mandrel 2.6.0 → 2.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (78) hide show
  1. package/.agents/README.md +104 -330
  2. package/.agents/agents/auditor.md +135 -0
  3. package/.agents/agents/plan-critic.md +80 -0
  4. package/.agents/audit-checklists/dependencies.md +7 -0
  5. package/.agents/audit-checklists/documentation.md +1 -0
  6. package/.agents/docs/SDLC.md +69 -162
  7. package/.agents/docs/configuration.md +133 -499
  8. package/.agents/docs/quality-gates.md +59 -180
  9. package/.agents/instructions.md +170 -295
  10. package/.agents/rules/changelog-style.md +8 -66
  11. package/.agents/rules/ci-remediation.md +65 -124
  12. package/.agents/rules/gherkin-standards.md +10 -31
  13. package/.agents/rules/git-conventions-reference.md +28 -61
  14. package/.agents/rules/git-conventions.md +1 -1
  15. package/.agents/rules/orchestration-error-handling.md +5 -15
  16. package/.agents/rules/security-baseline.md +7 -13
  17. package/.agents/rules/shell-conventions.md +4 -13
  18. package/.agents/rules/test-seams.md +2 -2
  19. package/.agents/rules/testing-standards.md +7 -17
  20. package/.agents/scripts/lib/feedback-loop/audit-results-graduator.js +7 -2
  21. package/.agents/scripts/lib/feedback-loop/graduator-core.js +144 -12
  22. package/.agents/scripts/lib/feedback-loop/retro-proposals-graduator.js +11 -1
  23. package/.agents/scripts/lib/observability/runtime-friction.js +97 -36
  24. package/.agents/scripts/lib/orchestration/single-story-close/phases/post-land.js +29 -5
  25. package/.agents/skills/core/api-and-interface-design/SKILL.md +23 -297
  26. package/.agents/skills/core/api-and-interface-design/reference.md +76 -0
  27. package/.agents/skills/core/browser-testing-with-devtools/SKILL.md +20 -327
  28. package/.agents/skills/core/browser-testing-with-devtools/reference.md +74 -0
  29. package/.agents/skills/core/code-review-and-quality/reference.md +16 -398
  30. package/.agents/skills/core/debugging-and-error-recovery/reference.md +14 -281
  31. package/.agents/skills/core/documentation-and-adrs/reference.md +42 -338
  32. package/.agents/skills/core/git-workflow-and-versioning/SKILL.md +28 -326
  33. package/.agents/skills/core/idea-refinement/SKILL.md +67 -193
  34. package/.agents/skills/core/security-and-hardening/SKILL.md +15 -31
  35. package/.agents/skills/core/security-and-hardening/reference.md +15 -273
  36. package/.agents/skills/skills.index.json +5 -5
  37. package/.agents/skills/stack/qa/gherkin-authoring/SKILL.md +16 -222
  38. package/.agents/skills/stack/qa/gherkin-authoring/reference.md +157 -0
  39. package/.agents/skills/stack/qa/playwright/SKILL.md +0 -29
  40. package/.agents/skills/stack/qa/qa-explore-driving/SKILL.md +19 -23
  41. package/.agents/skills/stack/qa/qa-harness/SKILL.md +35 -53
  42. package/.agents/skills/stack/qa/vitest/SKILL.md +0 -29
  43. package/.agents/workflows/audit-accessibility.md +34 -108
  44. package/.agents/workflows/audit-architecture.md +35 -123
  45. package/.agents/workflows/audit-clean-code.md +19 -78
  46. package/.agents/workflows/audit-data-model.md +32 -100
  47. package/.agents/workflows/audit-dependencies.md +47 -111
  48. package/.agents/workflows/audit-devops.md +16 -83
  49. package/.agents/workflows/audit-documentation.md +46 -93
  50. package/.agents/workflows/audit-navigability.md +26 -80
  51. package/.agents/workflows/audit-performance.md +40 -106
  52. package/.agents/workflows/audit-privacy.md +17 -80
  53. package/.agents/workflows/audit-quality.md +35 -99
  54. package/.agents/workflows/audit-security.md +20 -78
  55. package/.agents/workflows/audit-seo.md +20 -98
  56. package/.agents/workflows/audit-sre.md +20 -88
  57. package/.agents/workflows/audit-to-stories.md +1 -8
  58. package/.agents/workflows/audit-ux-ui.md +17 -80
  59. package/.agents/workflows/deliver.md +54 -9
  60. package/.agents/workflows/git-cleanup.md +50 -275
  61. package/.agents/workflows/helpers/audit-lens-core.md +230 -0
  62. package/.agents/workflows/helpers/code-review.md +11 -23
  63. package/.agents/workflows/helpers/deliver-story-reference.md +114 -17
  64. package/.agents/workflows/helpers/deliver-story.md +26 -186
  65. package/.agents/workflows/helpers/qa-core.md +174 -0
  66. package/.agents/workflows/helpers/qa-run-scenario-reference.md +35 -0
  67. package/.agents/workflows/helpers/qa-run-scenario.md +11 -25
  68. package/.agents/workflows/helpers/worktree-lifecycle.md +6 -67
  69. package/.agents/workflows/mandrel-update.md +7 -13
  70. package/.agents/workflows/plan.md +17 -15
  71. package/.agents/workflows/qa-assist.md +140 -269
  72. package/.agents/workflows/qa-explore.md +125 -316
  73. package/.agents/workflows/qa-run.md +180 -380
  74. package/docs/CHANGELOG.md +18 -0
  75. package/package.json +1 -1
  76. package/.agents/workflows/helpers/audit-dual-path.md +0 -59
  77. package/.agents/workflows/helpers/audit-self-check.md +0 -70
  78. package/.agents/workflows/helpers/audit-severity-scale.md +0 -19
@@ -1,46 +1,14 @@
1
1
  # Documentation and ADRs — Reference (on-demand)
2
2
 
