diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 24fa9d2..3ba3726 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,19 +1,26 @@ # Contributing to Devkit -## Adding a Slash Command (deterministic workflow) +## Adding a Workflow + +Most command logic lives in YAML workflows executed by the Go engine. Only 8 slash commands remain as tab-completable entry points. + +1. Create `workflows/my-workflow.yml` with steps, model assignments, and loop/gate definitions +2. Test with `devkit workflow run my-workflow "input"` +3. Optionally add a context-activated skill in `skills/` to auto-trigger it + +See `skills/creating-workflows/SKILL.md` for YAML schema reference. + +### Adding a Slash Command (rare — only for top-level entry points) -Slash commands appear in tab-completion and run step-by-step workflows. +Only add a command if it needs tab-completion. Most workflows are invoked via `devkit workflow run` or context-activated skills. 1. Create `commands/my-command.md` with YAML frontmatter: ```markdown --- description: What this command does. --- - # Command Title - Step-by-step workflow with numbered steps. + Run `devkit workflow run my-workflow` to execute. ``` -2. Include Budget & Early Exit section if the command loops -3. Include `[PARALLEL]` markers if steps run concurrently The command name is derived from the filename: `commands/my-command.md` becomes `/devkit:my-command`. diff --git a/README.md b/README.md index e0342b1..9d49bdd 100644 --- a/README.md +++ b/README.md @@ -306,7 +306,7 @@ Self-Improvement (self:* commands) ``` devkit/ -├── commands/ # 24 slash commands +├── commands/ # 8 slash commands (tab-completable entry points) ├── skills/ # 19 context-activated skills ├── agents/ # 6 agents (reviewer, researcher, improver, ...) ├── hooks/ # 10 hooks (safety, security, quality gates) diff --git a/ROADMAP.md b/ROADMAP.md index 230b052..84f1b07 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -2,7 +2,8 @@ ## Implemented -- **24 slash commands** — Lifecycle workflows, self-improvement loops, multi-agent dispatch, project health audit, post-PR monitoring, AST repo mapping, autoresearch-inspired self-audit, autoloop, setup-rules +- **8 slash commands** — Tab-completable entry points (tri-review, tri-debug, tri-security, pr-ready, pr-monitor, status, setup-rules, workflow); 16 former commands now context-activated via skills or invoked directly via `devkit workflow run` +- **Deterministic workflow conversion** — All command logic moved from LLM-interpreted markdown to Go-engine-driven YAML workflows; ~3,600 lines of inline logic removed - **19 context-activated skills** — 9 auto-trigger workflows (test-gen, doc-gen, changelog, onboard, research, deep-research, scrape, autoloop, adr) + 6 coding principles (executing, clean-code, DRY, YAGNI, dont-reinvent, stuck) + 2 tools (gcli, creating-workflows) + 1 iteration memory (scratchpad) + 1 orchestration (mega-pr) - **6 agents** — Scoped tool access, worktree isolation, model assignment - **10 hooks** — Safety (destructive command blocking, edit-time security patterns, PR gate), observability (audit trail, slop detection, post-validation, subagent verification, language-aware code review), optimization (RTK token compression) diff --git a/commands/audit.md b/commands/audit.md deleted file mode 100644 index d9b1574..0000000 --- a/commands/audit.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -description: Unified project health audit — dependencies, vulnerabilities, outdated packages, licenses, lint, and security. ---- - -# Project Audit - -Deterministic project health check: detect ecosystem → audit dependencies → check licenses → lint → security scan → report. - -## Invoke - -``` -devkit workflow run audit -``` - -If `devkit workflow` is not available, follow this manually: - -1. **Detect ecosystem** — Check for go.mod, package.json, requirements.txt/pyproject.toml, Cargo.toml -2. **Dependency vulnerabilities** — Run ecosystem audit tools (`npm audit`, `go vuln`, `pip-audit`, `cargo audit`) -3. **Outdated packages** — Check for outdated dependencies, report major/minor/patch updates available -4. **License compliance** — Scan dependency licenses, flag non-permissive or unknown licenses -5. **Code quality** — Run linters for detected ecosystems, count errors and warnings -6. **Security patterns** — Grep for common vulnerabilities: hardcoded secrets, SQL injection, command injection, path traversal -7. **Generate report** — Health score (A-F) with breakdown by category, actionable recommendations - -## Rules - -- Auto-detect ecosystem — don't ask the user what language -- Run actual audit tools — don't guess at vulnerabilities -- Score overall health: A (excellent) through F (critical issues) -- Prioritize findings by severity -- Token budget: ~100k tokens diff --git a/commands/autoloop.md b/commands/autoloop.md deleted file mode 100644 index 2e08529..0000000 --- a/commands/autoloop.