macca-method 2.1.1 → 2.1.3

package/.agents/skills/brainstorm-architecture/SKILL.md

@@ -20,6 +20,7 @@ Run as `@Fachri` (Tech Lead). Use the shared persona profile in `../_shared/refe
 You are **@Fachri — Tech Lead**, a **Senior Software Architect** who designs scalable, maintainable, secure systems.
 
 **Expertise:**
+
 - System design and tech stack selection for the project
 - Design patterns (MVC, Clean Architecture, Feature-based, Hexagonal)
 - Architecture-level scalability, reliability, and security
@@ -53,12 +54,12 @@ Before any interview:
 1. Load after `PRD.md` is complete.
 
 2. **Read existing project-context**:
-    - `project-context/PRD.md` — features, users, constraints
+   - `project-context/PRD.md` — features, users, constraints
 
 3. If `.agents/developer-config.json` exists, read `developerPreferences.scope`.
-    - `frontend` → architecture.md MUST focus on frontend architecture and backend/API dependencies only
-    - `backend` → architecture.md MUST focus on backend architecture, service/data/auth, and consumer dependencies only
-    - `fullstack` → full architecture.md
+   - `frontend` → architecture.md MUST focus on frontend architecture and backend/API dependencies only
+   - `backend` → architecture.md MUST focus on backend architecture, service/data/auth, and consumer dependencies only
+   - `fullstack` → full architecture.md
 
 4. Run the shared runtime setup above and apply all three pacing modes from the shared session policy. If preferences are saved, announce and proceed without another confirmation.
 
@@ -75,18 +76,22 @@ Before any interview:
 Ask the topics in order and wait after each selected batch, not after every topic when batching is enabled.
 
 ### 1. System Context
-*"What systems and external services interact with this project?"*
+
+_"What systems and external services interact with this project?"_
 
 Collect:
+
 - System users (end users, admins, etc.)
 - External services (payments, email, SMS, maps, OAuth)
 - Internal system connections
 - Incoming/outgoing data flows
 
 ### 2. Tech Stack
-*"What is the tech stack: frontend, backend, database, hosting, CI/CD?"*
+
+_"What is the tech stack: frontend, backend, database, hosting, CI/CD?"_
 
 Collect:
+
 - Frontend: framework & version
 - Backend: language, framework & version
 - Database: type & version
@@ -96,51 +101,63 @@ Collect:
 - For each strategic dependency/vendor: existing/native alternative, runtime compatibility, maintenance health, license, security advisories, operational cost, lock-in, migration path, and removal/exit path
 
 ### 3. State Management
-*"If there is a frontend, how is state managed?"*
+
+_"If there is a frontend, how is state managed?"_
 
 Collect:
+
 - Client state: Redux, Zustand, Jotai, Recoil, Context API
 - Server state: React Query, SWR, or built-in
 - Form state: React Hook Form, Formik, or native
 - State persistence (localStorage, sessionStorage)?
 
 ### 4. API Design
-*"How does frontend-backend communication work: REST, GraphQL, tRPC, or something else?"*
+
+_"How does frontend-backend communication work: REST, GraphQL, tRPC, or something else?"_
 
 Collect:
+
 - API pattern (REST, GraphQL, tRPC, or a combination)
 - Real-time needs? (WebSocket, SSE, long polling)
 - Microservice communication?
 
 ### 5. Folder Structure
-*"What folder structure do you want: framework default or custom?"*
+
+_"What folder structure do you want: framework default or custom?"_
 
 Collect:
+
 - Framework default or custom approach
 - Feature-based (by feature) or layer-based (controller/service/model)
 - Any reference structure
 
 ### 6. Design Pattern
-*"What architecture pattern do you want: MVC, Clean Architecture, modular, or something else?"*
+
+_"What architecture pattern do you want: MVC, Clean Architecture, modular, or something else?"_
 
 Collect:
+
 - Main pattern (MVC, Feature-based, Clean Architecture, Hexagonal)
 - Separation of concerns (routes → controller → service → repository)
 - Dependency injection approach
 
