opsx-gherkin 1.0.0

package/skills/opsx-gherkin/references/examples/account.feature.md

@@ -0,0 +1,96 @@
+`@code` `@authentication` `@security`
+# Feature: User sign-in
+
+Allow registered users to access their accounts securely while rejecting invalid credentials and limiting repeated attempts.
+
+## Background:
+
+* Given the authentication service is available
+
+`@credentials`
+## Rule: Credentials are verified securely
+
+The system SHALL grant access only when an active registered user provides the correct email address and password.
+
+`@smoke` `@positive`
+### Scenario Outline: Sign-in succeeds with correct credentials
+
+* Given an active registered account with these credentials:
+  | email | password |
+  | <storedEmail> | <storedPassword> |
+* And the account has <priorFailureCount> consecutive failed sign-in attempts
+* When the user signs in with email "<submittedEmail>" and password "<submittedPassword>"
+* Then the system grants access to the account with email "<expectedAccountEmail>"
+* And the system starts an authenticated session
+
+#### Examples: Matching credentials
+
+  | storedEmail | storedPassword | priorFailureCount | submittedEmail | submittedPassword | expectedAccountEmail |
+  | user@example.com | correct-password | 0 | user@example.com | correct-password | user@example.com |
+
+`@negative` `@api`
+### Scenario Outline: Sign-in rejects invalid credentials
+
+* Given only the following active account is registered:
+  | email | password |
+  | <storedEmail> | <storedPassword> |
+* And the account has <priorFailureCount> consecutive failed sign-in attempts
+* When a user signs in with email "<submittedEmail>" and password "<submittedPassword>"
+* Then the system rejects access with HTTP status <httpStatus>
+* And the response body is:
+
+  ```json
+  {
+    "error": "<errorCode>"
+  }
+  ```
+
+`@unknown-account`
+#### Examples: Unknown account
+
+  | storedEmail | storedPassword | priorFailureCount | submittedEmail | submittedPassword | httpStatus | errorCode |
+  | user@example.com | correct-password | 0 | missing@example.com | any-password | 401 | invalid_credentials |
+
+`@incorrect-password`
+#### Examples: Incorrect password
+
+  | storedEmail | storedPassword | priorFailureCount | submittedEmail | submittedPassword | httpStatus | errorCode |
+  | user@example.com | correct-password | 0 | user@example.com | wrong-password | 401 | invalid_credentials |
+
+`@account-protection`
+## Rule: Repeated failures lock the account
+
+The system SHALL lock an account after five consecutive failed sign-in attempts. The system SHALL reject sign-in while the account is locked, even when the submitted credentials are correct.
+
+`@negative` `@lockout`
+### Scenario Outline: Sign-in locks the account at the failure limit
+
+* Given an active registered account with these credentials:
+  | email | password |
+  | <storedEmail> | <storedPassword> |
+* And the account has <priorFailureCount> consecutive failed sign-in attempts
+* When a user signs in with email "<submittedEmail>" and password "<submittedPassword>"
+* Then the system rejects access
+* And the account has <expectedFailureCount> consecutive failed sign-in attempts
+* And the system locks the account
+
+#### Examples: Failure limit reached
+
+  | storedEmail | storedPassword | priorFailureCount | submittedEmail | submittedPassword | expectedFailureCount |
+  | user@example.com | correct-password | 4 | user@example.com | wrong-password | 5 |
+
+`@negative` `@lockout`
+### Scenario Outline: A locked account rejects correct credentials
+
+* Given a registered account with these credentials:
+  | email | password |
+  | <storedEmail> | <storedPassword> |
+* And the account has <priorFailureCount> consecutive failed sign-in attempts
+* But the account is locked
+* When a user signs in with email "<submittedEmail>" and password "<submittedPassword>"
+* Then the system rejects access
+
+#### Examples: Correct credentials while locked
+
+  | storedEmail | storedPassword | priorFailureCount | submittedEmail | submittedPassword |
+  | user@example.com | correct-password | 5 | user@example.com | correct-password |

