </check>
-  <action>Store as {{end_date}} (valid ISO date string, or empty string "" if skipped)</action>
-
-  <check if="both {{start_date}} and {{end_date}} are non-empty AND {{start_date}} > {{end_date}}">
-    <output>❌ Invalid date range: start date ({{start_date}}) is after end date ({{end_date}}). Start must be on or before end.</output>
-    <goto step="3a" />
-  </check>
-</step>
-
-<step n="4" goal="Confirm and validate all inputs">
-  <output>
-## Sprint Summary — Please Confirm
-
-- **Sprint ID:** {{sprint_id}}
-- **Sprint Name:** "{{sprint_name}}"
-- **Status:** planning
-- **Capacity (max items):** {{capacity}}
-- **Start Date:** {{start_date}} *(empty if skipped)*
-- **End Date:** {{end_date}} *(empty if skipped)*
-- **Items:** [] *(empty — items assigned via /add-to-sprint)*
-- **Output File:** `_bmad-output/implementation-artifacts/sprints/{{sprint_id}}.yaml`
-  </output>
-  <ask>Confirm creation? [y] Yes / [n] Cancel / [e] Edit a field:</ask>
-  <check if="user selects 'e'">
-    <ask>Which field to edit? (number / name / capacity / start / end)</ask>
-    <check if="field == 'number'">
-      <ask>New sprint number? (positive integer, 1-9999)</ask>
-      <action>Store input as {{sprint_number_input}}</action>
-      <action>Validate {{sprint_number_input}} matches `^[1-9]\d*$` and is <= 9999</action>
-      <check if="{{sprint_number_input}} fails validation">
-        <output>❌ Invalid sprint number: "{{sprint_number_input}}". Must be a positive integer (1-9999), no leading zeros.</output>
-        <goto step="4" />
-      </check>
-      <action>Store as {{sprint_number}} (integer)</action>
-      <action>Construct {{sprint_id}} = "sprint-{{sprint_number}}"</action>
-      <action>If sprint name was using previous default "Sprint {old_n}", update to "Sprint {{sprint_number}}"</action>
-      <action>Check if file exists at `_bmad-output/implementation-artifacts/sprints/{{sprint_id}}.yaml`</action>
-      <check if="file already exists at new path">
-        <output>⚠️ A sprint entity already exists at `_bmad-output/implementation-artifacts/sprints/{{sprint_id}}.yaml`. You will be prompted to overwrite at creation.</output>
-      </check>
-      <goto step="4" />
-    </check>
-    <check if="field == 'name'">
-      <ask>New sprint name (or press Enter to use "Sprint {{sprint_number}}"):</ask>
-      <action>If blank, set {{sprint_name}} = "Sprint {{sprint_number}}"; else store user input as {{sprint_name}}</action>
-      <goto step="4" />
-    </check>
-    <check if="field == 'capacity'"><goto step="2" /></check>
-    <check if="field == 'start'"><goto step="3a" /></check>
-    <check if="field == 'end'"><goto step="3b" /></check>
-    <check if="field is not recognized">
-      <output>❌ Unrecognized field: "{{field}}". Valid options: number, name, capacity, start, end.</output>
-      <goto step="4" />
-    </check>
-  </check>
-  <check if="user selects 'n'">
-    <output>❌ Sprint creation cancelled.</output>
-    <action>Exit workflow</action>
-  </check>
-  <check if="user input is not 'y', 'n', or 'e'">
-    <output>❌ Unrecognized option: "{{user_input}}". Please enter [y] Yes, [n] Cancel, or [e] Edit a field.</output>
-    <goto step="4" />
-  </check>
-</step>
-
-<step n="5" goal="Generate sprint entity YAML file">