 ### 7. Authentication & Authorization
-*"What auth method is used: JWT, session, OAuth? How are roles and permissions enforced?"*
+
+_"What auth method is used: JWT, session, OAuth? How are roles and permissions enforced?"_
 
 Collect:
+
 - Authentication (JWT, Session cookies, OAuth2)
 - Provider (Google, GitHub, custom)
 - RBAC (Role-Based Access Control)?
 - Token storage (recommended httpOnly cookie vs localStorage)
 
 ### 8. Security & Abuse Cases
-*"What data is sensitive, and what attacks must the architecture prevent?"*
+
+_"What data is sensitive, and what attacks must the architecture prevent?"_
 
 Collect:
+
 - Sensitive data types (PII, tokens, payment data, documents)
 - Critical actions (login, password reset, payment, file upload, admin actions)
 - Abuse scenarios: brute force, spam, IDOR, privilege escalation, CSRF, replay, webhook forgery, file abuse
@@ -148,9 +165,11 @@ Collect:
 - Audit log requirements
 
 ### 9. Deployment & Infrastructure
-*"Where will this run? Are staging and production separate?"*
+
+_"Where will this run? Are staging and production separate?"_
 
 Collect:
+
 - Hosting platform (Vercel, Railway, Fly.io, Docker+VPS, AWS, GCP)
 - Environment separation (dev, staging, prod)?
 - CI/CD strategy
@@ -162,9 +181,11 @@ Collect:
 - For critical depth: backup/restore ownership, tested restore process, RPO, RTO, and regional/dependency failure behavior
 
 ### 10. Architecture Decision Records (ADR)
-*"Are there key architecture decisions whose rationale should be documented?"*
+
+_"Are there key architecture decisions whose rationale should be documented?"_
 
 Collect:
+
 - Non-obvious decisions (why PostgreSQL vs MongoDB)
 - Structural decisions with hidden rationale
 - Trade-offs considered
@@ -195,5 +216,4 @@ Adapt only sections that are applicable and preserve every required contract fro
 - Use the strategic dependency checklist only for architecture-level choices; local packages remain a `developer` decision.
 - Render the final document in the configured document language
 
-
 ---

package/.agents/skills/brainstorm-architecture/assets/architecture.template.md

@@ -3,19 +3,21 @@
 > **Version:** 1.0 | **Date:** [date]
 
 ## Document Role
+
 - **Source of Truth:** System design, technical constraints, and architecture decisions
 - **Primary Owner:** `brainstorm-architecture`
 - **Out of Scope:** Detailed API payload schemas, per-table database columns, UI design tokens, and task sequencing
 
 ## System Boundaries
-| Topic | Canonical Document |
-|-------|--------------------|
-| Product scope and business intent | `project-context/PRD.md` |
-| Data model and field-level contracts | `project-context/schema.md` |
-| Endpoint contracts and error payloads | `project-context/api.md` |
-| UI language and component styling | `project-context/StyleGuide.md` |
-| Coding standards and AI behavior | `project-context/rules.md` |
-| Execution order and implementation plan | `project-context/Task.md` |
+
+| Topic                                   | Canonical Document              |
+| --------------------------------------- | ------------------------------- |
+| Product scope and business intent       | `project-context/PRD.md`        |
+| Data model and field-level contracts    | `project-context/schema.md`     |
+| Endpoint contracts and error payloads   | `project-context/api.md`        |
+| UI language and component styling       | `project-context/StyleGuide.md` |
+| Coding standards and AI behavior        | `project-context/rules.md`      |
+| Execution order and implementation plan | `project-context/Task.md`       |
 
 ---
 
@@ -24,36 +26,42 @@
 **Users:** [End Users, Admins, etc.]
 
 **External Services:**
-| Service | Purpose | Protocol |
-|---------|---------|----------|
+
+| Service   | Purpose   | Protocol           |
+| --------- | --------- | ------------------ |
 | [Service] | [Purpose] | REST / SDK / OAuth |
 
 ## 2. Tech Stack
-| Layer | Technology | Version | Notes |
-|-------|------------|---------|-------|
+
+| Layer    | Technology  | Version   | Notes   |
+| -------- | ----------- | --------- | ------- |
 | Frontend | [Framework] | [Version] | [Notes] |
-| Backend | [Framework] | [Version] | [Notes] |
-| Database | [Database] | [Version] | [Notes] |
-| ORM | [ORM] | [Version] | [Notes] |
-| Language | [Language] | [Version] | [Notes] |
+| Backend  | [Framework] | [Version] | [Notes] |
+| Database | [Database]  | [Version] | [Notes] |
+| ORM      | [ORM]       | [Version] | [Notes] |
+| Language | [Language]  | [Version] | [Notes] |
 
 ### Strategic Dependency Evaluation
-| Dependency/Vendor | Why Needed | Native/Existing Alternative | License & Health | Lock-in / Exit Path | Decision |
-|-------------------|------------|-----------------------------|------------------|---------------------|----------|
-| [name] | [reason] | [alternative] | [evidence] | [migration/removal] | Accepted / Proposed |
+
+| Dependency/Vendor | Why Needed | Native/Existing Alternative | License & Health | Lock-in / Exit Path | Decision            |
+| ----------------- | ---------- | --------------------------- | ---------------- | ------------------- | ------------------- |
+| [name]            | [reason]   | [alternative]               | [evidence]       | [migration/removal] | Accepted / Proposed |
 
 ## 3. State Management
+
 - **Client State:** [Zustand / Redux / Context API]
 - **Server State:** [TanStack Query / SWR]
 - **Forms:** [React Hook Form / Formik]
 - **Persistence:** [localStorage / sessionStorage / none]
 
 ## 4. API Design
+
 - **Type:** REST / GraphQL / tRPC / Event-driven / Mixed
 - **Primary Entry Point:** [base path / endpoint / router / broker namespace]
 - **Realtime / Delivery:** WebSocket / SSE / queue / stream / none
 
 ## 5. Folder Structure
+
 ```
 [Project Root]
 ├── [folder 1]/         # [description]
@@ -64,11 +72,13 @@
 ```
 
 ## 6. Design Pattern
+
 - **Main Pattern:** MVC / Feature-based / Clean Architecture
 - **Layers:** routes → controller → service → repository
 - **Notes:** [Special rules]
 
 ## 7. Authentication & Authorization
+
 - **Method:** JWT / Session / OAuth
 - **Provider:** Google / GitHub / Custom
 - **Token Storage:** httpOnly cookie
@@ -76,15 +86,17 @@
 - **Roles:** [List with access levels]
 
 ## 8. Security & Abuse Cases
+
 - **Sensitive Data:** [PII, tokens, payment data, etc.]
 - **Critical Actions:** [Login, password reset, admin actions, upload, payment, etc.]
 - **Abuse Cases:**
-   - [Brute force, spam, IDOR, CSRF, privilege escalation, replay, upload abuse, etc.]
+  - [Brute force, spam, IDOR, CSRF, privilege escalation, replay, upload abuse, etc.]
 - **Required Controls:**
-   - [Rate limiting, ownership checks, CSRF protection, audit logs, signed webhooks, secure session expiry]
+  - [Rate limiting, ownership checks, CSRF protection, audit logs, signed webhooks, secure session expiry]
 - **Audit Logs:** [Which events must be recorded]
 
 ## 9. Deployment & Infrastructure
+
 - **Platform:** Vercel / Railway / Docker+VPS / etc.
 - **Environments:** development → staging → production
 - **CI/CD:** GitHub Actions / etc.
@@ -92,6 +104,7 @@
 - **Domain:** [Planned domain]
 
 ### Operations & Observability
+
 - **Operational Owner:** [team/role]
 - **Runbook / Support:** [location and escalation]
 - **Logs:** [events, redaction, retention]
@@ -99,6 +112,7 @@
 - **Alerts:** [threshold, owner, escalation]
 
 ### Rollback and Recovery
+
 - **Rollback Trigger:** [condition]
 - **Rollback Mechanism:** [deployment/data strategy]
 - **Post-Rollback Validation:** [checks]
@@ -106,18 +120,21 @@
 - **RPO / RTO:** [critical systems only]
 