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -description: Autonomous improvement loop — audit, fix, measure, keep or revert, repeat. ---- - -# Autoloop - -Autonomous iterative improvement: gather inputs → baseline → audit → fix → measure → compare → keep/revert → repeat. - -## Invoke - -``` -devkit workflow run autoloop "{metric_command}" -``` - -If `devkit workflow` is not available, follow this manually: - -1. **Gather inputs** — Identify metric command, objective, guard command (optional), and iteration count -2. **Baseline** — Run metric command, capture starting state -3. **Audit** — Analyze codebase for improvement opportunities -4. **Fix** — Make one targeted improvement -5. **Measure** — Re-run metric command -6. **Compare + guard** — Did the metric improve? If yes AND a guard command is set, run it. If guard fails, treat as regression and revert. -7. **Keep or revert** — Keep if improved and guard passes; revert otherwise. If 3+ consecutive failures, escalate. -8. **Report** — Summary of iterations, improvements kept, and final state - -## Rules - -- One change per iteration — don't bundle -- Always measure before and after -- Revert on regression or guard failure -- Stop after 3 consecutive failures and report -- Guard command (if set) must pass to keep a change diff --git a/commands/bugfix.md b/commands/bugfix.md deleted file mode 100644 index 0d7f51e..0000000 --- a/commands/bugfix.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -description: Full lifecycle bug fix — reproduce, diagnose, fix, regression test, verify. ---- - -# Bug Fix - -Deterministic bug fix lifecycle: triage → reproduce → diagnose → fix → regression test → verify. - -## Invoke - -``` -devkit workflow run bugfix "{bug_description}" -``` - -If `devkit workflow` is not available, follow this manually: - -1. **Triage** — Classify as TRIVIAL / NORMAL / COMPLEX. Trivial bugs skip to quick-fix path. -2. **Reproduce** — Read relevant code, understand expected vs actual, identify minimal reproduction path -3. **Diagnose** — Check scratchpad for previous attempts; trace root cause (WHY, not just WHERE); propose specific fix with reasoning; append diagnosis to scratchpad -4. **Fix** — Implement minimal fix; don't refactor surrounding code -5. **Regression test** — Write a test that would have caught this bug; verify it fails without the fix and passes with it -6. **Run tests** — Run full test suite including new regression test -7. **Fix test failures** — If tests fail, check scratchpad for what was tried; determine if bug is in test or code; fix and re-run; append result to scratchpad (loop max 5) -8. **Summary** — Report bug, root cause, fix, regression test, and test suite status - -## Rules - -- Reproduce before diagnosing — don't guess at root causes -- Minimal changes only — fix the bug, don't refactor -- Always write a regression test -- Tests must pass before declaring fixed -- Use scratchpad (`.devkit/scratchpads/current.md`) to track attempts across iterations diff --git a/commands/decompose.md b/commands/decompose.md deleted file mode 100644 index 03e1db5..0000000 --- a/commands/decompose.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -description: Decompose a high-level goal into a task DAG — break down, assign to agents, resolve dependencies, execute in order. ---- - -# Goal Decomposition - -Break a high-level goal into an executable task graph: clarify → decompose → resolve order → execute → report. - -## Steps - -1. **Clarify the goal** — Restate precisely. Ask user for clarification if ambiguous. -2. **Decompose into tasks** — Break into 3-10 concrete, testable tasks. Each must have clear done criteria. Identify parallelizable groups. -3. **Resolve execution order** — Build dependency graph. Tasks with no dependencies can run in parallel. -4. **Execute** — Run tasks in dependency order, dispatching independent tasks to agents in parallel where possible. -5. **Report** — Summary of completed tasks, any failures, and remaining work. - -## Rules - -- Each task must be independently testable -- No circular dependencies -- Prefer parallel execution where dependencies allow -- Stop and report if a blocking task fails diff --git a/commands/deep-research.md b/commands/deep-research.md deleted file mode 100644 index e3b8155..0000000 --- a/commands/deep-research.