-  <action>Determine output path: `_bmad-output/implementation-artifacts/sprints/{{sprint_id}}.yaml`</action>
-  <action>Ensure directory `_bmad-output/implementation-artifacts/sprints/` exists (create if needed)</action>
-
-  <!-- Overwrite protection for new path -->
-  <action>Check if file already exists at `_bmad-output/implementation-artifacts/sprints/{{sprint_id}}.yaml`</action>
-  <check if="file already exists at new path">
-    <anchor id="overwrite_prompt" />
-    <output>⚠️ A sprint entity already exists at `_bmad-output/implementation-artifacts/sprints/{{sprint_id}}.yaml`.</output>
-    <ask>Overwrite existing sprint? [y] Yes / [n] Cancel:</ask>
-    <check if="user selects 'n'">
-      <output>❌ Sprint creation cancelled to preserve existing sprint.</output>
-      <action>Exit workflow</action>
-    </check>
-    <check if="user input is not 'y' or 'n'">
-      <output>❌ Unrecognized option: "{{user_input}}". Please enter [y] Yes or [n] Cancel.</output>
-      <goto anchor="overwrite_prompt" />
-    </check>
-  </check>
-
-  <!-- Advisory check for old-format file -->
-  <action>Check if file exists at old path: `_bmad-output/implementation-artifacts/sprint-plan-{{sprint_number}}.yaml`</action>
-  <check if="old-format file exists">
-    <output>ℹ️ **Note:** An old-format sprint file exists at `_bmad-output/implementation-artifacts/sprint-plan-{{sprint_number}}.yaml`. The new sprint will be created at the new path. The old file is NOT auto-migrated — review or remove it manually if no longer needed.</output>
-  </check>
-
-  <action>Get current ISO timestamp for created_date and last_modified</action>
-  <action>Write sprint entity YAML to `_bmad-output/implementation-artifacts/sprints/{{sprint_id}}.yaml` with this structure:
-
-```yaml
-id: {{sprint_id}}
-name: "{{sprint_name}}"
-status: planning
-capacity: {{capacity}}
-start: "{{start_date}}"
-end: "{{end_date}}"
-items: []
-created_date: "{{current_iso_timestamp}}"
-last_modified: "{{current_iso_timestamp}}"
-```
-
-  **YAML output rules:**
-  - Always quote the `name` field to handle special characters
-  - `start` and `end` are empty string `""` if skipped
-  - `items` is always empty array `[]` at creation
-  - `status` is always `planning` at creation (never `active` or `closed`)
-  </action>
-  <output>
-✅ **Sprint created successfully!**
-
-- **File:** `_bmad-output/implementation-artifacts/sprints/{{sprint_id}}.yaml`
-- **Sprint:** {{sprint_name}}
-- **Capacity:** {{capacity}} items
-- **Status:** planning
-
-**Next Steps:**
-- Use `/add-to-sprint` to assign backlog items to this sprint
-- Use `/modify-sprint` to update sprint details later
-- Use `/sprint-status-view` to view sprint progress
-  </output>
-</step>
-
-</workflow>

package/.opencode/skills/add-sprint/bmad-skill-manifest.yaml

@@ -1,3 +0,0 @@
-type: skill
-name: add-sprint
-module: ma-skills

package/.opencode/skills/add-to-sprint/SKILL.md

@@ -1,189 +0,0 @@
----
-name: add-to-sprint
-description: Guided workflow to assign backlog items to a sprint from the flat prioritized backlog
-type: skill
-triggers:
-  - "add to sprint"
-  - "assign to sprint"
----
-
-# Add-to-Sprint Workflow
-
-Guided workflow to assign unassigned backlog items to a sprint from the flat prioritized backlog.