3
3
  **Read this when** a task engages one of the sections below and the Policy
4
- Capsule in [`SKILL.md`](SKILL.md) does not settle it on its own. The capsule
5
- is the contract; this file is the reference material behind it. Nothing here
6
- relaxes a capsule MUST, and nothing here is required reading merely because
7
- the skill is active.
4
+ Capsule in [`SKILL.md`](SKILL.md) does not settle it on its own. The capsule is
5
+ the contract; this file is the reference material behind it. Generic ADR
6
+ templates, inline-comment / README / changelog conventions, and JSDoc/OpenAPI
7
+ snippets are frontier-known and are not reproduced here — this file keeps the
8
+ project-specific contracts: the two decisions-log layouts and their loading
9
+ model, and the prune/archive convention for living docs.
8
10
 
9
- ## Overview
10
-
11
- Document decisions, not just code. The most valuable documentation captures the
12
- _why_ — the context, constraints, and trade-offs that led to a decision. Code
13
- shows _what_ was built; documentation explains _why it was built this way_ and
14
- _what alternatives were considered_. This context is essential for future humans
15
- and agents working in the codebase.
16
-
17
- ## When to Use
18
-
19
- - Making a significant architectural decision
20
- - Choosing between competing approaches
21
- - Adding or changing a public API
22
- - Shipping a feature that changes user-facing behavior
23
- - Onboarding new team members (or agents) to the project
24
- - When you find yourself explaining the same thing repeatedly
25
-
26
- **When NOT to use:** Don't document obvious code. Don't add comments that
27
- restate what the code already says. Don't write docs for throwaway prototypes.
28
-
29
- ## Architecture Decision Records (ADRs)
30
-
31
- ADRs capture the reasoning behind significant technical decisions. They're the
32
- highest-value documentation you can write.
33
-
34
- ### When to Write an ADR
35
-
36
- - Choosing a framework, library, or major dependency
37
- - Designing a data model or database schema
38
- - Selecting an authentication strategy
39
- - Deciding on an API architecture (REST vs. GraphQL vs. tRPC)
40
- - Choosing between build tools, hosting platforms, or infrastructure
41
- - Any decision that would be expensive to reverse
42
-
43
- ### Decisions-log layouts
11
+ ## Decisions-log layouts
44
12
 
45
13
  Mandrel ships **two supported layouts** for the decisions log. Both keep the
46
14
  mandatory-read file named `docs/decisions.md` (the `project.docsContextFiles`
@@ -70,281 +38,59 @@ create a `decisions/` directory beside it, and scaffold each ADR from
70
38
  > `decisions/*.md`-style entry if it maintains its own globbing) as a
71
39
  > deliberate opt-in, but that is the exception, not the default.
72
40
 
73
- ### ADR Template
74
-
75
- In the **single-file** layout, append a short dated entry per the
76
- `templates/docs/decisions.md` format. In the **directory** layout, store ADRs
77
- in `docs/decisions/` with sequential numbering:
78
-
79
- ```markdown
80
- # ADR-001: Use PostgreSQL for primary database
81
-
82
- ## Status
83
-
84
- Accepted | Superseded by ADR-XXX | Deprecated
85
-
86
- ## Date
87
-
88
- 2025-01-15
89
-
90
- ## Deciders
91
-
92
- The platform team (architect + two senior engineers).
93
-
94
- ## Context
95
-
96
- We need a primary database for the task management application. Key
97
- requirements:
98
-
99
- - Relational data model (users, tasks, teams with relationships)
100
- - ACID transactions for task state changes
101
- - Support for full-text search on task content
102
- - Managed hosting available (for small team, limited ops capacity)
103
-
104
- ## Decision
105
-
106
- Use PostgreSQL with Prisma ORM.
107
-
108
- ## Alternatives Considered
109
-
110
- ### MongoDB
111
-
112
- - Pros: Flexible schema, easy to start with
113
- - Cons: Our data is inherently relational; would need to manage relationships
114
- manually
115
- - Rejected: Relational data in a document store leads to complex joins or data
116
- duplication
117
-
118
- ### SQLite
119
-
120
- - Pros: Zero configuration, embedded, fast for reads
121
- - Cons: Limited concurrent write support, no managed hosting for production
122
- - Rejected: Not suitable for multi-user web application in production
123
-
124
- ### MySQL
125
-
126
- - Pros: Mature, widely supported
127
- - Cons: PostgreSQL has better JSON support, full-text search, and ecosystem
128
- tooling
129
- - Rejected: PostgreSQL is the better fit for our feature requirements
130
-
131
- ## Consequences
132
-
133
- - Prisma provides type-safe database access and migration management
134
- - We can use PostgreSQL's full-text search instead of adding Elasticsearch
135
- - Team needs PostgreSQL knowledge (standard skill, low risk)
136
- - Hosting on managed service (Supabase, Neon, or RDS)
137
- ```
138
-
139
- ### ADR Lifecycle
41
+ ### ADR lifecycle (why archiving is not for ADRs)
140
42
 