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -description: ACH-enhanced deep research — delegates to deterministic YAML workflow. ---- - -# Deep Research - -Rigorous research for complex or high-stakes questions where correctness matters. Uses Analysis of Competing Hypotheses (ACH) to actively disprove answers rather than just confirming them. - -Use regular `/devkit:research` for quick lookups. Use this when: -- The answer has real consequences (architecture decisions, tool selection, security) -- Multiple conflicting sources exist -- You need confidence calibration, not just an answer -- The user says "deep research", "validate", "make sure this is right" - -## Invoke - -``` -devkit workflow run deep-research "{input}" -``` - -If `devkit workflow` is not available, activate the `/devkit:deep-research` skill which contains a condensed fallback for manual execution. - -The YAML workflow (`workflows/deep-research.yml`) enforces the full ACH sequence deterministically: -clarify → perspectives → decompose → parallel search → extract claims → hypotheses → disconfirm → evidence matrix → self-critique → synthesize. diff --git a/commands/feature.md b/commands/feature.md deleted file mode 100644 index 50f03d9..0000000 --- a/commands/feature.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -description: Full lifecycle feature development — brainstorm, plan, implement, test, lint, review. ---- - -# Feature - -Deterministic feature lifecycle: triage → brainstorm → plan → implement → test → lint → review → report. - -## Invoke - -``` -devkit workflow run feature "{feature_description}" -``` - -If `devkit workflow` is not available, follow this manually: - -1. **Triage** — Classify as TINY / SMALL / MEDIUM / LARGE. Tiny changes skip to quick-fix path. -2. **Brainstorm** — Think through design: what components change, simplest approach, risks, edge cases. Produce a short design summary. (SMALL scope skips this step and goes directly to Plan.) -3. **Plan** — Create numbered implementation todo list ordered by dependency -4. **Implement** — Execute one todo at a time; small focused changes; track progress in scratchpad (loop max 20) -5. **Generate tests** — Write tests for the new feature covering happy path, edge cases, and error conditions -6. **Run tests** — Run full test suite -7. **Fix test failures** — Fix any failures, determine if bug is in test or implementation (loop max 8) -8. **Lint** — Run linter on changed files; fix violations if any (loop max 4) -9. **Review** — Parallel smart + fast review of all changes -10. **Final report** — Summary of what was built, test coverage, review findings, and status - -## Rules - -- Triage honestly — most changes are smaller than they seem -- Design before implementing — don't jump to code -- One todo per iteration — keep changes small and focused -- Tests must pass before review -- Lint must be clean before review -- Use scratchpad (`.devkit/scratchpads/current.md`) to track progress across iterations diff --git a/commands/pr-ready.md b/commands/pr-ready.md index 613ddfc..e0d4aa9 100644 --- a/commands/pr-ready.md +++ b/commands/pr-ready.md @@ -2,31 +2,4 @@ description: Full PR preparation pipeline — validate branch, DRY review, lint, test, security, changelog, create PR. --- -# PR Ready - -Deterministic PR preparation: validate → necessity check → DRY review → lint → test → security → changelog → create PR. - -## Invoke - -``` -devkit workflow run pr-ready -``` - -If `devkit workflow` is not available, follow this manually: - -1. **Validate branch** — Confirm not on main/master, check for uncommitted changes, verify remote tracking -2. **Necessity check** — Review each changed file: is it needed? Remove unnecessary additions, debug artifacts, or unrelated changes. -3. **DRY review** — Check for duplicated logic across changed files. Extract shared code if 3+ repetitions. -4. **Lint** — Run project linter on changed files. Fix violations. -5. **Test** — Run full test suite. Fix failures. -6. **Security quick-check** — Scan for: hardcoded secrets, SQL injection, XSS, command injection, path traversal, insecure dependencies -7. **Generate changelog** — Create changelog entry from git diff summarizing what changed and why -8. **Create PR** — Push branch, create PR with title + summary + test plan - -## Rules - -- Every step must pass before proceeding to the next -- Remove unnecessary changes before reviewing code quality -- Fix lint and test failures — don't skip them -- Security check is not optional -- Changelog should explain WHY, not just WHAT +Run `devkit workflow run pr-ready` to execute the deterministic PR preparation workflow. diff --git a/commands/refactor.md b/commands/refactor.md deleted file mode 100644 index 6154ebc..0000000 --- a/commands/refactor.