package/skills/opsx-gherkin/references/examples/account.openspec.md

@@ -0,0 +1,109 @@
+`@code` `@authentication` `@security`
+# User sign-in
+
+## Purpose
+
+Allow registered users to access their accounts securely while rejecting invalid credentials and limiting repeated attempts.
+
+## Requirements
+
+**Background:**
+
+- **GIVEN** the authentication service is available
+
+`@credentials`
+### Requirement: Credentials are verified securely
+
+The system SHALL grant access only when an active registered user provides the correct email address and password.
+
+`@smoke` `@positive`
+#### Scenario Outline: Sign-in succeeds with correct credentials
+
+- **GIVEN** an active registered account with these credentials:
+  | email | password |
+  | --- | --- |
+  | <storedEmail> | <storedPassword> |
+- **AND** the account has <priorFailureCount> consecutive failed sign-in attempts
+- **WHEN** the user signs in with email "<submittedEmail>" and password "<submittedPassword>"
+- **THEN** the system grants access to the account with email "<expectedAccountEmail>"
+- **AND** the system starts an authenticated session
+
+##### Examples: Matching credentials
+
+  | storedEmail | storedPassword | priorFailureCount | submittedEmail | submittedPassword | expectedAccountEmail |
+  | --- | --- | --- | --- | --- | --- |
+  | user@example.com | correct-password | 0 | user@example.com | correct-password | user@example.com |
+
+`@negative` `@api`
+#### Scenario Outline: Sign-in rejects invalid credentials
+
+- **GIVEN** only the following active account is registered:
+  | email | password |
+  | --- | --- |
+  | <storedEmail> | <storedPassword> |
+- **AND** the account has <priorFailureCount> consecutive failed sign-in attempts
+- **WHEN** a user signs in with email "<submittedEmail>" and password "<submittedPassword>"
+- **THEN** the system rejects access with HTTP status <httpStatus>
+- **AND** the response body is:
+
+  ```json
+  {
+    "error": "<errorCode>"
+  }
+  ```
+
+`@unknown-account`
+##### Examples: Unknown account
+
+  | storedEmail | storedPassword | priorFailureCount | submittedEmail | submittedPassword | httpStatus | errorCode |
+  | --- | --- | --- | --- | --- | --- | --- |
+  | user@example.com | correct-password | 0 | missing@example.com | any-password | 401 | invalid_credentials |
+
+`@incorrect-password`
+##### Examples: Incorrect password
+
+  | storedEmail | storedPassword | priorFailureCount | submittedEmail | submittedPassword | httpStatus | errorCode |
+  | --- | --- | --- | --- | --- | --- | --- |
+  | user@example.com | correct-password | 0 | user@example.com | wrong-password | 401 | invalid_credentials |
+
+`@account-protection`
+### Requirement: Repeated failures lock the account
+
+The system SHALL lock an account after five consecutive failed sign-in attempts. The system SHALL reject sign-in while the account is locked, even when the submitted credentials are correct.
+
+`@negative` `@lockout`
+#### Scenario Outline: Sign-in locks the account at the failure limit
+
+- **GIVEN** an active registered account with these credentials:
+  | email | password |
+  | --- | --- |
+  | <storedEmail> | <storedPassword> |
+- **AND** the account has <priorFailureCount> consecutive failed sign-in attempts
+- **WHEN** a user signs in with email "<submittedEmail>" and password "<submittedPassword>"
+- **THEN** the system rejects access
+- **AND** the account has <expectedFailureCount> consecutive failed sign-in attempts
+- **AND** the system locks the account
+
+##### Examples: Failure limit reached
+
+  | storedEmail | storedPassword | priorFailureCount | submittedEmail | submittedPassword | expectedFailureCount |
+  | --- | --- | --- | --- | --- | --- |
+  | user@example.com | correct-password | 4 | user@example.com | wrong-password | 5 |
+
+`@negative` `@lockout`
+#### Scenario Outline: A locked account rejects correct credentials
+
+- **GIVEN** a registered account with these credentials:
+  | email | password |
+  | --- | --- |
+  | <storedEmail> | <storedPassword> |
+- **AND** the account has <priorFailureCount> consecutive failed sign-in attempts
+- **BUT** the account is locked
+- **WHEN** a user signs in with email "<submittedEmail>" and password "<submittedPassword>"
+- **THEN** the system rejects access
+
+##### Examples: Correct credentials while locked
+
+  | storedEmail | storedPassword | priorFailureCount | submittedEmail | submittedPassword |
+  | --- | --- | --- | --- | --- |
+  | user@example.com | correct-password | 5 | user@example.com | correct-password |

