specweave 0.22.0 → 0.22.3

package/plugins/specweave/templates/iac/gcp-cloud-functions/templates/main.tf.hbs

@@ -0,0 +1,192 @@
+# GCP Cloud Functions + Firestore Terraform Configuration
+# Generated by SpecWeave Serverless Architecture Intelligence
+
+# Enable required APIs
+resource "google_project_service" "cloudfunctions" {
+  project = "{{projectId}}"
+  service = "cloudfunctions.googleapis.com"
+
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "cloudbuild" {
+  project = "{{projectId}}"
+  service = "cloudbuild.googleapis.com"
+
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "firestore" {
+  project = "{{projectId}}"
+  service = "firestore.googleapis.com"
+
+  disable_on_destroy = false
+}
+
+resource "google_project_service" "run" {
+  project = "{{projectId}}"
+  service = "run.googleapis.com"
+
+  disable_on_destroy = false
+}
+
+# Service Account for Cloud Function
+resource "google_service_account" "{{snakeCase serviceAccountId}}" {
+  account_id   = "{{serviceAccountId}}"
+  display_name = "Service Account for {{functionName}}"
+  project      = "{{projectId}}"
+}
+
+# IAM binding for Firestore access
+resource "google_project_iam_member" "firestore_user" {
+  project = "{{projectId}}"
+  role    = "roles/datastore.user"
+  member  = "serviceAccount:${google_service_account.{{snakeCase serviceAccountId}}.email}"
+}
+
+# Storage Bucket for function source code
+resource "google_storage_bucket" "{{snakeCase bucketName}}" {
+  name     = "{{bucketName}}-{{projectId}}"
+  location = "{{bucketLocation}}"
+  project  = "{{projectId}}"
+
+  uniform_bucket_level_access = true
+
+  labels = {
+    environment = "{{environment}}"
+    managed_by  = "terraform"
+    project     = "{{projectName}}"
+  }
+}
+
+# Storage Bucket Object for function source code (placeholder)
+resource "google_storage_bucket_object" "function_source" {
+  name   = "function-source-{{environment}}.zip"
+  bucket = google_storage_bucket.{{snakeCase bucketName}}.name
+  source = "function-source.zip"  # You need to provide this file
+}
+
+# Cloud Function (2nd generation)
+resource "google_cloudfunctions2_function" "{{snakeCase functionName}}" {
+  name     = "{{functionName}}"
+  location = "{{region}}"
+  project  = "{{projectId}}"
+
+  build_config {
+    runtime     = "{{runtime}}"
+    entry_point = "{{entryPoint}}"
+
+    source {
+      storage_source {
+        bucket = google_storage_bucket.{{snakeCase bucketName}}.name
+        object = google_storage_bucket_object.function_source.name
+      }
+    }
+  }
+
+  service_config {
+    max_instance_count = {{maxInstances}}
+    min_instance_count = {{minInstances}}
+    available_memory   = "{{memoryMb}}M"
+    timeout_seconds    = {{timeoutSeconds}}
+
+    {{#if enableConcurrency}}
+    max_instance_request_concurrency = {{maxConcurrentRequests}}
+    {{/if}}
+
+    environment_variables = {
+      ENVIRONMENT      = "{{environment}}"
+      GCP_PROJECT      = "{{projectId}}"
+      FIRESTORE_DATABASE = "{{databaseId}}"
+      COLLECTION_ID    = "{{collectionId}}"
+      {{#if customEnvVars}}
+      {{#each customEnvVars}}
+      {{@key}} = "{{this}}"
+      {{/each}}
+      {{/if}}
+    }
+
+    service_account_email = google_service_account.{{snakeCase serviceAccountId}}.email
+
+    {{#if enableVpc}}
+    vpc_connector                 = google_vpc_access_connector.connector.id
+    vpc_connector_egress_settings = "ALL_TRAFFIC"
+    {{/if}}
+
+    {{#if corsOrigins}}
+    ingress_settings = "ALLOW_ALL"
+    {{/if}}
+  }
+
+  labels = {
+    environment = "{{environment}}"
+    managed_by  = "terraform"
+    project     = "{{projectName}}"
+  }
+
+  depends_on = [
+    google_project_service.cloudfunctions,
+    google_project_service.cloudbuild,
+    google_project_service.run,
+    google_project_iam_member.firestore_user
+  ]
+}
+
+# Cloud Function IAM - Allow unauthenticated invocations (API Gateway equivalent)
+resource "google_cloudfunctions2_function_iam_member" "invoker" {
+  project        = google_cloudfunctions2_function.{{snakeCase functionName}}.project
+  location       = google_cloudfunctions2_function.{{snakeCase functionName}}.location
+  cloud_function = google_cloudfunctions2_function.{{snakeCase functionName}}.name
+
+  role   = "roles/cloudfunctions.invoker"
+  member = "allUsers"  # For public API. Use specific members for private APIs
+}
+
+# Firestore Database
+resource "google_firestore_database" "{{snakeCase databaseId}}" {
+  project     = "{{projectId}}"
+  name        = "{{databaseId}}"
+  location_id = "{{region}}"
+  type        = "FIRESTORE_NATIVE"
+
+  concurrency_mode            = "OPTIMISTIC"
+  app_engine_integration_mode = "DISABLED"
+
+  depends_on = [google_project_service.firestore]
+}
+
+{{#if enableVpc}}
+# VPC Access Connector for private networking
+resource "google_vpc_access_connector" "connector" {
+  name          = "{{functionName}}-vpc-connector"
+  region        = "{{region}}"
+  project       = "{{projectId}}"
+  ip_cidr_range = "10.8.0.0/28"
+  network       = var.vpc_network
+}
+{{/if}}
+
+{{#if enableSecretManager}}
+# Secret Manager for sensitive configuration
+resource "google_secret_manager_secret" "{{snakeCase functionName}}_secrets" {
+  secret_id = "{{functionName}}-secrets"
+  project   = "{{projectId}}"
+
+  replication {
+    auto {}
+  }
+
+  labels = {
+    environment = "{{environment}}"
+    managed_by  = "terraform"
+  }
+}
+
+# IAM binding for Secret Manager access
+resource "google_secret_manager_secret_iam_member" "secret_accessor" {
+  project   = google_secret_manager_secret.{{snakeCase functionName}}_secrets.project
+  secret_id = google_secret_manager_secret.{{snakeCase functionName}}_secrets.secret_id
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.{{snakeCase serviceAccountId}}.email}"
+}
+{{/if}}