-
-<workflow>
-
-<step n="1" goal="Load backlog and identify unassigned items">
-  <action>Read `_bmad-output/implementation-artifacts/backlog.yaml`</action>
-  <action>Parse the `backlog` array. Filter items where `sprint` is `null` (unassigned).</action>
-  <action>Sort filtered items by `priority` ascending (lowest number = highest priority).</action>
-  <action>Store as {{unassigned_items}} list.</action>
-  <check if="no unassigned items remain">
-    <output>All backlog items are already assigned to sprints. Nothing to assign.</output>
-    <action>Exit workflow</action>
-  </check>
-</step>
-
-<step n="2" goal="Load sprints and select target">
-  <action>Glob `_bmad-output/implementation-artifacts/sprints/sprint-*.yaml` to discover all sprint files</action>
-  <check if="no sprint files found">
-    <output>No sprints exist. Run `/add-sprint` first to create a sprint before assigning items.</output>
-    <action>Exit workflow</action>
-  </check>
-  <action>Read each sprint file; extract: id, name, status, capacity, items (array length = assigned count)</action>
-  <action>Sort sprints by status: `active` first, then `planning`, then `closed`</action>
-  <action>Display sprints table (closed sprints shown but marked as not selectable):</action>
-  <output>
-## Available Sprints
-
-| # | ID | Name | Status | Capacity | Assigned | Remaining |
-|---|---|---|---|---|---|---|
-{{#each sprints}}
-| {{@index+1}} | {{id}} | {{name}} | {{status}} | {{capacity}} | {{assigned_count}} | {{remaining}} |
-{{/each}}
-
-*Closed sprints are shown for reference but cannot be selected.*
-  </output>
-  <check if="exactly one active sprint exists">
-    <output>Auto-selecting active sprint: {{active_sprint.name}} ({{active_sprint.id}})</output>
-    <ask>Proceed with this sprint? [y] Yes / [n] Choose a different sprint:</ask>
-    <check if="user selects 'y'">
-      <action>Set {{target_sprint}} = the active sprint</action>
-    </check>
-    <check if="user selects 'n'">
-      <ask>Select target sprint by number (active or planning only):</ask>
-      <action>Validate selection is not a closed sprint</action>
-      <action>Store as {{target_sprint}}</action>
-    </check>
-  </check>
-  <check if="no active sprint exists OR multiple active/planning sprints">
-    <ask>Select target sprint by number (active or planning only):</ask>
-    <action>Validate selection is not a closed sprint</action>
-    <check if="user selected a closed sprint">
-      <output>Closed sprints cannot receive new items. Select an active or planning sprint.</output>
-      <goto step="2" />
-    </check>
-    <action>Store as {{target_sprint}}</action>
-  </check>
-</step>
-
-<step n="3" goal="Display sprint capacity and unassigned backlog items">
-  <action>Calculate: {{assigned_count}} = length of {{target_sprint.items}}</action>
-  <action>Calculate: {{remaining_capacity}} = {{target_sprint.capacity}} - {{assigned_count}}</action>
-  <output>
-## Sprint Capacity: {{target_sprint.name}} ({{target_sprint.id}})
-
-[{{capacity_bar}}] {{assigned_count}}/{{target_sprint.capacity}} items ({{remaining_capacity}} remaining)
-
-{{#if remaining_capacity <= 0}}
-Warning: This sprint is at or over capacity. Adding items will exceed the limit.