package/skills/opsx-gherkin/references/examples/authentication-delta.feature

@@ -0,0 +1,41 @@
+@code @openspec-delta
+Feature: Authentication delta
+
+  STRUCTURAL CHANGE DOCUMENT: This Feature packages OpenSpec delta operations for authentication software. It demonstrates a change document, not one completed application use case. The added and modified requirements contain complete behavioral examples; removal and rename contain only the names allowed by the conversion contract.
+
+  @openspec-added
+  Rule: Recovery codes
+
+    The system SHALL accept one unused recovery code.
+
+    Scenario Outline: An unused recovery code grants account access
+      Given the account with email "<accountEmail>" has the unused recovery code "<storedRecoveryCode>"
+      When a user requests account access for "<submittedEmail>" with recovery code "<submittedRecoveryCode>"
+      Then access is granted to the account with email "<expectedAccountEmail>"
+
+      Examples: Matching unused recovery code
+        | accountEmail | storedRecoveryCode | submittedEmail | submittedRecoveryCode | expectedAccountEmail |
+        | user@example.com | recovery-7 | user@example.com | recovery-7 | user@example.com |
+
+  @openspec-modified
+  Rule: Password sign-in
+
+    The system SHALL reject an incorrect password.
+
+    Scenario Outline: An incorrect password rejects account access
+      Given the account with email "<accountEmail>" has the password "<storedPassword>"
+      When a user signs in with email "<submittedEmail>" and password "<submittedPassword>"
+      Then access is rejected
+
+      Examples: Password mismatch
+        | accountEmail | storedPassword | submittedEmail | submittedPassword |
+        | user@example.com | correct-password | user@example.com | wrong-password |
+
+  @openspec-removed
+  Rule: Security questions
+
+  @openspec-renamed
+  Rule: Rename requirement
+
+    FROM: ### Requirement: Login audit
+    TO: ### Requirement: Authentication audit

package/skills/opsx-gherkin/references/examples/authentication-delta.feature.md

@@ -0,0 +1,45 @@
+`@code` `@openspec-delta`
+# Feature: Authentication delta
+
+STRUCTURAL CHANGE DOCUMENT: This Feature packages OpenSpec delta operations for authentication software. It demonstrates a change document, not one completed application use case. The added and modified requirements contain complete behavioral examples; removal and rename contain only the names allowed by the conversion contract.
+
+`@openspec-added`
+## Rule: Recovery codes
+
+The system SHALL accept one unused recovery code.
+
+### Scenario Outline: An unused recovery code grants account access
+
+* Given the account with email "<accountEmail>" has the unused recovery code "<storedRecoveryCode>"
+* When a user requests account access for "<submittedEmail>" with recovery code "<submittedRecoveryCode>"
+* Then access is granted to the account with email "<expectedAccountEmail>"
+
+#### Examples: Matching unused recovery code
+
+  | accountEmail | storedRecoveryCode | submittedEmail | submittedRecoveryCode | expectedAccountEmail |
+  | user@example.com | recovery-7 | user@example.com | recovery-7 | user@example.com |
+
+`@openspec-modified`
+## Rule: Password sign-in
+
+The system SHALL reject an incorrect password.
+
+### Scenario Outline: An incorrect password rejects account access
+
+* Given the account with email "<accountEmail>" has the password "<storedPassword>"
+* When a user signs in with email "<submittedEmail>" and password "<submittedPassword>"
+* Then access is rejected
+
+#### Examples: Password mismatch
+
+  | accountEmail | storedPassword | submittedEmail | submittedPassword |
+  | user@example.com | correct-password | user@example.com | wrong-password |
+
+`@openspec-removed`
+## Rule: Security questions
+
+`@openspec-renamed`
+## Rule: Rename requirement
+
+FROM: `### Requirement: Login audit`
+TO: `### Requirement: Authentication audit`

package/skills/opsx-gherkin/references/examples/authentication-delta.openspec.md

@@ -0,0 +1,52 @@
+`@code`
+`@openspec-delta`
+# Authentication delta
+
+## Purpose
+
+STRUCTURAL CHANGE DOCUMENT: This Feature packages OpenSpec delta operations for authentication software. It demonstrates a change document, not one completed application use case. The added and modified requirements contain complete behavioral examples; removal and rename contain only the names allowed by the conversion contract.
+
+## ADDED Requirements
+
+### Requirement: Recovery codes
+
+The system SHALL accept one unused recovery code.
+
+#### Scenario Outline: An unused recovery code grants account access
+
+- **GIVEN** the account with email "<accountEmail>" has the unused recovery code "<storedRecoveryCode>"
+- **WHEN** a user requests account access for "<submittedEmail>" with recovery code "<submittedRecoveryCode>"
+- **THEN** access is granted to the account with email "<expectedAccountEmail>"
+
+##### Examples: Matching unused recovery code
+
+  | accountEmail | storedRecoveryCode | submittedEmail | submittedRecoveryCode | expectedAccountEmail |
+  | --- | --- | --- | --- | --- |
+  | user@example.com | recovery-7 | user@example.com | recovery-7 | user@example.com |
+
+## MODIFIED Requirements
+
+### Requirement: Password sign-in
+
+The system SHALL reject an incorrect password.
+
+#### Scenario Outline: An incorrect password rejects account access
+
+- **GIVEN** the account with email "<accountEmail>" has the password "<storedPassword>"
+- **WHEN** a user signs in with email "<submittedEmail>" and password "<submittedPassword>"
+- **THEN** access is rejected
+
+##### Examples: Password mismatch
+
+  | accountEmail | storedPassword | submittedEmail | submittedPassword |
+  | --- | --- | --- | --- |
+  | user@example.com | correct-password | user@example.com | wrong-password |
+
+## REMOVED Requirements
+
+### Requirement: Security questions
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Login audit`
+- TO: `### Requirement: Authentication audit`

