Skip to content

Add Skills Support and Command→Agent→Skill Architecture - #15

Merged
dean0x merged 13 commits into
mainfrom
feat/add-skills-support
Oct 21, 2025
Merged

dean0x merged 13 commits into
mainfrom
feat/add-skills-support

Conversation

@dean0x

@dean0x dean0x commented Oct 21, 2025

Copy link
Copy Markdown
Owner

DevFlow Skills Support & Architectural Improvements

This PR introduces comprehensive skills support and implements a clean command→agent→skill architecture pattern for DevFlow.

🎯 Summary

Skills Infrastructure (7 Auto-Activate Skills)

Pattern Enforcers:

  • pattern-check - Validates Result types, DI, immutability, pure functions
  • test-design - Ensures test quality and integration focus
  • code-smell - Detects fake solutions, hardcoded data, unlabeled workarounds

Workflow Guides:

  • research - Auto-launches research agent for unfamiliar features (lightweight dispatcher)
  • debug - Auto-launches debug agent for systematic debugging (lightweight dispatcher)

Safety Validators:

  • input-validation - Boundary validation, parse-don't-validate enforcement
  • error-handling - Result type consistency, exception boundary checks

Architecture Pattern: Commands → Agents → Skills

Implemented clean separation:

  • Commands: Orchestrate workflows (launch agents)
  • Agents: Execute intensive analysis (separate context)
  • Skills: Guide decisions (lightweight auto-dispatchers)
  • Main session: Stays clean and focused

New Agents

  • debug - Systematic debugging with hypothesis testing (12k lines)
  • project-state - Codebase analysis for status reporting (465 lines)

New Commands

  • /implement - Smart interactive implementation orchestrator (507 lines)

Refactored Commands

  • /debug - Now launches debug agent (228 → 56 lines)
  • /devlog - Now launches project-state agent (369 → 409 lines, but zero bash/grep)

Skills Refactored

  • research - Lightweight dispatcher (381 → 135 lines)
  • debug - Lightweight dispatcher (484 → 119 lines)

📊 Changes

Added

  • 7 new skills in src/claude/skills/devflow/
  • 2 new agents: debug.md, project-state.md
  • 1 new command: implement.md
  • Skills installation in CLI (init.ts)
  • Comprehensive skills documentation

Modified

  • Refactored /debug command to orchestrator pattern
  • Refactored /devlog command to orchestrator pattern
  • Simplified research and debug skills to dispatchers
  • Updated README with skills documentation
  • Updated CLAUDE.md with development guide
  • Fixed uninstall bug (skills directory not removed)
  • Fixed command injection vulnerability in init.ts
  • Implemented namespace pattern for CLI directories

Removed

  • Inline bash/grep work from /debug and /devlog commands
  • Heavy analysis from research and debug skills

🏗️ Architecture Benefits

Context Efficiency:

  • Main session: Lightweight (skills ~120 lines avg vs 400+ before)
  • Agent context: Heavy analysis isolated
  • Total skill reduction: 3026 → 2415 lines (611 lines saved, 20%)

Separation of Concerns:

  • Commands orchestrate only
  • Agents execute analysis in separate context
  • Skills guide with auto-dispatch
  • No context pollution

Quality by Default:

  • Skills auto-enforce patterns during implementation
  • Result types, DI, immutability validated automatically
  • Test quality checked inline
  • Anti-patterns detected immediately

🔄 Complete Workflow

User workflow now fully integrated:

/research [topic]     → Pre-implementation research
/plan-next-steps      → Extract actionable todos
/implement            → Smart guided implementation
/code-review          → Comprehensive quality check
/commit               → Atomic commit creation
/devlog               → Session documentation

🔧 Implementation Details

Skills Auto-Activation

  • Model-invoked based on context
  • Enforce quality during implementation
  • Auto-launch agents when heavy work needed
  • Keep main session clean

Dual-Mode Pattern

Research and debug exist as:

  • Commands (manual): /research, /debug - User explicitly requests
  • Skills (auto): Auto-detect when needed and launch agents

This gives maximum flexibility and autonomy.

📝 Testing

  • ✅ Build successful (npm run build)
  • ✅ All refactored commands follow orchestrator pattern
  • ✅ Skills installation tested in init.ts
  • ✅ Namespace pattern applied to init/uninstall
  • ✅ Security fix validated (execSync input validation)

🚀 Impact

For Users:

  • Better AI autonomy (skills auto-guide quality)
  • Interactive implementation (/implement)
  • Cleaner session context (heavy work offloaded)
  • Complete workflow integration

For Developers:

  • Clear architecture (commands/agents/skills)
  • Easy to extend (add skills, agents, commands)
  • Maintainable (namespace pattern)
  • Documented (CLAUDE.md, README.md)

📚 Documentation

  • Updated README.md with skills section
  • Updated CLAUDE.md with development guide
  • Added skills creation guide
  • Documented dual-mode pattern
  • CLI output shows commands and skills

🤖 Generated with Claude Code

Dean Sharon and others added 13 commits October 20, 2025 21:16
Introduce model-invoked skills that automatically enforce quality
patterns without manual invocation. Skills activate based on context
and provide proactive quality gates during implementation.

Skills added:
- pattern-check: Enforce Result types, DI, immutability, pure functions
- test-design: Detect test quality issues (complex setup, difficult mocking)
- code-smell: Catch fake solutions, unlabeled workarounds, magic values
- research: Auto-trigger pre-implementation planning for unfamiliar features
- debug: Systematic debugging with hypothesis testing and root cause analysis
- input-validation: Enforce boundary validation (parse-don't-validate, SQL injection)
- error-handling: Ensure Result type consistency and exception boundaries

This shifts quality enforcement from reactive (code review) to proactive
(during implementation), catching violations before they're committed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Remove /research and /debug commands in favor of skills-based approach.
These workflows work better as auto-activating skills rather than
manual commands:

- research skill auto-triggers when unfamiliar features are requested
- debug skill activates when errors occur or tests fail

This reduces friction (no need to remember to invoke commands) and
ensures best practices are always applied.

Breaking change: /research and /debug commands removed. Users should
rely on automatic skill activation instead.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Update init command to:
- Install skills to ~/.claude/skills/devflow/
- Clean old skills directory on reinstall
- Display installed skills in output with auto-activate annotation
- Update component list to include skills

Installation now shows both commands (user-invoked) and skills
(model-invoked) to clarify the distinction.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Add skills section explaining:
- What skills are and how they differ from commands
- Auto-activation triggers for each skill
- How skills enforce quality proactively
- Updated workflows showing skill integration
- Skills installation path

Reorganize command list to clarify user-invoked vs model-invoked
capabilities. Update examples to show skills auto-activating during
development.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Add comprehensive guide for developing skills:
- Skill structure and YAML frontmatter requirements
- When to use skills vs commands
- Skill activation testing procedures
- Integration with project philosophy
- Examples of current skills

Update architecture overview to include skills as fourth main
component alongside CLI, commands, and sub-agents.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
BREAKING FIX: uninstall command now properly removes skills directory

Previously, 'devflow uninstall' was NOT removing the skills directory,
leaving orphaned files in ~/.claude/skills/devflow/. This occurred because
we were manually managing each directory separately, making it easy to
forget new additions.

Refactored both init.ts and uninstall.ts to use a namespace pattern with
a single source of truth for all DevFlow directories:

- commands/devflow
- agents/devflow
- skills/devflow
- scripts

This ensures:
- Uninstall properly removes ALL DevFlow namespaces
- Adding new directories in the future requires only one line change
- Impossible to forget a directory (DRY principle)
- Consistent behavior between init and uninstall

Updated CLI output to clearly distinguish between commands (manual) and
skills (auto-activate) for better user understanding.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Restored /research and /debug as explicit commands in addition to skills.

This implements a "dual-mode" pattern where research and debug exist as:
1. Commands (manual, user-invoked): /research, /debug
   - Explicit control when user wants deep analysis
   - Launches sub-agent with separate context
   - Full workflow with documentation tracking

2. Skills (auto, model-invoked): research skill, debug skill
   - Proactive assistance during implementation
   - Inline guidance and enforcement
   - Context-aware activation

This gives users maximum flexibility:
- Explicit control when they want it
- Automatic assistance when they need it

Updated init.ts to clearly show both modes in installation output
with "(manual)" and "(auto)" labels for clarity.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
- Isolate stderr with stdio configuration
- Validate git root path for injection patterns (newlines, semicolons, &&)
- Ensure returned path is absolute
- Prevent command injection vulnerability (HIGH-1 from code review)

Addresses security concern in init.ts where execSync was called without
proper input validation on the returned git root path.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Implement clean separation following DevFlow philosophy:
- Commands: Orchestrate workflows (launch agents)
- Agents: Execute intensive analysis (separate context)
- Skills: Guide decisions (lightweight dispatchers)

Changes:
- Created debug agent (12k lines) for systematic debugging
- Simplified /debug command: 228 → 56 lines (launches agent)
- Simplified debug skill: 484 → 119 lines (auto-dispatcher)
- Simplified research skill: 381 → 135 lines (auto-dispatcher)
- Total skill reduction: 3026 → 2415 lines (611 lines saved)

Architecture Benefits:
- Main session stays clean (skills are lightweight)
- Heavy analysis offloaded to agents (separate context)
- Auto-activation preserves autonomy (skills dispatch agents)
- Context-efficient while maximizing AI quality

Skills now:
1. Detect when heavy work needed
2. Auto-launch appropriate agent
3. Summarize agent results
4. Keep main session focused

This ensures comprehensive research/debugging happens in isolated
context while main session remains clean and focused on implementation.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Complete separation of session context from codebase analysis:

**Command Changes (devlog.md):**
- Before: 369 lines with Bash, Read, Grep, Glob, Write, TodoWrite, Task
- After: 409 lines with Task, Write, TodoWrite only
- Removed: All inline git/find/grep operations
- Architecture: Session context (inline) + Project state (agent)

**New Agent (project-state.md):**
- 465 lines of comprehensive codebase analysis
- Handles: Git history, file changes, TODO scanning, docs structure
- Returns: Structured data for status documentation
- Tools: Bash, Read, Grep, Glob

**Workflow:**
1. Command captures session-local context (conversation, todos)
2. Command launches project-state agent (separate context)
3. Agent analyzes codebase (git, files, TODOs, docs, tech stack)
4. Command synthesizes agent data + session context
5. Command writes comprehensive status documents

**Benefits:**
- Main session: Zero heavy bash/grep work
- Agent context: All codebase analysis isolated
- Clean separation: Session vs project state
- Follows orchestrator pattern: Commands launch agents

**Philosophy Applied:**
- Commands → Orchestrate workflows
- Agents → Execute intensive analysis
- Main session stays clean and focused

This completes the orchestrator pattern refactoring for all major
commands that were doing heavy codebase analysis inline.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Create intelligent implementation orchestrator that guides users through
todo implementation with continuous interaction and quality enforcement.

**Command**: /implement (507 lines)
**Type**: Smart Interactive Orchestrator
**Tools**: TodoWrite, Read, Write, Edit, AskUserQuestion, Bash, Grep, Glob

**Workflow**:
1. Load current todos from TodoWrite
2. Interactive triage (remove, defer, prioritize)
3. For each todo in priority:
   - Analyze complexity (Simple/Medium/Complex)
   - Seek clarification only when needed (AskUserQuestion)
   - Share implementation plan
   - Implement following existing patterns
   - Skills auto-validate (pattern-check, test-design, etc.)
   - Mark complete, move to next
4. Comprehensive session summary

**Key Features**:
- **Smart Triage**: User controls what to implement vs defer
- **One Question at a Time**: Only asks when genuinely unclear
- **Pattern-Driven**: Finds and follows existing code patterns
- **Quality by Default**: Existing skills enforce patterns automatically
- **Transparent Progress**: Shows plan before implementing
- **Continuous Interaction**: Can pause for decisions/clarification

**Philosophy**: Pair programming with AI
- User decides priorities and provides clarification
- AI implements with user guidance
- Quality enforced through existing skills
- No need for separate implementation agent

**Usage**:
User: /implement
→ Triage todos
→ Implement iteratively with guidance
→ Summary and recommendations

This completes the implementation workflow:
/plan-next-steps → /implement → /code-review → /commit

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Addresses all 4 critical documentation issues identified in comprehensive
code review (.docs/audits/feat-add-skills-support/comprehensive-review.md):

1. Add missing commands to table:
   - /implement - Smart interactive implementation orchestrator
   - /debug - Systematic debugging workflow
   - /research - Pre-implementation research and approach analysis

2. Add auto-activation warning:
   - Clear statement that skills cannot be manually invoked
   - Prevents user confusion about skill invocation

3. Document dual-mode pattern:
   - Explains research/debug exist as both skill (auto) and command (manual)
   - Clarifies when to use each mode
   - Provides best of both worlds: automatic assistance + manual control

4. Skills path verification:
   - Confirmed already documented in CLAUDE.md:425
   - No changes needed

Impact: Resolves all blocking documentation issues from code review.
Estimated time saved in user confusion: significant.

Related: PR #15, comprehensive review 2025-10-21_2111

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Release 0.4.0 with 12 commits since v0.3.3
- Skills infrastructure with 7 auto-activating skills
- /implement command for guided implementation
- Command→Agent→Skill dual-mode architecture
- Security and bug fixes

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
@dean0x
dean0x merged commit cd06d00 into main Oct 21, 2025
@dean0x
dean0x deleted the feat/add-skills-support branch October 21, 2025 21:43
dean0x added a commit that referenced this pull request Sep 9, 2026
…t harness (#327)

## Problem Being Solved

The command→agent issue seam is untyped and five defects are live:
`/plan` never fetches issues, `/debug` passes an undeclared key, three
sites bypass the Git agent for issue operations, `resolve.mds`
contradicts `git.md`'s D9 authority, and `release.md` promises a step
that does not exist. The harness Phases 1–3 depend on does not exist in
a form that survives an agent rename.

## Key Changes to Highlight

**A1 (4aa15c5)** — Prompt-text fixes (19 edits) incl. the
`fetch-issues-batch` single-query rewrite [DR-07]

**A2 (b9d36ed)** — Two golden fixtures (git-agent, github-status-lines)
captured from the post-A1 tree

**A3 (6d595b6, 83594b9)** — Resolver, seam test, D11 union, guard-gap
closures, numeric-floor manifest [DR-27a], CI integration

**A4 (e8c4055)** — Docs sweep (platform-assumptions.md, CHANGELOG, KB
citations)

**Pipeline gate commits** — integration-test isolation, Simplify,
Scrutinize, alignment fixes, cleanup, knowledge write-back

**Post-review fixes (75f13e7a2207ac)** — containment gaps in
`setup-task` and batch template, Gate 0 / Step 0 contradiction in
`plan.mds`, `learn-conventions` commit step, `.claudeignore` gitignore
(marker v4), seam and guard repairs, golden re-capture, CHANGELOG
expansion, KB update

**Internal seam corrections (not user-visible):**
- `gh issue` routing through the Git agent (AC-0.4)
- D9 caller collapse (AC-0.5)

## Thirteen User-Visible Behaviour Changes

| # | Before | After |
|---|---|---|
| 1 | `/plan #42` parsed the reference and consumed a body it never
fetched | `/plan #42` spawns `OPERATION: fetch-issue`; `/plan #12 #15
#18` spawns `OPERATION: fetch-issues-batch` (one query, `≤50`,
`TRUNCATED ({n} not processed)`) |
| 2 | `/debug #42` passed `ISSUE: {issue number}` — a key `fetch-issue`
does not declare; the issue path never worked | `/debug #42` passes
`ISSUE_INPUT: {issue reference}` and the issue path works |
| 3 | `fetch-issue`/`fetch-issues-batch`: issue title, body, labels,
ACs, and dependencies reached Design agents unwrapped | All
remote-sourced fields per issue wrapped in `<untrusted-issue-body>` with
a data-only note appended; `### Suggested Branch` (locally-derived)
stays outside the block |
| 4 | `resolution-summary.md` emitted a bare `Tracked = (pending)` |
`Tracked = (pending)` names the DEGRADED reason, at all four sites |
| 5 | `release.md` promised *"close milestone"* — a step that does not
exist | The untruthful claim is deleted |
| 6 | `resolve.mds` authorised the Git agent to auto-resolve threads on
any of three verdicts: `FIXED`, `FALSE_POSITIVE`, or `BY_DESIGN` |
Auto-resolution authorised only when verdict is `FIXED` **and**
`commit_sha` is non-empty — matching the D9 contract `git.md` had always
enforced, closing a live divergence (closes PF-024) |
| 7 | `setup-task` emitted issue title, description, and ACs as bare
bullets; `fetch-issues-batch` template showed the wrapper on the first
issue only, leaving up to 49 uncontained; no op defended against remote
content containing the literal `</untrusted-issue-body>` closing marker
| `setup-task` wraps all remote-sourced fields; batch template
explicitly shows the wrapper on every entry; Principle 8 mandates
neutralising any closing marker found in remote content before wrapping,
with pointers from all four affected operations |
| 8 | `plan.mds` declared "Do not spawn any agents until Gate 0 is
confirmed" with no exception, directly contradicting the Step 0 issue
fetch — a session honouring the ban could silently skip the fetch | The
Gate 0 ban names the Step 0 issue fetch as its sole exception |
| 9 | `learn-conventions` wrote `.devflow/conventions.md` — a
git-tracked carve-out path — but included no commit step, leaving `??
.devflow/conventions.md` in `git status` on every fresh project |
`setup-task` step 4b commits `.devflow/conventions.md` after `git
checkout -b`, on the feature branch and never on the base branch, via
`git -C … commit --only -- .devflow/conventions.md` (never `git add -A`,
never push, never force, never amend), reporting `CONVENTIONS_COMMIT: …`
non-blockingly; `learn-conventions` no longer commits |
| 10 | `devflow init` wrote `.claudeignore` into any git repo but never
ignored the file, leaving `?? .claudeignore` in `git status` on every
fresh install | `.claudeignore` is a line of the devflow-managed
`.gitignore` block (marker `v4`); block presence is detected only by the
devflow-unique `!.devflow/conventions.md` sentinel — a user-authored
`.claudeignore` or `!.claudeignore` line is respected (the block is
appended without its own `.claudeignore` line; an un-ignore is never
overridden); the TypeScript function and the `ensure-root-gitignore`
shell twin are byte-identical and idempotent across 15 parity rows |

| 11 | `/plan`, `/debug` and the dynamic-build wave reader had no branch
for a `TRACEABILITY: DEGRADED` return from the Git agent — the status
line could be consumed as issue content | `/plan` warns, carries the
line verbatim into the report and runs Gate 0 with the bare issue
reference; `/debug` reports it verbatim and asks for the bug description
before generating hypotheses; the wave reader returns empty
ready/blocked sets with the DEGRADED rationale and the wave stops
(AC-0.6) |
| 12 | `fetch-issue` sent `#42` down the text-search path (first open
match for the literal `#42` — the wrong issue, or none);
`fetch-issues-batch` left `#`-prefixed tokens unspecified | Both strip a
leading `#` (`#42` ≡ `42`) before the numeric/text branch (AC-0.3) |
| 13 | A null GraphQL alias (unresolvable reference) in a batch could
abort the whole fetch | The alias is dropped, never aborts the batch,
and is reported as `NOT_FOUND ({refs})` alongside any `TRUNCATED` note;
comments are not fetched in batch mode (AC-0.3) |

**Honest label:** *"no change to the **GitHub rendering** of any
existing traceability artifact."* Not "no behaviour change" — see the
thirteen above.

## Breaking Changes

none.

## Reviewer Focus Areas

1. **Commit order** — A1 (4aa15c5) edits `git.md` only, no test file
touched. A2 (b9d36ed) contains only the two fixtures, captured from the
post-A1 tree. A3a/A3b split is pre-authorised. A4 (e8c4055) is the docs
sweep.

2. **RED proofs** — Verify seam known-bad at
`tests/seams/command-agent-input.test.ts` against the pre-A1 parser. D9
caller at `tests/git-agent.test.ts` asserts `resolve.mds` and
`dist/commands/resolve.md` carry the D9 rule literal from `git.md`.
`manage-debt` D4 at `git-agent.test.ts` (AC-0.6a). `gh issue` scope via
`collectGhIssueProseViolations` at `tests/build-mds.test.ts`. Batch
single-query [DR-07] at `git-agent.test.ts`.

