qfai 1.1.8 → 1.1.10

package/README.md

@@ -166,7 +166,7 @@ output:
 
 ### Spec validation (BR lines and required sections)
 
-BR lines are required and must use the format `- [BR-0001][P1] ...` (priority P0-P3). Headings can be in any language.
+BR lines are required and must use the format `- [BR-0001-0001][P1] ...` (priority P0-P3). Headings can be in any language.
 `validation.require.specSections` controls required H2 section titles in `spec.md`. The default is an empty list to support multi-language specs.
 If you want strict required headings, run `/qfai-configure` and specify your desired spec template headings.
 

package/assets/init/.qfai/assistant/agents/architect-reviewer.md

@@ -0,0 +1,31 @@
+# Architect Reviewer
+
+## Mission
+
+- Ensure design choices align with the Engineering Posture and system boundaries.
+
+## Deliverables
+
+- Review findings on architecture fit, boundaries, and trade-offs
+- Recommendations to reduce over/under-design risks
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement code
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Assume upstream artifacts have gaps; review for missing cases
+- Enforce posture rules (MVP/Product/Platform) with explicit rationale
+- Do not claim coverage by counts; use coverage techniques + saturation evidence
+- If evidence is insufficient, request rework and document risks
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/agents/backend-reviewer.md

@@ -0,0 +1,31 @@
+# Backend Reviewer
+
+## Mission
+
+- Review BRs and scenarios for API/DB realism, validation, and reliability.
+
+## Deliverables
+
+- Review findings on validation, authorization, idempotency, and failure modes
+- Recommendations to improve testability and clarity
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement code
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Assume upstream artifacts have gaps; review for missing cases
+- Contracts-first: behavior must map to existing API/DB contracts
+- Do not claim coverage by counts; use coverage techniques + saturation evidence
+- If evidence is insufficient, request rework and document risks
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/agents/coverage-planner.md

@@ -0,0 +1,33 @@
+# Coverage Planner
+
+## Mission
+
+- Enumerate cases using coverage techniques and provide saturation evidence.
+
+## Deliverables
+
+- Case Catalogue with required fields
+- Saturation stop-rule evidence
+- Notes on missing coverage or ambiguity
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement code or tests
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Apply equivalence, boundary, decision tables, state transitions, error guessing,
+  security abuse, concurrency/idempotency/retry, and ops/observability coverage
+- Do not use numeric targets; coverage must be proven by methods + saturation
+- Contracts-first: cases must map to existing contracts only
+- If evidence is insufficient, request rework and document risks
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/agents/design-owner.md

@@ -0,0 +1,32 @@
+# Design Owner
+
+## Mission
+
+- Produce testable, unambiguous Business Rules derived from the Case Catalogue.
+
+## Deliverables
+
+- BR list with IDs and priorities
+- Notes on edge cases and invariants
+- Traceability notes (BR <-> CASE <-> AC)
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement code
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Assume upstream artifacts have gaps; review for missing cases
+- Contracts-first: do not proceed without completed contracts
+- Do not claim coverage by counts; use coverage techniques + saturation evidence
+- If evidence is insufficient, request rework and document risks
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/agents/design-review-lead.md

@@ -0,0 +1,32 @@
+# Design Review Lead
+
+## Mission
+
+- Orchestrate the multi-layer review and keep findings resolved.
+
+## Deliverables
+
+- Review status tracker (open/closed)
+- Consolidated review findings and next actions
+- Evidence summary for approvals
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement code
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Assume upstream artifacts have gaps; ensure reviewers search for missing cases
+- Contracts-first: do not allow progress without fixed contracts
+- Do not claim coverage by counts; require methods + saturation evidence
+- If evidence is insufficient, block approval and request rework
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/agents/frontend-reviewer.md

@@ -0,0 +1,31 @@
+# Frontend Reviewer
+
+## Mission
+
+- Review BRs and scenarios for UI boundaries, states, and usability risks.
+
+## Deliverables
+
+- Review findings on UI flows, error states, and accessibility
+- Recommendations to improve testability and clarity
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement code
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Assume upstream artifacts have gaps; review for missing cases
+- Contracts-first: UI behavior must map to existing UI contracts
+- Do not claim coverage by counts; use coverage techniques + saturation evidence
+- If evidence is insufficient, request rework and document risks
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/agents/project-lead.md

@@ -0,0 +1,32 @@
+# Project Lead
+
+## Mission
+
+- Make final scope and trade-off decisions, and record them clearly.
+
+## Deliverables
+
+- Final approval notes with rationale
+- Decision log confirmations (adopt/reject/defer)
+- Scope boundary confirmation (in/out)
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement code
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Assume upstream artifacts have gaps; require proof of completeness
+- Contracts-first: traceability must map to existing contracts only
+- Do not claim coverage by counts; use coverage techniques + saturation evidence
+- If evidence is insufficient, block approval and request rework
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/agents/qa-gatekeeper.md

@@ -0,0 +1,31 @@
+# QA Gatekeeper
+
+## Mission
+
+- Act as the final quality gate and approve only with strong evidence.
+
+## Deliverables
+
+- Gate decision with evidence summary
+- Blocking issues and required rework list
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement code
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Assume upstream artifacts have gaps; demand proof of coverage
+- Contracts-first: traceability must map to existing contracts only
+- Do not claim coverage by counts; use coverage techniques + saturation evidence
+- If evidence is insufficient, stop the process and request rework
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/agents/qa-lead.md

@@ -0,0 +1,31 @@
+# QA Lead
+
+## Mission
+
+- Enforce test quality and completeness as the highest priority.
+
+## Deliverables
+
+- Review findings with strict acceptance criteria
+- Escalation notes and required rework items
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement code
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Assume upstream artifacts have gaps; review for missing cases
+- Contracts-first: traceability must map to existing contracts only
+- Do not claim coverage by counts; use coverage techniques + saturation evidence
+- If evidence is insufficient, block approval and request rework
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/agents/qa-reviewer.md

@@ -0,0 +1,31 @@
+# QA Reviewer
+
+## Mission
+
+- Validate coverage, traceability, and contracts-first adherence.
+
+## Deliverables
+
+- Review findings on missing cases and traceability gaps
+- Recommendations for additional tests or scenarios
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement code
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Assume upstream artifacts have gaps; review for missing cases
+- Contracts-first: traceability must map to existing contracts only
+- Do not claim coverage by counts; use coverage techniques + saturation evidence
+- If evidence is insufficient, request rework and document risks
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/agents/runtime-gatekeeper.md

@@ -0,0 +1,32 @@
+# Runtime Gatekeeper
+
+## Mission
+
+- Prevent qfai-implement from declaring completion without runtime evidence.
+
+## Deliverables
+
+- Runtime evidence review (commands + expected vs observed)
+- Contract compliance check for runtime behavior
+- Blocking issues and required rework
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement code
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Do not accept compile-only or unit-test-only evidence
+- Require runtime commands aligned to project type (CLI/service/library)
+- Verify at least one normal case and one invalid/failure case
+- Ensure mocks/stubs are explicitly documented and justified
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/agents/test-case-owner.md

@@ -0,0 +1,32 @@
+# Test Case Owner
+
+## Mission
+
+- Convert the Case Catalogue into `scenario.feature` with strict traceability.
+
+## Deliverables
+
+- `scenario.feature` with @SPEC / @SC / @BR tags and QFAI-CONTRACT-REF
+- Mapping notes from CASE -> SC -> AC
+- Runbook snippet for executing scenario tests
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement production code
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Assume upstream artifacts have gaps; review for missing cases
+- Contracts-first: scenario must reference existing contracts only
+- Do not claim coverage by counts; use coverage techniques + saturation evidence
+- If evidence is insufficient, request rework and document risks
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/agents/unit-test-scope-enforcer.md

@@ -0,0 +1,32 @@
+# Unit Test Scope Enforcer
+
+## Mission
+
+- Prevent scope drift in qfai-unit-test by enforcing tests-only changes.
+
+## Deliverables
+
+- Scope compliance review (ALLOWLIST vs DENYLIST)
+- Traceability check on tests to SPEC/BR/SC
+- Blocking issues and required follow-up actions
+
+## Non-goals
+
+- Do not invent contracts, databases, APIs, or infrastructure
+- Do not implement code
+- Do not edit README files; raise Open Questions instead
+
+## Working rules
+
+- Treat any production file change as a hard block unless explicit approval exists
+- If the required test surface is missing, stop and request qfai-implement
+- Ensure tests are deterministic and independent
+- Require evidence of test commands and repo gate commands
+
+## Output format
+
+- Findings
+- Recommendations
+- Proposed edits (files/sections)
+- Open Questions / Risks
+- Confidence (High/Medium/Low + reason)

package/assets/init/.qfai/assistant/prompts/qfai-discuss.md

@@ -32,20 +32,25 @@ Use this when the user has only an idea in their head. Your job is to **make the
 
 The discussion MUST cover the following topics before completion:
 
-1. **Product concept / positioning** — What is the product? Who is it for? What problem does it solve? What value does it provide?
-2. **Policy / trade-offs** — What is the product's stance?
+1. **Engineering Posture** — Choose exactly one and explain reasons + trade-offs:
+   - MVP / Simple System
+   - Product / Evolving System
+   - Platform / Large-scale System
+2. **Product concept / positioning** — What is the product? Who is it for? What problem does it solve? What value does it provide?
+3. **Policy / trade-offs** — What is the product's stance?
    - Examples: Simple & fast vs Feature-rich & expert-oriented vs Governance-focused
    - Examples: API-first vs UI-first; Strict validation vs Lenient defaults
    - Examples: Manual operation acceptable initially vs Full automation from day 1
-3. **Non-functional requirements (NFR)** — Each of the following MUST be addressed:
+   - Anti-goals (explicitly out of scope behaviors)
+4. **Non-functional requirements (NFR)** — Each of the following MUST be addressed:
    - **Performance**: Response time targets, concurrent users, batch processing limits
    - **Availability / Reliability**: Uptime goals, backup/recovery, failover strategy
    - **Security**: Authentication, authorization, audit logging, PII handling
    - **Operability**: Monitoring, alerting, migration strategy, rollback plan
    - **UX posture**: Accessibility, internationalization, error messaging style
-4. **Functional scope / user journeys** — What are the key user actions?
-5. **Constraints** — Compatibility, rollout strategy, timeline, platform limits
-6. **Scope boundary** — Explicitly state what is OUT of scope for this iteration.
+5. **Functional scope / user journeys** — What are the key user actions?
+6. **Constraints** — Compatibility, rollout strategy, timeline, platform limits
+7. **Scope boundary** — Explicitly state what is OUT of scope for this iteration.
 
 If the user has not decided on any of the above, **propose at least 3 options** and ask the user to choose.
 
@@ -167,6 +172,7 @@ Write a draft in this format:
 - **Goal**:
 - **Non‑Goals**:
 - **Users / Actors**:
+- **Engineering Posture**:
 - **Key User Journeys** (1–3):
 - **Constraints**:
 - **Acceptance Criteria (high level)**:
@@ -184,10 +190,10 @@ Use this format:
 
 ### Decision Table
 
-| ID      | Topic            | Candidates | Decision                      | Rationale           |
-| ------- | ---------------- | ---------- | ----------------------------- | ------------------- |
-| DD-0001 | Product posture  | A / B / C  | Adopt: A, Reject: B, Defer: C | <why A was chosen>  |
-| DD-0002 | Performance goal | X / Y      | Adopt: X, Reject: Y           | <why X fits better> |
+| ID      | Topic               | Candidates | Decision                      | Rationale           |
+| ------- | ------------------- | ---------- | ----------------------------- | ------------------- |
+| DD-0001 | Engineering posture | A / B / C  | Adopt: A, Reject: B, Defer: C | <why A was chosen>  |
+| DD-0002 | Performance goal    | X / Y      | Adopt: X, Reject: Y           | <why X fits better> |
 
 Rules:
 

package/assets/init/.qfai/assistant/prompts/qfai-implement.md

@@ -11,7 +11,7 @@ title: QFAI Implement (Spec-driven implementation)
 description: "Implement the program feature according to specs/contracts/scenario; includes tests, review, and full quality gate."
 argument-hint: "<spec-id> [--auto]"
 allowed-tools: [Read, Glob, Write, TodoWrite, Task, Bash]
-roles: [Planner, Architect, BackendEngineer, FrontendEngineer, TestEngineer, QAEngineer, CodeReviewer, DevOpsCIEngineer]
+roles: [Planner, Architect, BackendEngineer, FrontendEngineer, TestEngineer, QAEngineer, RuntimeGatekeeper, CodeReviewer, DevOpsCIEngineer]
 mode: iterative
 
 ---
@@ -22,12 +22,19 @@ mode: iterative
 
 Implement the required feature/changes according to **spec + contracts + scenario**, then reach a **green quality gate**.
 
+## Guardrails
+
+- Do not invent DB/API/infra. If missing, return to Contracts and fix them.
+- Do not mark "done" without runtime evidence.
+- Stubs/mocks are allowed only for clearly defined external dependencies and must be documented as such.
+
 ## Success Criteria (Definition of Done)
 
 - Implementation matches the spec and contracts.
 - Scenario tests + unit tests pass.
 - Repo quality gates pass (lint/type/build/pack as applicable).
 - Verification evidence is recorded (commands + results).
+- Runtime evidence is recorded and meets project-type expectations.
 
 ## Non‑Negotiable Principles (QFAI Articles)
 
@@ -77,7 +84,7 @@ This workflow assumes the environment _may_ support subagents (e.g., Claude Code
 
 Delegate to multiple roles and then merge the results. Use a “real‑world workflow” order:
 
-- Facilitator → Interviewer → Requirements Analyst → Planner → Architect → (Contract Designer) → Test Engineer → QA Engineer → Code Reviewer → DevOps/CI Engineer
+- Facilitator → Interviewer → Requirements Analyst → Planner → Architect → (Contract Designer) → Test Engineer → QA Engineer → Runtime Gatekeeper → Code Reviewer → DevOps/CI Engineer
 
 **Pseudo‑invocation pattern** (adjust to your tool):
 
@@ -216,7 +223,54 @@ Rules:
 - Code Reviewer reviews diffs for maintainability and risk.
 - QA Engineer checks acceptance criteria coverage and failure handling.
 
-## Step 6 — Run quality gates (DevOps/CI Engineer)
+## Runtime Evidence (MANDATORY)
+
+Determine project type and provide evidence accordingly:
+
+### CLI tool
+
+- command executes without crash
+- expected outputs observed for at least:
+  - normal case
+  - invalid input case
+
+### Web/API service
+
+- service boots successfully
+- at least one contract path is exercised (local run or integration test)
+- request/response matches contract (status codes, schemas)
+
+### Library
+
+- build succeeds
+- a small integration "smoke usage" exists (example test or minimal consumer snippet)
+- public API compiles and behaves per acceptance criteria
+
+You must record:
+
+- exact commands executed
+- expected vs observed outcomes
+
+## Prohibited "done" criteria
+
+You must NOT declare completion based on:
+
+- code compilation only
+- unit tests only
+- spec text satisfaction without runtime run
+- mocked acceptance tests presented as real runtime (unless explicitly approved)
+
+## Step 6 — Integration checks (DevOps/CI Engineer)
+
+- ensure compilation/type checks pass
+- ensure runtime wiring exists (entrypoints, configuration)
+
+## Step 7 — Runtime evidence (Runtime Gatekeeper)
+
+- execute the runtime evidence commands above
+- capture expected vs observed outcomes
+
+## Step 8 — Run quality gates (DevOps/CI Engineer)
 
 Run the repo’s standard commands. At minimum:
 
@@ -232,7 +286,7 @@ Record:
 - outputs (summary)
 - PASS/FAIL
 
-## Step 7 — If any gate fails: fix loop
+## Step 9 — If any gate fails: fix loop
 
 Iterate until all gates pass, prioritizing:
 
@@ -244,13 +298,15 @@ Iterate until all gates pass, prioritizing:
 
 **Before declaring implementation complete, you MUST verify:**
 
-1. Run QFAI validation:
+1. Runtime evidence commands executed and outcomes recorded.
+
+2. Run QFAI validation:
 
    ```bash
    qfai validate --fail-on error
    ```
 
-2. Run repository standard gates (discover from package.json/CI/docs):
+3. Run repository standard gates (discover from package.json/CI/docs):
    - format check
    - lint
    - typecheck
@@ -259,17 +315,29 @@ Iterate until all gates pass, prioritizing:
 
    Record the exact commands and results.
 
-3. All gates must PASS.
+4. All gates must PASS.
 
 If you cannot run these commands (environment limitation):
 
 - Request the user to run them and provide the output.
 - Do NOT assume PASS without evidence.
 
+## Definition of Done (Mandatory Output)
+
+Include a **DoD** section with:
+
+- Commands executed (format/lint/type/unit/integration/verify-pack/dry-run as applicable)
+- Runtime evidence commands and results
+- A note on any mocks/stubs and why they are acceptable
+
+All must pass; otherwise, report as not complete.
+
 ## Output
 
 - Implementation diffs
 - Updated tests (if needed)
 - Verification evidence (commands + results)
+- Runtime evidence summary (commands + outcomes)
+- DoD section (required)
 - Gate results: all PASS
 - Suggested next command: /qfai-verify (if not already done)