[LarsLaskowski]

Pull Request

📖 Description

Refreshes the squad and agent rules from Squad-Spec-Repository-Template (5793c8e → 77cc882, profile dotnet). The template-managed agents, skills, .squad/routing.md, .squad/team.md, squad tools and spec templates are updated, and the new plan-check.py and sonar-check.py tools are added. With this update, Security reviews the plan whenever a security area is touched (not only on the security tier), and features write their spec first and have it challenged before planning. .squad/stack.md gets a Sonar gate that runs SonarQube Cloud's analysis on the work branch before the PR, using the same project key and organization as CI, and its SonarQube notes now point to that gate. squad_settings.py and the security-area intro in .squad/project.md are updated to match the new seeds.

🎫 Issues

None.

💬 Reviewer Notes

• Changed by hand (project-owned):
  • .squad/stack.md: the Sonar gate row and section, with the scanner installed globally, because a local install leaves an untracked dotnet-tools.json that the gate refuses. The SonarQube notes are reworded to point to that gate.
  • .squad/tools/squad_settings.py: SONAR_REPORT_TASK.
  • .squad/project.md: the security-areas intro.
• All other files come verbatim from the template. The project blocks in AGENTS.md and docs/ARCHITECTURE.md are unchanged.
• No files were backed up, retired or skipped. No new decision seeds, and no new dev dependencies in the repository: the Sonar gate needs dotnet-sonarscanner installed globally plus SONAR_TOKEN in the session environment, and reports NOT CHECKED without them.

📑 Test Plan

config-check.py passes. Format check, Build, Analyzer gate (0 diagnostics), Test with coverage (501 tests passed) and Coverage gate (84.0 % overall) all pass. The Sonar gate was not run, because no SONAR_TOKEN was available.

✅ Checklist

• I have added or updated Unit Tests for the change.
• I have tested my changes.
• I have run Format and Build from .squad/stack.md, and the Analyzer gate reports no diagnostic in a changed file.
• The Coverage gate in .squad/stack.md passes (line coverage on new or changed production code and overall).
• I have updated the project documentation (README.md, ARCHITECTURE.md) to reflect my changes.
• I have read the CONTRIBUTING documentation and followed the project's code style guidelines.
• New dependencies, if any, were added the way Dependencies in .squad/stack.md prescribes.
• The C# rules in csharp.instructions.md are followed.

⏭ Next Steps

None.

[LarsLaskowski]

SonarCloud Code Analysis is failing (Reliability rating C on new code). It reports five findings, all in template-managed squad tools this PR brings in:

• .squad/tools/plan-check.py:60: python:S8786 and python:S5850 (backtracking, alternation with anchors in EMPHASIS)
• .squad/tools/plan-check.py:257: python:S8786 ([ \t]*(.*)$)
• .squad/tools/plan-check.py:295: python:S1192 ("spec.md" repeated)
• .squad/tools/squad-log.py:480: python:S3776 (cognitive complexity 16 > 15)

These files aren't edited in this repository. They're fixed in the template and re-applied from its main. The fix is pushed on the template branch fix-sonar-findings-in-squad-tools. Its unit tests, ruff, bandit and template-check.py pass, and it also carries the global dotnet-sonarscanner install fix for the dotnet seed. After that template PR merges, this PR gets re-applied from the new template commit. Until then it stays a draft.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud