musubix3 0.1.14 → 0.1.15

package/.github/plugin/marketplace.json

@@ -3,13 +3,13 @@
   "owner": { "name": "nahisaho" },
   "metadata": {
     "description": "GitHub Copilot CLI specification-driven development skills",
-    "version": "0.1.14"
+    "version": "0.1.15"
   },
   "plugins": [
     {
       "name": "musubix3",
       "source": ".",
-      "version": "0.1.14",
+      "version": "0.1.15",
       "description": "Evidence-driven SDD without duplicating native Copilot capabilities."
     }
   ]

package/.github/skills/sdd-change/SKILL.md

@@ -9,6 +9,7 @@ description: "Use as the MANDATORY first Skill for requests to develop, build, c
  */
 Mandatory entrypoint: every new natural-language development request is a new change, even in an existing Copilot session; never reuse prior requirements, approvals, TDD, or change evidence unless the user explicitly names the existing change ID and asks to continue it. never start implementation before validating requirements/design; skip only for verified approved artifacts of that explicitly continued change.
 Never infer approval; show `approval prepare <stage>` and record only its reviewed hash with `approval record <stage> --approver <name> --artifact-sha256 <hash> --confirm`.
+Whenever an AI deliverable is documentation (requirements, design, ADRs, the CHANGE document, or release/quality evidence), run Copilot's native `rubber-duck` review agent on it before that phase's human approval, fixing every issue and re-reviewing until none remain.
 Follow the user's input language. Use native Copilot planning, editing, research, review, security review and subagents.
 Record exactly one final invocation outcome with `npx musubix3 workflow-record sdd-change complete --status <status>`; `change-record` separately proves phases.
 Run `workflow-sanitize <copilot.jsonl> <safe.jsonl>` before review, then
@@ -38,11 +39,10 @@ Persisted monotonic order, not wall-clock time, proves these phase boundaries.
 2. For a bug where implementation violates an existing requirement, keep that
    requirement and record that no specification change is needed. Never rewrite
    a requirement merely to make incorrect behavior appear compliant.
-3. Update design responsibilities/interfaces/constraints/links and ADRs for real decisions.
-4. Run requirements, constitution and design validation. Stop on invalid
-   artifacts instead of continuing with unapproved assumptions.
-5. Stop before design for explicit current `requirements` approval; stop before
-   Red/implementation for explicit current `design` approval. Changes re-open approval.
+3. Run requirements and constitution validation; stop on invalid artifacts
+   instead of continuing with unapproved assumptions.
+4. Run a `rubber-duck` review (Copilot's native review agent) of `requirements.md`, fixing every issue and re-reviewing until none remain, then stop for explicit current `requirements` approval before design. An edit to `requirements.md` re-opens approval and requires re-review.
+5. Update design responsibilities/interfaces/constraints/links and ADRs, run design validation, then run the same rubber-duck review/fix loop on `design.md`/ADRs before stopping for explicit current `design` approval before Red/implementation. An edit re-opens approval and requires re-review.
 ## 3. Implement and prove coverage / 実装と網羅性
 1. For observable behavior changes and defect fixes, write the smallest meaningful
    test first. Include its `TEST-*` ID in the test name/output and link it to the
@@ -70,8 +70,6 @@ Documentation/prototypes may omit TDD only when policy allows; record the reason
    A required `formal` check enforces modeled fraction and configured solver.
 3. Run `gate --changed --json` and `status --json`. Repair failures, dangling
    links and stale evidence; never weaken requirements or policy to obtain green.
-4. Treat the first otherwise-passing gate as the release candidate. Before any
-   release operation, prepare/show its exact hash, ask one human approve/reject
-   question and wait; record only that hash, then rerun gate/status.
+4. Treat the first otherwise-passing gate as the release candidate. Run a `rubber-duck` review of the release/quality evidence summary and the CHANGE document; fix every reported issue and re-review until zero issues remain. Before any release operation, prepare/show its exact hash, ask one human approve/reject question and wait; record only that hash, then rerun gate/status.
 5. Complete only when required checks pass and `status.gate.ready` is true;
    otherwise report blockers. One-phase work must state downstream work.

package/.github/skills/sdd-design/SKILL.md

@@ -25,8 +25,12 @@ completed` exactly once.
 5. Run `npx musubix3 trace build` then `npx musubix3 trace check`.
    Do not hand-edit `trace.json`. Ask native review to inspect coupling and
    coverage; use `sdd-formal-codegraph` for compiler-based impact checks.
-6. Before implementation or Red, run `approval prepare design`, show its exact
+6. Before requesting human approval, run Copilot's native `rubber-duck`
+   review agent on `design.md` and any related ADRs. Fix every reported
+   issue, then re-run the review. Repeat fix-then-review until the review
+   reports zero remaining issues; only then proceed to step 7.
+7. Before implementation or Red, run `approval prepare design`, show its exact
    artifacts/hash, ask one explicit approve/reject question, then wait. On approval
    only, record that hash with `approval record design --approver <name>
    --artifact-sha256 <hash> --confirm`; rejection or changes require renewed review.
-7. Hand off responsibilities, interfaces, constraints and IDs to implementation.
+8. Hand off responsibilities, interfaces, constraints and IDs to implementation.

package/.github/skills/sdd-quality/SKILL.md

@@ -71,8 +71,5 @@ completed` exactly once.
    check all configured claims; offline strict verification fails closed.
    Ensure the baseline protects CI-required mode, strict OIDC and key binding.
    Never store a private key or overstate OIDC as proof of arbitrary runner work.
-7. After required non-approval checks pass, run `approval prepare release`, show
-   its exact hash and residual risks, ask one approve/reject question, then wait.
-   On approval only record that hash with `approval record release --approver
-   <name> --artifact-sha256 <hash> --confirm`; rejection stops. Rerun gate/status;
-   stale approval blocks commit/push/publish/deploy; no resident watcher or REPL.
+7. Before requesting human approval, run Copilot's native `rubber-duck` review agent on the release evidence summary and the CHANGE document; fix every reported issue, then re-run the review, repeating until it reports zero remaining issues.
+8. After required non-approval checks pass, run `approval prepare release`, show its exact hash and residual risks, ask one approve/reject question, then wait. On approval only record that hash with `approval record release --approver <name> --artifact-sha256 <hash> --confirm`; rejection stops. Rerun gate/status; stale approval blocks commit/push/publish/deploy; no resident watcher or REPL.

package/.github/skills/sdd-requirements/SKILL.md

@@ -50,10 +50,15 @@ After the work, run `npx musubix3 workflow-record sdd-requirements complete
 5. Validate with `npx musubix3 requirements validate <file> --json` and
    `npx musubix3 constitution validate --json`. Rules use `PRINC-001`, `RULE-001`,
    a supported `Metric:` and numeric `Limit:`. Validation is not execution evidence.
-6. Validation is not human approval. Before design, run `approval prepare
+6. Before requesting human approval, run Copilot's native `rubber-duck`
+   review agent on `requirements.md`. Fix every reported issue, then re-run
+   the review. Repeat fix-then-review until the review reports zero
+   remaining issues; only then proceed to step 7. Do not request human
+   approval while rubber-duck findings remain open.
+7. Validation is not human approval. Before design, run `approval prepare
    requirements`, show its exact artifacts/hash, ask one explicit approve/reject
    question, then wait. On approval only, record that hash with `approval record
    requirements --approver <name> --artifact-sha256 <hash> --confirm`; rejection
    or any intervening artifact change stops and requires renewed review.
-7. Hand off confirmed IDs and unresolved assumptions to `sdd-design`; use native
+8. Hand off confirmed IDs and unresolved assumptions to `sdd-design`; use native
    review for semantic completeness, not merely syntactic conformance.

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.1.15 - 2026-09-11
+
+Documentation/workflow update: AI-generated documentation deliverables now go
+through a mandatory rubber-duck review/fix loop before human approval.
+
+- `sdd-requirements`, `sdd-design`, `sdd-quality`, and `sdd-change` now
+  require a `rubber-duck` review of any AI-generated documentation artifact
+  (requirements.md, design.md/ADRs, the CHANGE document, and release/quality
+  evidence summaries) before the corresponding human approval step
+  (`requirements`, `design`, or `release`). Every reported issue must be
+  fixed and the artifact re-reviewed; only once the review reports zero
+  remaining issues may human review/approval be requested.
+- Documented the same review/fix loop in the Workflow section of
+  README.md/README-ja.md.
+- No CLI, schema, or validation behavior changed. Apart from the package
+  version metadata bump (`package.json`/`package-lock.json`), this release
+  only updates the bundled `.github/skills/sdd-*` guidance and documentation.
+
 ## 0.1.14 - 2026-09-11
 