-{{/if}}
-  </output>
-
-  <action>Take the top 20 items from {{unassigned_items}} (or all if fewer than 20)</action>
-  <output>
-## Unassigned Backlog Items
-
-| # | ID | Title | Type | Priority | Severity |
-|---|---|---|---|---|---|
-{{#each displayed_items}}
-| {{@index+1}} | {{id}} | {{title}} | {{type}} | {{priority}} | {{severity_or_na}} |
-{{/each}}
-
-*Showing {{displayed_count}} of {{total_unassigned}} unassigned items.*
-  </output>
-</step>
-
-<step n="4" goal="Prompt for item selection">
-  <ask>Select items to add (comma-separated numbers, 'all' for all shown, or 'q' to cancel):</ask>
-  <check if="user enters 'q'">
-    <output>Assignment cancelled -- no changes made.</output>
-    <action>Exit workflow</action>
-  </check>
-  <check if="user enters 'all'">
-    <action>Set {{selected_items}} = all displayed items from step 3</action>
-  </check>
-  <check if="user enters comma-separated numbers">
-    <action>Parse and validate each number is within the displayed list range</action>
-    <check if="any number is invalid or out of range">
-      <output>Invalid selection: {{invalid_numbers}}. Enter numbers from the list above.</output>
-      <goto step="4" />
-    </check>
-    <action>Set {{selected_items}} = the items corresponding to the entered numbers</action>
-  </check>
-</step>
-
-<step n="5" goal="Capacity check and assignment">
-  <action>For each item in {{selected_items}}, in order:</action>
-  <action>Re-calculate current assigned count (accounts for items already added in this session)</action>
-  <check if="adding this item would exceed capacity">
-    <output>Capacity Warning: Adding "{{item.title}}" ({{item.id}}) would bring assigned items to {{new_count}}/{{target_sprint.capacity}} -- exceeding sprint capacity by {{overage}}.</output>
-    <ask>Options:
-- [a] Add anyway (over-capacity acknowledged)
-- [s] Skip this item
-- [q] Quit (stop assigning, keep items already assigned this session)
-
-Choice:</ask>
-    <check if="user selects 's'">
-      <action>Skip this item -- do not add to sprint. Continue to next item.</action>
-    </check>
-    <check if="user selects 'q'">
-      <action>Stop processing remaining items. Proceed to step 6 with items confirmed so far.</action>
-    </check>
-    <check if="user selects 'a'">
-      <action>Proceed with adding this item despite over-capacity.</action>
-    </check>
-  </check>
-  <action>For each confirmed item:
-    - Add item ID to {{target_sprint}}.items array
-    - Set item's `sprint` field in backlog.yaml to {{target_sprint.id}}
-    - Update {{target_sprint}}.last_modified to current ISO timestamp
-  </action>
-  <action>Store all confirmed items as {{assigned_items}} for the summary.</action>
-</step>
-
-<step n="6" goal="Persist changes and display summary">
-  <check if="no items were confirmed for assignment">
-    <output>No items were assigned. No files modified.</output>
-    <action>Exit workflow</action>
-  </check>
-  <action>**Dual-write — both files must be updated for consistency:**</action>
-  <action>Write updated `_bmad-output/implementation-artifacts/backlog.yaml`:
-    - Preserve all existing fields on all items
-    - Only the `sprint` field changes on assigned items (set to {{target_sprint.id}})
-  </action>
-  <check if="backlog.yaml write fails">
-    <output>**Error:** Failed to write backlog.yaml. No changes persisted. Sprint file NOT modified.</output>
-    <action>Exit workflow</action>
-  </check>
-  <action>Write updated `_bmad-output/implementation-artifacts/sprints/{{target_sprint.id}}.yaml`:
-    - Append confirmed item IDs to the `items` array
-    - Update `last_modified` to current ISO timestamp
-    - Preserve all other fields unchanged
-  </action>
-  <check if="sprint file write fails">
-    <output>**Warning: Inconsistent state!** backlog.yaml was updated but sprint file write failed. The `sprint` field in backlog.yaml now references {{target_sprint.id}} but the sprint file's `items` array is stale. Re-run `/add-to-sprint` or manually fix `sprints/{{target_sprint.id}}.yaml`.</output>
-  </check>
-  <action>**Do NOT read or write sprint-plan-*.yaml or sprint-status.yaml**</action>
-  <output>
-## Assignment Complete
-
-**Sprint:** {{target_sprint.name}} ({{target_sprint.id}})
-**Items assigned this session:** {{assigned_count_this_session}}
-
-| # | ID | Title | Type | Priority |
-|---|---|---|---|---|
-{{#each assigned_items}}
-| {{@index+1}} | {{id}} | {{title}} | {{type}} | {{priority}} |
-{{/each}}
-
-**Capacity Usage:** {{new_assigned_total}}/{{target_sprint.capacity}} items ({{new_remaining}} remaining)
-
-**Next Steps:**
-- Use `/add-to-sprint` again to assign more items
-- Use `/modify-sprint` to adjust capacity or remove items
-- Use `/sprint-status-view` to view the full sprint with all assigned items
-  </output>
-</step>
-
-</workflow>

package/.opencode/skills/add-to-sprint/bmad-skill-manifest.yaml

@@ -1,3 +0,0 @@
-type: skill
-name: add-to-sprint
-module: ma-skills

package/.opencode/skills/ai-audit-trail/SKILL.md

@@ -1,23 +0,0 @@
----
-name: AI Audit Trail
-description: Tracks AI agent session activity, time spent, and token usage in a project-level AiAudit.md log file.
