diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index f98b43c..6b1ec71 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -11,7 +11,7 @@ "plugins": [ { "name": "system-developer", - "description": "Systems development toolkit with specialized agents for C (C17/C23), C++ (C++17/20/23, C++26 emerging), Python 3.14, and Bash/POSIX shell. Includes language-aware commands, modern-standards skills, build-system and diagnostics tooling, FFI interop, secure-coding guidance, plugin-scoped advisory hooks, full igrsoft 11-stage workflow integration, and utility agents for code fixes, test generation, performance, security, and dependency management.", + "description": "Systems development toolkit with specialized agents for C (C17/C23), C++ (C++17/20/23, C++26 emerging), Python 3.14, and Bash/POSIX shell. Includes language-aware commands, modern-standards skills, build-system and diagnostics tooling, FFI interop, secure-coding guidance, plugin-scoped advisory hooks, full company-workflow 11-stage workflow integration, and utility agents for code fixes, test generation, performance, security, and dependency management.", "source": "./", "strict": true, "category": "development", diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 00cdb8f..ffd3736 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "system-developer", - "description": "Systems development toolkit with specialized agents for C (C17/C23), C++ (C++17/20/23, C++26 emerging), Python 3.14, and Bash/POSIX shell. Full igrsoft v3.36.0 11-stage workflow integration (PL\u2192AR\u2192TL\u2192DV\u2192DR\u2192SR\u2192QA\u2192DC\u2192RE\u2192FN\u2192ST): handoff-protocol (development-N.md, state.json, frontmatter schema), requires_screenshots:false / cli-fallback evidence norm, scoped Bash toolchain allowlists, qualified Task() delegation, and plugin-scoped audit/checkpoint hooks.", + "description": "Systems development toolkit with specialized agents for C (C17/C23), C++ (C++17/20/23, C++26 emerging), Python 3.14, and Bash/POSIX shell. Full company-workflow v4.0.0 11-stage workflow integration (PL\u2192AR\u2192TL\u2192DV\u2192DR\u2192SR\u2192QA\u2192DC\u2192RE\u2192FN\u2192ST): handoff-protocol (development-N.md, state.json, frontmatter schema), requires_screenshots:false / cli-fallback evidence norm, scoped Bash toolchain allowlists, qualified Task() delegation, and plugin-scoped audit/checkpoint hooks.", "version": "1.6.0", "author": { "name": "IGRSoft", diff --git a/CHANGELOG.md b/CHANGELOG.md index 61c5879..885c1df 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ All notable changes to the **system-developer** plugin are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/) and the project adheres to [Semantic Versioning](https://semver.org/). Version strings move together across `plugin.json`, `marketplace.json`, `README.md`, and `MEMORY.md` -per the igrsoft `/cc-update` convention. +per the company-workflow `/cc-update` convention. ## [1.6.0] — 2026-07-29 @@ -92,7 +92,7 @@ flag that had no code path. ## [1.5.0] — 2026-07-29 -Command-surface unification with the rest of the igrsoft plugin family. Six commands +Command-surface unification with the rest of the company-workflow plugin family. Six commands are renamed to the shared verb-first scheme, eight new commands are added to match the standard set, and two existing commands gain capability (`fix-performance` an optional checkpoint-gated apply phase, `deps` a subcommand form). No C/C++/Python/Bash language @@ -165,21 +165,21 @@ guidance changed, and no agent or skill was added or removed. ## [1.4.0] — 2026-07-22 -igrsoft compatibility port to **v3.36.0** (from v3.33.0). Beyond the version-string -realignment, this release ports three igrsoft v3.36.0 workflow-contract learnings — the +company-workflow compatibility port to **v3.36.0** (from v3.33.0). Beyond the version-string +realignment, this release ports three company-workflow v3.36.0 workflow-contract learnings — the `state-patch.sh` pointer form, a CLI evidence-freshness rule, and benchmark-driven output budgets with an architector complexity gate — and wires two structure linters into the test harness. No C/C++/Python/Bash language guidance changed. ### Changed -- **igrsoft compatibility → v3.36.0** across `plugin.json`, `marketplace.json`, +- **company-workflow compatibility → v3.36.0** across `plugin.json`, `marketplace.json`, `README.md`, `MEMORY.md`, the `workflow-integration` skill (invocation/contract headers + skill-catalog descriptions), and the agent stage-participation headers (`system-developer`, `system-architector`, `sys-code-fixer`, `_base/language-agent`). The Dynamic Worktask Sizing table was already current (DR0 at every tier); the PL0 stamp note now also names `metadata.test_mode` (`build-only`/`scoped`/`full`) and - `metadata.ui_visual_check`, citing igrsoft `estimation-methodology § PL0 Stage-Set` as + `metadata.ui_visual_check`, citing company-workflow `estimation-methodology § PL0 Stage-Set` as the source of truth. - **state.json patching → `state-patch.sh` pointer form** — replaced the manual `read → merge → temp → fsync → rename` atomic-write prose in `_base/language-agent.md`, @@ -192,7 +192,7 @@ test harness. No C/C++/Python/Bash language guidance changed. - **CLI evidence-freshness rule** — every `cli-fallback` transcript row must be produced *this run* from the actual build/test invocation; a stale or duplicated transcript - re-opens DV. The systems analog of igrsoft's QA direct-read evidence-integrity check + re-opens DV. The systems analog of company-workflow's QA direct-read evidence-integrity check (`workflow-integration/SKILL.md § Screenshot Gate for CLI Work`). Also documents that `ui_visual_check` exists in the DV metadata contract but is **not applicable** to systems/CLI work (left `false`). @@ -214,12 +214,12 @@ test harness. No C/C++/Python/Bash language guidance changed. ## [1.3.1] — 2026-07-08 -igrsoft compatibility refresh to **v3.33.0** (from v3.27.1); version-string realignment +company-workflow compatibility refresh to **v3.33.0** (from v3.27.1); version-string realignment only — the `workflow-integration` content was already current, so no agent/skill behavior change. ### Changed -- **igrsoft compatibility → v3.33.0** across `plugin.json`, `marketplace.json`, `README.md`, +- **company-workflow compatibility → v3.33.0** across `plugin.json`, `marketplace.json`, `README.md`, `MEMORY.md`, the `workflow-integration` skill (invocation/contract headers), the skill catalog descriptions, and the agent stage-participation headers (`system-developer`, `system-architector`, `sys-code-fixer`, `_base/language-agent`). Historical release notes @@ -228,7 +228,7 @@ change. ## [1.3.0] — 2026-06-23 -igrsoft worktask-behaviour currency refresh to v3.27.1; additive — existing +company-workflow worktask-behaviour currency refresh to v3.27.1; additive — existing C/C++/Python/Bash guidance preserved. ### Changed @@ -241,9 +241,9 @@ C/C++/Python/Bash guidance preserved. - **Corrected stage-model facts** — SR (`security-reviewer`) and ET (`ethics-reviewer`) run on opus at effort xhigh; Fable 5 (`fable`) noted as the available top tier (stage agents pin opus). -- **Base Code Comment Policy and agents** now cross-reference igrsoft's new - compact code-documentation standard (`igrsoft:code-comment-standard`). -- **Refreshed igrsoft compatibility** to v3.27.1 / CC 2.1.170 across +- **Base Code Comment Policy and agents** now cross-reference company-workflow's new + compact code-documentation standard (`company-workflow:code-comment-standard`). +- **Refreshed company-workflow compatibility** to v3.27.1 / CC 2.1.170 across `plugin.json`, `marketplace.json`, `README.md`, `MEMORY.md`, and the 3 skill-index labels. @@ -326,4 +326,4 @@ entry skill (`embedded-skills`) and two leaf skills (`embedded-systems`, `embedded-cpp`) with reference files, cross-linked from `c/SKILL.md` and `cpp/SKILL.md`. Established the Bash 5.3 and Python 3.14 baselines and the tiered-`maxTurns` / scoped-`Bash(cmd:*)` allow-list / plugin-scoped advisory-hooks -conventions on the igrsoft v3.17.0 / CC 2.1.169 baseline. +conventions on the company-workflow v3.17.0 / CC 2.1.169 baseline. diff --git a/MEMORY.md b/MEMORY.md index e02c14c..65fd235 100644 --- a/MEMORY.md +++ b/MEMORY.md @@ -5,16 +5,16 @@ | Field | Value | |-------|-------| | Plugin version | 1.6.0 | -| igrsoft compatibility | v3.36.0 | +| company-workflow compatibility | v4.0.0 | | Claude Code min required | 2.1.170 | | Last updated | 2026-07-29 | Version strings move together (plugin.json, marketplace.json metadata, README -header, this table) per the igrsoft `/cc-update` convention. +header, this table) per the company-workflow `/cc-update` convention. ## CC Features Adopted at 1.0.0 -The plugin is born on the igrsoft v3.27.1 / CC 2.1.170 baseline, so it adopts the +The plugin is born on the company-workflow v3.27.1 / CC 2.1.170 baseline, so it adopts the current capability set from the start rather than migrating into it: - **Tiered `maxTurns`** — every agent declares a runaway-loop backstop sized to @@ -29,7 +29,7 @@ current capability set from the start rather than migrating into it: - **Fully-qualified `Task(plugin:agent)` references** — all delegations use the `Task(system-developer:)` / `subagent_type="system-developer:"` form; no bare agent names anywhere. Cross-plugin targets keep their own prefix - (`igrsoft:*`, `security-scanning:*`, etc.). + (`company-workflow:*`, `security-scanning:*`, etc.). - **Scoped `Bash(cmd:*)` allowlists** — each agent's `tools:` enumerates only the toolchain binaries it needs (for example `c-developer`: gcc, clang, cc, make, cmake, ninja, ctest, clang-tidy, clang-format, gdb, lldb, valgrind, pkg-config, @@ -39,22 +39,22 @@ current capability set from the start rather than migrating into it: - **Plugin-scoped advisory hooks** — `hooks/{audit-tooluse,audit-subagent, precompact-checkpoint}.sh`, wired in `plugin.json` (PostToolUse / SubagentStop / PreCompact). All rows are advisory (`actor: "system-developer:hook:*"`, - `metadata.advisory: true`) and share igrsoft's `dedupe_key` / `dedupe_key_extended` - shape so igrsoft's `audit-dedup.sh` keeps the orchestrator row authoritative when + `metadata.advisory: true`) and share company-workflow's `dedupe_key` / `dedupe_key_extended` + shape so company-workflow's `audit-dedup.sh` keeps the orchestrator row authoritative when system-developer runs nested. Each script has `--self-test`. -## Not Adopted (igrsoft-owned infrastructure) +## Not Adopted (company-workflow-owned infrastructure) -system-developer agents are invoked specialists; igrsoft owns orchestration. The +system-developer agents are invoked specialists; company-workflow owns orchestration. The following stay orchestrator-owned and are deliberately **not** implemented here: -- **`audit-dedup.sh`** — igrsoft-owned. system-developer emits advisory rows with - matching dedupe keys for igrsoft's helper to reconcile; it does not reconcile +- **`audit-dedup.sh`** — company-workflow-owned. system-developer emits advisory rows with + matching dedupe keys for company-workflow's helper to reconcile; it does not reconcile them itself. - **`state-merge.sh` / SubagentStop `state.json` merge** — orchestrator-owned. The hooks here read and checkpoint state but never merge it. Frontmatter - emission is unconditional (it is the input igrsoft's merge layer consumes). -- **Screenshot-gate ownership** — igrsoft owns the evidence gate. system-developer + emission is unconditional (it is the input company-workflow's merge layer consumes). +- **Screenshot-gate ownership** — company-workflow owns the evidence gate. system-developer work defaults to `requires_screenshots: false` and, when a gate demands proof, supplies `cli-fallback` terminal transcripts (build logs, ctest/pytest/bats output, sanitizer reports). It does not own or override the gate itself. @@ -79,7 +79,7 @@ following stay orchestrator-owned and are deliberately **not** implemented here: `sys-code-fixer`. Keeps the review/fix separation explicit and auditable. - **Shared verb-first command names (v1.5.0)** — commands use bare filenames (invoked as `/system-developer:`) drawn from the naming standard shared - across the igrsoft plugin family, with `apple-developer` as the reference + across the company-workflow plugin family, with `apple-developer` as the reference implementation: a `-` shape grouped by verb (`review-`, `fix-`, `gen-`, `arch-`, `analyze-`). Supersedes the pre-1.5.0 ad-hoc names (`code-review`, `lint-fix`, `deps-audit`, …). The point is cross-plugin recall — @@ -164,7 +164,7 @@ added to the agent, skill, or command inventory. ## Refresh Log (v1.5.0 — 2026-07-29) -Command-surface unification with the igrsoft plugin family. The command set is the only +Command-surface unification with the company-workflow plugin family. The command set is the only thing that moved — no agent, skill, or language guidance changed. - **Six commands renamed** to the cross-plugin verb-first standard (`code-review` → @@ -196,17 +196,17 @@ thing that moved — no agent, skill, or language guidance changed. ## Refresh Log (v1.4.0 — 2026-07-22) -igrsoft v3.36.0 port — three workflow-contract learnings plus repo-structure linters; no +company-workflow v3.36.0 port — three workflow-contract learnings plus repo-structure linters; no C/C++/Python/Bash guidance changed. - **Contract sync v3.33.0 → v3.36.0** — version headline realigned across `plugin.json`, `marketplace.json`, `README.md`, this file, the `workflow-integration` skill, and the agent stage-participation headers. The PL0 stamp note now also names `metadata.test_mode` and `metadata.ui_visual_check` (the latter **N/A** for systems/CLI work — left `false`), citing - igrsoft `estimation-methodology § PL0 Stage-Set`; the Dynamic Worktask Sizing table was + company-workflow `estimation-methodology § PL0 Stage-Set`; the Dynamic Worktask Sizing table was already current (DR0 at every tier). - **CLI evidence freshness** — `cli-fallback` transcripts must be produced this run from the - actual build/test invocation, never reused; the systems analog of igrsoft's ov151 + actual build/test invocation, never reused; the systems analog of company-workflow's ov151 evidence-integrity gate (QA direct-reads evidence and cross-checks `### build-evidence` log paths, re-opening DV on a stale/duplicated transcript). - **state-patch pointer form** — replaced the manual `read → merge → temp → fsync → rename` @@ -225,7 +225,7 @@ still fires the right skill. The section-lint burn-down is tracked separately. ## Refresh Log (v1.3.1 — 2026-07-08) -- **igrsoft compatibility refresh v3.27.1 → v3.33.0** — version-string realignment only; the +- **company-workflow compatibility refresh v3.27.1 → v3.33.0** — version-string realignment only; the `workflow-integration` content was already current (`/worktask`-only launch, two-gate model), so no agent/skill behavior changed. Bumped the compat headline across `plugin.json`, `marketplace.json`, `README.md`, the version table above, the `workflow-integration` skill @@ -235,8 +235,8 @@ still fires the right skill. The section-lint burn-down is tracked separately. ## Refresh Log (v1.3.0 — 2026-06-23) -- **Worktask alignment to igrsoft v3.27.1** — version co-move 1.2.0 → 1.3.0 and - igrsoft compatibility v3.17.0 → v3.27.1 (CC min 2.1.169 → 2.1.170) across +- **Worktask alignment to company-workflow v3.27.1** — version co-move 1.2.0 → 1.3.0 and + company-workflow compatibility v3.17.0 → v3.27.1 (CC min 2.1.169 → 2.1.170) across plugin.json, marketplace.json, README, this file, and the skill-index labels. README Workflow Integration section