voidmachine 0.0.0 → 4.0.0

package/core-assets/specialists/test-qa-engineer.source

@@ -0,0 +1,14 @@
+Sources:
+- ISTQB Certified Tester Foundation Level syllabus 4.0.1: https://istqb.org/wp-content/uploads/2024/11/ISTQB_CTFL_Syllabus_v4.0.1.pdf
+- ISTQB CTFL 4.0 release notes: https://www.istqb.org/istqb-releases-certified-tester-foundation-level-v4-0-ctfl/
+- Claude Code subagents: https://code.claude.com/docs/en/sub-agents
+- Codex custom agents: https://learn.chatgpt.com/docs/agent-configuration/subagents
+
+Adapted:
+- Kept test-basis traceability, risk focus, meaningful evidence, and defect-versus-missing-proof separation.
+- Narrowed the role to review and release evidence for one ticket or diff.
+- Added the shared Void specialist identity, budget, failure, and JSON output contract.
+
+Rejected:
+- Certification vocabulary, process ceremony, test implementation, and release authority.
+- Architecture, security, product, and visual-design ownership.

package/core-assets/specialists/test-qa-engineer.yaml

@@ -0,0 +1,35 @@
+schemaVersion: 1
+id: core:test-qa-engineer
+version: 2
+name: test-qa-engineer
+description: Reviews behavioral coverage, failure paths, and release evidence without editing the project.
+scope: quality
+independence: fresh-context
+writeAccess: none
+stages: [pre-implementation, post-implementation]
+appliesWhen:
+  any:
+    - qa-baseline
+    - qa
+    - tdd
+    - code-change
+inputs:
+  - ticket
+  - acceptance-criteria
+  - diff
+  - tests
+  - verification-evidence
+outputs:
+  - verdict
+  - findings
+  - evidenceRequests
+  - limitations
+budgets:
+  contextTokens: 12000
+  maxTurns: 2
+failurePolicy: block-on-critical
+instructions: >-
+  Own acceptance-criteria coverage, meaningful assertions, failure paths, regression risk, flakiness,
+  and release evidence. Distinguish missing proof from a proven defect and request the smallest useful
+  verification. Do not perform architecture, security, product, or visual-design review and never edit
+  tests or implementation.

package/core-assets/specialists/visual-craft-director.source

@@ -0,0 +1,17 @@
+Sources:
+- W3C Web Content Accessibility Guidelines 2.2: https://www.w3.org/TR/WCAG22/
+- Apple Human Interface Guidelines, Visual design: https://developer.apple.com/design/human-interface-guidelines/visual-design
+- Playwright visual comparisons: https://playwright.dev/docs/test-snapshots
+- Vercel agent skills, frontend-design: https://github.com/vercel-labs/agent-skills
+- Claude Code subagents: https://code.claude.com/docs/en/sub-agents
+- Codex custom agents: https://learn.chatgpt.com/docs/agent-configuration/subagents
+
+Adapted:
+- Kept evidence-grounded responsive, state, hierarchy, contrast, keyboard, and visual-distinctiveness review.
+- Added a six-dimension 8/10 floor and current-diff binding for every screenshot and test proof.
+- Split post-build judgment from build-time design and live browser operation to preserve fresh context and one-role scope.
+- DEV-843: retained conservative selection while requiring revision-bound rendered-scope assessment before capture obligations; a guidance-only N/A completes scope assessment, not visual certification.
+
+Rejected:
+- LLM-only visual certification, self-authored screenshots, brand invention, implementation, browser driving, functional QA, and architecture or security review.
+- Snapshot approval without current diff identity and applicable state coverage.

package/core-assets/specialists/visual-craft-director.yaml

@@ -0,0 +1,60 @@
+schemaVersion: 1
+id: core:visual-craft-director
+version: 3
+name: visual-craft-director
+description: Independently reviews rendered UI craft, responsive states, accessibility, and current-diff visual evidence after implementation.
+scope: visual-craft
+independence: fresh-context
+writeAccess: none
+stages: [post-implementation]
+appliesWhen:
+  any:
+    - ux-ui
+    - frontend-change
+    - profile-react
+    - profile-expo
+inputs:
+  - ticket
+  - acceptance-criteria
+  - design-contract
+  - current-diff
+  - mobile-screenshots
+  - desktop-screenshots
+  - state-evidence
+  - test-evidence
+outputs:
+  - verdict
+  - findings
+  - evidenceRequests
+  - limitations
+budgets:
+  contextTokens: 16000
+  maxTurns: 3
+failurePolicy: block-on-critical
+instructions: >-
+  Own the post-implementation visual-craft verdict in a context distinct from the builder and
+  pre-build designer. Selection by a UI subject, frontend profile, or changed path requests a
+  scope assessment; it does not establish that a rendered interface changed. First establish
+  applicability from the complete relevant current diff, touched paths, and supplied artifacts.
+  Inspect behavior, including templates and renderers in arbitrary source files, not extensions
+  alone. Mixed guidance and rendered-UI changes require visual review. An empty pre-implementation
+  diff does not prove non-applicability when UI work is planned.
+  If the complete relevant post-implementation evidence establishes that no rendered interface
+  changed, return pass with an explicit "Rendered-UI review not applicable" explanation in
+  limitations, naming the inspected paths and why their changes do not affect a rendered surface.
+  This completes the scope assessment, not visual certification: do not invent craft scores,
+  screenshots, or claims of visual quality. Guidance about UI and a frontend profile alone do not
+  require captures.
+  Resolve relevant omissions through permitted exact-path reads only when their content is
+  demonstrably bound to the reviewed revision and canonical review receipt. A SHA label alone is
+  insufficient. Explain why an unresolved omission is irrelevant before excluding it; missing,
+  truncated, stale, or unbound relevant evidence requires blocked with an evidence request.
+  When rendered UI changes, review current-diff mobile and desktop captures for every applicable state.
+  Score hierarchy, information architecture, interaction states, responsive intent,
+  distinctiveness, and accessibility from 0 to 10; any dimension below 8 requires changes.
+  Reject generic generated-UI reflexes and ground every finding in a supplied screenshot or
+  repository path. For applicable visual review, missing browser access, missing viewport or state
+  captures, captures not tied to the current diff, or absent behavioral test proof requires a
+  blocked verdict. Do not certify visual quality from
+  prose or model judgment alone, invent brand identity, edit code, drive the browser, or perform
+  architecture, security, and functional QA review.

package/core-assets/templates/github/dependency-audit.mjs

@@ -0,0 +1,54 @@
+// Bun 1.3.14: exit 1 means either advisories or a failed registry request.
+// Interpret only a recognized JSON response; ambiguous output never passes.
+import { spawnSync } from 'node:child_process';
+import { appendFileSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const scope = 'npm advisories for packages Bun 1.3.14 sends to its default registry';
+const severities = new Set(['info', 'low', 'moderate', 'high', 'critical']);
+const object = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const advisory = (value) => object(value)
+  && (typeof value.id === 'number' || typeof value.id === 'string')
+  && ['url', 'title', 'vulnerable_versions'].every((key) => typeof value[key] === 'string' && value[key].length > 0)
+  && severities.has(value.severity);
+
+function classify(result) {
+  if (result.error || result.signal || ![0, 1].includes(result.status)) {
+    return { state: 'unavailable', exitCode: 2, reason: 'audit-process-failed' };
+  }
+  let response;
+  try {
+    response = JSON.parse(result.stdout);
+  } catch {
+    return { state: 'unavailable', exitCode: 2, reason: 'invalid-registry-json' };
+  }
+  if (object(response)) {
+    const entries = Object.entries(response);
+    if (entries.length === 0 && result.status === 0) {
+      return { state: 'clean', exitCode: 0, reason: 'no-advisories-in-response' };
+    }
+    if (entries.length > 0 && entries.every(([name, values]) => name.length > 0
+      && Array.isArray(values) && values.length > 0 && values.every(advisory))) {
+      return { state: 'vulnerabilities', exitCode: 1, reason: 'advisories-returned', advisories: response };
+    }
+  }
+  return { state: 'unavailable', exitCode: 2, reason: 'unrecognized-registry-response' };
+}
+
+if (process.argv.length !== 3) {
+  process.stderr.write('Usage: node dependency-audit.mjs <report-directory>\n');
+  process.exitCode = 2;
+} else {
+  const result = spawnSync('bun', ['audit', '--json'], {
+    encoding: 'utf8', shell: false, timeout: 120_000, maxBuffer: 1_048_576,
+  });
+  const report = { schemaVersion: 1, scope, ...classify(result) };
+  const directory = process.argv[2];
+  mkdirSync(directory, { recursive: true });
+  writeFileSync(join(directory, 'result.json'), `${JSON.stringify(report, null, 2)}\n`);
+  const summary = `## Dependency audit: ${report.state}\n\nScope: ${scope}.\n\nReason: ${report.reason}. Exit code: ${report.exitCode}.\n\nUnavailability is not a clean audit. This result does not certify dependencies outside the stated scope.\n`;
+  writeFileSync(join(directory, 'summary.md'), summary);
+  if (process.env.GITHUB_STEP_SUMMARY) appendFileSync(process.env.GITHUB_STEP_SUMMARY, summary);
+  process.stdout.write(summary);
+  process.exitCode = report.exitCode;
+}

package/core-assets/templates/github/void-dependency-audit.yml

@@ -0,0 +1,35 @@
+# Manual consumer template: copy this workflow and its companion script.
+# See docs/DEPENDENCY-AUDIT.md before adopting; no consumer CI is overwritten.
+name: void-dependency-audit
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24
+      - uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
+        with:
+          bun-version: 1.3.14
+      - name: Classify dependency audit
+        run: node .github/scripts/dependency-audit.mjs "$RUNNER_TEMP/dependency-audit"
+      - name: Preserve audit report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: dependency-audit
+          path: ${{ runner.temp }}/dependency-audit
+          if-no-files-found: error
+          retention-days: 7

package/core-assets/templates/github/void-security.yml

@@ -0,0 +1,85 @@
+# Periodic security baseline.
+#
+# Copy into `.github/workflows/` and adjust the schedule. Nothing here depends
+# on a security vendor: the baseline runs whatever scanners the runner happens
+# to have, names the ones it did not find, and reports the surface it could not
+# measure as degraded or blocked — never green.
+#
+# That is the point of running it with no scanner installed at all: the result
+# is honest about measuring almost nothing, instead of a green tick that means
+# "we did not look".
+#
+# Third-party actions are pinned by commit SHA, with the tag in a comment. A
+# mutable tag is a supply-chain hole: whoever controls it controls what runs
+# with your token.
+name: void-security
+
+on:
+  schedule:
+    # Weekly, Monday 04:17 UTC. Change this to whatever cadence you can act on:
+    # a scan nobody reads on Monday morning is a scan that is not being run.
+    # Avoid the top of the hour — GitHub queues those the heaviest.
+    - cron: '17 4 * * 1'
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: Mission mode to judge findings against
+        required: false
+        default: team
+        type: choice
+        options: [fast, team, fortress]
+      prelaunch:
+        description: Hold the run to the stricter pre-launch bar
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+
+jobs:
+  baseline:
+    runs-on: ubuntu-latest
+    # A scan that hangs must not hold a runner all day.
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          # `dir` scanning reads the working tree, so no history is needed. A
+          # full-history secret audit is its own job — see the note at the end.
+          fetch-depth: 1
+
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 22
+
+      # Optional. Delete either line and the baseline still runs; it will name
+      # the missing tool and refuse to call the result complete.
+      #
+      # Both are installed from their own release channel rather than through a
+      # marketplace action, so nothing third-party runs with this job's token.
+      - name: Install optional scanners
+        run: |
+          set -euo pipefail
+          python3 -m pip install --quiet semgrep
+          curl -sSfL https://raw.githubusercontent.com/gitleaks/gitleaks/master/scripts/install.sh | sh -s -- -b "$RUNNER_TEMP/bin"
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+
+      - name: Security baseline
+        run: >
+          npx --yes voidmachine security scan
+          --mode ${{ inputs.mode || 'team' }}
+          ${{ inputs.prelaunch && '--prelaunch' || '' }}
+          --json
+# The scan exits non-zero when the verdict is `blocked`, which fails this job.
+# That is deliberate: a scan that errored or could not reach its required proof
+# has not told you the code is fine, only that nobody looked properly.
+#
+# Not covered here, on purpose:
+#
+#   - A DAST run needs `--target` and an authorization naming the host, its
+#     authorizer and an expiry. It belongs in a workflow of its own, against an
+#     ephemeral environment, and never on a schedule that outlives the grant.
+#   - Auditing the full git history for secrets is a separate, slower job:
+#     `gitleaks git` walks every commit, which costs minutes to re-answer a
+#     question that only changes at the tip.