package/skills/opsx-gherkin/references/examples/minimal.feature

@@ -0,0 +1,17 @@
+@code
+Feature: Add a product to an empty shopping cart
+
+  Keep the quantity a customer selects when adding a product to an empty shopping cart.
+
+  Rule: Adding a product retains its quantity
+
+    The cart SHALL contain the selected quantity of a product after the customer adds it.
+
+    Scenario Outline: Retain the requested product quantity
+      Given an empty shopping cart
+      When the customer adds <requestedQuantity> units of product "<productId>"
+      Then the cart contains <expectedQuantity> units of product "<productId>"
+
+      Examples: Selected quantity
+        | productId | requestedQuantity | expectedQuantity |
+        | P-7 | 2 | 2 |

package/skills/opsx-gherkin/references/examples/minimal.feature.md

@@ -0,0 +1,19 @@
+`@code`
+# Feature: Add a product to an empty shopping cart
+
+Keep the quantity a customer selects when adding a product to an empty shopping cart.
+
+## Rule: Adding a product retains its quantity
+
+The cart SHALL contain the selected quantity of a product after the customer adds it.
+
+### Scenario Outline: Retain the requested product quantity
+
+* Given an empty shopping cart
+* When the customer adds <requestedQuantity> units of product "<productId>"
+* Then the cart contains <expectedQuantity> units of product "<productId>"
+
+#### Examples: Selected quantity
+
+  | productId | requestedQuantity | expectedQuantity |
+  | P-7 | 2 | 2 |

package/skills/opsx-gherkin/references/examples/minimal.openspec.md

@@ -0,0 +1,24 @@
+`@code`
+# Add a product to an empty shopping cart
+
+## Purpose
+
+Keep the quantity a customer selects when adding a product to an empty shopping cart.
+
+## Requirements
+
+### Requirement: Adding a product retains its quantity
+
+The cart SHALL contain the selected quantity of a product after the customer adds it.
+
+#### Scenario Outline: Retain the requested product quantity
+
+- **GIVEN** an empty shopping cart
+- **WHEN** the customer adds <requestedQuantity> units of product "<productId>"
+- **THEN** the cart contains <expectedQuantity> units of product "<productId>"
+
+##### Examples: Selected quantity
+
+  | productId | requestedQuantity | expectedQuantity |
+  | --- | --- | --- |
+  | P-7 | 2 | 2 |

package/skills/opsx-gherkin/references/profile-access.feature.md

@@ -0,0 +1,34 @@
+`@code`
+# Feature: Access specification conversion guidance
+
+Find the supported output formats and retrieve the canonical conversion profile before authoring a compatible specification. The [canonical mapping contract](OPENSPEC_MDG_PROFILE.feature.md) defines the mappings; this Feature specifies access to that resource.
+
+## Background:
+
+* Given the opsx-gherkin package is installed with its canonical profile resource
+
+## Rule: Help identifies the profile and supported output formats
+
+The CLI SHALL direct readers to the profile before authoring and SHALL distinguish Markdown with Gherkin output from plain Gherkin output.
+
+### Scenario: Find the profile command in help
+
+* When the user requests `opsx-gherkin --help`
+* Then the help directs the user to `opsx-gherkin profile` before authoring
+* And the help distinguishes `.feature.md` from `.feature` output
+
+## Rule: Profile commands return the complete canonical resource
+
+The profile and instructions commands SHALL return the canonical mapping contract verbatim on stdout and SHALL exit with status 0.
+
+### Scenario Outline: Retrieve the canonical contract through `<command>`
+
+* When the user runs `opsx-gherkin <command>`
+* Then stdout equals the complete installed canonical resource byte for byte
+* And the command exits with status `<exit_status>`
+
+#### Examples: Resource commands
+
+  | command | exit_status |
+  | profile | 0 |
+  | instructions | 0 |