3. **Numeric floor manifest [DR-27a]** —
`tests/guards/numeric-floor-manifest.test.ts` mechanises AC-0.17 against
`tests/fixtures/numeric-floors.json` (18 entries, occurrence-aware).
GREEN: no numeric literal in `tests/` decreases — with one argued
exception (see Deviations from the Plan §1).

4. **Recorded exceptions:**
- `src/assets/commands/release.md:85` — conventions read (allowlisted)
- `src/assets/commands/code-review.mds:77` — `gh pr view` (allowlisted)
- `src/assets/commands/bug-analysis.mds:44` — `gh pr view` (allowlisted)

5. **[DR-03]** — `npm run test:golden:update` requires a named target,
refuses `github-status-lines` without `--unfreeze`, has `--out-dir` so
tests never rewrite the frozen fixture.

## Deviations from the Plan

Four deliberate departures from stated acceptance criteria, each argued
below.

**1. A numeric floor was decreased (AC-0.17 exception).**
`issue-capture-contract-size` in `tests/fixtures/numeric-floors.json`
went from 5 → 3. AC-0.17 states no threshold may be lowered. This is a
deliberate, argued exception: the old value of 5 counted `ISSUE_ID` and
`ISSUE_URL`, neither of which had a producer anywhere in `git.md` or a
consumer in `plan.mds` — the floor was inflated by two erroneous
entries. Lowering from 5 to 3 corrects the manifest to match the actual
seam, not the imagined one. This is the only floor decrease in the
manifest.

**2. The golden regeneration commit (`3a95c92`) is not strictly
fixture-only.**
That commit carries `tests/goldens/github-status-lines.test.ts`
alongside the `.txt` fixture, because that file holds the fixture's own
byte/newline freeze baselines (`17_379→17_914`, `233→246`). Splitting
them would leave the tree red at the commit boundary, which this
branch's own rules forbid (all CI gates must be green at every commit).
The AC's intent — no behaviour change in the golden commit — is
preserved: the test file change is the baseline constant update, not a
logic change.

**3. The frozen `github-status-lines.txt` was unfrozen and re-captured
(AC-0.9 / DR-03).**
Third re-capture within Phase 0 (after `a5dd078` and `38db29e`), on
explicit user authorisation. The diff is exactly three hunks, all
genuine status-line vocabulary introduced by `75f13e7`: `setup-task`
containment, the per-issue batch wrapper, and the external-thread
neutralisation note. Context that matters for Phase 1: the fixture was
previously extracted by hard-coded line offsets, so it broke on any
insertion anywhere above a sampled range — it went red on a 26-line
insertion that changed no status line at all, and would have failed
outright at Phase 1 when `git.md` becomes MDS-generated. `e276175`
re-anchors extraction on content, proven faithful by reproducing the
pre-change fixture byte-for-byte from `b6928e5` before being run against
HEAD.

**4. Phase 0 ships thirteen user-visible changes, not five.**
Scope grew from review findings. Six of the thirteen were always on the
branch (`/plan` fetch, `/debug` key, containment, `Tracked` reason,
`close milestone`, D9 gate — the last was present but undeclared,
explaining why the CHANGELOG previously understated the count). Four are
new: the `setup-task`/batch/marker containment gaps, the Gate 0 / Step 0
contradiction, `learn-conventions` commit step, and `.claudeignore`
gitignore. `97f421a` and `7074733` are isolated commits and can be
lifted out if the reviewer prefers a tighter phase.

**5. Size floors → equality baselines (user decision D1).**
`GIT_MD_LINES`/`GIT_MD_CHARS`/`TOTAL_*` in
`tests/goldens/github-status-lines.test.ts` are equality baselines
against `tests/fixtures/golden/git-agent.md` (992 / 65,677 / TOTAL_CHARS
77,823), re-set in every golden-regeneration commit and deliberately not
registered in `tests/fixtures/numeric-floors.json`; the four `git-md-*`
manifest entries were deleted (17 remain). Red proof with the old
constants: `expected 992 to be 963` and `expected 65677 to be 61018`.

**6. Seam caller floor measured 13, not the planned 14.**
18 `## Operation:` sections, five without a live caller fence
(`learn-conventions`, `create-release`, `gather-release-evidence`,
`backlink-shipped-issues`, `check-ci-status` — the last is prose-only in
implement/resolve); floor raised 10 → 13.

**7. Gitignore append forms.**
Rules "continue an existing block" (v3→+`.claudeignore`,
v2→+conventions) use a no-blank-separator form so five pre-existing
byte-identity assertions stay valid; only "start a new block" inserts
the blank separator. A 15th parity row (a `.gitignore` whose only
content is the legacy `.devflow/` line) pins a `grep -v` exit-status
hazard found while aligning the twins.

**8. Batch step-5 wording.**
The plan's "`{n}` counts fetched issues only" was self-contradictory
against the literal `TRUNCATED ({n} not processed)`; git.md states the
invariant as two disjoint counts instead.