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -description: Full lifecycle refactor — analyze code smells, plan transformations, restructure, verify nothing broke. ---- - -# Refactor - -Deterministic refactor lifecycle: analyze → plan → refactor → test → compare. - -## Invoke - -``` -devkit workflow run refactor "{target_and_objective}" -``` - -If `devkit workflow` is not available, follow this manually: - -1. **Analyze** — Identify code smells, duplication, complexity hotspots in the target -2. **Plan** — Create ordered list of transformations; each should be a single testable change -3. **Refactor** — Execute transformations one at a time; run tests after each (loop max 15) -4. **Run tests** — Full test suite must pass -5. **Before/after comparison** — Show what changed: complexity metrics, line counts, readability improvements - -## Rules - -- Tests must pass after every transformation — no "fix later" -- One transformation at a time -- Preserve behavior — refactoring changes structure, not functionality -- If tests fail, revert the transformation -- Token budget: ~400k tokens diff --git a/commands/repo-map.md b/commands/repo-map.md deleted file mode 100644 index 3efc6d2..0000000 --- a/commands/repo-map.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -description: Build an AST-based symbol index of the repository — exports, functions, classes, imports — cached for fast agent navigation. ---- - -# Repo Map - -Build and cache an AST-based symbol index for fast codebase navigation. - -## Steps - -1. **Detect languages** — Scan for language markers (go.mod, package.json, pyproject.toml, Cargo.toml, etc.) -2. **Extract symbols (AST)** — Use language-specific AST tools to extract exports, functions, classes, types, interfaces. Fall back to regex if AST tools unavailable. -3. **Build dependency graph** — Map imports/requires between files to build a dependency graph -4. **Cache the map** — Write to `.devkit/repo-map.json` with current commit hash for staleness detection -5. **Generate report** — Summary: entry points, hub files (most imported), orphan files (never imported), symbol counts - -## Rules - -- Prefer AST extraction over regex — more accurate -- Cache results — don't rebuild on every invocation -- Include commit hash for staleness detection -- Identify entry points, hubs, and orphans -- Other commands (tri-review, refactor, decompose) can reference the cached map diff --git a/commands/self-audit.md b/commands/self-audit.md deleted file mode 100644 index b49eea3..0000000 --- a/commands/self-audit.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -description: Automated self-audit — measure the codebase, rank improvement hypotheses by evidence, present actionable plan. ---- - -# Self-Audit - -Evidence-based codebase health assessment: detect stack → measure → analyze → rank and present. - -## Invoke - -``` -devkit workflow run self-audit -``` - -If `devkit workflow` is not available, follow this manually: - -1. **Detect stack** — Auto-detect languages, frameworks, package managers, test runners, linters -2. **Measure** — Collect data across 6 dimensions: - - Code quality (lint errors, warnings, complexity) - - Test coverage (percentage, untested critical paths) - - Security (vulnerability scan, secrets detection) - - Stale code (dead code, unused exports, orphan files) - - Documentation (README freshness, API docs, changelog) - - Git health (branch age, large files, merge conflicts) -3. **Analyze** — Turn measurements into ranked improvement hypotheses with predicted impact and effort -4. **Report** — Present top 5-10 improvements sorted by impact/effort ratio, with specific file references - -## Rules - -- Measure first, hypothesize second — no guessing at problems -- Run actual tools — don't estimate metrics -- Rank by evidence strength, not gut feel -- Every recommendation must cite specific measurements -- Token budget: ~200k tokens diff --git a/commands/self-improve.md b/commands/self-improve.md deleted file mode 100644 index 307c0b0..0000000 --- a/commands/self-improve.