----
-# AI Audit Trail
-
-At the end of every significant agent session, append an entry to `{project_root}/AiAudit.md`. If the file does not exist, create it with a `# AI Audit Trail` header first.
-
-## Entry Format
-
-```markdown
-| Date | Task | Tokens (est.) |
-|------|------|---------------|
-| YYYY-MM-DD | Brief task description | In: ~X / Out: ~Y |
-```
-
-## Rules
-
-- **Append only** — never delete or modify previous entries
-- **One row per session** — combine multiple tasks in the same session into one entry
-- **Estimate tokens** — round to nearest thousand, prefix with `~`. Write `N/A` if unknown
-- Write the entry as the **last action** before presenting results to the user
-- Skip trivial interactions (single-question answers, quick lookups)

package/.opencode/skills/auto-bug-detection/SKILL.md

@@ -1,169 +0,0 @@
----
-name: auto-bug-detection
-description: Instructs agents to identify and report defects in already-delivered code
----
-# Auto Bug Detection
-
-Proactively identify and report defects found in already-delivered code during all agent sessions.
-
-## Purpose
-
-When you encounter code that has already been delivered (story/task marked done), you must scan for defects
-and report them using the structured format below. Do not silently ignore bugs in delivered code.
-
-## Detection Scope
-
-### Delivered Code (MUST scan and report bugs)
-
-- Code whose associated story/task is marked **done** or **completed**, regardless of branch.
-- Committed code on `main` or release branches.
-- Committed code on feature branches whose **parent story is completed**.
-
-### Work-in-Progress (DO NOT flag as bugs)
-
-- Uncommitted changes in the working tree.
-- Committed code on a branch whose associated story is still **in-progress** or **not-started**.
-- `TODO` / `FIXME` markers in code added as part of the **current story under review**.
-- Incomplete implementations explicitly tied to an active story.
-
-### Ambiguous Boundary — Feature Branches
-
-Committed code on a feature branch where the story status is **unknown** must be treated as WIP.
-
-To resolve the status, use the `story-status-lookup` skill — it defines how to identify the story slug,
-which file to read, and how to map status values to delivered vs WIP. Follow its fallback rule:
-when status cannot be determined, **default to WIP and do NOT flag as a bug**.
-
----
-
-## Detection Criteria
-
-Scan delivered code for the following categories of defects. Each category includes examples of what qualifies.
-
-### 1. Logic Errors
-
-Incorrect computational logic, wrong conditionals, or inverted boolean expressions that cause the code
-to produce incorrect results.
-
-**Examples:**
-- Using `>` instead of `>=` in a boundary check, silently excluding a valid edge value.
-- An accumulator initialized to `1` instead of `0`, skewing totals.
-- A loop that iterates one too many or one too few times (off-by-one error).
-
-### 2. Unhandled Edge Cases
-
-Inputs or states that the code does not handle, leading to incorrect behavior or crashes.
-
-**Examples:**
-- A function that accepts a list but does not handle an empty list, throwing an index error.
-- A parser that crashes on a valid but empty string input.
-- Division without a zero-check on the divisor.
-
-### 3. Missing Error Handling
-
-Absence of error handling for operations that can fail, causing unhandled exceptions or silent failures.