## Test Inventory (AC-0.13)

| Guard | File:Line (verify) | RED Mechanism / Probe Test Name | Status
|
|-------|-------------------|--------|--------|
| Seam forward | `tests/seams/command-agent-input.test.ts` | Forward:
`KEY: passed is declared` | RED on `/plan`, `/debug` undeclared keys |
| Seam reverse | `tests/seams/command-agent-input.test.ts` | Reverse:
`required INPUT is passed` | RED when spawn missing a declared input |
| Seam producer | `tests/seams/command-agent-input.test.ts` | Producer:
`issue_capture_contract()` searches agent source, consumer excluded; RED
proof via `ISSUE_URL` re-add | RED when agent source has no producer
(previously searched consumer — vacuous guard, now repaired) |
| Seam fence counts | `tests/seams/command-agent-input.test.ts` |
Per-agent-type fence count verification | RED when fence count doesn't
match expected |
| D9 caller | `tests/git-agent.test.ts` | `git.md`
`resolve-review-threads` section literal matches `resolve.mds` | RED on
caller contradiction |
| Manage-debt D4 | `tests/git-agent.test.ts` | `60000` char cap +
`DEGRADED` reason presence | RED when cap missing or reason empty |
| Batch bounds | `tests/git-agent.test.ts` | `≤50` issues, `TRUNCATED
({n} not processed)`, `## Issues Batch ({n} issues)` | RED when any
literal missing |
| `gh issue` scope | `tests/build-mds.test.ts` via
`collectGhIssueProseViolations` | 6 hosts checked for `compliance_gate`
adoption | RED when a host omits gate or violates allowlist |
| Batch single-query [DR-07] | `tests/git-agent.test.ts` | Asserts `gh
api graphql` not `gh issue view` loop | RED on incorrect API call
pattern |
| Containment (issue-body) | `tests/git-agent.test.ts` | Named op set:
{`fetch-issue`, `fetch-issues-batch`, `setup-task`}; floor 3 on
issue-body ops | RED: scores 0 on `main` — recorded RED proof
(previously the broad `>= 3` predicate passed on unmodified `main` via
pre-existing `<external-thread>` ops, validating nothing for issue-body;
now split and named) |
| Containment (ext-thread) | `tests/git-agent.test.ts` | Named op set:
{`fetch-review-threads`, `post-resolution-summary`, `post-wave-report`};
stabilisation guard | Labelled stabilisation — cannot fail on `main`
since those ops pre-existed; labelled as such rather than dressed up as
validation |
| D11 forward | `tests/git-agent.test.ts` | `>=8` posting ops +
known-bad synthetic corpus | RED when D11 sink count drops |
| D11 bypass | `tests/git-agent.test.ts` | Negative probe: summary ops
bypass redaction | RED when summary op rewrite adds scrub call |
| `INTERNAL_OPS` | `tests/registry-integrity.test.ts:397-405` |
`fetch-issues-batch` removed with SG-11 rationale | RED if entry present
(AC-0.11) |
| Golden byte-equality | `tests/goldens/git-agent-golden.test.ts` |
`<<<`/`>>>` marker device on mismatch | RED when git.md diverges from
fixture |
| Golden refusal | `tests/goldens/github-status-lines.test.ts` |
`test:golden:update -- github-status-lines` refuses without `--unfreeze`
| RED when refusal logic missing |
| Status-lines frozen | `tests/goldens/github-status-lines.test.ts` |
Fixture byte-equality, mtime unchanged | RED when fixture mutates across
suites |
| Numeric-floor manifest | `tests/guards/numeric-floor-manifest.test.ts`
| Every manifest entry decreases → RED | RED when any floor value
decreases |

| Agent-source resolver | `tests/harness/agent-source-resolver.test.ts`
| `gitAgentSinkCorpus` recursive walk finds nested
`references/tracker/github/fetch-issue.md`; `walkFiles` missing-dir →
`[]` and depth cap; `resolveAllAgents() ⊇ getAllAgentNames()` in
skill-references / agent-name-guards / agent-frontmatter | RED: nested
reference missing on flat `readdir`; resolver missing-`git` fixture |
| Seam caller floor | `tests/seams/command-agent-input.test.ts` | Floor
13 on live caller fences | RED: temporary floor 99 → `expected 13 to be
greater than or equal to 99` |
| Init logic exact-output | `tests/init-logic.test.ts` | Cases (a)–(f)
exact output + idempotency | RED: (a)–(c) returned `null`, (e) returned
a block, (f) `trimEnd` collapsed newlines |
| Shell-hooks parity | `tests/shell-hooks.test.ts` | 15-row parity
(bytes + booleans + TS/shell idempotency) | RED: 5 rows byte-diverged
including `grep -qF` matching `.claudeignore` as substring of
`!.claudeignore` |
| Golden-dimension baselines |
`tests/goldens/github-status-lines.test.ts` | Equality baselines:
`GIT_MD_LINES` 992, `GIT_MD_CHARS` 65,677 | RED: old constants — see
Deviations §5 |
| Conventions-commit guard | `tests/git-agent.test.ts` |
`collectConventionsCommitPlacementViolations` live guard + H10 probe |
RED: 4 violations on synthetic corpus with old learn-conventions commit
block and no step 4b |

## Byte/Char Baselines (P0-S1)

Post-Phase-0 (HEAD `b04e8f7`):
- `src/assets/agents/git.md` = `tests/fixtures/golden/git-agent.md`: 992
lines / 65,677 chars (JS `.length`) / 66,180 bytes (18 `## Operation:`
sections)
- `src/assets/skills/git/SKILL.md`: 9,204 chars / 283 lines
- `src/assets/skills/worktree-support/SKILL.md`: 2,942 chars / 92 lines
- **TOTAL_CHARS**: 77,823
- `tests/fixtures/golden/github-status-lines.txt`: 17,914 bytes / 246
newlines (byte-identical at every commit since `08fbdd4`)

Pre-Phase-0 (`main@e726874`):
- `git.md`: 938 lines / 59,376 bytes / 58,903 chars

Constants live in `tests/goldens/github-status-lines.test.ts` and are
asserted against the live files.