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -description: Metric-gated improvement loop — run command, fix issues, repeat until passing. ---- - -# Self-Improve - -Deterministic improvement loop: run metric → fix issues → gate check → repeat until exit code 0. - -## Invoke - -``` -devkit workflow run self-improve "{metric_command}" -``` - -If `devkit workflow` is not available, follow this manually: - -1. **Baseline** — Run the metric command and capture output -2. **Improve loop** — Analyze failures, make targeted fixes, re-run metric; stop when passing (max 10 iterations) -3. **Verify** — Run metric one final time -4. **Summary** — Report what was fixed, iteration count, final metric status - -## Rules - -- Only change what's needed to improve the metric -- Don't refactor unrelated code -- One group of related fixes per iteration -- The metric command must exit non-zero when improvement is still needed diff --git a/commands/self-lint.md b/commands/self-lint.md deleted file mode 100644 index 916e64b..0000000 --- a/commands/self-lint.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -description: Run linter, fix violations deterministically, repeat until clean. ---- - -# Self-Lint - -Deterministic lint-fix loop: run linter → fix violations → gate check → repeat until exit code 0. - -## Invoke - -``` -devkit workflow run self-lint "{lint_command}" -``` - -If `devkit workflow` is not available, follow this manually: - -1. **Baseline** — Run the lint command and capture output -2. **Fix loop** — Fix one group of related lint/type issues at a time; re-run linter after each fix; stop when clean (max 20 iterations) -3. **Verify** — Run linter one final time -4. **Summary** — Report what was fixed and what remains - -## Rules - -- Prioritize errors over warnings -- Fix one group of related issues at a time -- Don't change code behavior — only fix lint issues -- Never disable lint rules — fix the underlying issue diff --git a/commands/self-migrate.md b/commands/self-migrate.md deleted file mode 100644 index a63d1c9..0000000 --- a/commands/self-migrate.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -description: Incremental migration loop — migrate code one piece at a time with tests as safety gate. ---- - -# Self-Migrate - -Deterministic migration loop: run tests → migrate one piece → gate check → repeat until gate exits 0. - -## Invoke - -``` -devkit workflow run self-migrate "{test_command}" -``` - -If `devkit workflow` is not available, follow this manually: - -1. **Baseline** — Run tests to confirm green starting point -2. **Migrate loop** — Migrate one file or closely-related group per iteration; update imports/references; re-run gate command after each step (max 20 iterations). To detect migration completeness, use a gate command that exits non-zero until all files are converted (e.g., `npm test && ! grep -r 'require(' src/`). -3. **Verify** — Run tests one final time -4. **Summary** — Report which files were migrated and what remains - -## Rules - -- One file or closely-related group per iteration -- Tests must pass to keep — no exceptions -- Preserve existing behavior — migration, not refactoring -- Update imports and references in the same iteration diff --git a/commands/self-perf.md b/commands/self-perf.md deleted file mode 100644 index 4c0bda1..0000000 --- a/commands/self-perf.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -description: Profile performance, optimize hot paths deterministically, verify improvement. ---- - -# Self-Perf - -Deterministic performance optimization: benchmark → optimize → gate check → repeat until benchmark exits 0. - -## Invoke - -``` -devkit workflow run self-perf "{benchmark_command}" -``` - -If `devkit workflow` is not available, follow this manually: - -1. **Baseline** — Run the benchmark command and capture metrics -2. **Optimize loop** — Identify bottleneck, make one targeted optimization, re-benchmark; stop when target met (max 5 iterations) -3. **Verify** — Run benchmark one final time -4. **Summary** — Report improvement (absolute and percentage) - -## Rules - -- The benchmark command must exit non-zero when the target is not met (wrap bare benchmarks in a threshold-checking script) -- One optimization at a time — no speculative refactoring -- Only change what impacts the metric diff --git a/commands/self-test.md b/commands/self-test.md deleted file mode 100644 index da60638..0000000 --- a/commands/self-test.