-
-**Examples:**
-- File I/O calls with no try/catch, crashing the process on a missing file.
-- Network requests with no timeout or error callback.
-- A database query whose rejection is swallowed without logging or recovery.
-
-### 4. Broken Contracts
-
-Code that violates the API contract it published: wrong return types, missing required fields in
-responses, or side effects not documented in the interface.
-
-**Examples:**
-- A function documented to return `string | null` but sometimes returns `undefined`.
-- A REST endpoint returning HTTP 200 for a failed operation instead of the correct 4xx/5xx code.
-- A class method mutating shared state that is not documented as a side effect.
-
-### 5. Regressions
-
-Previously working behavior that is now broken, typically introduced by a change in a related component.
-
-**Examples:**
-- A utility function refactored to accept a new parameter that broke all existing callers that pass no argument.
-- A config key renamed in one place but not updated in all consumers, causing silent runtime failures.
-- A test that was green before a dependency upgrade and now fails due to an incompatible API change.
-
-### 6. Security Vulnerabilities
-
-Code patterns that introduce exploitable security weaknesses in existing, delivered functionality.
-
-**Examples:**
-- User-supplied input passed directly into a shell command without sanitization (command injection).
-- Secrets or API keys hard-coded in source files committed to the repository.
-- SQL queries constructed via string concatenation with unsanitized user input (SQL injection).
-- Sensitive data (passwords, tokens) logged at INFO level in production code.
-
----
-
-## Reporting Format
-
-When a defect is detected in delivered code, report it using this structured template:
-
-```
-## Bug Report
-
-**Title:** [Short, descriptive title]
-**Severity:** [critical | high | medium | low]
-**Category:** [logic-error | unhandled-edge-case | missing-error-handling | broken-contract | regression | security-vulnerability]
-**Affected Component:** [Module, file, or system area]
-
-**Reproduction Steps:**
-1. [Step 1]
-2. [Step 2]
-
-**Expected Behavior:**
-[What should happen]
-
-**Actual Behavior:**
-[What actually happens]
-
-**Affected Files:**
-- path/to/file.ext (line N)
-```
-
-**Severity Guidelines:**
-- `critical` — Data loss, security breach, or system crash in normal usage.
-- `high` — Core feature broken or serious security risk; blocks users.
-- `medium` — Feature partially broken or degraded; workaround exists.
-- `low` — Minor issue, cosmetic defect, or edge case with minimal user impact.
-
----
-
-## What NOT to Flag
-
-Do **not** report the following as bugs:
-
-- **Work-in-progress code** — Uncommitted changes or code on a branch with an active story.
-- **TODO / FIXME comments** in code added as part of the **current story** being reviewed.
-- **Incomplete implementations** explicitly tied to an active or not-yet-started story.
-- **Style preferences** — Naming conventions, formatting, or architectural opinions not related to correctness.
-- **Speculative issues** — Theoretical attack scenarios or failure modes with no demonstrable code path in the current codebase (e.g., an attack vector that requires filesystem access the process can never obtain).
-
----
-
-## Required Action on Detection
-
-The required action depends on severity:
-
-### critical or high severity
-
-**Immediately run `/create-bug-story`** without waiting for user confirmation. These defects represent
-broken core functionality or security risks that must not be left untracked. Inform the user as you act:
-
-> "I found a **[severity]** bug in delivered code — running `create-bug-story` now to ensure it is tracked."
-
-Do not ask permission. Do not proceed with other tasks until the bug story is created.
-
-### medium or low severity
-
-**Recommend** that the user create a formal bug story, but do not act without their confirmation:
-
-> "I found a **[severity]** bug in delivered code. Would you like me to run `create-bug-story` to log it
-> formally so it can be scheduled in the sprint?"
-
-If the user declines or does not respond, note the finding in your response and continue. The bug report
-remains visible in the conversation but is not written to a file.