 Fix for one issue (#17) found while running musubix3@0.1.13 against a large

package/README-ja.md

@@ -248,17 +248,25 @@ Copilot の提案を記号的検査で制約する構成であり、独自の「
 要求を確定しません。
 
 1. ネイティブ計画・調査で意図と測定可能な受入条件を明確化。
-2. `change-record CHANGE-ID impact` を記録して要求を編集・検証し、
-   `requirements` checkpoint後、設計前にartifact-boundな人間の
-   `requirements`承認を明示的に記録。
-3. コンポーネントとADRを更新して `design` checkpointを記録し、
-   実装前にartifact-boundな人間の`design`承認を明示的に記録。
+2. `change-record CHANGE-ID impact` を記録して要求を編集・検証し、要求文書の
+   `rubber-duck`レビューを実施して指摘事項をすべて修正（指摘がゼロになるまで
+   レビュー・修正を繰り返す）、`requirements` checkpoint後、設計前に
+   artifact-boundな人間の`requirements`承認を明示的に記録。
+3. コンポーネントとADRを更新し、設計文書・ADRの`rubber-duck`レビューを実施して
+   指摘事項をすべて修正（指摘がゼロになるまで繰り返す）、`design` checkpoint
+   を記録し、実装前にartifact-boundな人間の`design`承認を明示的に記録。
 4. 注釈付きテストを作成し、構造化結果を伴う `tdd red` と変更の `red` を記録。
 5. 最小実装後に `implementation`、成功する `tdd green`、変更の `green` を記録。
 6. 注釈とグラフを更新して変更影響・網羅性を確認。
-7. 実コマンドで候補品質ゲートを実行。承認以外の必須checkがすべて合格した後、
-   人間が`release`承認を記録してgate/statusを再実行し、その後だけ
-   commit・push・publish・deployへ進む。検証結果や自然言語から承認を推測しない。
+7. 実コマンドで候補品質ゲートを実行。リリース・品質エビデンス要約の
+   `rubber-duck`レビューを実施して指摘事項をすべて修正(指摘がゼロになるまで
+   繰り返す)。承認以外の必須checkがすべて合格した後、人間が`release`承認を
+   記録してgate/statusを再実行し、その後だけcommit・push・publish・deployへ
+   進む。検証結果や自然言語から承認を推測しない。
+
+AIが生成した文書成果物(要求、設計、ADR、CHANGE文書、リリース・品質エビデンス
+要約)は、対応する人間承認を依頼する**前**に、指摘事項がゼロになるまでこの
+`rubber-duck`レビュー・修正ループを実施する。
 
 ```sh
 npx musubix3 requirements validate .musubix/features/example/requirements.md --json

package/README.md

@@ -252,11 +252,15 @@ question at a time and waits for the answer; it does not batch questions or
 finalize requirements while blockers remain.
 
 1. Use native planning/research to establish intent and measurable acceptance.
-2. Record `change-record CHANGE-ID impact`, edit/validate requirements, record
-   the `requirements` checkpoint, then obtain explicit artifact-bound human
-   `requirements` approval before design.
-3. Design explicit components, record trade-offs in ADRs, record `design`, then
-   obtain explicit artifact-bound human `design` approval before implementation.
+2. Record `change-record CHANGE-ID impact`, edit/validate requirements, run a
+   `rubber-duck` review of the requirements document and fix every finding
+   (repeat review/fix until zero issues remain), record the `requirements`
+   checkpoint, then obtain explicit artifact-bound human `requirements`
+   approval before design.
+3. Design explicit components, record trade-offs in ADRs, run a `rubber-duck`
+   review of the design document/ADRs and fix every finding (repeat until zero
+   issues remain), record `design`, then obtain explicit artifact-bound human
+   `design` approval before implementation.
 4. Write an annotated behavior test, record a structured failing `tdd red`, then
    record the change `red` checkpoint.
 5. Implement the minimum change, record `implementation`, run passing `tdd green`,
@@ -266,10 +270,17 @@ finalize requirements while blockers remain.
    Red-Implementation-Green loop before moving to the next, instead of
    completing every requirement's Red before any Implementation.
 6. Add trace annotations, build graphs, inspect impact and fix missing coverage.
-7. Configure real checks and run the candidate `gate --changed`. After every
-   required non-approval check passes, obtain explicit human `release` approval,
+7. Configure real checks and run the candidate `gate --changed`. Run a
+   `rubber-duck` review of the release/quality evidence summary and fix every
+   finding (repeat until zero issues remain). After every required
+   non-approval check passes, obtain explicit human `release` approval,
    rerun the gate/status, and only then commit, push, publish, or deploy.
 
+Any AI-generated documentation deliverable (requirements, design, ADRs, the
+CHANGE document, or release/quality evidence summaries) goes through this
+`rubber-duck` review/fix loop until zero issues remain **before** the
+corresponding human approval step is requested.
+
 ```sh
 npx musubix3 requirements validate .musubix/features/example/requirements.md --json
 npx musubix3 constitution validate --json

package/dist/packages/cli/src/main.js

@@ -24,7 +24,7 @@ function pathQuery(root, query) {
     return portable(relative(root, resolve(root, query)));
 }
 export function createProgram() {
-    const program = new Command().name('musubix3').description('Evidence-driven SDD for GitHub Copilot CLI / 根拠に基づく仕様駆動開発').version('0.1.14');
+    const program = new Command().name('musubix3').description('Evidence-driven SDD for GitHub Copilot CLI / 根拠に基づく仕様駆動開発').version('0.1.15');
     program.exitOverride();
     common(program.command('init').alias('install').description('Install repository skills and SDD artifacts (preserves existing files)'))
         .option('--dry-run', 'Preview without writing').option('--force', 'Replace bundled, managed paths only')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "musubix3",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "Evidence-driven specification development skills for GitHub Copilot CLI",
   "type": "module",
   "license": "MIT",

package/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "musubix3",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "Evidence-driven SDD skills for GitHub Copilot CLI: requirements, design, traceability, implementation, quality, knowledge, formal checks and codegraph.",
   "author": { "name": "nahisaho" },
   "repository": "https://github.com/nahisaho/musubix3",