141
43
  ```text
142
44
  PROPOSED → ACCEPTED → (SUPERSEDED or DEPRECATED)
143
45
  ```
144
46
 
145
- - **Don't delete old ADRs.** They capture historical context.
146
- - When a decision changes, write a new ADR that references and supersedes the
147
- old one.
148
-
149
- ## Inline Documentation
150
-
151
- ### When to Comment
152
-
153
- Comment the _why_, not the _what_:
154
-
155
- ```typescript
156
- // BAD: Restates the code
157
- // Increment counter by 1
158
- counter += 1;
159
-
160
- // GOOD: Explains non-obvious intent
161
- // Rate limit uses a sliding window — reset counter at window boundary,
162
- // not on a fixed schedule, to prevent burst attacks at window edges
163
- if (now - windowStart > WINDOW_SIZE_MS) {
164
- counter = 0;
165
- windowStart = now;
166
- }
167
- ```
168
-
169
- ### When NOT to Comment
170
-
171
- ```typescript
172
- // Don't comment self-explanatory code
173
- function calculateTotal(items: CartItem[]): number {
174
- return items.reduce((sum, item) => sum + item.price * item.quantity, 0);
175
- }
176
-
177
- // Don't leave TODO comments for things you should just do now
178
- // TODO: add error handling ← Just add it
179
-
180
- // Don't leave commented-out code
181
- // const oldImplementation = () => { ... } ← Delete it, git has history
182
- ```
183
-
184
- ### Document Known Gotchas
185
-
186
- ```typescript
187
- /**
188
- * IMPORTANT: This function must be called before the first render.
189
- * If called after hydration, it causes a flash of unstyled content
190
- * because the theme context isn't available during SSR.
191
- *
192
- * See ADR-003 for the full design rationale.
193
- */
194
- export function initializeTheme(theme: Theme): void {
195
- // ...
196
- }
197
- ```
198
-
199
- ## API Documentation
200
-
201
- For public APIs (REST, GraphQL, library interfaces):
202
-
203
- ### Inline with Types (Preferred for TypeScript)
204
-
205
- ```typescript
206
- /**
207
- * Creates a new task.
208
- *
209
- * @param input - Task creation data (title required, description optional)
210
- * @returns The created task with server-generated ID and timestamps
211
- * @throws {ValidationError} If title is empty or exceeds 200 characters
212
- * @throws {AuthenticationError} If the user is not authenticated
213
- *
214
- * @example
215
- * const task = await createTask({ title: 'Buy groceries' });
216
- * console.log(task.id); // "task_abc123"
217
- */
218
- export async function createTask(input: CreateTaskInput): Promise<Task> {
219
- // ...
220
- }
221
- ```
222
-
223
- ### OpenAPI / Swagger for REST APIs
224
-
225
- ```yaml
226
- paths:
227
- /api/tasks:
228
- post:
229
- summary: Create a task
230
- requestBody:
231
- required: true
232
- content:
233
- application/json:
234
- schema:
235
- $ref: '#/components/schemas/CreateTaskInput'
236
- responses:
237
- '201':
238
- description: Task created
239
- content:
240
- application/json:
241
- schema:
242
- $ref: '#/components/schemas/Task'
243
- '422':
244
- description: Validation error
245
- ```
246
-
247
- ## README Structure
248
-
249
- Every project should have a README that covers:
250
-
251
- ```markdown
252
- # Project Name
253
-
254
- One-paragraph description of what this project does.
255
-
256
- ## Quick Start
257
-
258
- 1. Clone the repo
259
- 2. Install dependencies: `npm install`
260
- 3. Set up environment: `cp .env.example .env`
261
- 4. Run the dev server: `npm run dev`
262
-
263
- ## Commands
264
-
265
- | Command | Description |
266
- | --------------- | ------------------------ |
267
- | `npm run dev` | Start development server |
268
- | `npm test` | Run tests |
269
- | `npm run build` | Production build |
270
- | `npm run lint` | Run linter |
271
-
272
- ## Architecture
273
-
274
- Brief overview of the project structure and key design decisions. Link to ADRs
275
- for details.
276
-
277
- ## Contributing
278
-
279
- How to contribute, coding standards, PR process.
280
- ```
281
-
282
- ## Changelog Maintenance
283
-
284
- For shipped features:
285
-
286
- ```markdown
287
- # Changelog
288
-
289
- ## [1.2.0] - 2025-01-20
290
-
291
- ### Added
292
-
293
- - Task sharing: users can share tasks with team members (#123)
294
- - Email notifications for task assignments (#124)
295
-
296
- ### Fixed
297
-
298
- - Duplicate tasks appearing when rapidly clicking create button (#125)
299
-
300
- ### Changed
301
-
302
- - Task list now loads 50 items per page (was 20) for better UX (#126)
303
- ```
47
+ Don't delete old ADRs they capture historical context. When a decision
48
+ changes, write a new ADR that references and supersedes the old one. An ADR that
49
+ no longer holds is **superseded in place**, keeping the numbered chain intact;
50
+ it is not pruned by archiving (see below).
304
51
 
305
52
  ## Pruning & Archiving
306
53
 
307
- Living docs accrete history — dated changelog entries, closed decision-log
308
- rows, completed rollout checklists, resolved runbook incidents. Left
309
- unpruned, that verbatim history crowds out the live guidance a reader (human
310
- or agent) actually needs, and every task that loads the doc re-pays the cost.
311
- The fix is to **archive, don't delete**: relocate the cold history so the live
312
- doc stays lean while the record stays recoverable.
54
+ Living docs accrete history — dated changelog entries, closed decision-log rows,
55
+ completed rollout checklists, resolved runbook incidents. Left unpruned, that
56
+ verbatim history crowds out the live guidance a reader (human or agent) actually
57
+ needs, and every task that loads the doc re-pays the cost. The fix is to
58
+ **archive, don't delete**: relocate the cold history so the live doc stays lean
59
+ while the record stays recoverable.
313
60
 
314
61
  ### The archive-don't-delete rule
315
62
 
316
63
  **History is preserved by _moving_ it, never by deleting it.** Pruning a doc
317
64
  never destroys its past — the verbatim content is relocated to a dated archive
318
- file under version control, so the full record remains diffable and
319
- recoverable. Deleting history outright (even with "git has it") is the
320
- anti-pattern this convention exists to prevent: the archive is discoverable
321
- from the live doc, a buried git revision is not.
65
+ file under version control, so the full record remains diffable and recoverable.
66
+ Deleting history outright (even with "git has it") is the anti-pattern this
67
+ convention exists to prevent: the archive is discoverable from the live doc, a
68
+ buried git revision is not.
322
69
 
323
70
  ### How to prune a doc
324
71
 
325
72
  1. **Extract the still-live signal first — before you archive anything.**
326
73
  Gotchas, traps, and hard-won caveats buried in the history are the most
327
- valuable lines in the doc. Lift them into the live doc's standing guidance
328
- (a "Known gotchas" list, an inline warning, or an ADR) **before** the
329
- history moves. Archiving first risks stranding a live trap in a cold file
330
- nobody rereads.
74
+ valuable lines in the doc. Lift them into the live doc's standing guidance (a
75
+ "Known gotchas" list, an inline warning, or an ADR) **before** the history
76
+ moves. Archiving first risks stranding a live trap in a cold file nobody
77
+ rereads.
331
78
  2. **Move the verbatim history to a dated archive file.** Relocate the cold
332
- content — untouched, word-for-word — to
333
- `docs/archive/<name>-<YYYY-MM>.md`, where `<name>` is the source doc's base
334
- name and `<YYYY-MM>` is the archive date (e.g. `docs/archive/changelog-2025-01.md`,
79
+ content — untouched, word-for-word — to `docs/archive/<name>-<YYYY-MM>.md`,
80
+ where `<name>` is the source doc's base name and `<YYYY-MM>` is the archive
81
+ date (e.g. `docs/archive/changelog-2025-01.md`,
335
82
  `docs/archive/decisions-2024-11.md`). The archive is an exact copy of what
336
83
  was live; do not summarize or rewrite it in the move.
337
- 3. **Collapse completed checklists to a one-line summary.** A finished
338
- checklist (a rollout runbook, a migration plan, a release gate) does not
339
- need to keep every ticked box in the live doc. Replace it with a single
340
- line recording the outcome and date — e.g.
341
- `Auth-migration rollout completed 2025-01-18, all 12 steps green` and
342
- let the archived copy carry the full detail.
84
+ 3. **Collapse completed checklists to a one-line summary.** A finished checklist
85
+ (a rollout runbook, a migration plan, a release gate) does not need to keep
86
+ every ticked box in the live doc. Replace it with a single line recording the
87
+ outcome and date — e.g. `Auth-migration rollout — completed 2025-01-18, all
88
+ 12 steps green` — and let the archived copy carry the full detail.
343
89
  4. **Leave a one-line pointer behind.** Every archived doc leaves exactly one
344
90
  line in the live doc pointing at where its history went, so the record is
345
- never orphaned — e.g.
346
- `Older entries archived to docs/archive/changelog-2024.md`. The pointer is
347
- what makes "moved, not deleted" true from the reader's vantage point.
91
+ never orphaned — e.g. `Older entries archived to
92
+ docs/archive/changelog-2024.md`. The pointer is what makes "moved, not
93
+ deleted" true from the reader's vantage point.
348
94
 