refreshed: the two human checkpoints (PL plan gate + FN finalization gate, both on `PL0.metadata`, independently bypassable), diff --git a/README.md b/README.md index fdc6d68..67be5d4 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ # System Developer Plugin -Claude Code plugin for systems and scripting development in **C**, **C++ (17/20/23/26-emerging)**, **Python 3.14**, and **Bash/POSIX shell**, with specialized agents, commands, and skills. Collaborates with the igrsoft (company-workflow) plugin v3.36.0 for full 11-stage workflow orchestration (PL→AR→TL→DV→**DR**→SR→QA→DC→RE→FN→ST) including the handoff-protocol (planning-N.md, state.json ledger, frontmatter schema). Systems and CLI work defaults to `requires_screenshots: false`; when an evidence gate demands proof, agents attach `cli-fallback` terminal transcripts (build logs, test output, sanitizer reports) instead of screenshots. +Claude Code plugin for systems and scripting development in **C**, **C++ (17/20/23/26-emerging)**, **Python 3.14**, and **Bash/POSIX shell**, with specialized agents, commands, and skills. Collaborates with the company-workflow plugin v4.0.0 for full 11-stage workflow orchestration (PL→AR→TL→DV→**DR**→SR→QA→DC→RE→FN→ST) including the handoff-protocol (planning-N.md, state.json ledger, frontmatter schema). Systems and CLI work defaults to `requires_screenshots: false`; when an evidence gate demands proof, agents attach `cli-fallback` terminal transcripts (build logs, test output, sanitizer reports) instead of screenshots. -**Version**: 1.6.0 | **igrsoft Compatibility**: v3.36.0 | **claude-code min version**: "2.1.170" +**Version**: 1.6.0 | **company-workflow Compatibility**: v4.0.0 | **claude-code min version**: "2.1.170" ## What's new in 1.6.0 @@ -20,14 +20,14 @@ Claude Code plugin for systems and scripting development in **C**, **C++ (17/20/ ## What's new in 1.4.0 -- **igrsoft v3.36.0 sync** — compatibility headline realigned v3.33.0 → v3.36.0 across the manifests, README, `MEMORY.md`, the `workflow-integration` skill, and the agent stage-participation headers; the PL0 stamp note now also names `metadata.test_mode` and `metadata.ui_visual_check` (the latter N/A for CLI work, left `false`), with the Dynamic Worktask Sizing table already current (DR0 at every tier). +- **company-workflow v3.36.0 sync** — compatibility headline realigned v3.33.0 → v3.36.0 across the manifests, README, `MEMORY.md`, the `workflow-integration` skill, and the agent stage-participation headers; the PL0 stamp note now also names `metadata.test_mode` and `metadata.ui_visual_check` (the latter N/A for CLI work, left `false`), with the Dynamic Worktask Sizing table already current (DR0 at every tier). - **state-patch pointer form** — the manual `read → merge → temp → fsync → rename` atomic-write prose is replaced by the two-mode `state-patch.sh --stage --prev ` contract (run when its path is supplied, else silently skip; Layers 2/3 repair from the unconditional `handoff:` frontmatter). -- **CLI evidence-freshness rule** — every `cli-fallback` transcript must be produced this run from the actual build/test invocation, never reused; the systems analog of igrsoft's QA direct-read evidence-integrity check. +- **CLI evidence-freshness rule** — every `cli-fallback` transcript must be produced this run from the actual build/test invocation, never reused; the systems analog of company-workflow's QA direct-read evidence-integrity check. - **Output budgets + Complexity Triage** — benchmark-driven `Output Budget` blocks on the DV (`_base`), AR, DV-support, and DR-support agents (Build Evidence stays exempt), plus a `Complexity Triage` gate on `system-architector` that self-limits scope at Low complexity; `section-lint` and `desc-lint` are wired into `scripts/test.sh`. See [`CHANGELOG.md`](CHANGELOG.md). ## What's new in 1.3.0 -- **Worktask refresh to igrsoft v3.27.1** — workflow integration realigned to the current igrsoft worktask behaviour: launch is `/worktask`-only (no message-prefix triggers), two human checkpoints (the PL plan gate and the FN finalization gate, both carried on `PL0.metadata` and independently bypassable), `/megatask` for dependency-ordered multi-issue batches, PL0 dynamic sizing that stamps `metadata.skipped_stages`, and SR/ET running on `opus` (xhigh) with Fable 5 available as the top reasoning tier. See [`CHANGELOG.md`](CHANGELOG.md). +- **Worktask refresh to company-workflow v3.27.1** — workflow integration realigned to the current company-workflow worktask behaviour: launch is `/worktask`-only (no message-prefix triggers), two human checkpoints (the PL plan gate and the FN finalization gate, both carried on `PL0.metadata` and independently bypassable), `/megatask` for dependency-ordered multi-issue batches, PL0 dynamic sizing that stamps `metadata.skipped_stages`, and SR/ET running on `opus` (xhigh) with Fable 5 available as the top reasoning tier. See [`CHANGELOG.md`](CHANGELOG.md). ## What's in 1.2.0 @@ -38,7 +38,7 @@ Claude Code plugin for systems and scripting development in **C**, **C++ (17/20/ - **11 agents** — a `system-developer` router, four language developers (`c-developer`, `cpp-developer`, `python-developer`, `bash-developer`), `system-architector`, and five Tier-2 specialists (`sys-test-generator`, `sys-performance-engineer`, `sys-security-auditor`, `sys-code-fixer`, `sys-dependency-manager`). All inherit `agents/_base/language-agent.md`. - **8 commands** — language-aware review, build/test, test generation, sanitizer runs, lint/format, profiling, standard modernization, and dependency auditing, each with restrictive `allowed-tools` and an `estimated-cost` band. - **Complete skills tree** — 25 `SKILL.md` skills across `_shared`, `c`, `cpp`, `python`, `bash`, `embedded`, and `tooling`, with deep reference files. Version-specificity is the product: every language feature carries a standard/version marker and a pre-version fallback. The C++ standard-selection table and `skills/_shared/version-feature-matrix.md` are canonical; everything else links to them. -- **Plugin-scoped advisory hooks** — `audit-tooluse`, `audit-subagent`, `precompact-checkpoint`, wired in `plugin.json` with igrsoft-compatible dedupe keys. Advisory only: never merges `state.json` (orchestrator-owned). See [`hooks/README.md`](hooks/README.md). +- **Plugin-scoped advisory hooks** — `audit-tooluse`, `audit-subagent`, `precompact-checkpoint`, wired in `plugin.json` with company-workflow-compatible dedupe keys. Advisory only: never merges `state.json` (orchestrator-owned). See [`hooks/README.md`](hooks/README.md). - **CC capabilities adopted** — tiered `maxTurns` runaway-loop backstops, `disallowed-tools: Write, Edit` on the two review-only auditors, fully-qualified `Task(system-developer:)` delegations, and scoped `Bash(cmd:*)` allowlists per toolchain. ## Agents (11) @@ -101,7 +101,7 @@ All commands degrade gracefully when a tool is missing: they print an install hi ## Migration: old → new command names -Six commands were renamed in 1.5.0 to match the naming standard shared across the igrsoft plugin family. The old names no longer resolve — update any scripts, aliases, or worktask payloads that reference them. +Six commands were renamed in 1.5.0 to match the naming standard shared across the company-workflow plugin family. The old names no longer resolve — update any scripts, aliases, or worktask payloads that reference them. | Old name (≤1.4.0) | New name (1.5.0+) | Behavior change | |-------------------|-------------------|-----------------| @@ -121,7 +121,7 @@ Six commands were renamed in 1.5.0 to match the naming standard shared across th | Skill | Description | |-------|-------------| | `secure-coding` | Non-negotiable security rules and bug-class defenses across all four languages — injection-safe process execution, sanitizer mapping, integer safety, path-traversal/TOCTOU resistance, secrets hygiene. | -| `workflow-integration` | Guide for integrating with the igrsoft 11-stage workflow system (v3.36.0), including the DV development contract and the `requires_screenshots: false` / cli-fallback norm. | +| `workflow-integration` | Guide for integrating with the company-workflow 11-stage workflow system (v4.0.0), including the DV development contract and the `requires_screenshots: false` / cli-fallback norm. | ### C @@ -224,15 +224,15 @@ Register the marketplace as a directory source and enable the plugin: After editing `settings.json`, run `/plugins` (or restart the session) to load the plugin. -## Workflow Integration (igrsoft v3.36.0) +## Workflow Integration (company-workflow v4.0.0) -This plugin collaborates with the **igrsoft** (company-workflow) plugin v3.36.0 for 11-stage workflow orchestration. igrsoft owns orchestration, worktree isolation, and `state.json` merge; system-developer agents stay invoked specialists and follow the handoff-protocol (plan-file resolution, Required Inputs, `handoff:` frontmatter schema, `state.json` atomic write). During the DV stage, `igrsoft:developer` routes to the appropriate system-developer specialist based on file/marker detection. +This plugin collaborates with the **company-workflow** plugin v4.0.0 for 11-stage workflow orchestration. company-workflow owns orchestration, worktree isolation, and `state.json` merge; system-developer agents stay invoked specialists and follow the handoff-protocol (plan-file resolution, Required Inputs, `handoff:` frontmatter schema, `state.json` atomic write). During the DV stage, `company-workflow:developer` routes to the appropriate system-developer specialist based on file/marker detection. -**Two human checkpoints**: igrsoft worktasks stop at the **PL gate** (post-PL0 plan approval) and the **FN gate** (pre-finalization commit/push/PR). Both carriers live independently on `PL0.metadata` (`plan_gate` / `fn_gate`, default `checkpoint`) and are bypassed by `--auto-plan` / `--auto-finalization` respectively (and both by `--emergency`). system-developer agents run as invoked specialists *between* the gates and do not own gate logic, though DV/DR/QA may re-run on a gate loopback. +**Two human checkpoints**: company-workflow worktasks stop at the **PL gate** (post-PL0 plan approval) and the **FN gate** (pre-finalization commit/push/PR). Both carriers live independently on `PL0.metadata` (`plan_gate` / `fn_gate`, default `checkpoint`) and are bypassed by `--auto-plan` / `--auto-finalization` respectively (and both by `--emergency`). system-developer agents run as invoked specialists *between* the gates and do not own gate logic, though DV/DR/QA may re-run on a gate loopback. **Multi-issue batches**: `/megatask ` (or `/megatask --issues 12,15,18`) orders many worktasks by a dependency/blocker DAG, each issue in its own isolated worktree. -**Reasoning tier**: the security-review (SR) and ethics-review (ET) stages run on `opus` at effort `xhigh`; Fable 5 is available as the top reasoning tier on CC ≥ 2.1.170, but the shipped igrsoft stage agents pin `opus`. system-developer's own agents keep their existing models. +**Reasoning tier**: the security-review (SR) and ethics-review (ET) stages run on `opus` at effort `xhigh`; Fable 5 is available as the top reasoning tier on CC ≥ 2.1.170, but the shipped company-workflow stage agents pin `opus`. system-developer's own agents keep their existing models. | Stage | system-developer Role | Contribution | |-------|----------------------|--------------| diff --git a/agents/_base/language-agent.md b/agents/_base/language-agent.md index 0a6606a..ac1d70f 100644 --- a/agents/_base/language-agent.md +++ b/agents/_base/language-agent.md @@ -36,7 +36,7 @@ Violations must be flagged and corrected before code is complete. | Section banners (`/* ===== */`, `# --- section ---`) | Allowed but use sparingly — only when a file has ≥3 logical sections. | | `// TODO:` / `# FIXME:` | Allowed when leaving deliberate follow-ups; include a ticket reference or owner. | -Apply this policy in DV stage output and when responding to DR findings. Reviewers (DR, SR) should flag policy violations alongside other issues. This policy aligns with `skill: igrsoft:code-comment-standard` — comment the non-obvious *why* and the contract only; route rationale, history, and before/after narrative to the PR / `.context/development-N.md` / ADR, not to source comments. +Apply this policy in DV stage output and when responding to DR findings. Reviewers (DR, SR) should flag policy violations alongside other issues. This policy aligns with `skill: company-workflow:code-comment-standard` — comment the non-obvious *why* and the contract only; route rationale, history, and before/after narrative to the PR / `.context/development-N.md` / ADR, not to source comments. ## Tool Priority @@ -75,7 +75,7 @@ Apply this policy in DV stage output and when responding to DR findings. Reviewe ## Workflow Stage Participation -Language agents participate in the igrsoft 11-stage workflow system (v3.36.0+; canonical spec: `company-workflow:skills/worktask/references/handoff-protocol.md`). +Language agents participate in the company-workflow 11-stage workflow system (v4.0.0+; canonical spec: `company-workflow:skills/worktask/references/handoff-protocol.md`). **Two human checkpoints** gate the pipeline: the **PL gate** (post-PL0 plan approval) and the **FN gate** (pre-finalization commit/push/PR). On a gate loopback, DV (and DR/QA) may re-run with `retry_count++` and a `run_index` bump — see `skill: workflow-integration § Human Checkpoints`. @@ -83,10 +83,10 @@ Language agents participate in the igrsoft 11-stage workflow system (v3.36.0+; c All cross-plugin invocations follow `skills/_shared/workflow-integration/SKILL.md`: plan-file resolution (`task.metadata.plan_file` → newest `.context/planning-*.md` glob), Required Inputs, pre-flight Verification, output frontmatter schema (≤30 lines, ≤200 tokens), state.json atomic write, and the per-stage required `metadata.*` matrix. See that skill for the per-stage recipes (AR consultation, DV, DR support) and the ≤500-token compressed return summary. -**state.json patching is REQUIRED before returning** — but do NOT hand-roll a `jq` or manual read→merge→rename. Use igrsoft's single, lock-serialized implementation, or skip and let the safety-net layers repair the ledger from your frontmatter: +**state.json patching is REQUIRED before returning** — but do NOT hand-roll a `jq` or manual read→merge→rename. Use company-workflow's single, lock-serialized implementation, or skip and let the safety-net layers repair the ledger from your frontmatter: -- **Primary (script)**: when the dispatching prompt or `task.metadata.state_patch_script` supplies the path to igrsoft's `state-patch.sh` (it ships in the igrsoft plugin under `skills/worktask/scripts/`), run `bash /state-patch.sh --stage --prev `. It parses this artifact's `handoff:` frontmatter and atomically merges `stages.` plus the `→` handoff edge into `.context/state.json` — single implementation, lock-serialized, idempotent. -- **Degrade (silent skip)**: if no script path was supplied, or `jq`/`state.json` is absent, skip — do NOT reconstruct the merge inline. The orchestrator's post-stage re-read (Layer 2) and igrsoft's SubagentStop `state-merge.sh` hook (Layer 3) repair the ledger from your frontmatter. +- **Primary (script)**: when the dispatching prompt or `task.metadata.state_patch_script` supplies the path to company-workflow's `state-patch.sh` (it ships in the company-workflow plugin under `skills/worktask/scripts/`), run `bash /state-patch.sh --stage --prev `. It parses this artifact's `handoff:` frontmatter and atomically merges `stages.` plus the `→` handoff edge into `.context/state.json` — single implementation, lock-serialized, idempotent. +- **Degrade (silent skip)**: if no script path was supplied, or `jq`/`state.json` is absent, skip — do NOT reconstruct the merge inline. The orchestrator's post-stage re-read (Layer 2) and company-workflow's SubagentStop `state-merge.sh` hook (Layer 3) repair the ledger from your frontmatter. **Frontmatter emission is therefore unconditional**: an artifact without `handoff:` YAML breaks the entire three-layer safety net (agent self-patch → orchestrator re-read → SubagentStop hook). @@ -98,7 +98,7 @@ All cross-plugin invocations follow `skills/_shared/workflow-integration/SKILL.m - Run only the tests covering changed files — `ctest --test-dir build -R `, `uv run pytest -k `, or `bats -f `. Full-suite regression belongs to QA. - Include security-surface summary in `.context/development-N.md` for DR and SR. - On retry, append narrative to `.context/errors/{agent-basename}.md`. -- **Evidence gate (replaces the UI screenshot gate)**: systems/CLI work defaults `requires_screenshots: false` — PL0 should set it explicitly, and DV writes the skip-rationale manifest (`> Skipped: metadata.requires_screenshots = false. Rationale: `). When gate metadata still demands evidence (`metadata.requires_screenshots: true`), capture terminal transcripts of the decisive runs (build, tests, sanitizers) as `source: cli-fallback` rows (manifest `Adapter` column: `cli_fallback`) in `.context/images//screenshots.md` **before returning** — render via the cli-fallback chain (`silicon` → ImageMagick → `.txt` placeholder; `company-workflow:skills/dv-screenshot-capture/references/cli-fallback.md`). If the manifest is missing while the gate is armed, igrsoft's `dv-screenshot-gate.sh` blocks `SubagentStop` with `hookSpecificOutput.additionalContext` and re-dispatches. +- **Evidence gate (replaces the UI screenshot gate)**: systems/CLI work defaults `requires_screenshots: false` — PL0 should set it explicitly, and DV writes the skip-rationale manifest (`> Skipped: metadata.requires_screenshots = false. Rationale: `). When gate metadata still demands evidence (`metadata.requires_screenshots: true`), capture terminal transcripts of the decisive runs (build, tests, sanitizers) as `source: cli-fallback` rows (manifest `Adapter` column: `cli_fallback`) in `.context/images//screenshots.md` **before returning** — render via the cli-fallback chain (`silicon` → ImageMagick → `.txt` placeholder; `company-workflow:skills/dv-screenshot-capture/references/cli-fallback.md`). If the manifest is missing while the gate is armed, company-workflow's `dv-screenshot-gate.sh` blocks `SubagentStop` with `hookSpecificOutput.additionalContext` and re-dispatches. - **Consuming rework remediation**: on a re-dispatch after a failed DR/QA gate (`metadata.retry_count > 0`), read the prepended `REMEDIATION (from gate…)` block plus `metadata.gate_from_stage` + `metadata.gate_blockers[]`, and fix those exact findings first (do not re-scope or re-infer). Keep the diff minimal; record per-blocker resolution in `.context/errors/{agent-basename}.md`. The orchestrator owns the injection — language agents only consume it. See `skill: workflow-integration § Gate-Feedback Contract`. ### Output Budget (DV) @@ -107,7 +107,7 @@ All cross-plugin invocations follow `skills/_shared/workflow-integration/SKILL.m ### DR Stage (Developer Review) - Provide Context -Technical-lead (`igrsoft:technical-lead`) reviews DV output against systems-specific criteria (memory safety, undefined behavior, error-handling discipline, unsafe constructs, build hygiene, Linux/macOS portability). Language agents support DR by: +Technical-lead (`company-workflow:technical-lead`) reviews DV output against systems-specific criteria (memory safety, undefined behavior, error-handling discipline, unsafe constructs, build hygiene, Linux/macOS portability). Language agents support DR by: - Flagging known trade-offs in `development-N.md` under "DR Focus" section - Responding to DR findings by routing to `system-developer:sys-code-fixer` (minimal-diff application) or `system-developer:system-architector` (pattern consult) diff --git a/agents/bash-developer.md b/agents/bash-developer.md index 6eb51aa..78c580c 100644 --- a/agents/bash-developer.md +++ b/agents/bash-developer.md @@ -13,7 +13,7 @@ Expert shell developer specializing in defensive Bash 5.x and strict POSIX `sh`. ## Workflow Integration -If `.context/state.json` exists, this agent is inside an igrsoft workflow. BEFORE doing any work: +If `.context/state.json` exists, this agent is inside a company-workflow workflow. BEFORE doing any work: 1. Load `skill: workflow-integration` for stage pipeline context and the binding handoff contract 2. Follow the active-stage recipe (typically **DV** — implementation; DR support) @@ -131,7 +131,7 @@ For deep audits (CWE mapping, gitleaks, supply-chain) route to `system-developer ## DR Focus -Flag these in `development-N.md` under "DR Focus" so `igrsoft:technical-lead` can review (and pre-empt rework): +Flag these in `development-N.md` under "DR Focus" so `company-workflow:technical-lead` can review (and pre-empt rework): - Strict-mode completeness: prologue present, `set -e` blind spots handled explicitly, `ERR`/`EXIT` traps wired - Quoting + word-splitting: every expansion quoted; NUL-safe filename handling; no `for f in $(ls)` diff --git a/agents/c-developer.md b/agents/c-developer.md index fc8beec..3642477 100644 --- a/agents/c-developer.md +++ b/agents/c-developer.md @@ -15,7 +15,7 @@ Inherits `_base/language-agent.md` (Constraints, Code Comment Policy, Tool Prior ## Workflow Integration -If `.context/state.json` exists, this agent is inside an igrsoft workflow. BEFORE doing any work: +If `.context/state.json` exists, this agent is inside a company-workflow workflow. BEFORE doing any work: 1. Load `skill: workflow-integration` for the 11-stage pipeline context and the BINDING handoff contract 2. Resolve the plan file (`task.metadata.plan_file` → newest `.context/planning-*.md`) and read Required Inputs diff --git a/agents/cpp-developer.md b/agents/cpp-developer.md index e8d6afe..045fc18 100644 --- a/agents/cpp-developer.md +++ b/agents/cpp-developer.md @@ -13,7 +13,7 @@ Expert C++ developer specializing in modern, memory-safe C++ across the C++17/20 ## Workflow Integration -If `.context/state.json` exists, this agent is inside an igrsoft workflow. BEFORE doing any work: +If `.context/state.json` exists, this agent is inside a company-workflow workflow. BEFORE doing any work: 1. Load `skill: workflow-integration` for stage pipeline context and the binding handoff contract (plan-file resolution, Required Inputs, output frontmatter schema, state.json atomic write). 2. Follow the active stage recipe — typically **DV** (implementation); **DR** support and **SR** context as a contributor. @@ -104,7 +104,7 @@ For C++20 modules use `FILE_SET CXX_MODULES` (CMake 3.28+); treat `import std;` ## DR Focus -When supporting the DR stage (`igrsoft:technical-lead` review), flag these C++-specific concerns in `development-N.md` so the reviewer can target them: +When supporting the DR stage (`company-workflow:technical-lead` review), flag these C++-specific concerns in `development-N.md` so the reviewer can target them: - **Memory safety & ownership**: every allocation's owner is unambiguous; no naked `new`/`delete`; no dangling `string_view`/`span`/reference; Rule of Zero/Five applied consistently. - **Undefined behavior**: no signed-overflow assumptions, OOB access, use-after-move, or strict-aliasing violations; integer conversions are checked. diff --git a/agents/python-developer.md b/agents/python-developer.md index 5eb0d3f..80bccac 100644 --- a/agents/python-developer.md +++ b/agents/python-developer.md @@ -15,7 +15,7 @@ Inherits `_base/language-agent.md` (Constraints, Code Comment Policy, Tool Prior ## Workflow Integration -If `.context/state.json` exists, this agent is inside an igrsoft workflow. BEFORE doing any work: +If `.context/state.json` exists, this agent is inside a company-workflow workflow. BEFORE doing any work: 1. Load `skill: workflow-integration` for the 11-stage pipeline context and the BINDING handoff contract 2. Resolve the plan file (`task.metadata.plan_file` → newest `.context/planning-*.md`) and read Required Inputs diff --git a/agents/sys-code-fixer.md b/agents/sys-code-fixer.md index 2317991..9952abb 100644 --- a/agents/sys-code-fixer.md +++ b/agents/sys-code-fixer.md @@ -30,7 +30,7 @@ Input: a finding from a reviewer/auditor with `file:line`, issue description, se ### 3. Apply Fix - Make minimal, targeted changes; preserve existing formatting -- Add a brief comment only when the *why* is non-obvious (workaround, hidden invariant, ticket reference) — never restate what the code does (see Code Comment Policy in base; aligned with `skill: igrsoft:code-comment-standard`) +- Add a brief comment only when the *why* is non-obvious (workaround, hidden invariant, ticket reference) — never restate what the code does (see Code Comment Policy in base; aligned with `skill: company-workflow:code-comment-standard`) - Update related code (callers, headers, tests) only when the fix requires it ### 4. Verify Fix @@ -94,11 +94,11 @@ Before marking a fix complete: - Do not silence a warning/finding by suppression when a real fix is cheap; suppressions need a why-comment and the narrowest scope - Do not introduce a second linter/formatter/test framework — use the project's existing tooling -## Workflow Stage Participation (igrsoft v3.36.0) +## Workflow Stage Participation (company-workflow v4.0.0) | Stage | Role | Contribution | |-------|------|-------------| -| **DR** | Primary Support | Apply `igrsoft:technical-lead` findings from `.context/developer-review-N.md`; enforce minimal-diff; write retries to `.context/errors/sys-code-fixer.md` | +| **DR** | Primary Support | Apply `company-workflow:technical-lead` findings from `.context/developer-review-N.md`; enforce minimal-diff; write retries to `.context/errors/sys-code-fixer.md` | | **DV** | Support | Fix automation during implementation (review findings, lint/compiler errors, quick playbook fixes); on rework, apply injected gate-feedback (see below) | | **IR** | Support | Apply hotfix patches under the DR minimal-diff gate (see `_base/language-agent.md § IR Stage`) | @@ -106,7 +106,7 @@ Before marking a fix complete: Read `.context/developer-review-N.md`; group blockers by file; address P0/P1 first, defer P2/P3 unless approved; re-run the matching build/test/lint gate (single scoped command) after each fix group. On completion, `TaskUpdate({ taskId, owner: "system-developer:sys-code-fixer", status: "completed" })`. See `skills/_shared/workflow-integration/templates/dr-review.md` for review criteria and delegation examples. -### Consuming DR/QA gate-feedback on re-dispatch (igrsoft v3.36.0) +### Consuming DR/QA gate-feedback on re-dispatch (company-workflow v4.0.0) When the orchestrator re-dispatches DV after a failed DR or QA gate, the failed gate's findings are injected **verbatim** so you fix the exact reported issues instead of re-inferring them. On such a run: @@ -115,7 +115,7 @@ When the orchestrator re-dispatches DV after a failed DR or QA gate, the failed 3. **Record per-blocker resolution** in `.context/errors/sys-code-fixer.md` (which blocker → what fix → `file:line`; if a blocker cannot be applied cleanly, log why and return `verdict: blocked` naming it). 4. **Enforce minimal-diff across rework cycles** — change only what the blockers require; the diff must not grow with each retry. Re-run the native build/test/lint gate after each fix group. -You **consume** this contract — the injection itself is orchestrator-owned (igrsoft `worktask/SKILL.md`). See `skills/_shared/workflow-integration/SKILL.md § Gate-Feedback Contract`. +You **consume** this contract — the injection itself is orchestrator-owned (company-workflow `worktask/SKILL.md`). See `skills/_shared/workflow-integration/SKILL.md § Gate-Feedback Contract`. ### Output Budget (DR support) diff --git a/agents/sys-dependency-manager.md b/agents/sys-dependency-manager.md index 2cdc766..f2eaae4 100644 --- a/agents/sys-dependency-manager.md +++ b/agents/sys-dependency-manager.md @@ -15,7 +15,7 @@ Inherits `_base/language-agent.md` (Constraints, Code Comment Policy, Tool Prior ## Workflow Integration -If `.context/state.json` exists, this agent is inside an igrsoft workflow. BEFORE doing any work: +If `.context/state.json` exists, this agent is inside a company-workflow workflow. BEFORE doing any work: 1. Load `skill: workflow-integration` for the binding handoff contract 2. Read `.context/state.json` for upstream context diff --git a/agents/sys-performance-engineer.md b/agents/sys-performance-engineer.md index 98d2511..9cab62d 100644 --- a/agents/sys-performance-engineer.md +++ b/agents/sys-performance-engineer.md @@ -16,7 +16,7 @@ Inherits `_base/language-agent.md` (Constraints, Tool Priority, Delegation Routi ## Workflow Integration -When `.context/state.json` exists, this agent runs inside an igrsoft workflow as **DV support**, not as a stage owner: +When `.context/state.json` exists, this agent runs inside a company-workflow workflow as **DV support**, not as a stage owner: 1. Load `skill: workflow-integration` for the handoff contract; read `.context/state.json` for upstream context and `development-N.md#files-changed` for profiling targets 2. The parent DV agent owns `.context/development-N.md` — this agent supplies findings as input to its `## Performance` section diff --git a/agents/sys-security-auditor.md b/agents/sys-security-auditor.md index 7c7d2cc..6e24232 100644 --- a/agents/sys-security-auditor.md +++ b/agents/sys-security-auditor.md @@ -16,11 +16,11 @@ Inherits `_base/language-agent.md` (Constraints, Tool Priority, Delegation Routi ## Workflow Integration -If `.context/state.json` exists, this agent is inside an igrsoft workflow. BEFORE doing any work: +If `.context/state.json` exists, this agent is inside a company-workflow workflow. BEFORE doing any work: 1. Load `skill: workflow-integration` for the 11-stage context and the BINDING handoff contract 2. Read `.context/state.json` for upstream context; read `development-N.md` (newest `development-*.md`) for the SR security-surface table and files changed -3. Default stage: **SR context provider** — the SR owner `igrsoft:security-reviewer` (runs on **opus** at **effort xhigh** — Fable 5 is available on the runtime but SR pins opus) owns `.context/security-review.md`; this agent supplies systems-specific findings (memory safety, injection, secrets, supply chain, privilege, hardening) as input for that agent to merge +3. Default stage: **SR context provider** — the SR owner `company-workflow:security-reviewer` (runs on **opus** at **effort xhigh** — Fable 5 is available on the runtime but SR pins opus) owns `.context/security-review.md`; this agent supplies systems-specific findings (memory safety, injection, secrets, supply chain, privilege, hardening) as input for that agent to merge 4. Return a **compressed summary (≤500 tokens)** — findings grouped by severity, each with CWE + `file:line` — for the parent SR agent 5. Do NOT patch `state.json` and do NOT write `security-review.md` — the parent SR agent owns stage status and the report file diff --git a/agents/sys-test-generator.md b/agents/sys-test-generator.md index 83309d6..77d46fe 100644 --- a/agents/sys-test-generator.md +++ b/agents/sys-test-generator.md @@ -15,7 +15,7 @@ Inherits `_base/language-agent.md` (Constraints, Code Comment Policy, Tool Prior ## Workflow Integration -If `.context/state.json` exists, this agent is inside an igrsoft workflow. BEFORE doing any work: +If `.context/state.json` exists, this agent is inside a company-workflow workflow. BEFORE doing any work: 1. Load `skill: workflow-integration` for the binding handoff contract 2. Read `.context/state.json` for upstream context; read `.context/development-N.md#files-changed` for coverage targets @@ -23,7 +23,7 @@ If `.context/state.json` exists, this agent is inside an igrsoft workflow. BEFOR 4. Frontmatter template (only if owning a standalone artifact): `skills/_shared/workflow-integration/templates/dv-development.md` 5. Do NOT patch `state.json` — the parent DV agent handles stage status -Also invoked during the **QA** stage by `igrsoft:qa-engineer` for coverage-gap analysis. +Also invoked during the **QA** stage by `company-workflow:qa-engineer` for coverage-gap analysis. ## Framework Selection Matrix @@ -102,7 +102,7 @@ When running tests and encountering failures, follow the iterative retry loop: 6. If regression fails, return to step 2 with the new failure set 7. Cap at 3 fix-retest iterations; escalate to the caller if still failing -**When invoked from the DV stage** (igrsoft workflow), the "requested tests" in step 1 are the **change-scoped test set** (tests covering modified files), and the **final regression gate (step 5) is skipped** because the QA stage owns full-suite regression. Outside DV, the loop runs as written with the caller-supplied requested set and a full-suite regression gate. +**When invoked from the DV stage** (company-workflow workflow), the "requested tests" in step 1 are the **change-scoped test set** (tests covering modified files), and the **final regression gate (step 5) is skipped** because the QA stage owns full-suite regression. Outside DV, the loop runs as written with the caller-supplied requested set and a full-suite regression gate. Build before running where compilation is required (`cmake --build build` for C/C++); a compile failure in a generated test is a step-2 fix, not an escalation. diff --git a/agents/system-architector.md b/agents/system-architector.md index b0b349c..d05a045 100644 --- a/agents/system-architector.md +++ b/agents/system-architector.md @@ -22,13 +22,13 @@ You are a systems architecture specialist who selects, validates, and applies so ### Complexity Triage (0–50 scale) -Read `metadata.complexity_score` when supplied. igrsoft's AR runs only at **Medium+** (≥ 11) — its Low-Complexity Gate answers Low-band picks itself. Called directly without a score, infer the band (single library, module, or script with clear constraints and no migration = Low). +Read `metadata.complexity_score` when supplied. company-workflow's AR runs only at **Medium+** (≥ 11) — its Low-Complexity Gate answers Low-band picks itself. Called directly without a score, infer the band (single library, module, or script with clear constraints and no migration = Low). - **Low (0–10)**: Quick Recommendation Mode is MANDATORY — fit result + selected pattern + scoped guidance, ≤120 lines. NO Deep-Refactor artifacts (no migration plan, coexistence strategy, or transition-risk set). - **11–30 (Medium / Moderate)**: Quick Recommendation by default; enter Deep Refactor only on its own triggers (migrations, mixed patterns, ABI/API breaks, module-boundary changes). - **31+ (High / Critical)**: Deep Refactor deliverables warranted. -Bands (igrsoft): 0–10 Low / 11–20 Medium / 21–30 Moderate / 31–40 High / 41–50 Critical. The mode triggers always outrank an inferred low score — a genuine migration ask gets Deep Refactor regardless. +Bands (company-workflow): 0–10 Low / 11–20 Medium / 21–30 Moderate / 31–40 High / 41–50 Critical. The mode triggers always outrank an inferred low score — a genuine migration ask gets Deep Refactor regardless. ## Supported Patterns @@ -87,7 +87,7 @@ When analyzing existing code, look for: | Security boundary review of the architecture | `system-developer:sys-security-auditor` (via the router) | | Library / standard documentation, ABI specifics | Context7 or Ref MCP tools | -## Workflow Stage Participation (igrsoft v3.36.0) +## Workflow Stage Participation (company-workflow v4.0.0) See `_base/language-agent.md § Workflow Stage Participation` for the binding handoff contract. @@ -95,7 +95,7 @@ See `_base/language-agent.md § Workflow Stage Participation` for the binding ha |-------|------|-------------| | **AR** | Primary | Architecture design, pattern selection, ABI/API blueprint, technical decisions | | **DV** | Support | Architecture guidance during implementation | -| **DR** | Consultant | Structural review when `igrsoft:technical-lead` flags systemic concerns (wrong pattern, boundary/layering leaks, ABI exposure) | +| **DR** | Consultant | Structural review when `company-workflow:technical-lead` flags systemic concerns (wrong pattern, boundary/layering leaks, ABI exposure) | | **SR** | Context | Boundary and trust-zone documentation for security review | | **QA** | Context | Architecture-driven test strategy and boundary test guidance | @@ -104,7 +104,7 @@ See `_base/language-agent.md § Workflow Stage Participation` for the binding ha 1. Resolve the plan file (`task.metadata.plan_file` → newest `.context/planning-*.md`) and the active stage from `.context/state.json`. 2. Run the Core Workflow (Fast Path → Quick Recommendation or Deep Refactor → Guardrails → Verification) to select the pattern, ownership model, and ABI/API contract. 3. Write the canonical AR artifact `analyzing-N.md` (`N = run_index` from `task.metadata.run_index`; e.g., `analyzing-0.md`) with `handoff:` frontmatter conforming to `skill: workflow-integration § Handoff Frontmatter` — emit the frontmatter **unconditionally**, it is the merge input regardless of filename. Readers fall back to newest-glob (`analyzing-*.md`). -4. Patch `state.json` (`stages.AR` + the `PL→AR` handoff edge): run `state-patch.sh --stage AR --prev PL` when its path is supplied (`task.metadata.state_patch_script`; ships under igrsoft `skills/worktask/scripts/`), else skip — do not hand-roll the merge; the SubagentStop hook repairs from frontmatter. +4. Patch `state.json` (`stages.AR` + the `PL→AR` handoff edge): run `state-patch.sh --stage AR --prev PL` when its path is supplied (`task.metadata.state_patch_script`; ships under company-workflow `skills/worktask/scripts/`), else skip — do not hand-roll the merge; the SubagentStop hook repairs from frontmatter. ### Output Budget (AR) diff --git a/agents/system-developer.md b/agents/system-developer.md index 8b7fa62..7fcc1e9 100644 --- a/agents/system-developer.md +++ b/agents/system-developer.md @@ -26,11 +26,11 @@ You are a systems and scripting development expert and routing coordinator for C | `sys-code-fixer` | Batch remediation: compiler/clang-tidy fixes, `ruff --fix`, shellcheck quoting; minimal-diff application from review findings | | `sys-dependency-manager` | vcpkg manifests, Conan 2 profiles/lockfiles, FetchContent pinning, `uv` lockfiles, pip constraints; safe-update process, CVE reports | -## Workflow Collaboration (igrsoft v3.36.0) +## Workflow Collaboration (company-workflow v4.0.0) See: `skill: workflow-integration` for the complete 11-stage workflow guide and the binding handoff contract (also summarized in `_base/language-agent.md`). -Two human checkpoints gate the run — the **PL gate** (post-PL0 plan approval) and the **FN gate** (pre-finalization commit/push/PR); DV may re-run on a gate loopback. Infra-scope DV work (worktask state, stages, Task System) routes to `igrsoft:workflow-engineer`. +Two human checkpoints gate the run — the **PL gate** (post-PL0 plan approval) and the **FN gate** (pre-finalization commit/push/PR); DV may re-run on a gate loopback. Infra-scope DV work (worktask state, stages, Task System) routes to `company-workflow:workflow-engineer`. ### Quick Reference @@ -44,7 +44,7 @@ Two human checkpoints gate the run — the **PL gate** (post-PL0 plan approval) ### DV Stage Quick Steps -When `.context/state.json` exists, this agent is inside an igrsoft workflow. Follow `_base/language-agent.md § Workflow Stage Participation § DV Stage` for the contract; the router-specific steps: +When `.context/state.json` exists, this agent is inside a company-workflow workflow. Follow `_base/language-agent.md § Workflow Stage Participation § DV Stage` for the contract; the router-specific steps: 1. Resolve the plan file (`task.metadata.plan_file` → newest `.context/planning-*.md`) and the active stage from `state.json`. 2. Detect language(s) and build system(s) per the Quick Route Decision Tree below. @@ -53,7 +53,7 @@ When `.context/state.json` exists, this agent is inside an igrsoft workflow. Fol **Pass-through metadata.** When routing DV to a specialist, forward the gate/screenshot and rework metadata unchanged — the router relays, it does not consume or rewrite: -- `metadata.requires_screenshots` (systems/CLI work defaults **`false`**) — PL0 should set this explicitly. The specialist writes the skip-rationale manifest (`> Skipped: metadata.requires_screenshots = false. Rationale: `). If the gate is still armed (`true`), the specialist captures terminal transcripts of the decisive runs (build, tests, sanitizers) as `source: cli-fallback` rows in `.context/images//screenshots.md` before returning, or igrsoft's `dv-screenshot-gate.sh` blocks `SubagentStop`. +- `metadata.requires_screenshots` (systems/CLI work defaults **`false`**) — PL0 should set this explicitly. The specialist writes the skip-rationale manifest (`> Skipped: metadata.requires_screenshots = false. Rationale: `). If the gate is still armed (`true`), the specialist captures terminal transcripts of the decisive runs (build, tests, sanitizers) as `source: cli-fallback` rows in `.context/images//screenshots.md` before returning, or company-workflow's `dv-screenshot-gate.sh` blocks `SubagentStop`. - On a rework re-dispatch (`metadata.retry_count > 0`): `metadata.gate_from_stage` + `metadata.gate_blockers[]`, plus the prepended `REMEDIATION (from gate…)` block — the specialist fixes those exact findings first, minimal diff, no re-scoping. See `skill: workflow-integration § Screenshot Gate for CLI Work` and `§ Gate-Feedback Contract`. @@ -65,7 +65,7 @@ After a routed sub-agent returns, verify before returning to the orchestrator: 1. The sub-agent's artifact starts with `---\nhandoff:\n` YAML conforming to `skill: workflow-integration § Handoff Frontmatter` (unconditional — this is the Layer-1/Layer-2 merge input regardless of filename). 2. `state.json` has been patched (or the sub-agent logged that the patch failed — acceptable, the SubagentStop hook repairs from frontmatter). 3. The artifact uses the numbered `-N.md` name from `skill: workflow-integration § Artifact Filename Contract` (e.g., `development-0.md`); the canonical basenames hold, only the `-N` suffix varies. -4. For DV with `requires_screenshots != false`, the evidence manifest `.context/images//screenshots.md` exists with `source: cli-fallback` transcript rows (else igrsoft's `dv-screenshot-gate.sh` blocks the specialist's `SubagentStop`). For the systems default (`false`), confirm the skip-rationale line is present. +4. For DV with `requires_screenshots != false`, the evidence manifest `.context/images//screenshots.md` exists with `source: cli-fallback` transcript rows (else company-workflow's `dv-screenshot-gate.sh` blocks the specialist's `SubagentStop`). For the systems default (`false`), confirm the skip-rationale line is present. 5. On a rework re-dispatch, confirm the specialist addressed each `metadata.gate_blockers[]` item and recorded per-blocker resolution. If verification fails, log WARN and attempt repair: parse the sub-agent's return summary and emit minimal frontmatter. Never return to the orchestrator without `handoff:` frontmatter on the artifact. @@ -76,7 +76,7 @@ If verification fails, log WARN and attempt repair: parse the sub-agent's return |-------|---------| | `workflow-integration` | Complete 11-stage workflow guide and handoff contract | | `_shared/secure-coding` | Input validation and injection-surface review (SR context) | -| `igrsoft:cross-plugin-handoff` | Cross-plugin protocol | +| `company-workflow:cross-plugin-handoff` | Cross-plugin protocol | ## Quick Route Decision Tree diff --git a/commands/deps.md b/commands/deps.md index 6c56b8e..87d2997 100644 --- a/commands/deps.md +++ b/commands/deps.md @@ -24,7 +24,7 @@ Three subcommands select the operation from the first argument, across the four **Exception — a flag that names a mutating mode is an error, not a fallback.** The `audit` default is safe for an empty token, a bare path, or an unrecognized-but-harmless word. It is *not* safe for `--upgrade` or `--add`: those fall through to "not one of the three", silently run a read-only audit, and hand the caller an audit result for a mutation they asked for — "no action taken" reads as "nothing to do". If `--upgrade` or `--add` appears anywhere in `$ARGUMENTS`, stop and emit the Error Handling message; do not fall back to `audit`. -[Extended thinking: Dependency changes are the highest-blast-radius edits in a systems project — one transitive bump can silently change ABI, drop a symbol, or pull in a CVE. This command separates read-only assessment (audit) from mutation (upgrade/add) and forces upgrades through a one-dependency, pin-exact, build-and-test-gated loop. Manifest discovery is shared with `skill: language-detection`; CVE lookup prefers a local `osv-scanner` and falls back to the osv.dev API; license inventory is best-effort and never blocks. Security findings are phrased in `igrsoft:security-review-process` vocabulary so they flow cleanly into an SR stage. The heavy reasoning — version-jump risk, breaking-change analysis, manifest edits — is delegated to `system-developer:sys-dependency-manager`; this command owns discovery, the gate loop, and reporting.] +[Extended thinking: Dependency changes are the highest-blast-radius edits in a systems project — one transitive bump can silently change ABI, drop a symbol, or pull in a CVE. This command separates read-only assessment (audit) from mutation (upgrade/add) and forces upgrades through a one-dependency, pin-exact, build-and-test-gated loop. Manifest discovery is shared with `skill: language-detection`; CVE lookup prefers a local `osv-scanner` and falls back to the osv.dev API; license inventory is best-effort and never blocks. Security findings are phrased in `company-workflow:security-review-process` vocabulary so they flow cleanly into an SR stage. The heavy reasoning — version-jump risk, breaking-change analysis, manifest edits — is delegated to `system-developer:sys-dependency-manager`; this command owns discovery, the gate loop, and reporting.] ## CRITICAL BEHAVIORAL RULES @@ -36,7 +36,7 @@ You MUST follow these rules exactly. Violating any of them is a failure. 4. **Single-command Bash invocations.** Use each tool's own directory flags (`vcpkg --x-manifest-root=DIR`, `conan` from the project via `--`-scoped args, `uv --project DIR`). Never `cd`-chain or `&&`-chain directory changes — scoped Bash patterns do not match compound commands. 5. **Tool-missing never hard-fails.** If a package manager or scanner binary is absent, print the install hint, skip that manager's pass, and continue with the others. Report what was skipped. A missing `osv-scanner` falls back to the osv.dev API via WebFetch — never skip the CVE pass silently. 6. **Delegate the reasoning, own the loop.** Hand version-jump risk, breaking-change analysis, and manifest edits to `system-developer:sys-dependency-manager`. This command performs discovery, runs the build+test gate, and synthesizes the report. -7. **Security findings use SR vocabulary.** Phrase every CVE/advisory finding in `igrsoft:security-review-process` terms (severity, CVE/advisory id, affected version range, fixed-in version, remediation) so the output is consumable by an SR stage. +7. **Security findings use SR vocabulary.** Phrase every CVE/advisory finding in `company-workflow:security-review-process` terms (severity, CVE/advisory id, affected version range, fixed-in version, remediation) so the output is consumable by an SR stage. 8. **Never enter plan mode.** This command IS the procedure — execute it. ## Usage @@ -122,7 +122,7 @@ Prefer a locally installed scanner; fall back to the osv.dev API. **Never skip t - URL: `https://api.osv.dev/v1/query` - Body shape: `{"package": {"ecosystem": "", "name": ""}, "version": ""}` - Map ecosystems: Python → `PyPI`; native C/C++ deps from vcpkg/Conan/FetchContent → query by upstream project (osv.dev coverage for native libs is partial; cross-check the NVD via WebSearch when osv.dev returns nothing for a well-known native CVE). Verify coverage against your toolchain. -4. **Normalize every finding into SR vocabulary** (per `igrsoft:security-review-process`): `severity` (Critical/High/Medium/Low from CVSS), `advisory id` (CVE-/GHSA-/OSV-), `affected range`, `fixed-in version`, `remediation` (upgrade target). Group Critical/High at the top. +4. **Normalize every finding into SR vocabulary** (per `company-workflow:security-review-process`): `severity` (Critical/High/Medium/Low from CVSS), `advisory id` (CVE-/GHSA-/OSV-), `affected range`, `fixed-in version`, `remediation` (upgrade target). Group Critical/High at the top. ### Phase 4: License Inventory (best-effort) @@ -139,7 +139,7 @@ Flag any GPL/AGPL/SSPL or otherwise copyleft-incompatible license against a perm Hand the raw discovery + queries to the dependency manager for risk framing: - **Use Task tool with subagent_type="system-developer:sys-dependency-manager"** - Prompt: "Audit-mode dependency analysis for the project at `{path}`. Discovered managers: {managers}. Outdated report:\n```\n{outdated_output}\n```\nCVE findings (raw):\n```\n{cve_output}\n```\nLicenses:\n```\n{license_output}\n```\nFor each outdated dependency, classify the version jump (patch/minor/major), note documented breaking changes, and assess upgrade risk. Normalize every vulnerability into `igrsoft:security-review-process` vocabulary (severity, advisory id, affected range, fixed-in, remediation). Produce a prioritized upgrade plan (security patches first, then patch/minor, then majors individually). Do NOT edit any files — this is read-only audit." + Prompt: "Audit-mode dependency analysis for the project at `{path}`. Discovered managers: {managers}. Outdated report:\n```\n{outdated_output}\n```\nCVE findings (raw):\n```\n{cve_output}\n```\nLicenses:\n```\n{license_output}\n```\nFor each outdated dependency, classify the version jump (patch/minor/major), note documented breaking changes, and assess upgrade risk. Normalize every vulnerability into `company-workflow:security-review-process` vocabulary (severity, advisory id, affected range, fixed-in, remediation). Produce a prioritized upgrade plan (security patches first, then patch/minor, then majors individually). Do NOT edit any files — this is read-only audit." - Synthesize the agent's analysis into the Output Format report. ## Subcommand: `upgrade` (one dependency, gated) @@ -321,4 +321,4 @@ Print the install hint, skip that manager's pass, continue. A missing `osv-scann - `skill: secure-coding` — supply-chain and dependency-trust rules that gate a diff. - `/system-developer:build-test` — the build+test gate this command invokes after every upgrade/add. - `/system-developer:sanitize-check` — run after a dependency upgrade to catch ABI/behavior regressions a new version introduces. -- `igrsoft:security-review-process` — SR-stage vocabulary used for every vulnerability finding here. +- `company-workflow:security-review-process` — SR-stage vocabulary used for every vulnerability finding here. diff --git a/commands/fix-modernize.md b/commands/fix-modernize.md index 9ddf033..9b900f2 100644 --- a/commands/fix-modernize.md +++ b/commands/fix-modernize.md @@ -234,7 +234,7 @@ After a class is `verified`: > Per the user's git conventions: no `--no-verify`, no AI-attribution footers, and follow the repo's commit format. If the repo is mid-feature on a protected branch, branch first. -> Doc constraint: modernization rationale and before/after notes belong in the PR / `.context/development-N.md`, NOT in source comments — per the compact code-documentation standard (`igrsoft:code-comment-standard`). Source comments carry only the non-obvious WHY and the contract. +> Doc constraint: modernization rationale and before/after notes belong in the PR / `.context/development-N.md`, NOT in source comments — per the compact code-documentation standard (`company-workflow:code-comment-standard`). Source comments carry only the non-obvious WHY and the contract. ### Phase 5: Report diff --git a/commands/fix-refactor.md b/commands/fix-refactor.md index 0edde7b..f5192d6 100644 --- a/commands/fix-refactor.md +++ b/commands/fix-refactor.md @@ -232,7 +232,7 @@ Rows marked MAJOR (Rule 8) are surfaced in the report before application and are > Per the user's git conventions: no `--no-verify`, no AI-attribution footers, follow the repo's commit format, and branch first if on a protected branch. Keep refactoring commits separate from feature commits. -> Rationale and before/after notes belong in the PR or `.context/development-N.md`, NOT in source comments (`igrsoft:code-comment-standard`) — source comments carry only the non-obvious WHY and the contract. +> Rationale and before/after notes belong in the PR or `.context/development-N.md`, NOT in source comments (`company-workflow:code-comment-standard`) — source comments carry only the non-obvious WHY and the contract. ### Phase 6: Report diff --git a/commands/gen-docs.md b/commands/gen-docs.md index 8a11129..acc5676 100644 --- a/commands/gen-docs.md +++ b/commands/gen-docs.md @@ -22,7 +22,7 @@ Generate or update API documentation in place — Doxygen comment blocks for C a You MUST follow these rules exactly. Violating any of them is a failure. -1. **Contract only — never narrate the code.** Per `igrsoft:code-comment-standard`, every comment you write documents the non-obvious WHY or the contract. NEVER restate what the next line does, NEVER record history/provenance/before-after ("was X, now Y", "added for ticket 42"), NEVER enumerate call sites. This rule binds you AND every delegated documenter. +1. **Contract only — never narrate the code.** Per `company-workflow:code-comment-standard`, every comment you write documents the non-obvious WHY or the contract. NEVER restate what the next line does, NEVER record history/provenance/before-after ("was X, now Y", "added for ticket 42"), NEVER enumerate call sites. This rule binds you AND every delegated documenter. 2. **API doc comments ARE contract.** Doxygen `@brief`/`@param`/`@return`/`@retval`/`@throws`, Python docstring summary + Args/Returns/Raises, and a Bash header's purpose/usage/exit codes are in scope precisely because they state the contract. A `@param n The n` that restates the name is not contract — omit it or say something real. 3. **Detect the style, never impose one.** Read existing docstrings/comments first and match them: Google vs NumPy vs reST for Python, the project's existing Doxygen dialect (`@param` vs `\param`, `/**` vs `///<`) for C/C++. Only when a tree has no precedent do you pick a default. 4. **One documenter per detected language, in parallel.** Launch a documenter only for a language actually present in scope (or forced by `--lang`). They have no dependencies on each other. @@ -144,16 +144,16 @@ Each non-trivial function gets a contract comment: arguments (positional meaning Launch one documenter per detected language **simultaneously**. Each receives the resolved file list, the detected style, and the comment standard. **C — Use Task tool with subagent_type="system-developer:c-developer"** -Prompt: "Add or update Doxygen documentation for these C files: {file_list}. Existing dialect: {dialect}. Put blocks on declarations in headers. Document ownership/free responsibility, lifetime and validity of pointer arguments, thread-safety, units, and the error contract (`@param`, `@return`, `@retval` with errno values). CRITICAL — per `igrsoft:code-comment-standard`: document only the non-obvious WHY and the contract. Never restate what a line does, never record history/provenance/before-after, never enumerate call sites. `@param`/`@return` are contract and are in scope; `@param n The n` restates the name — omit it instead. Do not invent behavior: leave genuinely unclear contracts undocumented and list them. No TODO/placeholder text. {If --public-only: 'Only the public header surface; skip statics and internals.'} Report `{file, symbol, action}` plus a list of symbols needing manual review." +Prompt: "Add or update Doxygen documentation for these C files: {file_list}. Existing dialect: {dialect}. Put blocks on declarations in headers. Document ownership/free responsibility, lifetime and validity of pointer arguments, thread-safety, units, and the error contract (`@param`, `@return`, `@retval` with errno values). CRITICAL — per `company-workflow:code-comment-standard`: document only the non-obvious WHY and the contract. Never restate what a line does, never record history/provenance/before-after, never enumerate call sites. `@param`/`@return` are contract and are in scope; `@param n The n` restates the name — omit it instead. Do not invent behavior: leave genuinely unclear contracts undocumented and list them. No TODO/placeholder text. {If --public-only: 'Only the public header surface; skip statics and internals.'} Report `{file, symbol, action}` plus a list of symbols needing manual review." **C++ — Use Task tool with subagent_type="system-developer:cpp-developer"** -Prompt: "Add or update Doxygen documentation for these C++ files: {file_list}. Existing dialect: {dialect}. Put blocks on declarations in headers. Document ownership and lifetime (who owns what, dangling traps for `string_view`/`span`), exception guarantees via `@throws`, template parameters via `@tparam`, const/thread-safety, and the return contract. CRITICAL — per `igrsoft:code-comment-standard`: document only the non-obvious WHY and the contract. Never restate what a line does, never record history/provenance/before-after, never enumerate call sites. `@param`/`@return`/`@throws` are contract and are in scope; a `@param` that restates the name is not — omit it. Do not invent behavior: leave unclear contracts undocumented and list them. No TODO/placeholder text. {If --public-only: 'Only the public/installed header surface.'} Report `{file, symbol, action}` plus symbols needing manual review." +Prompt: "Add or update Doxygen documentation for these C++ files: {file_list}. Existing dialect: {dialect}. Put blocks on declarations in headers. Document ownership and lifetime (who owns what, dangling traps for `string_view`/`span`), exception guarantees via `@throws`, template parameters via `@tparam`, const/thread-safety, and the return contract. CRITICAL — per `company-workflow:code-comment-standard`: document only the non-obvious WHY and the contract. Never restate what a line does, never record history/provenance/before-after, never enumerate call sites. `@param`/`@return`/`@throws` are contract and are in scope; a `@param` that restates the name is not — omit it. Do not invent behavior: leave unclear contracts undocumented and list them. No TODO/placeholder text. {If --public-only: 'Only the public/installed header surface.'} Report `{file, symbol, action}` plus symbols needing manual review." **Python — Use Task tool with subagent_type="system-developer:python-developer"** -Prompt: "Add or update PEP 257 docstrings for these Python files: {file_list}. The project already uses **{detected_style}** style — match it exactly; do NOT convert existing docstrings to another style. One-line imperative summary, blank line, discussion, then the structured section block. Document raised exceptions, side effects, argument mutation, and any non-obvious contract. Types live in annotations — do not repeat them in prose. Add module docstrings where missing so autodoc renders them. CRITICAL — per `igrsoft:code-comment-standard`: document only the non-obvious WHY and the contract. Never restate what a line does, never record history/provenance/before-after, never enumerate call sites. Docstring Args/Returns/Raises are contract and are in scope; an `Args:` entry that restates the parameter name is not — omit it. Do not invent behavior. No TODO/placeholder text. {If --public-only: 'Only public names (respect `__all__`); skip `_`-prefixed helpers.'} Report `{file, symbol, action}` plus symbols needing manual review." +Prompt: "Add or update PEP 257 docstrings for these Python files: {file_list}. The project already uses **{detected_style}** style — match it exactly; do NOT convert existing docstrings to another style. One-line imperative summary, blank line, discussion, then the structured section block. Document raised exceptions, side effects, argument mutation, and any non-obvious contract. Types live in annotations — do not repeat them in prose. Add module docstrings where missing so autodoc renders them. CRITICAL — per `company-workflow:code-comment-standard`: document only the non-obvious WHY and the contract. Never restate what a line does, never record history/provenance/before-after, never enumerate call sites. Docstring Args/Returns/Raises are contract and are in scope; an `Args:` entry that restates the parameter name is not — omit it. Do not invent behavior. No TODO/placeholder text. {If --public-only: 'Only public names (respect `__all__`); skip `_`-prefixed helpers.'} Report `{file, symbol, action}` plus symbols needing manual review." **Bash — Use Task tool with subagent_type="system-developer:bash-developer"** -Prompt: "Add or update documentation comments for these shell scripts: {file_list}. Every script gets a header below the shebang with Purpose, Usage (real synopsis with flags), Exit codes (each distinct status and its meaning), and Requires (external commands). Every non-trivial function gets a contract comment: positional argument meaning, stdout contract, return status, and globals read or mutated. CRITICAL — per `igrsoft:code-comment-standard`: document only the non-obvious WHY and the contract. Never narrate the body, never record history/provenance/before-after, never enumerate call sites. Usage/exit-code/argument contracts are in scope; `# loop over files` above a `for` is not — delete such comments when you find them. Do not invent exit codes the script cannot return. No TODO/placeholder text. Report `{file, function, action}` plus anything needing manual review." +Prompt: "Add or update documentation comments for these shell scripts: {file_list}. Every script gets a header below the shebang with Purpose, Usage (real synopsis with flags), Exit codes (each distinct status and its meaning), and Requires (external commands). Every non-trivial function gets a contract comment: positional argument meaning, stdout contract, return status, and globals read or mutated. CRITICAL — per `company-workflow:code-comment-standard`: document only the non-obvious WHY and the contract. Never narrate the body, never record history/provenance/before-after, never enumerate call sites. Usage/exit-code/argument contracts are in scope; `# loop over files` above a `for` is not — delete such comments when you find them. Do not invent exit codes the script cannot return. No TODO/placeholder text. Report `{file, function, action}` plus anything needing manual review." [SYNC POINT: Wait for all documenters before verification.] @@ -270,7 +270,7 @@ Apply `skill: language-detection` shebang/tie-break rules; if still ambiguous, r ## See Also -- `igrsoft:code-comment-standard` — the WHY/contract-only standard every comment written here must satisfy (no restated code, no history/provenance, no call-site enumeration). +- `company-workflow:code-comment-standard` — the WHY/contract-only standard every comment written here must satisfy (no restated code, no history/provenance, no call-site enumeration). - `skill: language-detection` — canonical marker → language → agent routing; keep the detection table in sync. - `skill: python-tooling` — uv/Sphinx environment setup for the Python doc build. - `skill: build-systems` — wiring a `docs` target into CMake or Meson so the doc build runs in CI. diff --git a/commands/review-code.md b/commands/review-code.md index 4769537..c0578e0 100644 --- a/commands/review-code.md +++ b/commands/review-code.md @@ -115,19 +115,19 @@ When `--quick` is set, skip the fan-out entirely: Launch every eligible reviewer **simultaneously** (one per detected language) plus the security pass. All are read-only and receive the same resolved file list. Each language reviewer gets a language-specific review focus: **C — Use Task tool with subagent_type="system-developer:c-developer"** -- Focus: buffer bounds and overflow, `malloc`/`free` ownership and double-free/use-after-free, unchecked allocation failure, `errno` handling and unchecked return values, integer overflow and signedness, format-string safety, undefined behavior, POSIX portability (GNU vs BSD), source-comment hygiene (comments that restate what the code does, narrate history/before-after context, or enumerate call sites; per `igrsoft:code-comment-standard`: WHY/contract only). +- Focus: buffer bounds and overflow, `malloc`/`free` ownership and double-free/use-after-free, unchecked allocation failure, `errno` handling and unchecked return values, integer overflow and signedness, format-string safety, undefined behavior, POSIX portability (GNU vs BSD), source-comment hygiene (comments that restate what the code does, narrate history/before-after context, or enumerate call sites; per `company-workflow:code-comment-standard`: WHY/contract only). - Prompt: "Read-only review of the C files: {file_list}. Review for: buffer bounds/overflow, malloc/free ownership (double-free, use-after-free, leaks on error paths), unchecked return values and errno, integer/signedness overflow, format-string safety, undefined behavior, and source-comment hygiene (flag comments that restate the code, narrate design history/before-after, or enumerate callers — WHY/contract-only standard). Do NOT edit any file. Return findings as a list of `{file, line, category, severity (P0-P3), why, fix, confidence}`. If there are no material issues, say so directly." **C++ — Use Task tool with subagent_type="system-developer:cpp-developer"** -- Focus: RAII and ownership (Rule of Zero/Five, naked `new`/`delete`, leaked resources on exception paths), dangling references (`string_view`/`span` outliving its backing store), exception safety (basic/strong/nothrow guarantees), move/copy correctness, const-correctness, lifetime/iterator invalidation, undefined behavior, source-comment hygiene (comments that restate what the code does, narrate history/before-after context, or enumerate call sites; per `igrsoft:code-comment-standard`: WHY/contract only). +- Focus: RAII and ownership (Rule of Zero/Five, naked `new`/`delete`, leaked resources on exception paths), dangling references (`string_view`/`span` outliving its backing store), exception safety (basic/strong/nothrow guarantees), move/copy correctness, const-correctness, lifetime/iterator invalidation, undefined behavior, source-comment hygiene (comments that restate what the code does, narrate history/before-after context, or enumerate call sites; per `company-workflow:code-comment-standard`: WHY/contract only). - Prompt: "Read-only review of the C++ files: {file_list}. Review for: RAII/ownership (Rule of Zero/Five, naked new/delete, leaks on exception paths), dangling references (string_view/span lifetime traps), exception safety guarantees, move/copy correctness, const-correctness, iterator/lifetime invalidation, undefined behavior, and source-comment hygiene (flag comments that restate the code, narrate design history/before-after, or enumerate callers — WHY/contract-only standard). Do NOT edit any file. Return findings as a list of `{file, line, category, severity (P0-P3), why, fix, confidence}`. If there are no material issues, say so directly." **Python — Use Task tool with subagent_type="system-developer:python-developer"** -- Focus: type-annotation correctness and `Any` leaks, async misuse (blocking calls in coroutines, unawaited coroutines, fire-and-forget `create_task` without a reference, `gather` vs `TaskGroup`), resource handling (unclosed files/sockets, missing context managers), mutable default arguments, broad `except:`/swallowed exceptions, error propagation, source-comment hygiene (comments that restate what the code does, narrate history/before-after context, or enumerate call sites; per `igrsoft:code-comment-standard`: WHY/contract only). +- Focus: type-annotation correctness and `Any` leaks, async misuse (blocking calls in coroutines, unawaited coroutines, fire-and-forget `create_task` without a reference, `gather` vs `TaskGroup`), resource handling (unclosed files/sockets, missing context managers), mutable default arguments, broad `except:`/swallowed exceptions, error propagation, source-comment hygiene (comments that restate what the code does, narrate history/before-after context, or enumerate call sites; per `company-workflow:code-comment-standard`: WHY/contract only). - Prompt: "Read-only review of the Python files: {file_list}. Review for: typing correctness and Any leaks, async misuse (blocking calls in async code, unawaited coroutines, unreferenced create_task, gather-vs-TaskGroup), resource handling (unclosed files/sockets, missing context managers), mutable default arguments, broad/swallowed exceptions, error propagation, and source-comment hygiene (flag comments that restate the code, narrate design history/before-after, or enumerate callers — WHY/contract-only standard). Do NOT edit any file. Return findings as a list of `{file, line, category, severity (P0-P3), why, fix, confidence}`. If there are no material issues, say so directly." **Bash — Use Task tool with subagent_type="system-developer:bash-developer"** -- Focus: quoting (unquoted expansions, word-splitting/glob, SC2086), strict mode (`set -euo pipefail` and its honest caveats), command injection (`eval`, unsanitized input in commands, missing `--` separators), unsafe `PATH`/temp-file handling, portability (bashism vs POSIX, GNU vs BSD), exit-status handling, source-comment hygiene (comments that restate what the code does, narrate history/before-after context, or enumerate call sites; per `igrsoft:code-comment-standard`: WHY/contract only). +- Focus: quoting (unquoted expansions, word-splitting/glob, SC2086), strict mode (`set -euo pipefail` and its honest caveats), command injection (`eval`, unsanitized input in commands, missing `--` separators), unsafe `PATH`/temp-file handling, portability (bashism vs POSIX, GNU vs BSD), exit-status handling, source-comment hygiene (comments that restate what the code does, narrate history/before-after context, or enumerate call sites; per `company-workflow:code-comment-standard`: WHY/contract only). - Prompt: "Read-only review of the shell scripts: {file_list}. Review for: quoting/word-splitting (SC2086 and friends), strict mode and its caveats, command injection (eval, unsanitized input, missing `--` separators), unsafe PATH/temp-file handling, portability (bashisms, GNU vs BSD), exit-status handling, and source-comment hygiene (flag comments that restate the code, narrate design history/before-after, or enumerate callers — WHY/contract-only standard). Do NOT edit any file. Return findings as a list of `{file, line, category, severity (P0-P3), why, fix, confidence}`. If there are no material issues, say so directly." **Security pass (always, unless `--quick`) — Use Task tool with subagent_type="system-developer:sys-security-auditor"** @@ -139,7 +139,7 @@ Launch every eligible reviewer **simultaneously** (one per detected language) pl 1. **Collect** every reviewer's findings (language reviewers + security pass). 2. **Deduplicate** — the security pass and a language reviewer will overlap (e.g. both flag a buffer overflow). Merge duplicates at the same `{file, line}`, keeping the higher severity and the clearer fix; credit both lenses in `why`. -3. **Filter** — drop speculative claims with no concrete evidence and drop pure style nits unless they hide a real defect. Per Rule 7, do not backfill. Source-comment hygiene findings from the language reviewers are not pure style nits — preserve them: they flag comments violating `igrsoft:code-comment-standard` (WHY/contract-only; no restated code, design history/before-after, or call-site enumeration). +3. **Filter** — drop speculative claims with no concrete evidence and drop pure style nits unless they hide a real defect. Per Rule 7, do not backfill. Source-comment hygiene findings from the language reviewers are not pure style nits — preserve them: they flag comments violating `company-workflow:code-comment-standard` (WHY/contract-only; no restated code, design history/before-after, or call-site enumeration). 4. **Normalize** every survivor to `{file, line, category, severity, why, fix, confidence}` (severity from `skill: severity-matrix` P0-P3; confidence = high/medium/low). 5. **Rank** into P0-P3. With `--security-focus`, security findings win severity ties. 6. **Emit** the Output Format report. @@ -241,7 +241,7 @@ If detection cannot classify a file (e.g. extensionless), apply `skill: language - `skill: language-detection` — canonical marker → language → agent routing (keep this command's detection in sync). - `skill: severity-matrix` — P0-P3 definitions used by the synthesis ranking. - `skill: secure-coding` — input-validation and injection patterns the security pass draws on. -- `igrsoft:code-comment-standard` — the compact code-documentation standard the language reviewers check source comments against (WHY/contract-only; no design provenance/history/call-site enumeration). +- `company-workflow:code-comment-standard` — the compact code-documentation standard the language reviewers check source comments against (WHY/contract-only; no design provenance/history/call-site enumeration). - `/system-developer:fix-quick` — run formatters/linters first to clear P3 noise before review. - `/system-developer:build-test` — confirm the change builds and tests green before or after review. - `/system-developer:sanitize-check` — escalate a memory/UB finding to ASan/UBSan/TSan confirmation. diff --git a/hooks/README.md b/hooks/README.md index c74ede2..a08a0f5 100644 --- a/hooks/README.md +++ b/hooks/README.md @@ -3,7 +3,7 @@ Plugin-scoped hook scripts (added v1.0.0). They give system-developer agents their own audit trail and pre-compaction checkpoint when the plugin runs **standalone** — and degrade cleanly to *advisory* rows when system-developer -agents run as subagents under the **igrsoft** orchestrator. +agents run as subagents under the **company-workflow** orchestrator. | Script | Event | Purpose | |--------|-------|---------| @@ -13,15 +13,15 @@ agents run as subagents under the **igrsoft** orchestrator. ## Advisory / dedup contract (CRITICAL) -system-developer specialists are spawned **as subagents under igrsoft's +system-developer specialists are spawned **as subagents under company-workflow's orchestrator**, whose own hooks (`hooks/audit-tooluse.sh`, `hooks/audit-subagent.sh`) fire for the same events. To avoid double-counting: - Every row written here carries `metadata.advisory: true`. -- Rows share the **same `metadata.dedupe_key`** shape as igrsoft +- Rows share the **same `metadata.dedupe_key`** shape as company-workflow (`:` for tools, `::stop` for subagents) plus `dedupe_key_extended` (parent_agent_id-prefixed). -- igrsoft's `hooks/audit-dedup.sh` keeps the **orchestrator** row authoritative +- company-workflow's `hooks/audit-dedup.sh` keeps the **orchestrator** row authoritative and drops the advisory duplicate. Readers prefer `actor: "hook:*"` over `actor: "system-developer:hook:*"` when `dedupe_key` collides. diff --git a/hooks/audit-subagent.sh b/hooks/audit-subagent.sh index c98a3eb..a91480b 100755 --- a/hooks/audit-subagent.sh +++ b/hooks/audit-subagent.sh @@ -2,13 +2,13 @@ # SubagentStop → audit.jsonl writer (system-developer plugin, v1.0.0+). # Emits a `subagent_stopped` row with actor "system-developer:hook:audit-subagent". # -# ADVISORY ROW: system-developer specialists run as subagents under the igrsoft +# ADVISORY ROW: system-developer specialists run as subagents under the company-workflow # orchestrator, whose SubagentStop hook also fires. To avoid double-counting, -# igrsoft's rows are authoritative; these carry metadata.advisory=true and a -# matching metadata.dedupe_key ("::stop") so igrsoft's +# company-workflow's rows are authoritative; these carry metadata.advisory=true and a +# matching metadata.dedupe_key ("::stop") so company-workflow's # audit-dedup.sh keeps the orchestrator row and drops this one. Standalone -# (no igrsoft) these rows stand alone. This hook NEVER touches state.json — -# state.json merge is orchestrator-owned (igrsoft's state-merge.sh). +# (no company-workflow) these rows stand alone. This hook NEVER touches state.json — +# state.json merge is orchestrator-owned (company-workflow's state-merge.sh). set -eu SELF_TEST=0 diff --git a/hooks/audit-tooluse.sh b/hooks/audit-tooluse.sh index ccd153b..7c458eb 100755 --- a/hooks/audit-tooluse.sh +++ b/hooks/audit-tooluse.sh @@ -4,11 +4,11 @@ # effort.level, session_id) and appends one row to .context/logs/audit.jsonl # with actor "system-developer:hook:audit-tooluse". # -# ADVISORY ROW: system-developer agents run as subagents under the igrsoft -# orchestrator. When igrsoft's own hooks are active, its rows are authoritative +# ADVISORY ROW: system-developer agents run as subagents under the company-workflow +# orchestrator. When company-workflow's own hooks are active, its rows are authoritative # and these are advisory — the shared metadata.dedupe_key (": -# ") lets igrsoft's audit-dedup.sh reconcile the two. When -# system-developer runs standalone (no igrsoft), these rows stand alone. +# ") lets company-workflow's audit-dedup.sh reconcile the two. When +# system-developer runs standalone (no company-workflow), these rows stand alone. # # Self-test: pass --self-test to feed a synthetic fixture and assert schema. set -eu diff --git a/hooks/precompact-checkpoint.sh b/hooks/precompact-checkpoint.sh index 06e80b2..c5457c7 100755 --- a/hooks/precompact-checkpoint.sh +++ b/hooks/precompact-checkpoint.sh @@ -5,7 +5,7 @@ # Pairs with the PostCompact recovery prose in # skills/_shared/workflow-integration/references/stage-details.md. # -# When igrsoft is the orchestrator it owns state.json and runs its own +# When company-workflow is the orchestrator it owns state.json and runs its own # precompact hook; this checkpoint is harmless and idempotent (timestamped # copy). Exit code is always 0 — never blocks compaction. set -eu diff --git a/scripts/validate.sh b/scripts/validate.sh index 1957adc..b7dd3a6 100755 --- a/scripts/validate.sh +++ b/scripts/validate.sh @@ -343,8 +343,8 @@ shopt -s nullglob for f in "${HOME}"/.claude/plugins/cache/*/*/*/agents/*.md; do collect_external "${f}" done -if [[ -n "${IGRSOFT_WORKFLOW_DIR:-}" && -d "${IGRSOFT_WORKFLOW_DIR}/agents" ]]; then - for f in "${IGRSOFT_WORKFLOW_DIR}/agents"/*.md; do +if [[ -n "${COMPANY_WORKFLOW_DIR:-}" && -d "${COMPANY_WORKFLOW_DIR}/agents" ]]; then + for f in "${COMPANY_WORKFLOW_DIR}/agents"/*.md; do collect_external "${f}" done fi @@ -398,7 +398,7 @@ fi # --------------------------------------------------------------------------- # Allowed plugin prefixes for subagent_type values. -ALLOWED_PREFIX_RE='^(system-developer|igrsoft|security-scanning|debugging-toolkit|general-purpose)' +ALLOWED_PREFIX_RE='^(system-developer|company-workflow|security-scanning|debugging-toolkit|general-purpose)' check_subagent_refs() { # check_subagent_refs @@ -416,7 +416,7 @@ check_subagent_refs() { esac # Prefix whitelist. if [[ ! "${st}" =~ ${ALLOWED_PREFIX_RE} ]]; then - err "${rel}" "subagent_type '${st}' has a disallowed plugin prefix" "use system-developer:/igrsoft:/security-scanning:/debugging-toolkit:/general-purpose:" + err "${rel}" "subagent_type '${st}' has a disallowed plugin prefix" "use system-developer:/company-workflow:/security-scanning:/debugging-toolkit:/general-purpose:" continue fi # Own-plugin targets must exist as agent files. diff --git a/skills/SKILL.md b/skills/SKILL.md index dfced19..5478789 100644 --- a/skills/SKILL.md +++ b/skills/SKILL.md @@ -58,7 +58,7 @@ than trusting memory. | Picking a sanitizer/debugger/profiler for a symptom | [tooling/diagnostics/SKILL.md](tooling/diagnostics/SKILL.md) | | Binding C/C++ to Python or designing an ABI boundary | [tooling/ffi-interop/SKILL.md](tooling/ffi-interop/SKILL.md) | | Reviewing untrusted input, subprocess calls, or secrets | [_shared/secure-coding/SKILL.md](_shared/secure-coding/SKILL.md) | -| Participating in an igrsoft workflow stage | [_shared/workflow-integration/SKILL.md](_shared/workflow-integration/SKILL.md) | +| Participating in a company-workflow workflow stage | [_shared/workflow-integration/SKILL.md](_shared/workflow-integration/SKILL.md) | | Confirming a feature is available on a toolchain | [_shared/version-feature-matrix.md](_shared/version-feature-matrix.md) | | Routing a file or repo to the right agent | [_shared/language-detection.md](_shared/language-detection.md) | @@ -156,7 +156,7 @@ Cross-cutting patterns used by every agent, command, and skill. | Skill | Path | Description | |-------|------|-------------| | **secure-coding** | [_shared/secure-coding/SKILL.md](_shared/secure-coding/SKILL.md) | Non-negotiable security rules and bug-class defenses for C, C++, Python, Bash | -| **workflow-integration** | [_shared/workflow-integration/SKILL.md](_shared/workflow-integration/SKILL.md) | Integrating with the igrsoft 11-stage workflow system (v3.36.0) | +| **workflow-integration** | [_shared/workflow-integration/SKILL.md](_shared/workflow-integration/SKILL.md) | Integrating with the company-workflow 11-stage workflow system (v4.0.0) | | version-feature-matrix | [_shared/version-feature-matrix.md](_shared/version-feature-matrix.md) | Standards/versions → minimum toolchains + headline features (canonical) | | language-detection | [_shared/language-detection.md](_shared/language-detection.md) | Marker → language → agent routing table | | model-selection | [_shared/model-selection.md](_shared/model-selection.md) | Per-agent model/effort/maxTurns assignments | @@ -198,5 +198,5 @@ toolchain before relying on a feature. - [`_shared/version-feature-matrix.md`](_shared/version-feature-matrix.md) — canonical version/toolchain lookup - [`_shared/language-detection.md`](_shared/language-detection.md) — file/repo → agent routing -- [`_shared/workflow-integration/SKILL.md`](_shared/workflow-integration/SKILL.md) — igrsoft 11-stage integration +- [`_shared/workflow-integration/SKILL.md`](_shared/workflow-integration/SKILL.md) — company-workflow 11-stage integration - [`_index.md`](_index.md) — full navigation index of every skill directory diff --git a/skills/_index.md b/skills/_index.md index 0206f56..7e4eda3 100644 --- a/skills/_index.md +++ b/skills/_index.md @@ -23,7 +23,7 @@ at [`SKILL.md`](SKILL.md) for the routing entry point. | Skill | Path | Description | |-------|------|-------------| | **secure-coding** | [`_shared/secure-coding/SKILL.md`](_shared/secure-coding/SKILL.md) | Non-negotiable security rules and bug-class defenses for C, C++, Python, and Bash — injection-safe process execution, memory-corruption sanitizer mapping, integer safety, path-traversal/TOCTOU resistance, secrets hygiene | -| **workflow-integration** | [`_shared/workflow-integration/SKILL.md`](_shared/workflow-integration/SKILL.md) | Guide for integrating with the igrsoft 11-stage workflow system (v3.36.0) | +| **workflow-integration** | [`_shared/workflow-integration/SKILL.md`](_shared/workflow-integration/SKILL.md) | Guide for integrating with the company-workflow 11-stage workflow system (v4.0.0) | | version-feature-matrix | [`_shared/version-feature-matrix.md`](_shared/version-feature-matrix.md) | Standards/versions → minimum toolchains and headline features (canonical lookup) | | language-detection | [`_shared/language-detection.md`](_shared/language-detection.md) | Marker → language → agent routing table, detection priority, tie-breaking | | model-selection | [`_shared/model-selection.md`](_shared/model-selection.md) | Per-agent model/effort/maxTurns assignments and opus+xhigh override paths | diff --git a/skills/_shared/_index.md b/skills/_shared/_index.md index f4b4214..b2ffb6b 100644 --- a/skills/_shared/_index.md +++ b/skills/_shared/_index.md @@ -6,7 +6,7 @@ Quick navigation for cross-cutting references shared by all system-developer age | File | Description | |------|-------------| -| `workflow-integration/SKILL.md` | Guide for integrating with igrsoft 11-stage workflow system (v3.36.0) — DV/DR/QA contracts, screenshot cli-fallback, gate feedback | +| `workflow-integration/SKILL.md` | Guide for integrating with company-workflow 11-stage workflow system (v4.0.0) — DV/DR/QA contracts, screenshot cli-fallback, gate feedback | | `workflow-integration/templates/dv-development.md` | Copy-paste `development-N.md` artifact template (Build Evidence, anchors, frontmatter) | | `workflow-integration/templates/dr-review.md` | Copy-paste `developer-review-N.md` template with systems review checklist | | `workflow-integration/templates/qa-testing.md` | Copy-paste `testing-N.md` template with sanitizer-gate evidence | @@ -33,7 +33,7 @@ Quick navigation for cross-cutting references shared by all system-developer age ### "I need to..." -- **Integrate with igrsoft worktask** → `workflow-integration/SKILL.md` +- **Integrate with company-workflow worktask** → `workflow-integration/SKILL.md` - **Write a DV/DR/QA stage artifact** → `workflow-integration/templates/` - **Handle the screenshot gate for CLI work** → `workflow-integration/SKILL.md § Screenshot Gate for CLI Work` - **Route a file/repo to the right agent** → `language-detection.md` diff --git a/skills/_shared/language-detection.md b/skills/_shared/language-detection.md index d1d62bd..f3006bb 100644 --- a/skills/_shared/language-detection.md +++ b/skills/_shared/language-detection.md @@ -5,7 +5,7 @@ description: Shared marker-to-language-to-agent routing table for system-develop # Language Detection & Agent Routing -Single source of truth for the marker → language → agent mapping used by `system-developer` (router), `igrsoft:developer`, and every command that scopes work per language. Keep command-local detection logic in sync with this file — do not fork the table. +Single source of truth for the marker → language → agent mapping used by `system-developer` (router), `company-workflow:developer`, and every command that scopes work per language. Keep command-local detection logic in sync with this file — do not fork the table. ## Detection Priority Order diff --git a/skills/_shared/model-selection.md b/skills/_shared/model-selection.md index 0a03aea..cdc540b 100644 --- a/skills/_shared/model-selection.md +++ b/skills/_shared/model-selection.md @@ -6,7 +6,7 @@ effort: low # Model & Effort Selection (system-developer) -Companion to igrsoft's `skills/shared/model-selection.md`. This file pins the +Companion to company-workflow's `skills/shared/model-selection.md`. This file pins the **system-developer** per-agent assignments and the override paths the language agents expose. Frontmatter in `agents/*.md` is the source of truth — keep this table in sync with it. diff --git a/skills/_shared/workflow-integration/SKILL.md b/skills/_shared/workflow-integration/SKILL.md index e9fb16a..26613dd 100644 --- a/skills/_shared/workflow-integration/SKILL.md +++ b/skills/_shared/workflow-integration/SKILL.md @@ -1,11 +1,11 @@ --- name: workflow-integration -description: Guide for integrating with igrsoft 11-stage workflow system (v3.36.0). Use when participating in structured workflow stages. +description: Guide for integrating with company-workflow 11-stage workflow system (v4.0.0). Use when participating in structured workflow stages. --- # Workflow Integration Guide -When invoked from the igrsoft workflow system, follow these guidelines for seamless collaboration. +When invoked from the company-workflow workflow system, follow these guidelines for seamless collaboration. ## 11-Stage Pipeline (Default) @@ -15,7 +15,7 @@ PL → AR → TL → DV → DR → SR → QA → DC → RE → FN → ST system-developer agents contribute to AR, DV, DR, SR, QA, and RE ``` -| Code | Stage | igrsoft Agent | system-developer Contribution | +| Code | Stage | company-workflow Agent | system-developer Contribution | |------|-------|---------------|-------------------------------| | PL | Planning | product-manager | — | | AR | Architecture | software-architector | system-architector (consultation: layering, ownership models, API/ABI design) | @@ -29,9 +29,9 @@ PL → AR → TL → DV → DR → SR → QA → DC → RE → FN → ST | FN | Finalization | project-manager | — | | ST | Stakeholder | stakeholder | — | -## Worktask Invocation (v3.36.0) +## Worktask Invocation (v4.0.0) -Launch is **only** via the `/worktask` slash command (or `Skill igrsoft:worktask`) plus flags. Message-prefix triggers (`micro:`/`quick:`/`worktask:`/`fworktask:`/`emergency:`) are **removed**. PL0 dynamic sizing selects which of the 9 stages run. +Launch is **only** via the `/worktask` slash command (or `Skill company-workflow:worktask`) plus flags. Message-prefix triggers (`micro:`/`quick:`/`worktask:`/`fworktask:`/`emergency:`) are **removed**. PL0 dynamic sizing selects which of the 9 stages run. | Flag | Effect | |------|--------| @@ -57,7 +57,7 @@ system-developer agents are **invoked specialists that run between the gates** ## DV Contract for Systems Work -The DV agent writes `.context/development-N.md`. Mandatory H2 anchors are fixed by igrsoft's anchor allow-list (`handoff-protocol.md#anchor-allow-list`): `## files-changed`, `## tests-added`, `## deviations`, `## follow-ups`. Systems-specific sections nest as H3 under them: +The DV agent writes `.context/development-N.md`. Mandatory H2 anchors are fixed by company-workflow's anchor allow-list (`handoff-protocol.md#anchor-allow-list`): `## files-changed`, `## tests-added`, `## deviations`, `## follow-ups`. Systems-specific sections nest as H3 under them: | Section | Anchor level | Content | |---------|--------------|---------| @@ -79,13 +79,13 @@ Build Evidence is non-negotiable, but **which rows apply depends on the language Every language needs a toolchain line, its own gate result, and a transcript path; an artifact missing those is incomplete. Never demand a compiler line or a `-Wall -Wextra` count from a pure Python or Bash change, and never satisfy one by fabricating a value — record that language's row instead. Tee raw build/test output to `.context/logs/-.log`. -Source comments follow the compact code-documentation standard (`igrsoft:code-comment-standard` / igrsoft `skills/shared/code-documentation.md`): comment the non-obvious WHY and the contract only — never the WHAT, history, or call sites; rationale lives in the PR / `.context/development-N.md`. DR flags violations. +Source comments follow the compact code-documentation standard (`company-workflow:code-comment-standard` / company-workflow `skills/shared/code-documentation.md`): comment the non-obvious WHY and the contract only — never the WHAT, history, or call sites; rationale lives in the PR / `.context/development-N.md`. DR flags violations. Copy-paste template: [templates/dv-development.md](templates/dv-development.md). ## Screenshot Gate for CLI Work (HIGHEST INTEGRATION RISK — read this) -igrsoft's `dv-screenshot-gate.sh` blocks `SubagentStop` when `metadata.requires_screenshots != false` and no manifest exists at `.context/images//screenshots.md`. The igrsoft default is **TRUE** — but systems/CLI work has no UI to screenshot. Handle it in this order: +company-workflow's `dv-screenshot-gate.sh` blocks `SubagentStop` when `metadata.requires_screenshots != false` and no manifest exists at `.context/images//screenshots.md`. The company-workflow default is **TRUE** — but systems/CLI work has no UI to screenshot. Handle it in this order: 1. **Preferred**: the dispatcher sets `metadata.requires_screenshots: false` for system-developer DV stages (non-UI changes). Then no manifest is required and the gate is skipped. Plugin norm: `requires_screenshots: false` is the **default expectation** for systems work — flag it in your return summary if the metadata says otherwise. 