## Prefix-Shippability Evidence (§14 clause i–iv)

**Run on HEAD `a2207ac`:**

- `npm run build` exit 0 (13 MDS hosts compiled, `dist/commands/` 14
files)
- `npx tsc --noEmit` exit 0
- `npm test` exit 0 — 4,127 tests / 114 files
- `npm run test:integration` exit 0 — 48 tests / 5 files (preload suite
7/7: Simplify 18.0s, Scrutinize 13.3s, Review 11.5s, Code 17.2s, Design
13.1s, Git 13.0s, Research 12.6s)
- `npm pack --dry-run` exit 0 — 375 files
- Goldens SHA-256:
`f0e29b82106082b937f1e8804b998ca03e1454c08cb3ccbc1965390a95edd46f`
(status-lines) /
`6382d7698d80cdfdfe248ffe96db734a5836fb615ecd7e2634fbb7306b02384f`
(git-agent), `cmp` exit 0, fixture mtime unchanged across suites
- Clause (iii) negative grep: `PR link line|Branch token` in git.md → 0
· `docs/reference/platform-assumptions.md` first inbound reference added
(CLAUDE.md `## Reference Documents`, commit `90fd060`) — clause (iii)
miss resolved
- `git status --porcelain` empty

**Clause (ii) — file-residue half MECHANISED; prompt half still manual
(see Test Suite Status).**

## Test Suite Status

**Full suite: 4,127 tests / 114 files** — everything this PR modifies is
green.

A full-suite run produced 12 failures across 7 files: `redact-secrets`,
`decisions/ledger-ops`, `shell-hooks` json-helper describe,
`eager-memory-refresh`, `decisions/decisions-usage-scan`, `build-mds`,
`compliance-e2e`. **All 7 files pass 3/3 in isolation, 21 clean runs,
zero isolated failures.** Root cause is load-induced subprocess-spawn
contention under concurrent test workers, not regressions — none of the
7 files is in code this PR modifies.

**Integration: 5 files / 48 tests green.**
`tests/integration/subagent-skill-preload.test.ts` is excluded — it
spawns live `claude` against the developer's real `~/.claude` and has
historically committed to this repo mid-run.

**Clause (ii) mechanisation status:**
- **File-residue (MECHANISED):**
`tests/integration/clause-ii-file-residue.test.ts` packs a real tarball,
installs into a scratch `$HOME`, runs `devflow init --recommended` in a
throwaway git repo, and asserts no `??` untracked entries — with a
positive assertion that `.gitignore` was modified, so it cannot pass by
doing nothing. It found a real violation on first run (`??
.claudeignore`), now fixed by `7074733`.
- **Prompt half (STILL MANUAL):** the "no new prompt" half and the
`/plan → /implement → /code-review → /resolve → /release` walk-through
remain unverified. Remaining manual scope is narrowed to four
model-generalisation questions: (a) does the `<untrusted-issue-body>`
wrapper repeat across all 50 batched issues; (b) is the literal
`TRUNCATED ({n} not processed)` emitted; (c) does the agent build one
GraphQL query or fall back to 50 sequential `gh issue view` calls; (d)
does `plan.mds` Step 0 actually fire.

**CI:** build-and-test PASS (51s) · security/snyk PASS — all checks
green.

## PR-Template Checklist (D-B)

- [x] Test-inventory table present with a recorded red proof per guard
(AC-0.13)
- [x] CHANGELOG enumerates the thirteen user-visible changes with
before/after (AC-0.15)
- [ ] Prefix-shippability command sequence run and pasted — clauses (i),
(iii), (iv) above; **clause (ii) file-residue half mechanised (finds
real violations); prompt half and model-generalisation questions pending
a human**
- [x] AC-0.17 numeric-floor manifest guard green (with one argued
exception — see Deviations from the Plan §1)

## Known Deviations

- 42 commits, not 4 (A1→A2→A3a→A3b→A4 plus pipeline gates and
post-review fixes; A3 split pre-authorised; both goldens fixture-only —
with the exception noted in Deviations from the Plan §2)
- Three `gh pr view` exceptions, not two (code-review.mds:77,
bug-analysis.mds:44, resolve.mds:63 pre-exists on main)
- D9 authority cited as `git.md:resolve-review-threads` section, not a
line number
- `step 1c` retained; retired literal is `issue-first gate`
- P0-S13 landed as v2→v3 marker repair rather than deletion (v3
fast-path pinned by test)
- AC-0.10 split into two named assertions (issue-body and ext-thread)
rather than a single `>=3` floor derivation; see Deviations from the
Plan §1 and Test Inventory for detail
- `tests/integration/**` scope addition forced by wiring
`test:integration` into CI
- Two pre-existing load-sensitive suite timeouts pass in isolation
- `docs/reference/platform-assumptions.md` now has its first inbound
reference (CLAUDE.md `## Reference Documents`, commit `90fd060`) —
clause-(iii) miss resolved

## Commit Subjects

```
4aa15c5 fix(traceability): repair issue-seam prompt defects (A1)
b9d36ed test(golden): capture git-agent and github-status-lines goldens (A2)
6d595b6 test(harness): land A3a — resolver, seam test, golden infra, D11 union, op corrections
83594b9 test(guards): land A3b — guard-gap closures, CI integration, AC-0.7 resolver (P0-S21–S25)
e8c4055 docs(traceability): Phase-0 docs sweep — platform assumptions, CHANGELOG, KB citations (A4)
4df70e8 test(integration): scope subagent transcript scan to the spawned session
71a3ce4 test(integration): pin the spawned session id and diagnose non-spawns in the preload suite
fac739e refactor(tests): simplify harness helpers and guards
b1f38bc fix(tests): scrutinize fixes for Phase-0 harness
ef67f32 refactor(tests): remove unused transcript selector
4a00484 fix(traceability): contain every remote-sourced field in issue-fetch outputs
1ca307d test(harness): re-anchor status-line extraction and consolidate update-golden into tsx
a5dd078 test(golden): re-capture goldens after containment fix
5fc76aa docs(changelog): enumerate the plan's five user-visible changes
fe11930 test(harness): implement missing guards M1–M13 and Guard 6 anchor fix (F2)
21c9a4c test(harness): isolate the resolver fixture in a temp root
98a5bb5 fix(traceability): add D4 degradation to issue-fetch ops and restore body summarisation
1528bf1 test(harness): re-anchor status lines and re-measure byte baselines after D4 fix
38db29e test(golden): re-capture goldens after D4 degradation fix
27191ba docs(changelog): correct the containment before-state
0b44eae test(guards): widen containment and D4 predicates, restore AC-0.10 floor (MIS-1/MIS-2)
27d6fbd test(harness): mechanise literal-path and dist-throw contracts, real-collector probes, seam input scoping (MIS-5–9)
0f65757 docs(knowledge): add test-harness feature knowledge base
a1fe205 docs(changelog): keep the five enumerated user-visible changes
b6928e5 test(harness): relabel char baselines, pin the v3 fast-path, strip fix-round labels
75f13e7 fix(git-agent): contain setup-task issue bodies and harden containment markers
c7bff85 fix(plan): carve Step 0 out of the Gate 0 spawn ban and drop unbacked capture names
97f421a fix(git-agent): commit conventions.md so learn-conventions leaves a clean tree
b0d576a test(golden): regenerate git-agent fixture after containment fixes
948c440 test(integration): mechanise clause (ii) file-residue via tarball install into a scratch HOME
c56c105 test(guards): restore genuine containment validation and pin the matching op sets
0503e89 test(seams): source issue-capture producers from the agent, not the consumer
7074733 fix(init): gitignore the devflow-written .claudeignore (marker v4)
f7ac392 test(integration): assert clause (ii) file-residue now that .claudeignore is ignored
e276175 test(harness): anchor status-line extraction on content instead of line offsets
eec2ae3 docs(changelog): enumerate the full Phase 0 user-visible change set
3a95c92 test(golden): re-capture frozen status-lines fixture after containment changes
df34d77 docs(changelog): cite stable identifiers instead of volatile line numbers
0af035b chore(gitignore): adopt the v4 carve-out block in devflow's own repo
4ce6261 docs(changelog): drop a redundant operation-name repetition
a2207ac docs(knowledge): update test-harness, compliance-feature, installer-shadowing feature knowledge bases
08fbdd4 docs(test): correct stale shape count in hud-git header comments
69568f1 test(harness): resolve extractStatusLines through the agent resolver and walk skill references recursively
ac20850 test(guards): repoint agent enumerations through resolveAllAgents (AC-0.7)
32d0389 test(guards): fix the stale seam-caller rationale and name the retired-wording list a denylist
f4db128 fix(init): detect the devflow gitignore block by its own sentinel and respect user .claudeignore entries
b06a4dd fix(commands): handle TRACEABILITY: DEGRADED at the three issue-fetch callers
ae62d0a fix(git-agent): commit conventions on the feature branch, accept #-prefixed refs, drop unresolved batch refs
23ea357 test(golden): regenerate git-agent fixture after conventions-commit and ref-handling fixes
6b70215 test(golden): pin git.md size to the golden as equality baselines
8de1f3e test(git-agent): guard the conventions-commit placement and the batch NOT_FOUND rule
754379b docs(changelog): describe the caller-side conventions commit, the sentinel semantics, and the new degradation handling
90fd060 docs: describe the tests/ harness, the golden update ritual, and platform assumptions
1070758 refactor(tests): drop unused name binding in skill-references agent loops
d2cebfe docs(changelog): state only what the gitignore and #-ref fixes actually do
19fdea5 docs(init): name both block shapes in the ensureDevflowGitignore contract
5efff97 test(harness): bound walkFiles, repoint the last literal agent reads, and refresh three stale comments
b04e8f7 docs(knowledge): refresh test-harness and installer-shadowing knowledge bases for the Phase-0 gap closure
```

## Related Issues

Closes #322 · Tracking: #321
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant