xdrs-core 0.49.1 → 0.51.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -5,13 +5,46 @@ description: >
5
5
  Activate this skill when the user asks to create or write any XDRS element.
6
6
  metadata:
7
7
  author: flaviostutz
8
- version: "1.0"
8
+ version: "1.0.0"
9
+ updated: 2026-09-19
9
10
  ---
10
11
 
11
12
  ## Overview
12
13
 
13
14
  Routes the request to the appropriate XDRS authoring skill based on the type of document the user wants to create. Reads the target skill at runtime and follows its instructions in full.
14
15
 
16
+ ### Inputs
17
+
18
+ #### Required
19
+
20
+ - A free-form request to write a document.
21
+
22
+ #### Optional
23
+
24
+ - None.
25
+
26
+ ### Outputs
27
+
28
+ #### Contents
29
+
30
+ - The delegated skill's fully written file.
31
+
32
+ #### Changes
33
+
34
+ - Whatever changes the delegated skill makes.
35
+
36
+ ### Halt Conditions
37
+
38
+ - No document type identifiable even after clarification.
39
+
40
+ ### User Interaction
41
+
42
+ - A single disambiguation question when type is unclear.
43
+
44
+ ### Runtime Requirements
45
+
46
+ - Same as the delegated skill's, if any.
47
+
15
48
  ## Instructions
16
49
 
17
50
  ### Phase 1: Infer Document Type
@@ -60,3 +93,17 @@ Read the full content of the skill file for the inferred type, then follow all i
60
93
  - MUST NOT create documents of a type not listed in the routing table above.
61
94
  - When routing to the Policy skill, MUST also read `_core-adr-policy-016` (`.xdrs/_core/adrs/principles/016-policy-subjects.md`) before choosing a subject — it contains the allowed subject list, descriptions, and disambiguation tiebreaker rules.
62
95
  - When routing to the Policy skill, MUST also read `_core-adr-policy-017` (`.xdrs/_core/adrs/principles/017-policy-numbering-ranges.md`) before choosing a policy number — it defines the subject-based block ranges that determine valid numbers for each subject.
96
+
97
+ ## Anti-Patterns
98
+
99
+ - **Mistake:** Authoring the document directly from general knowledge of the target type instead of reading the target skill file.
100
+ **Why it happens:** The router already knows roughly what a Policy or Skill looks like, so reading the full target skill feels redundant.
101
+ **Instead:** Always read the full target SKILL.md and follow it phase by phase; this skill is a router, not an author.
102
+
103
+ - **Mistake:** Guessing the document type without asking when the request is genuinely ambiguous (e.g., could be Research or Article).
104
+ **Why it happens:** Asking feels like it slows the user down.
105
+ **Instead:** Ask the single focused disambiguation question in Phase 1 rather than guessing wrong and producing the wrong document type.
106
+
107
+ - **Mistake:** Creating a document type not present in the routing table (e.g., a generic README) by improvising a new template.
108
+ **Why it happens:** The user's request doesn't map cleanly onto the six known types.
109
+ **Instead:** MUST NOT create documents of a type not listed in the routing table; clarify with the user instead.
package/README.md CHANGED
@@ -90,13 +90,18 @@ Every scope declares a `scope-type` in its `index.md` frontmatter. The six built
90
90
  ```yaml
91
91
  # .xdrs/owasp-top10/adrs/principles/001-core.md (compilation meta-policy)
92
92
  ## Sources
93
- - [web] https://owasp.org/Top10/
94
- - [git] https://github.com/OWASP/Top10.git
93
+ - [web] owasp-top10-web: https://owasp.org/Top10/
94
+ - [git] owasp-top10-git: https://github.com/OWASP/Top10.git
95
95
 
96
96
  ## Selectors
97
97
  Include A01–A10 risk entries only.
98
+
99
+ ## Sync Settings
100
+ - Source re-sync period days: 30
98
101
  ```
99
102
 
103
+ By default, fetched and selected source content persists under `.assets/sources/[name]/` so later compilations can re-sync incrementally instead of always refetching; set `Source storage: temporary` in `## Sync Settings` to discard the bulk content after each run instead (only the per-source tracking file persists in that mode). Either way, `.assets/sources/` content is never authoritative on its own — only the compiled policies are.
104
+
100
105
  **`standard` scopes** are the default. Use them for team, product, or business-area scopes that do not fit the other types.
101
106
 
102
107
  **`_local` scopes** hold workspace-specific content such as local tooling decisions, transition overrides, or temporary decisions. This content is never packaged or distributed.