2. **cli-fallback procedure** (when the flag is unset/true and you cannot change it): produce the manifest anyway using terminal transcripts — @@ -93,11 +93,11 @@ igrsoft's `dv-screenshot-gate.sh` blocks `SubagentStop` when `metadata.requires_ - Write `.context/images//screenshots.md` with one row per capture, `source: cli-fallback`, and a `notes` cell explaining why (e.g. "CLI tool, no UI; transcript capture"). - Frontmatter `screenshot_count` MUST equal the number of table rows. 3. **Never** fabricate image files or return without either the `false` flag or a cli-fallback manifest — the gate re-dispatches DV until one exists. -4. **Evidence freshness**: every `cli-fallback` transcript row must be produced *this run* from the actual build/test invocation — never reuse a transcript from a prior run or another workdir. igrsoft QA direct-reads the evidence files and cross-checks them against the log paths recorded in the DV artifact's `### build-evidence` section; a stale or duplicated transcript is flagged and re-opens DV. This is the text-evidence corollary of rule 3 — the "never fabricate" integrity bar applies to reused transcripts as much as to invented image files. +4. **Evidence freshness**: every `cli-fallback` transcript row must be produced *this run* from the actual build/test invocation — never reuse a transcript from a prior run or another workdir. company-workflow QA direct-reads the evidence files and cross-checks them against the log paths recorded in the DV artifact's `### build-evidence` section; a stale or duplicated transcript is flagged and re-opens DV. This is the text-evidence corollary of rule 3 — the "never fabricate" integrity bar applies to reused transcripts as much as to invented image files. -Manifest row format mirrors igrsoft's `dv-screenshot-capture` output: `| name | path | source | design_ref | notes |` with `source` ∈ {`cli-fallback`} for systems work; `design_ref` stays blank (no mockups for CLI). +Manifest row format mirrors company-workflow's `dv-screenshot-capture` output: `| name | path | source | design_ref | notes |` with `source` ∈ {`cli-fallback`} for systems work; `design_ref` stays blank (no mockups for CLI). -`ui_visual_check` (the v3.36.0 DV metadata contract field) is **not applicable** to systems/CLI work — leave it `false`; it gates live-driven UI-capture provenance on UI platforms, which have no analog here. +`ui_visual_check` (the v4.0.0 DV metadata contract field) is **not applicable** to systems/CLI work — leave it `false`; it gates live-driven UI-capture provenance on UI platforms, which have no analog here. ## Per-Agent Error Files @@ -125,7 +125,7 @@ technical-lead reads `development-N.md` + error files and produces `developer-re | Error-handling discipline | No bare `except:` (Python); no swallowed `errno` / unchecked return values (C); `set -euo pipefail` present and its caveats handled (Bash); no `\|\| true` masking failures | | Unsafe constructs | `strcpy`/`strcat`/`sprintf`/`gets` (C); `eval`, unquoted expansions (Bash); `pickle.loads` on untrusted data, `subprocess(..., shell=True)`, `yaml.load` without `SafeLoader` (Python); `system()` with user input | | Build hygiene | 0 warnings at `-Wall -Wextra` (ruff/shellcheck clean for Python/Bash); no committed build artifacts; lockfiles updated with manifest changes; `compile_commands.json` regenerated when targets change | -| Comment hygiene | Comments follow the compact code-documentation standard (`igrsoft:code-comment-standard`): WHY/contract only, no design provenance, history, or call-site enumeration; no restated code | +| Comment hygiene | Comments follow the compact code-documentation standard (`company-workflow:code-comment-standard`): WHY/contract only, no design provenance, history, or call-site enumeration; no restated code | Template: [templates/dr-review.md](templates/dr-review.md). @@ -140,12 +140,12 @@ sys-test-generator supports QA with framework-native generation (GoogleTest/Catc ## SR and RE Contributions -- **SR** — sys-security-auditor provides platform context to igrsoft's security-reviewer: sanitizer evidence, CWE Top 25 mapping, injection review (command/SQL/path/format-string), secrets scan, supply-chain audit (`pip-audit`, `osv-scanner`), hardening flags (`-D_FORTIFY_SOURCE=3`, RELRO, PIE — verified via `checksec`/`readelf`/`otool`). Review-only: findings route to sys-code-fixer for application. +- **SR** — sys-security-auditor provides platform context to company-workflow's security-reviewer: sanitizer evidence, CWE Top 25 mapping, injection review (command/SQL/path/format-string), secrets scan, supply-chain audit (`pip-audit`, `osv-scanner`), hardening flags (`-D_FORTIFY_SOURCE=3`, RELRO, PIE — verified via `checksec`/`readelf`/`otool`). Review-only: findings route to sys-code-fixer for application. - **RE** — release-engineer owns the stage; system-developer contributes packaging: sys-dependency-manager freezes lockfiles/pins (vcpkg baselines, Conan lockfiles, `uv.lock`), and the language agents produce release artifacts (tarballs, wheels/sdists via `uv build`, version bumps, changelog entries) recorded in `release-N.md`. -## Artifact Filename Contract (v3.36.0) +## Artifact Filename Contract (v4.0.0) -**Numbered `-N.md` names are canonical** per igrsoft's authoritative `handoff-protocol.md#stage-artifact-map`. N is allocated by PL0 (same value as `planning-N.md`), shared across all stages within a run, and propagated via `task.metadata.run_index`; it bumps on gate loop-back re-dispatch. Readers fall back to newest-glob (`-*.md`). +**Numbered `-N.md` names are canonical** per company-workflow's authoritative `handoff-protocol.md#stage-artifact-map`. N is allocated by PL0 (same value as `planning-N.md`), shared across all stages within a run, and propagated via `task.metadata.run_index`; it bumps on gate loop-back re-dispatch. Readers fall back to newest-glob (`-*.md`). | Stage | Artifact | Owner | |-------|----------|-------| @@ -165,7 +165,7 @@ sys-test-generator supports QA with framework-native generation (GoogleTest/Catc **Emit `handoff:` frontmatter unconditionally — it is the merge input regardless of filename.** state.json reconciliation is three-layered: Layer 1 (agent runs `state-patch.sh --stage --prev ` when its path is supplied, else skips — never a hand-rolled `jq`/manual merge), Layer 2 (orchestrator re-reads artifact frontmatter after `Task()` returns), Layer 3 (`SubagentStop` hook auto-merge). Attempt Layer 1; if the script or its path is absent, proceed — Layers 2 and 3 repair from frontmatter. An artifact without `handoff:` YAML breaks the safety net (degrades to F3 fallback: orchestrator derives a minimal handoff and logs WARN). -## Handoff Frontmatter (v3.36.0 schema) +## Handoff Frontmatter (v4.0.0 schema) Every stage artifact MUST start with a YAML block between `---` markers. Budgets: ≤200 tokens, ≤30 lines. Base required fields: `stage`, `verdict`, `summary` (≤200 chars), `refs`. Per-stage additions (from `handoff-protocol.md#frontmatter-schema`): @@ -177,9 +177,9 @@ Every stage artifact MUST start with a YAML block between `---` markers. Budgets `key_decisions[].anchor` and `refs.*` MUST resolve to a real `## ` heading in the target file (anchor-lint enforces this at DR and via PostToolUse hook). Copy-paste blocks: `templates/` in this directory. -## Gate-Feedback Contract (v3.36.0) +## Gate-Feedback Contract (v4.0.0) -When DR returns `verdict: fail` or QA returns `verdict: no-go`, the orchestrator re-dispatches DV (`run_index` bumped, `retry_count`++) and carries the upstream remediation **verbatim** into the retry prompt (igrsoft `worktask/SKILL.md` step 4.6). system-developer agents **consume** this contract; the injection is orchestrator-owned. +When DR returns `verdict: fail` or QA returns `verdict: no-go`, the orchestrator re-dispatches DV (`run_index` bumped, `retry_count`++) and carries the upstream remediation **verbatim** into the retry prompt (company-workflow `worktask/SKILL.md` step 4.6). system-developer agents **consume** this contract; the injection is orchestrator-owned. | Surface | Mechanism | system-developer action | |---------|-----------|-------------------------| @@ -199,8 +199,8 @@ All Task delegations MUST use the fully-qualified `plugin:agent` form: | Form | Status | |------|--------| | `system-developer:cpp-developer` | Required | -| `igrsoft:technical-lead` | Required | -| `cpp-developer` (bare) | Deprecated — back-compat shim prepends `igrsoft:` and logs a warning (would resolve to the wrong plugin) | +| `company-workflow:technical-lead` | Required | +| `cpp-developer` (bare) | Deprecated — back-compat shim prepends `company-workflow:` and logs a warning (would resolve to the wrong plugin) | Task metadata carries qualified names: @@ -219,10 +219,10 @@ Task metadata carries qualified names: ## Token Budgets -- **Incoming compressed context** (from igrsoft): 300-500 tokens (planning summary 300, architecture summary 300, development handoff 500) +- **Incoming compressed context** (from company-workflow): 300-500 tokens (planning summary 300, architecture summary 300, development handoff 500) - **Full stage output**: write to `.context/-N.md` (no token cap) - **Outgoing return summary**: 500 tokens max (for the orchestrator) -- **Inter-stage handoffs**: DV→DR 300, DR→QA 300 (`igrsoft:context-compression § Context Budget by Handoff`) +- **Inter-stage handoffs**: DV→DR 300, DR→QA 300 (`company-workflow:context-compression § Context Budget by Handoff`) ## Detecting Workflow Context @@ -232,7 +232,7 @@ Task metadata carries qualified names: 4. **Architecture document**: newest `.context/analyzing-*.md` — or the anchors named in upstream `next_stage_focus`. 5. **Task System**: TaskList/TaskGet; inspect `task.metadata.{plan_file, agent, model, run_index, error_file, gate_from_stage, gate_blockers, requires_screenshots, workspace_path}`. -## Dynamic Worktask Sizing (v3.36.0) +## Dynamic Worktask Sizing (v4.0.0) PL0 assesses complexity (0-50) and creates only the stages needed: @@ -246,7 +246,7 @@ PL0 assesses complexity (0-50) and creates only the stages needed: Security-sensitive features (authentication, payment, PII, cryptography, secrets, file uploads) auto-include SR0 regardless of score. -PL0 stamps `metadata.skipped_stages = [{stage, reason}]` for every stage dropped from the full 9-stage pipeline (PL→AR→TL→DV→DR→QA→DC→FN→ST), so `state.json` self-documents the drops. It also stamps `metadata.test_mode` (`build-only` / `scoped` / `full` — defaulted by score and marker coverage) and `metadata.ui_visual_check` (the UI-capture provenance gate, left `false` for systems/CLI work). The stage table above, the `test_mode` defaults, and these stamps are all defined by igrsoft `estimation-methodology § PL0 Stage-Set` (the source of truth) — keep them in lockstep with it so the next sync is a mechanical copy. +PL0 stamps `metadata.skipped_stages = [{stage, reason}]` for every stage dropped from the full 9-stage pipeline (PL→AR→TL→DV→DR→QA→DC→FN→ST), so `state.json` self-documents the drops. It also stamps `metadata.test_mode` (`build-only` / `scoped` / `full` — defaulted by score and marker coverage) and `metadata.ui_visual_check` (the UI-capture provenance gate, left `false` for systems/CLI work). The stage table above, the `test_mode` defaults, and these stamps are all defined by company-workflow `estimation-methodology § PL0 Stage-Set` (the source of truth) — keep them in lockstep with it so the next sync is a mechanical copy. ## MCP Dynamic Inheritance @@ -256,16 +256,16 @@ Subagents inherit the parent session's MCP tools (Context7, Ref, etc.). Do not r If no workflow context is detected (no `.context/`, no task metadata), proceed with standard implementation: follow the language skills, run the same build/test/sanitizer discipline, and report results directly — no artifacts or frontmatter required. -## Related Skills (igrsoft plugin) +## Related Skills (company-workflow plugin) | Skill | Purpose | |-------|---------| -| `igrsoft:worktask` | Complete worktask system documentation | -| `igrsoft:cross-plugin-handoff` | Handoff protocol between plugins | -| `igrsoft:agent-coordination` | Multi-agent coordination patterns | -| `igrsoft:context-compression` | Token budgets and compression techniques | -| `igrsoft:security-review-process` | SR stage OWASP checklists | -| `igrsoft:release-engineering` | RE stage versioning patterns | +| `company-workflow:worktask` | Complete worktask system documentation | +| `company-workflow:cross-plugin-handoff` | Handoff protocol between plugins | +| `company-workflow:agent-coordination` | Multi-agent coordination patterns | +| `company-workflow:context-compression` | Token budgets and compression techniques | +| `company-workflow:security-review-process` | SR stage OWASP checklists | +| `company-workflow:release-engineering` | RE stage versioning patterns | ## Related Skills (system-developer plugin) diff --git a/skills/_shared/workflow-integration/templates/dr-review.md b/skills/_shared/workflow-integration/templates/dr-review.md index d8d9b6d..147b0ea 100644 --- a/skills/_shared/workflow-integration/templates/dr-review.md +++ b/skills/_shared/workflow-integration/templates/dr-review.md @@ -1,6 +1,6 @@ # DR Stage Artifact Template (systems review) -Primary artifact `.context/developer-review-N.md` is owned by igrsoft's technical-lead; use this when a system-developer agent takes over DR or contributes the review body. sys-code-fixer appends retry narratives to `.context/errors/sys-code-fixer.md` instead. +Primary artifact `.context/developer-review-N.md` is owned by company-workflow's technical-lead; use this when a system-developer agent takes over DR or contributes the review body. sys-code-fixer appends retry narratives to `.context/errors/sys-code-fixer.md` instead. ```markdown --- diff --git a/skills/_shared/workflow-integration/templates/dv-development.md b/skills/_shared/workflow-integration/templates/dv-development.md index da78f8b..783d4cc 100644 --- a/skills/_shared/workflow-integration/templates/dv-development.md +++ b/skills/_shared/workflow-integration/templates/dv-development.md @@ -1,6 +1,6 @@ # DV Stage Artifact Template (systems work) -Copy this to `.context/development-N.md` (`N` from `task.metadata.run_index`; e.g. `development-0.md`). H2 anchors are fixed by igrsoft's anchor allow-list — keep them exactly as written (kebab-case, H2); systems sections nest as H3. +Copy this to `.context/development-N.md` (`N` from `task.metadata.run_index`; e.g. `development-0.md`). H2 anchors are fixed by company-workflow's anchor allow-list — keep them exactly as written (kebab-case, H2); systems sections nest as H3. ```markdown --- @@ -74,6 +74,6 @@ handoff: - **Screenshots**: systems/CLI work defaults `metadata.requires_screenshots: false` — no manifest needed. If the flag is unset/true and cannot be changed, write a **cli-fallback** manifest at `.context/images//screenshots.md` (rows with `source: cli-fallback` pointing at terminal-transcript `.txt` files; `screenshot_count` = row count) before returning, or `dv-screenshot-gate.sh` blocks `SubagentStop`. See `workflow-integration/SKILL.md § Screenshot Gate for CLI Work`. - `remediation_consumed:` is populated only on a rework re-dispatch — list the `metadata.gate_blockers[]` strings (from the DR/QA gate) this run fixed. See `workflow-integration/SKILL.md § Gate-Feedback Contract`. - Frontmatter budget: ≤200 tokens, ≤30 lines. Emit it unconditionally — it is the state.json merge input regardless of filename. -- **state.json patch**: on completion run `state-patch.sh --stage DV --prev ` when its path is supplied (`task.metadata.state_patch_script`; ships under igrsoft `skills/worktask/scripts/`) to merge `stages.DV` + the `→DV` edge from this frontmatter; if the script/`jq`/`state.json` is absent, skip — never hand-roll the merge; Layers 2/3 repair from the frontmatter. See `workflow-integration/SKILL.md § Artifact Filename Contract`. +- **state.json patch**: on completion run `state-patch.sh --stage DV --prev ` when its path is supplied (`task.metadata.state_patch_script`; ships under company-workflow `skills/worktask/scripts/`) to merge `stages.DV` + the `→DV` edge from this frontmatter; if the script/`jq`/`state.json` is absent, skip — never hand-roll the merge; Layers 2/3 repair from the frontmatter. See `workflow-integration/SKILL.md § Artifact Filename Contract`. - Tee raw build/test output to `.context/logs/` — the Build Evidence transcript path must exist on disk. - **Build Evidence rows are per-language.** A pure Python or Bash change has no compiler and no `-Wall -Wextra` count; record the interpreter/shell version and the `ruff`/`shellcheck` result instead. Never fabricate a compiler row to fill the template. See `workflow-integration/SKILL.md § DV Contract for Systems Work`. diff --git a/skills/_shared/workflow-integration/templates/qa-testing.md b/skills/_shared/workflow-integration/templates/qa-testing.md index 00fa43d..b1319e9 100644 --- a/skills/_shared/workflow-integration/templates/qa-testing.md +++ b/skills/_shared/workflow-integration/templates/qa-testing.md @@ -1,6 +1,6 @@ # QA Stage Artifact Template (systems testing) -Primary artifact `.context/testing-N.md` is owned by igrsoft's qa-engineer; use this when sys-test-generator or a system-developer agent takes over QA or supplies the evidence body. +Primary artifact `.context/testing-N.md` is owned by company-workflow's qa-engineer; use this when sys-test-generator or a system-developer agent takes over QA or supplies the evidence body. ```markdown ---