349
95
  ### When to prune
350
96
 
@@ -352,52 +98,10 @@ from the live doc, a buried git revision is not.
352
98
  entries are hard to find among the historical ones.
353
99
  - A checklist or rollout plan is fully complete and its step-by-step detail is
354
100
  now reference-only.
355
- - A doc reloaded into agent context on many tasks carries more cold history
356
- than live guidance.
101
+ - A doc reloaded into agent context on many tasks carries more cold history than
102
+ live guidance.
357
103
 
358
104
  Do **not** prune ADRs by archiving — an ADR that no longer holds is
359
- **superseded** in place (see [ADR Lifecycle](#adr-lifecycle)), keeping the
360
- numbered chain intact. Archiving is for the accreted history of living docs,
361
- not for the immutable decision record.
362
-
363
- ## Documentation for Agents
364
-
365
- Special consideration for AI agent context:
366
-
367
- - **CLAUDE.md / rules files** — Document project conventions so agents follow
368
- them
369
- - **Spec files** — Keep specs updated so agents build the right thing
370
- - **ADRs** — Help agents understand why past decisions were made (prevents
371
- re-deciding)
372
- - **Inline gotchas** — Prevent agents from falling into known traps
373
-
374
- ## Common Rationalizations
375
-
376
- | Rationalization | Reality |
377
- | ------------------------------------------ | ----------------------------------------------------------------------------------------------------- |
378
- | "The code is self-documenting" | Code shows what. It doesn't show why, what alternatives were rejected, or what constraints apply. |
379
- | "We'll write docs when the API stabilizes" | APIs stabilize faster when you document them. The doc is the first test of the design. |
380
- | "Nobody reads docs" | Agents do. Future engineers do. Your 3-months-later self does. |
381
- | "ADRs are overhead" | A 10-minute ADR prevents a 2-hour debate about the same decision six months later. |
382
- | "Comments get outdated" | Comments on _why_ are stable. Comments on _what_ get outdated — that's why you only write the former. |
383
-
384
- ## Red Flags
385
-
386
- - Architectural decisions with no written rationale
387
- - Public APIs with no documentation or types
388
- - README that doesn't explain how to run the project
389
- - Commented-out code instead of deletion
390
- - TODO comments that have been there for weeks
391
- - No ADRs in a project with significant architectural choices
392
- - Documentation that restates the code instead of explaining intent
393
-
394
- ## Verification
395
-
396
- After documenting:
397
-
398
- - [ ] ADRs exist for all significant architectural decisions
399
- - [ ] README covers quick start, commands, and architecture overview
400
- - [ ] API functions have parameter and return type documentation
401
- - [ ] Known gotchas are documented inline where they matter
402
- - [ ] No commented-out code remains
403
- - [ ] Rules files (CLAUDE.md etc.) are current and accurate
105
+ **superseded** in place (see [ADR lifecycle](#adr-lifecycle-why-archiving-is-not-for-adrs)),
106
+ keeping the numbered chain intact. Archiving is for the accreted history of
107
+ living docs, not for the immutable decision record.