Defame1297
c705a38809
Produces docs/notes/skill-implementation-workflow.md with agreed conventions for all Chunk 3 skill issues (0017–0028). Key decisions: - Per-skill process: source discovery (sub-agent) → source review with licence/security check (sub-agent) → conflict check vs constitution + factory principles (sub-agent) → synthesis grill → co-write iteratively - Bootstrap: write-eval (hand-written) → write-skill (hand-written) → write-docs (first factory-authored, phase 2 of 0018) → everything else - Upstream review changed from per-chunk-start to per-skill - `when:` and `references:` frontmatter fields added to authoring standard - Sub-agent usage prescribed as named steps in the workflow - HITL: human reviewed and approved conventions Updates: PRD implementation decisions; issues 0016–0028 with specific acceptance criteria; docs/spec/overview.md; ROADMAP Chunk 3 housekeeping note (bootstrap order, cadence, acceptance criteria status); CONTEXT.md Source field (per-skill cadence, references: companion field); LESSONS.md with three patterns from the grill session. Post-grill additions (same session): Step 6 (session handoff) added to the workflow; handoff section appended to issue 0016; handoff checklist item added to Chunk 3 closure issue (0028). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
65 lines
4.0 KiB
Markdown
65 lines
4.0 KiB
Markdown
# 0023 — Review skills + cliff.toml: code-review, security-review, pr-description, changelog-entry
|
|
|
|
**Type:** HITL
|
|
**Parent PRD:** `docs/prd/chunk-3-skills-library.md`
|
|
|
|
## What to build
|
|
|
|
The 4 review phase skills plus the `cliff.toml` changelog config. All skills are new. Authored via `write-skill` (0018), evals via `write-eval` (0017). `cliff.toml` is a deterministic config file added to the repo root (no skill implementation required for the config itself).
|
|
|
|
**Skills and trigger descriptions:**
|
|
|
|
| Flat name | Trigger description |
|
|
|---|---|
|
|
| `code-review` | Review this code, check this diff, pre-commit review |
|
|
| `security-review` | Security review, OWASP check, pre-merge security scan |
|
|
| `pr-description` | Write PR description, describe this change |
|
|
| `changelog-entry` | Write changelog entry, add to CHANGELOG, release notes |
|
|
|
|
**Key constraints per skill:**
|
|
- `code-review`: severity-rated findings (critical/high/low); auto-fixes obvious style issues; flags architectural concerns for human review
|
|
- `security-review`: OWASP LLM Top 10 + Agentic AI Top 10 for application code; AST03/04/06/07/09 categories for self-authored factory skills (AST01 excluded — requires attacker-controlled content, does not apply to self-authored skills); includes credential and licence checks
|
|
- `pr-description`: derives from diff; covers what changed, why, and what to review carefully
|
|
- `changelog-entry`: conventional changelog format; derives from PR description and diff; designed for git-cliff consumption
|
|
|
|
**cliff.toml:**
|
|
- Config file at repo root for git-cliff deterministic changelog generation
|
|
- Selected over release-please (GitHub-only, incompatible with Gitea) and conventional-changelog (Node.js dependency, less actively maintained)
|
|
- CI integration is Chunk 6; this issue only adds the config
|
|
|
|
## Implementation notes
|
|
|
|
Follow the per-skill workflow defined in `docs/notes/skill-implementation-workflow.md`.
|
|
|
|
**Known upstream sources to review:**
|
|
- `mattpocock/skills` — check for code-review or security-review skills
|
|
- `bmad-method/bmad-method` — BMAD reviewer and security role patterns
|
|
- OWASP LLM Top 10 (current published version) and Agentic AI Top 10 (current published version) as authoritative checklists for `security-review`
|
|
- OWASP Agentic Skills Top 10 (AST10) — incubator draft; use AST03/04/06/07/09 only for self-authored skills
|
|
- git-cliff documentation for `cliff.toml` format
|
|
|
|
## Acceptance criteria
|
|
|
|
- [ ] All 4 SKILL.md files exist at `.agents/skills/<skill-name>/SKILL.md`; `metadata.category: review`; authoring standard met
|
|
- [ ] `security-review` uses correct OWASP checklist per context (LLM Top 10 + Agentic AI Top 10 for app code; AST03/04/06/07/09 for self-authored factory skills)
|
|
- [ ] `changelog-entry` produces output compatible with git-cliff conventional format
|
|
- [ ] `cliff.toml` exists at repo root with conventional commits config; `git-cliff` runs against repo history without error
|
|
- [ ] `source:` fields populated for any adopted upstream content
|
|
- [ ] Each skill has a co-located eval at `.agents/evals/review/<skill-name>/eval.yaml` via `write-eval`
|
|
- [ ] `install.sh` deploys all 4 skills to `~/.agents/skills/`
|
|
- [ ] **HITL:** human runs behavioral test per skill
|
|
- [ ] **HITL:** human reviews each SKILL.md, eval, and cliff.toml before committing
|
|
- [ ] Per-skill process followed for all 4 skills: source discovery (sub-agent) → source review with licence/security check (sub-agent) → conflict check against constitution + factory principles (sub-agent) → synthesis grill → co-write iteratively
|
|
- [ ] Trigger description for each skill tested against explicit, implicit, and negative queries before body written
|
|
- [ ] `when:` frontmatter field present in all SKILL.md files
|
|
- [ ] `source:` and `references:` fields correctly populated or absent
|
|
- [ ] eval.yaml for each skill contains all 5 required test types
|
|
- [ ] Body ≤500 lines for each skill
|
|
- [ ] `docs/spec/overview.md` updated to reflect all 4 skills deployed
|
|
|
|
## Blocked by
|
|
|
|
- 0016 (per-skill workflow)
|
|
- 0017 (`write-eval`)
|
|
- 0018 (`write-skill`)
|