 ## 10. Canonical Terminology
-| Term | Definition |
-|------|------------|
+
+| Term   | Definition                          |
+| ------ | ----------------------------------- |
 | [Term] | [Definition in the project context] |
 
 ## 11. Architecture Decision Records (ADR)
 
 ### ADR Index
-| ADR ID | Title | Status | Summary |
-|--------|-------|--------|---------|
+
+| ADR ID  | Title   | Status              | Summary           |
+| ------- | ------- | ------------------- | ----------------- |
 | ADR-001 | [Title] | Accepted / Proposed | [One-line reason] |
 
 ### ADR-001: [Title]
+
 - **Context:** [Situation that led to the decision]
 - **Decision:** [What was decided]
 - **Rationale:** [Why this option]
@@ -129,7 +146,9 @@
 ## 12. Assumptions & Open Questions
 
 ### Assumptions
+
 - [Assumption the architecture depends on]
 
 ### Open Questions
+
 - [Question that is still unresolved]

package/.agents/skills/brainstorm-prd/SKILL.md

@@ -20,6 +20,7 @@ Run as `@Galbi` (Project Manager). Use the shared persona profile in `../_shared
 You are an experienced **Product Manager** who turns raw ideas into clear, actionable requirements.
 
 **Expertise:**
+
 - Gathering requirements and understanding real user needs
 - Defining realistic MVP scope
 - Writing testable acceptance criteria (Given/When/Then format)
@@ -53,7 +54,7 @@ Before any interview:
 1. Load this skill when the user asks to create a PRD or brainstorm a new project.
 
 2. **Read existing project-context** before any user interaction:
-    - Check whether `project-context/PRD.md` already exists to avoid duplication
+   - Check whether `project-context/PRD.md` already exists to avoid duplication
 
 3. If `.agents/developer-config.json` exists, read `developerPreferences.scope`.
    - `frontend` → PRD MUST focus on UI flows, pages, state, client validation, and backend/API dependencies
@@ -75,69 +76,85 @@ Before any interview:
 Ask the topics in order. Use conversational language.
 
 ### 1. Project Goal
-*"What is the main goal and long-term vision of this project?"*
+
+_"What is the main goal and long-term vision of this project?"_
 
 Collect:
+
 - Project name (if any)
 - Long-term vision
 - What makes this project different
 
 ### 2. Target Users
-*"Who are the target users? There may be multiple personas."*
+
+_"Who are the target users? There may be multiple personas."_
 
 Collect:
+
 - User personas (Admin, Customer, Cashier, etc.)
 - Demographics (age, role, background)
 - Multiple roles with different access?
 
 ### 3. Problem Statement
-*"What problem does this project solve?"*
+
+_"What problem does this project solve?"_
 
 Collect:
+
 - Current condition without this project
 - Current workaround and its time, cost, or reliability impact
 - Main pain points
 - Why existing solutions are not enough
 
 ### 4. Core Features
-*"What are the main features?"*
+
+_"What are the main features?"_
 
 Collect:
+
 - MVP features (release 1)
 - Future enhancements
 - Priority of each
 
 ### 5. Business Rules
-*"What business rules apply? For example: min/max values, pricing rules, special conditions."*
+
+_"What business rules apply? For example: min/max values, pricing rules, special conditions."_
 
 Collect:
+
 - Validation rules (for example password ≥ 8 characters)
 - Calculation rules (for example 10% member discount)
 - Access rules (for example only admins can delete)
 - Limits/thresholds
 
 ### 6. User Flow
-*"Describe how users move through the app from start to finish to reach their goal."*
+
+_"Describe how users move through the app from start to finish to reach their goal."_
 
 Collect:
+
 - Step-by-step user journey
 - Different flows for different roles
 - Happy path vs error scenarios
 - Expected degraded behavior when data or an external dependency is unavailable
 
 ### 7. Design & Technical Requirements
-*"What is the target platform: web, mobile, or both? Any design references or technical preferences?"*
+
+_"What is the target platform: web, mobile, or both? Any design references or technical preferences?"_
 
 Collect:
+
 - Platform (Web, iOS, Android, Desktop)
 - UI/UX references
 - Preferred tech stack
 - Third-party integrations
 
 ### 8. Non-Functional Requirements (NFR)
-*"Are there performance, security, or availability targets?"*
+
+_"Are there performance, security, or availability targets?"_
 
 Collect:
+
 - **Performance:** Load time target?
 - **Security:** Regulatory compliance? (GDPR, data privacy)
 - **Scalability:** Concurrent users?
@@ -145,9 +162,11 @@ Collect:
 - **Availability:** Uptime target?
 
 ### 9. Success Criteria
-*"What is the minimum definition of success for this project?"*
+
+_"What is the minimum definition of success for this project?"_
 
 Collect:
+
 - MVP criteria
 - Success metrics with baseline, target, timeframe, measurement source, and owner
 - Timeline/deadline
@@ -155,46 +174,58 @@ Collect:
 - Analytics events needed to measure the selected metrics, only when behavioral measurement is relevant
 
 ### 10. Acceptance Criteria
-*"For each main feature, what conditions must be met for it to count as 'done'?"*
+
+_"For each main feature, what conditions must be met for it to count as 'done'?"_
 
 Collect:
+
 - Testable conditions per feature (Given/When/Then format)
 - Edge cases (empty input, missing data, etc.)
 
 ### 11. Non-Goals / Out of Scope
-*"What is intentionally not included?"*
+
+_"What is intentionally not included?"_
 
 Collect:
+
 - Features intentionally deferred
 - Common scope misunderstandings
 - Project boundaries
 
 ### 12. Assumptions
-*"What do you assume is true but are not sure about? For example: 'Users have stable internet.'"*
+
+_"What do you assume is true but are not sure about? For example: 'Users have stable internet.'"_
 
 Collect:
+
 - Technology assumptions (modern browsers)
 - Environment assumptions (server setup)
 - Business assumptions (contract already signed)
 
 ### 13. User Stories
-*"Give user stories in this format: 'As a [role], I want [feature] so that [benefit].'"*
+
+_"Give user stories in this format: 'As a [role], I want [feature] so that [benefit].'"_
 
 Collect:
+
 - Stories per main feature
 - Ordered by priority
 - Example: "As an admin, I want to see the order list so I can process shipping"
 
 ### 14. Stakeholders
-*"Who is involved in or has a stake in this project?"*
+
+_"Who is involved in or has a stake in this project?"_
 
 Collect:
+
 - Dev team, client, other parties
 
 ### 15. Open Questions
-*"Are there unresolved decisions or known risks?"*
+
+_"Are there unresolved decisions or known risks?"_
 
 Collect:
+
 - Outstanding questions
 - Deferred decisions
 - Known risks
@@ -238,5 +269,4 @@ Each step can be skipped. Always confirm before proceeding.
 - **Topic 8 (NFR)** is a common source of AI hallucination. Do not skip it.
 - Render the final document in the configured document language
 
-
 ---

package/.agents/skills/brainstorm-prd/assets/PRD.template.md

@@ -3,73 +3,89 @@
 > **Version:** 1.0 | **Date:** [date] | **Status:** Draft
 
 ## Document Role
+
 - **Source of Truth:** Product scope, user intent, business rules, and success criteria
 - **Primary Owner:** `brainstorm-prd`
 - **Out of Scope:** API payload details, schema column definitions, code patterns, and implementation order
 
 ## Canonical Terminology
-| Term | Meaning |
-|------|---------|
+
+| Term   | Meaning                         |
+| ------ | ------------------------------- |
 | [Term] | [Exact meaning in this project] |
 
 ---
 
 ## 1. Project Goal
+
 [Goal and vision — 1-2 paragraphs]
 
 ## 2. Target Users
-| Persona | Description | Role |
-|---------|-------------|------|
+
+| Persona     | Description   | Role                   |
+| ----------- | ------------- | ---------------------- |
 | [Persona 1] | [Description] | End User / Admin / etc |
 
 ## 3. Problem Statement
+
 [Problem being solved]
 
 ### Current Workaround
+
 - **How users handle it now:** [workaround]
 - **Cost / limitation:** [time, money, risk, or reliability impact]
 
 ## 4. Core Features
+
 ### MVP (Release 1)
-| ID | Feature | Description | Priority |
-|----|---------|-------------|----------|
-| FEAT-01 | [Feature] | [Description] | High |
+
+| ID      | Feature   | Description   | Priority |
+| ------- | --------- | ------------- | -------- |
+| FEAT-01 | [Feature] | [Description] | High     |
 
 ### Future Enhancements
+
 - **FEAT-02:** [Feature] — [Description]
 
 ## 5. Business Rules
+
 - **BR-01:** [Rule]
 - **BR-02:** [Rule]
 
 ## 6. User Flow
+
 ### [Persona 1]
+
 1. [Step 1]
 2. [Step 2]
 
 ### Failure and Degraded Behavior
-| Situation | Expected User Experience | Recovery |
-|-----------|--------------------------|----------|
-| [Dependency/data unavailable] | [behavior] | [retry/fallback/support] |
+
+| Situation                     | Expected User Experience | Recovery                 |
+| ----------------------------- | ------------------------ | ------------------------ |
+| [Dependency/data unavailable] | [behavior]               | [retry/fallback/support] |
 
 ## 7. Design & Technical Requirements
+
 - **Platform:** Web / Mobile / Desktop
 - **UI Reference:** [Link or name]
 - **Tech Stack (preferred):** [If any]
 - **Integrations:** [Third-party services]
 
 ## 8. Non-Functional Requirements
-| ID | Category | Requirement | Target |
-|----|----------|-------------|--------|
-| NFR-01 | Performance | Page load time | < 3 seconds |
-| NFR-02 | Security | [Requirement] | [Target] |
-| NFR-03 | Scalability | Concurrent users | [Count] |
-| NFR-04 | Accessibility | [Requirement] | [Target] |
+
+| ID     | Category      | Requirement      | Target      |
+| ------ | ------------- | ---------------- | ----------- |
+| NFR-01 | Performance   | Page load time   | < 3 seconds |
+| NFR-02 | Security      | [Requirement]    | [Target]    |
+| NFR-03 | Scalability   | Concurrent users | [Count]     |
+| NFR-04 | Accessibility | [Requirement]    | [Target]    |
 
 ## 9. Success Metrics and Rollout
-| Metric | Baseline | Target | Timeframe | Measurement Source | Owner |
-|--------|----------|--------|-----------|--------------------|-------|
-| [Metric] | [current/unknown] | [target] | [period] | [analytics/report] | [owner] |
+
+| Metric   | Baseline          | Target   | Timeframe | Measurement Source | Owner   |
+| -------- | ----------------- | -------- | --------- | ------------------ | ------- |
+| [Metric] | [current/unknown] | [target] | [period]  | [analytics/report] | [owner] |
 
 **Rollout:** [pilot / beta / phased / full]
 **Target Audience:** [initial cohort]
@@ -77,30 +93,38 @@
 **Analytics Events:** [only events required to measure the metrics]
 
 ## 10. Acceptance Criteria
+
 ### FEAT-01: [Feature Name]
+
 - **AC-01:** **Given** [starting condition], **When** [user action], **Then** [expected result]
 
 ## 11. Non-Goals / Out of Scope
+
 - [What will NOT be done]
 
 ## 12. Assumptions
+
 - [Assumption 1]
 - [Assumption 2]
 
 ## 13. User Stories
+
 - **US-01:** As a **[role]**, I want **[feature]** so that **[benefit]**
 
 ## 14. Stakeholders
+
 | Name/Role | Responsibility |
-|-----------|----------------|
-| [Name] | [Role] |
+| --------- | -------------- |
+| [Name]    | [Role]         |
 
 ## 15. Open Questions
-| Question | Status | Owner |
-|----------|--------|-------|
+
+| Question   | Status  | Owner |
+| ---------- | ------- | ----- |
 | [Question] | Pending | [Who] |
 
 ## Reading Guide for AI
+
 - If this PRD conflicts with detailed implementation documents, the PRD wins on business intent and scope.
 - If a term is ambiguous, prioritize the definition in `Canonical Terminology`.
 - Use `Non-Goals / Out of Scope`, `Assumptions`, and `Open Questions` to avoid building more than necessary.