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -description: Run tests, fix failures deterministically, repeat until all pass. ---- - -# Self-Test - -Deterministic test-fix loop: run tests → fix failures → gate check → repeat until exit code 0. - -## Invoke - -``` -devkit workflow run self-test "{test_command}" -``` - -If `devkit workflow` is not available, follow this manually: - -1. **Baseline** — Run the test command and capture output -2. **Fix loop** — Fix one group of related failures at a time; re-run tests after each fix; stop when all pass (max 8 iterations) -3. **Verify** — Run tests one final time -4. **Summary** — Report what was fixed and iteration count - -## Rules - -- One group of related fixes per iteration -- The bug might be in the test or the code under test -- Don't refactor unrelated code -- Match existing test conventions diff --git a/commands/tri-debug.md b/commands/tri-debug.md index db7ad52..943d4ea 100644 --- a/commands/tri-debug.md +++ b/commands/tri-debug.md @@ -2,30 +2,4 @@ description: Triple-agent debugging — independent root-cause hypotheses from Claude, Codex, and Gemini, then consensus fix. --- -# Triple-Agent Debug - -Dispatch a bug report to 2-3 AI agents in parallel, get independent root-cause hypotheses, and consolidate a fix. - -## Invoke - -``` -devkit workflow run tri-debug "{bug_description}" -``` - -The YAML workflow uses model tiers (smart/general/fast) for parallelism. The fallback below uses external agents (Claude/Codex/Gemini) — the richer path when the engine is unavailable. - -If `devkit workflow` is not available, follow this manually: - -1. **Gather context** — Collect error messages, stack traces, reproduction steps, and relevant code -2. **Detect agents** — Check for Codex and Gemini availability. Claude always runs. -3. **Build prompt** — Include: error output, relevant source code, recent changes (`git log -5`), and reproduction steps -4. **Dispatch in parallel** — Launch all available agents concurrently with the full context -5. **Consolidate** — Consensus diagnosis (2+ agents agree) → high confidence. Unique hypotheses → worth investigating. - -## Rules - -- Claude always runs as native background agent -- Codex and Gemini are optional — skip gracefully if not installed -- Each agent works independently — don't share findings between agents -- Report consensus vs unique diagnoses -- Include specific file:line references and suggested fixes +Run `devkit workflow run tri-debug` to execute the deterministic debug workflow. diff --git a/commands/tri-dispatch.md b/commands/tri-dispatch.md deleted file mode 100644 index 700b616..0000000 --- a/commands/tri-dispatch.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -description: Dispatch a task to all available agents (Claude, Codex, Gemini) in parallel and compare results. ---- - -# Triple-Agent Dispatch - -Send an arbitrary task to 2-3 AI agents in parallel and compare their results. - -## Invoke - -``` -devkit workflow run tri-dispatch "{task_description}" -``` - -The YAML workflow uses model tiers (smart/general/fast) for parallelism. The fallback below uses external agents (Claude/Codex/Gemini) — the richer path when the engine is unavailable. - -If `devkit workflow` is not available, follow this manually: - -1. **Detect agents** — Check for Codex and Gemini availability. Claude always runs. -2. **Dispatch in parallel** — Launch all available agents with the same prompt. Claude uses native background agent; others use plugin or CLI. -3. **Collect results** — Wait for all agents to complete. -4. **Compare** — Present results side by side. Highlight consensus and divergence. - -## Rules - -- Claude always runs as native background agent -- Codex and Gemini are optional — skip gracefully -- Same prompt goes to all agents — no agent-specific modifications -- Report which agents participated diff --git a/commands/tri-review.md b/commands/tri-review.md index c5b1517..d435034 100644 --- a/commands/tri-review.md +++ b/commands/tri-review.md @@ -2,30 +2,4 @@ description: Triple-agent code review — dispatches to Claude, Codex, and Gemini in parallel, consolidates findings. --- -# Triple-Agent Review - -Dispatch the same code review to 2-3 AI agents in parallel and consolidate results by consensus. - -## Invoke - -``` -devkit workflow run tri-review "{prompt or default}" -``` - -The YAML workflow uses model tiers (smart/general/fast) for parallelism. The fallback below uses external agents (Claude/Codex/Gemini) — the richer path when the engine is unavailable. - -If `devkit workflow` is not available, follow this manually: - -1. **Gather context** — Capture diff via `git diff main...HEAD` (fall back to `HEAD~1..HEAD` or `--cached`). Write to temp file. Warn if >5000 lines. -2. **Build prompt** — Use custom prompt if provided, otherwise default: bugs, security, DRY violations, unnecessary complexity, missing edge cases. -3. **Detect agents** — Check for Codex plugin/CLI and Gemini plugin/CLI. Claude always runs. -4. **Dispatch in parallel** — Launch all available agents concurrently. Pass diff inline in each prompt — worktree-isolated agents can't see latest commits, so the provided diff is the ONLY source of truth. Do NOT instruct agents to read files from the worktree to verify changes. Claude uses native background agent; Codex/Gemini use plugin (preferred) or CLI fallback. -5. **Consolidate** — Consensus findings (2+ agents) ranked higher. Unique findings listed per agent. - -## Rules - -- Claude always runs as native background agent (not `claude -p`) -- Codex and Gemini are optional — skip gracefully if not installed -- Diff MUST be passed inline — agents can't fetch it themselves -- Report which agents participated -- Sort by severity, then consensus count +Run `devkit workflow run tri-review` to execute the deterministic review workflow. diff --git a/commands/tri-security.md b/commands/tri-security.md index 19ee340..647ee74 100644 --- a/commands/tri-security.md +++ b/commands/tri-security.md @@ -2,30 +2,4 @@ description: Triple-agent security audit — independent security reviews from Claude, Codex, and Gemini, consolidated with severity ranking. --- -# Triple-Agent Security Audit - -Dispatch a security audit to 2-3 AI agents in parallel and consolidate with severity-ranked findings. - -## Invoke - -``` -devkit workflow run tri-security "{scope or default}" -``` - -The YAML workflow dispatches by security domain (injection/auth/config) across model tiers. The fallback below uses external agents (Claude/Codex/Gemini) — the richer path when the engine is unavailable. - -If `devkit workflow` is not available, follow this manually: - -1. **Gather scope** — Determine audit scope: full repo, specific directory, or changed files only. Capture relevant code. -2. **Detect agents** — Check for Codex and Gemini availability. Claude always runs. -3. **Build prompt** — Include OWASP top 10 categories, language-specific patterns, auth/authz checks, input validation, secrets detection, dependency vulnerabilities -4. **Dispatch in parallel** — Launch all available agents concurrently with full scope context -5. **Consolidate** — Rank by severity (critical/high/medium/low), then by consensus count (2+ agents = high confidence) - -## Rules - -- Claude always runs — others are optional -- Consensus findings ranked higher than single-agent findings -- Sort by severity, then by consensus count -- Include specific file:line references -- Provide actionable fix for each finding +Run `devkit workflow run tri-security` to execute the deterministic security audit workflow. diff --git a/commands/tri-test-gen.md b/commands/tri-test-gen.md deleted file mode 100644 index da5e0b2..0000000 --- a/commands/tri-test-gen.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -description: Triple-agent test generation — each agent generates tests independently, then merge for maximum coverage. ---- - -# Triple-Agent Test Generation - -Dispatch test generation to 2-3 AI agents in parallel, then merge and deduplicate for maximum coverage. - -## Steps - -1. **Analyze target** — Read source code, identify public API, detect test framework and conventions -2. **Scenario expansion** — Generate test scenarios using: boundary values, equivalence partitioning, error injection, state transitions, concurrency (if applicable) -3. **Detect agents** — Check for Codex and Gemini availability. Claude always runs. -4. **Dispatch in parallel** — Each agent generates tests independently for the target -5. **Merge & deduplicate** — Combine test files, remove duplicates, resolve naming conflicts -6. **Run & fix** — Execute merged tests, fix any failures -7. **Report** — Coverage summary, test count per agent, merged result - -## Rules - -- Claude always runs — others optional -- Each agent generates independently — no shared context between agents -- Merge by deduplicating equivalent test cases -- All merged tests must pass before reporting