package/plugins/specweave/templates/iac/gcp-cloud-functions/templates/outputs.tf.hbs

@@ -0,0 +1,66 @@
+# Output Values for GCP Cloud Functions + Firestore
+# Generated by SpecWeave Serverless Architecture Intelligence
+
+output "function_name" {
+  description = "Cloud Function name"
+  value       = google_cloudfunctions2_function.{{snakeCase functionName}}.name
+}
+
+output "function_id" {
+  description = "Cloud Function ID"
+  value       = google_cloudfunctions2_function.{{snakeCase functionName}}.id
+}
+
+output "function_url" {
+  description = "Cloud Function HTTPS trigger URL"
+  value       = google_cloudfunctions2_function.{{snakeCase functionName}}.service_config[0].uri
+}
+
+output "function_region" {
+  description = "Cloud Function region"
+  value       = google_cloudfunctions2_function.{{snakeCase functionName}}.location
+}
+
+output "service_account_email" {
+  description = "Service Account email for Cloud Function"
+  value       = google_service_account.{{snakeCase serviceAccountId}}.email
+}
+
+output "firestore_database_name" {
+  description = "Firestore database name"
+  value       = google_firestore_database.{{snakeCase databaseId}}.name
+}
+
+output "firestore_location" {
+  description = "Firestore database location"
+  value       = google_firestore_database.{{snakeCase databaseId}}.location_id
+}
+
+output "storage_bucket_name" {
+  description = "Storage bucket name for function source code"
+  value       = google_storage_bucket.{{snakeCase bucketName}}.name
+}
+
+output "storage_bucket_url" {
+  description = "Storage bucket URL"
+  value       = google_storage_bucket.{{snakeCase bucketName}}.url
+}
+
+{{#if enableSecretManager}}
+output "secret_manager_secret_id" {
+  description = "Secret Manager secret ID"
+  value       = google_secret_manager_secret.{{snakeCase functionName}}_secrets.secret_id
+}
+{{/if}}
+
+{{#if enableVpc}}
+output "vpc_connector_id" {
+  description = "VPC Access Connector ID"
+  value       = google_vpc_access_connector.connector.id
+}
+{{/if}}
+
+output "project_id" {
+  description = "GCP Project ID"
+  value       = "{{projectId}}"
+}

package/plugins/specweave/templates/iac/gcp-cloud-functions/templates/providers.tf.hbs

@@ -0,0 +1,25 @@
+# Terraform Provider Configuration for GCP
+# Generated by SpecWeave Serverless Architecture Intelligence
+
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 5.0"
+    }
+  }
+
+  {{#if enableRemoteState}}
+  backend "gcs" {
+    bucket = "{{tfStateBucket}}"
+    prefix = "terraform/state/{{projectName}}-{{environment}}"
+  }
+  {{/if}}
+}
+
+provider "google" {
+  project = "{{projectId}}"
+  region  = "{{region}}"
+}

package/plugins/specweave/templates/iac/gcp-cloud-functions/templates/variables.tf.hbs

@@ -0,0 +1,119 @@
+# Input Variables for GCP Cloud Functions + Firestore
+# Generated by SpecWeave Serverless Architecture Intelligence
+
+variable "project_id" {
+  description = "GCP Project ID"
+  type        = string
+  default     = "{{projectId}}"
+}
+
+variable "region" {
+  description = "GCP region for all resources"
+  type        = string
+  default     = "{{region}}"
+}
+
+variable "function_name" {
+  description = "Cloud Function name"
+  type        = string
+  default     = "{{functionName}}"
+}
+
+variable "runtime" {
+  description = "Cloud Function runtime (nodejs20, python312, go121, etc.)"
+  type        = string
+  default     = "{{runtime}}"
+}
+
+variable "entry_point" {
+  description = "Function entry point (handler function name)"
+  type        = string
+  default     = "{{entryPoint}}"
+}
+
+variable "memory_mb" {
+  description = "Memory allocation in MB (128-32768)"
+  type        = number
+  default     = {{memoryMb}}
+}
+
+variable "timeout_seconds" {
+  description = "Function timeout in seconds (1-3600)"
+  type        = number
+  default     = {{timeoutSeconds}}
+}
+
+variable "min_instances" {
+  description = "Minimum number of instances (0 for auto-scale to zero)"
+  type        = number
+  default     = {{minInstances}}
+}
+
+variable "max_instances" {
+  description = "Maximum number of instances"
+  type        = number
+  default     = {{maxInstances}}
+}
+
+variable "environment" {
+  description = "Environment name (dev, staging, prod)"
+  type        = string
+  default     = "{{environment}}"
+}
+
+variable "database_id" {
+  description = "Firestore database ID"
+  type        = string
+  default     = "{{databaseId}}"
+}
+
+variable "collection_id" {
+  description = "Firestore collection ID"
+  type        = string
+  default     = "{{collectionId}}"
+}
+
+variable "service_account_id" {
+  description = "Service Account ID for Cloud Function"
+  type        = string
+  default     = "{{serviceAccountId}}"
+}
+
+variable "cors_origins" {
+  description = "List of allowed CORS origins"
+  type        = list(string)
+  default     = {{tfList corsOrigins}}
+}
+
+variable "project_name" {
+  description = "Project name for resource labeling"
+  type        = string
+  default     = "{{projectName}}"
+}
+
+variable "bucket_name" {
+  description = "Storage bucket name for function source code"
+  type        = string
+  default     = "{{bucketName}}"
+}
+
+variable "bucket_location" {
+  description = "Storage bucket location (US, EU, ASIA, or region)"
+  type        = string
+  default     = "{{bucketLocation}}"
+}
+
+{{#if enableConcurrency}}
+variable "max_concurrent_requests" {
+  description = "Maximum concurrent requests per instance"
+  type        = number
+  default     = {{maxConcurrentRequests}}
+}
+{{/if}}
+
+{{#if enableVpc}}
+variable "vpc_network" {
+  description = "VPC network name for private networking"
+  type        = string
+}
+{{/if}}

package/plugins/specweave/templates/iac/supabase/defaults.json

@@ -0,0 +1,15 @@
+{
+  "projectName": "my-supabase-project",
+  "orgId": "your-org-id",
+  "region": "us-east-1",
+  "databasePassword": "changeme123",
+  "planType": "free",
+  "environment": "dev",
+  "enableAuth": true,
+  "enableStorage": true,
+  "enableRealtime": true,
+  "enableEdgeFunctions": true,
+  "storageBuckets": ["avatars", "documents"],
+  "authProviders": ["email"],
+  "postgresVersion": "15"
+}

package/plugins/specweave/templates/iac/supabase/templates/README.md.hbs

@@ -0,0 +1,46 @@
+# Supabase (PostgreSQL + Auth + Storage + Edge Functions) Configuration
+
+**Generated by SpecWeave Serverless Architecture Intelligence**
+
+Supabase provides complete backend-as-a-service:
+- PostgreSQL database (Postgres {{postgresVersion}})
+- Built-in Auth ({{authProviders}})
+- Object Storage
+- Edge Functions (Deno runtime)
+- Realtime subscriptions
+
+## Prerequisites
+
+1. Install Supabase CLI: `npm install -g supabase`
+2. Login: `supabase login`
+3. Get Org ID: `supabase orgs list`
+
+## Deployment
+
+```bash
+# Initialize Supabase
+supabase init
+
+# Link to project
+supabase link --project-ref {{projectName}}
+
+# Deploy database migrations
+supabase db push
+
+# Deploy edge functions
+supabase functions deploy
+```
+
+## Cost: $0/month (Free Tier)
+
+Supabase free tier includes:
+- 500 MB database storage
+- 1 GB file storage
+- 2 GB bandwidth
+- 50,000 monthly active users
+- 500,000 Edge Function invocations
+
+## Support
+
+- Supabase Docs: https://supabase.com/docs
+- SpecWeave: https://spec-weave.com

package/plugins/specweave/templates/iac/supabase/templates/main.tf.hbs

@@ -0,0 +1,50 @@
+# Supabase (Database + Auth + Storage + Edge Functions) Configuration
+# Generated by SpecWeave Serverless Architecture Intelligence
+#
+# Note: Supabase doesn't have official Terraform provider yet.
+# This uses Supabase CLI with null_resource provisioners.
+# For production, use Supabase Management API or wait for official provider.
+
+# Supabase Project (using CLI)
+resource "null_resource" "supabase_project" {
+  provisioner "local-exec" {
+    command = <<-EOT
+      supabase projects create {{projectName}} \
+        --org-id {{orgId}} \
+        --region {{region}} \
+        --plan {{planType}} \
+        --db-password '{{databasePassword}}'
+    EOT
+  }
+
+  provisioner "local-exec" {
+    when    = destroy
+    command = "supabase projects delete {{projectName}} --org-id {{orgId}}"
+  }
+}
+
+# Storage Buckets
+{{#each storageBuckets}}
+resource "null_resource" "storage_bucket_{{this}}" {
+  provisioner "local-exec" {
+    command = <<-EOT
+      supabase storage create {{this}} \
+        --project-ref {{projectName}} \
+        --public
+    EOT
+  }
+
+  depends_on = [null_resource.supabase_project]
+}
+{{/each}}
+
+# Edge Functions
+{{#if enableEdgeFunctions}}
+resource "null_resource" "edge_functions" {
+  provisioner "local-exec" {
+    command = "supabase functions deploy --project-ref {{projectName}}"
+  }
+
+  depends_on = [null_resource.supabase_project]
+}
+{{/if}}

package/plugins/specweave-ado/lib/ado-multi-project-sync.js

@@ -373,7 +373,6 @@ ${userStory.technicalContext}
         return mapping.task || "Task";
       case "Subtask":
         return mapping.task || "Task";
-      // ADO doesn't have subtasks, use Task
       default:
         return "User Story";
     }

package/plugins/specweave-github/agents/github-manager/AGENT.md

@@ -1,6 +1,38 @@
 # GitHub Manager Agent
 
-**Role**: GitHub integration specialist for SpecWeave increments
+⚠️ **DEPRECATED: Use Living Docs Sync Instead** ⚠️
+
+**CRITICAL**: This agent creates GitHub issues using the OLD `[Increment XXXX]` format,
+which violates SpecWeave's data flow architecture.
+
+**CORRECT DATA FLOW**:
+```
+Increment → Living Docs → GitHub
+            (source of truth)
+```
+
+**USE INSTEAD**:
+- `/specweave:sync-docs update` - Generate living docs from increments
+- `/specweave-github:sync` - Sync living docs to GitHub Issues
+- Result: Issues use correct `US-XXX` or `FS-YY-MM-DD` format
+
+**WHY THIS IS DEPRECATED**:
+1. Creates issues with `[Increment XXXX]` format (rejected by validation)
+2. Bypasses living docs (source of truth)
+3. No traceability to User Stories/Feature Specs
+4. Cannot sync bidirectionally with living docs
+
+**IF YOU USE THIS AGENT**: GitHub client will REJECT issue creation with error:
+```
+❌ DEPRECATED FORMAT DETECTED: "[Increment 0043] Title"
+GitHub issues MUST use living docs format:
+  ✅ CORRECT: "US-XXX: Title" (User Story)
+  ✅ CORRECT: "FS-YY-MM-DD: Title" (Feature Spec)
+```
+
+---
+
+**Role**: GitHub integration specialist for SpecWeave increments (DEPRECATED)
 
 **Expertise**: GitHub CLI, GitHub API, issue management, project boards, automation, webhooks, Actions
 
@@ -143,9 +175,9 @@ Invoke the github-manager agent (via Task tool) for:
 ### Issue Management
 
 ```bash
-# Create issue
+# ❌ DEPRECATED - Create issue (OLD FORMAT - DO NOT USE)
 gh issue create \
-  --title "[Increment 0004] Plugin Architecture" \
+  --title "[Increment 0004] Plugin Architecture" \  # ❌ DEPRECATED
   --body "$(cat issue-body.md)" \
   --label "specweave,increment,P1" \
   --milestone "v0.4.0"
@@ -384,10 +416,10 @@ When a new increment is created:
    - Parse `tasks.md` for task checklist
    - Format using issue template
 
-4. **Create GitHub Issue**
+4. **Create GitHub Issue** (❌ DEPRECATED - DO NOT USE)
    ```bash
    gh issue create \
-     --title "[Increment 0004] Plugin Architecture" \
+     --title "[Increment 0004] Plugin Architecture" \  # ❌ DEPRECATED
      --body "$(cat /tmp/issue-body.md)" \
      --label "specweave,increment,P1" \
      --milestone "v0.4.0"
@@ -680,9 +712,9 @@ GitHub Manager Agent:
 5. Updating metadata...
    ✓ Saved to .metadata.yaml
 
-✅ GitHub Issue Created!
+✅ GitHub Issue Created! (❌ DEPRECATED FORMAT)
 
-Issue #130: [Increment 0004] Plugin Architecture
+Issue #130: [Increment 0004] Plugin Architecture  # ❌ DEPRECATED
 URL: https://github.com/owner/repo/issues/130
 
 You can now:

package/plugins/specweave-github/commands/specweave-github-cleanup-duplicates.md

@@ -1,6 +1,27 @@
 ---
 name: specweave-github:cleanup-duplicates
 description: Clean up duplicate GitHub issues for an Epic. Finds issues with duplicate titles and closes all except the first created issue.
+justification: |
+  CRITICAL INCIDENT RESPONSE TOOL - DO NOT DELETE!
+
+  Why This Command Exists:
+  - Prevention systems (deduplication, GitHub self-healing) work for single-process execution
+  - Multiple parallel Claude Code instances bypass all prevention (file-based cache, no distributed locking)
+  - GitHub API race conditions: Time gap between "check exists" and "create issue" allows duplicates
+  - Historical duplicates from pre-v0.14.1 users (before prevention was added)
+
+  Evidence of Need:
+  - 2025-11-13: 123 duplicate GitHub issues incident (cleaned to 29 unique)
+  - Parallel execution creates race conditions that prevention CANNOT solve
+  - Industry standard: Prevention + Detection + Cleanup (defense in depth)
+
+  When to Delete:
+  - ONLY if distributed locking implemented (Redis/file locks)
+  - AND parallel execution tested (100+ concurrent syncs with zero duplicates)
+  - AND zero duplicates for 6+ months in production
+  - AND all users migrated to prevention-enabled versions
+
+  See: .specweave/increments/0043-spec-md-desync-fix/reports/ULTRATHINK-CLEANUP-DUPLICATES-NECESSITY-2025-11-18.md
 ---
 
 # Clean Up Duplicate GitHub Issues

package/plugins/specweave-github/commands/specweave-github-create-issue.md

@@ -175,9 +175,9 @@ Creating issue...
 ✓ Milestone set: v0.4.0
 ✓ Metadata updated
 
-✅ GitHub Issue Created!
+✅ GitHub Issue Created! (❌ DEPRECATED FORMAT)
 
-Issue #130: [Increment 0004] Plugin Architecture
+Issue #130: [Increment 0004] Plugin Architecture  # ❌ DEPRECATED
 URL: https://github.com/owner/repo/issues/130
 
 Auto-sync enabled: progress will update automatically after each task.
@@ -274,15 +274,15 @@ Preview issue body before creating:
 
 Output:
 ```
-📄 Preview: Issue body for increment 0004
+📄 Preview: Issue body for increment 0004 (❌ DEPRECATED FORMAT)
 
-Title: [Increment 0004] Plugin Architecture
+Title: [Increment 0004] Plugin Architecture  # ❌ DEPRECATED
 Labels: specweave, increment, P1
 Milestone: v0.4.0
 
 Body:
 ---
-# [Increment 0004] Plugin Architecture
+# [Increment 0004] Plugin Architecture  # ❌ DEPRECATED
 
 **Status**: Planning
 **Priority**: P1

package/plugins/specweave-github/lib/CodeValidator.ts

@@ -7,7 +7,7 @@
  * - Files are empty or have trivial content
  * - Implementation is incomplete
  *
- * Used by ThreeLayerSyncManager to enforce code-completion discipline.
+ * Used by GitHub sync to enforce code-completion discipline.
  *
  * @module CodeValidator
  */