diff --git a/CHANGELOG.md b/CHANGELOG.md index 15a3dab..1d883bc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,46 +12,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 [design/llm-usage-tracking.md](docs/design/llm-usage-tracking.md), slice stub, TRAIL/PROGRESS/STATUS DECIDED (not IMPLEMENTED). Historic collapsible Usage log + router metering — build only when slice execution starts. - -### Changed -- README restored to the fuller pre–slice-44 entry shape and brought current: - providers/scanners table (Modal, Supabase, Cisco, Snyk, Tessl five-row, - DepShield, Ossprey, SIE, Model Studio), hosted demo link, Live setup, guide - map, screenshot grid. Trust-strip gate superseded for Ossprey on README - (`ossprey-readme`); Overmind still forbidden. Sync-docs also aligned - ARCHITECTURE inventory + diagrams, STATUS, QUICKSTART, prerequisites, - CONTRIBUTING, setup-commands. -- Dashboard detail drawer **Findings** section is collapsible: clickable heading with - a rotating ▸ chevron (expanded by default on item select). Same expand pattern as - Scanner outputs rows — `prototypes/dc-dashboard/Tripwire.dc.html` (IMPLEMENTED). -- Public docs UX + compaction (slice 44): README/QUICKSTART lead with plain language, - demo-first (Recommended) then Live (Advanced); badges behind disclosure; path map - absorbed into QUICKSTART. Merged `sie-setup` + `model-studio-setup` into - `docs/user-guide/tiered-router-setup.md`. Removed thin aliases - `onboarding-cheatsheet.md` and `path-commands.md`. Glossary / CLI flags / fail hints - absorbed into reading-router-results and setup-commands; docs hub links agent-hooks. - Pile-on: Setup (accounts) vs Configure (keys) beats; loud Minimum Viable Live - (Supabase + Modal); Maintain hub row; Daily maintenance cheat lines; screenshots - note `R`/`Q` colour ≠ density. ARCHITECTURE adds External services inventory plus - operator-journey and dependency-order Mermaid diagrams. -- Dashboard visual identity v2 (slice 43): warm cream paper field (`#F5F2EA`), tan - primary CTA (`#C4A574`), Fraunces serif on intro `h1`/`h2`; cyan `#00D9FF` kept as - live **signal** only (SENSOR dots, wire pulse, scanning fills). Status labels, links, - and muted chrome use AA **ink** tokens on paper (`--red-ink` `#B42318`, `--cta-ink` - `#7A5C2E`, `--text-muted` `#6B645A`, and peers). Modal console and finding snippets - on `--bg-deep` use readable ink/secondary text (not HUD terminal neon). Partial-scan / - disagreement callouts and Guard result banners use `--violet-ink` / status ink (not - dark-theme pastels like `#d4bcff`). Tripwire HUD brackets, grid overlay, - and RAG fill colours retained. Supersedes slice 41 dark-cyan fill. -- Dashboard operator chrome (slice 42 A9–A13): skill cards show Tessl `Q N` / `Q —` / - `Q ?` with hover explaining 0–100 skill-review quality; risk uses compact `R N.NN` - badge (parity with Q) plus density tooltip; list column stays **Risk density**; - locus/availability chips use plain language (`On disk`, `No local source`, …). - Risk/quality hints use a fixed `#score-tip-portal` (viewport-clamped) fed by - `.score-tip` / `.score-tip-bubble` text — escapes grid `overflow` clipping and - avoids delayed native `title=` attributes. - -### Added - Tessl Review (Security) scanner row (slice 51): `run_tessl()` emits `"Tessl: Review (Security)"` after Eval via `_run_tessl_review(judge_type="security")` (`tessl review run security --json --workspace`); `upstream_run_ids.review_quality` @@ -107,6 +67,44 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 category without changing any other scan behaviour; composes with `--dry-discover`, `--force`, `--concurrency`, and explicit path arguments +### Changed +- README restored to the fuller pre–slice-44 entry shape and brought current: + providers/scanners table (Modal, Supabase, Cisco, Snyk, Tessl five-row, + DepShield, Ossprey, SIE, Model Studio), hosted demo link, Live setup, guide + map, screenshot grid. Trust-strip gate superseded for Ossprey on README + (`ossprey-readme`); Overmind still forbidden. Sync-docs also aligned + ARCHITECTURE inventory + diagrams, STATUS, QUICKSTART, prerequisites, + CONTRIBUTING, setup-commands. +- Dashboard detail drawer **Findings** section is collapsible: clickable heading with + a rotating ▸ chevron (expanded by default on item select). Same expand pattern as + Scanner outputs rows — `prototypes/dc-dashboard/Tripwire.dc.html` (IMPLEMENTED). +- Public docs UX + compaction (slice 44): README/QUICKSTART lead with plain language, + demo-first (Recommended) then Live (Advanced); badges behind disclosure; path map + absorbed into QUICKSTART. Merged `sie-setup` + `model-studio-setup` into + `docs/user-guide/tiered-router-setup.md`. Removed thin aliases + `onboarding-cheatsheet.md` and `path-commands.md`. Glossary / CLI flags / fail hints + absorbed into reading-router-results and setup-commands; docs hub links agent-hooks. + Pile-on: Setup (accounts) vs Configure (keys) beats; loud Minimum Viable Live + (Supabase + Modal); Maintain hub row; Daily maintenance cheat lines; screenshots + note `R`/`Q` colour ≠ density. ARCHITECTURE adds External services inventory plus + operator-journey and dependency-order Mermaid diagrams. +- Dashboard visual identity v2 (slice 43): warm cream paper field (`#F5F2EA`), tan + primary CTA (`#C4A574`), Fraunces serif on intro `h1`/`h2`; cyan `#00D9FF` kept as + live **signal** only (SENSOR dots, wire pulse, scanning fills). Status labels, links, + and muted chrome use AA **ink** tokens on paper (`--red-ink` `#B42318`, `--cta-ink` + `#7A5C2E`, `--text-muted` `#6B645A`, and peers). Modal console and finding snippets + on `--bg-deep` use readable ink/secondary text (not HUD terminal neon). Partial-scan / + disagreement callouts and Guard result banners use `--violet-ink` / status ink (not + dark-theme pastels like `#d4bcff`). Tripwire HUD brackets, grid overlay, + and RAG fill colours retained. Supersedes slice 41 dark-cyan fill. +- Dashboard operator chrome (slice 42 A9–A13): skill cards show Tessl `Q N` / `Q —` / + `Q ?` with hover explaining 0–100 skill-review quality; risk uses compact `R N.NN` + badge (parity with Q) plus density tooltip; list column stays **Risk density**; + locus/availability chips use plain language (`On disk`, `No local source`, …). + Risk/quality hints use a fixed `#score-tip-portal` (viewport-clamped) fed by + `.score-tip` / `.score-tip-bubble` text — escapes grid `overflow` clipping and + avoids delayed native `title=` attributes. + ### Fixed - Live dashboard latest-state accuracy (partial slice 21): `db/schema.sql` adds `dashboard_latest_runs` view (`DISTINCT ON (item_id)`); `tripwire-live.js` queries diff --git a/docs/plan/DECISIONS.md b/docs/plan/DECISIONS.md index f5bb778..8529a7c 100644 --- a/docs/plan/DECISIONS.md +++ b/docs/plan/DECISIONS.md @@ -184,3 +184,4 @@ | 2026-08-25 | planning | Slice 53 group = Wave **13-M** | Fit check: **M** (LLM usage / cost observability, ADR-0016 follow-on). Rejected J (quality ✅ closed), L (Tessl-only theme), G (ATDD parked), K (docs-only). Folder stays `slices/13-M-llm-usage-tracking/`; trackers renamed for clarity. DECIDED | | 2026-08-25 | planning | Slice 53 historic + collapsible log | Usage UI must show **past** per-transaction costs (append-only `llm_usage_events`), not only latest. Transaction log **collapsed by default**; per-row I/O expand; drawer **Prior routes** collapsed. Window chips Today/7d/30d optional. Retention TTL deferred. DECIDED | | 2026-08-25 | sync-docs | Wave M DECIDED discoverability | Feature-delta (plan-only): ARCHITECTURE Future + docs hub + reading-router-results Related + CHANGELOG Unreleased Added. README/AGENTS/CLAUDE: no false “Usage shipped” claims — aligned NO_CHANGE. User-guide env-vars / setup: deferred until IMPLEMENTED. Visual assets: current-truth diagrams unchanged (future prose only). APPLIED | +| 2026-08-25 | planning | Amended slices 26+28 (not new slice) | `/tw-verify` Quality column (`N/100` from `items.quality_score`) + blocked-note footer de-dupe. Quality-only metrics; amend-in-place like slice 42. Slice 30 one-line sync. Skill implementation deferred to `slice/28-*` execution. DECIDED | diff --git a/docs/plan/PROGRESS.md b/docs/plan/PROGRESS.md index f6ed0d8..f2a7a44 100644 --- a/docs/plan/PROGRESS.md +++ b/docs/plan/PROGRESS.md @@ -43,9 +43,9 @@ shared code area: slice 18 does not start until the H-wave subcommand lands | 1 | H1 | 23 | Config + Handler Scripts | Must | 📋 PLANNED | | 2 | H1 | 24 | `tripwire setup-agent-hooks` | Must | 📋 PLANNED | | 3 | H1 | 25 | Live Enforce Smoke | Must | 📋 PLANNED | -| 4 | H2 | 26 | API Introspect + Dual Output Contract | Must | 📋 PLANNED | +| 4 | H2 | 26 | API Introspect + Dual Output Contract (delta: Quality column) | Must | 📋 PLANNED | | 5 | H2 | 27 | `/tw-enable` + `/tw-disable` | Must | 📋 PLANNED | -| 6 | H2 | 28 | `/tw-verify` | Must | 📋 PLANNED | +| 6 | H2 | 28 | `/tw-verify` (delta: Quality `N/100` + blocked footer) | Must | 📋 PLANNED | | 7 | H2 | 29 | `/tw-scan` | Must | 📋 PLANNED | | 8 | H2 | 30 | `/tw-self-check` | Must | 📋 PLANNED | | 9 | H3 | 31 | Demo Artifacts | Must | 📋 PLANNED | @@ -129,7 +129,7 @@ shared code area: slice 18 does not start until the H-wave subcommand lands | 25 | [slice-25-live-enforce-smoke](slices/08-H-frontline-agent-hooks/slice-25-live-enforce-smoke.md) | Must | 📋 PLANNED | — | — | ~30 min | | 26 | [slice-26-api-output-contract](slices/08-H-frontline-agent-hooks/slice-26-api-output-contract.md) | Must | 📋 PLANNED | — | — | ~40 min | | 27 | [slice-27-tw-enable-disable](slices/08-H-frontline-agent-hooks/slice-27-tw-enable-disable.md) | Must | 📋 PLANNED | — | — | ~25 min | -| 28 | [slice-28-tw-verify](slices/08-H-frontline-agent-hooks/slice-28-tw-verify.md) | Must | 📋 PLANNED | — | — | ~50 min | +| 28 | [slice-28-tw-verify](slices/08-H-frontline-agent-hooks/slice-28-tw-verify.md) | Must | 📋 PLANNED | — | — | ~50 min (delta: Quality + footer) | | 29 | [slice-29-tw-scan](slices/08-H-frontline-agent-hooks/slice-29-tw-scan.md) | Must | 📋 PLANNED | — | — | ~40 min | | 30 | [slice-30-tw-self-check](slices/08-H-frontline-agent-hooks/slice-30-tw-self-check.md) | Must | 📋 PLANNED | — | — | ~30 min | | 31 | [slice-31-demo-artifacts](slices/08-H-frontline-agent-hooks/slice-31-demo-artifacts.md) | Must | 📋 PLANNED | — | — | ~40 min | diff --git a/docs/plan/TRAIL.md b/docs/plan/TRAIL.md index 69e405c..4b25e2b 100644 --- a/docs/plan/TRAIL.md +++ b/docs/plan/TRAIL.md @@ -191,9 +191,9 @@ Branch: `frontline-hackathon-london-2026-agent-hooks`. Source: `internal-docs/04 | # | File | Name | MoSCoW | Status | Depends on | Issue | Read time | |---|------|------|--------|--------|------------|-------|-----------| -| 26 | [slice-26-api-output-contract](slices/08-H-frontline-agent-hooks/slice-26-api-output-contract.md) | API Introspect + Dual Output Contract | Must | 📋 | 25 | — | ~4 min | +| 26 | [slice-26-api-output-contract](slices/08-H-frontline-agent-hooks/slice-26-api-output-contract.md) | API Introspect + Dual Output Contract (delta: Quality column) | Must | 📋 | 25 | — | ~4 min | | 27 | [slice-27-tw-enable-disable](slices/08-H-frontline-agent-hooks/slice-27-tw-enable-disable.md) | `/tw-enable` + `/tw-disable` | Must | 📋 | 26 | — | ~3 min | -| 28 | [slice-28-tw-verify](slices/08-H-frontline-agent-hooks/slice-28-tw-verify.md) | `/tw-verify` | Must | 📋 | 26,27 | — | ~5 min | +| 28 | [slice-28-tw-verify](slices/08-H-frontline-agent-hooks/slice-28-tw-verify.md) | `/tw-verify` (delta: Quality `N/100` + blocked footer) | Must | 📋 | 26,27 | — | ~5 min | | 29 | [slice-29-tw-scan](slices/08-H-frontline-agent-hooks/slice-29-tw-scan.md) | `/tw-scan` | Must | 📋 | 26 | — | ~4 min | | 30 | [slice-30-tw-self-check](slices/08-H-frontline-agent-hooks/slice-30-tw-self-check.md) | `/tw-self-check` | Must | 📋 | 28 | — | ~3 min | diff --git a/docs/plan/gate-evidence/slice-26.json b/docs/plan/gate-evidence/slice-26.json index 3496a03..b9f33e7 100644 --- a/docs/plan/gate-evidence/slice-26.json +++ b/docs/plan/gate-evidence/slice-26.json @@ -8,6 +8,8 @@ "after_checks": [], "planned_commands": [ "test -f docs/plan/slices/08-H-frontline-agent-hooks/slice-26-api-output-contract.md", + "rg -n \"Name \\| Type \\| Status \\| Quality \\| Note\" docs/plan/slices/08-H-frontline-agent-hooks/slice-26-api-output-contract.md", + "rg -n \"quality_score|footer|Will be blocked\" docs/plan/slices/08-H-frontline-agent-hooks/slice-26-api-output-contract.md", "rg -n \"fresh|stale|unscanned|scanning|not-found|will_be_blocked\" internal-docs/04_frontline/main_prompt.md", "rg -n \"heatmap_status\" guard/", "tripwire scan --help || true" @@ -20,5 +22,6 @@ "coverage_target": "TBD at AT design before IN PROGRESS", "complexity_policy": "enforcing for product-code; N/A for docs-only with reason in evidence", "phase": "H2", - "moscow": "Must" + "moscow": "Must", + "delta_2026_08_25": "Quality column + quality_score + blocked footer (DECIDED)" } diff --git a/docs/plan/gate-evidence/slice-28.json b/docs/plan/gate-evidence/slice-28.json index b1ef907..680352f 100644 --- a/docs/plan/gate-evidence/slice-28.json +++ b/docs/plan/gate-evidence/slice-28.json @@ -8,7 +8,8 @@ "after_checks": [], "planned_commands": [ "test -f docs/plan/slices/08-H-frontline-agent-hooks/slice-28-tw-verify.md", - "rg -n \"tw-verify|Will be blocked when Tripwire is enabled\" docs/plan/slices/08-H-frontline-agent-hooks/ internal-docs/04_frontline/", + "rg -n \"Quality|N/100|quality_score|Will be blocked when Tripwire is enabled\" docs/plan/slices/08-H-frontline-agent-hooks/slice-28-tw-verify.md agent-hooks/skills/tw-verify/", + "rg -n \"Name \\| Type \\| Status \\| Quality \\| Note\" docs/plan/slices/08-H-frontline-agent-hooks/", "rg -n \"heatmap_status\" guard/", "./scripts/quality-gates.sh" ], @@ -18,7 +19,8 @@ "review": {"acceptance": "PENDING", "implementation": "PENDING"}, "verdict": "NOT_RUN", "coverage_target": "TBD at AT design before IN PROGRESS", - "complexity_policy": "enforcing for product-code; N/A for docs-only with reason in evidence", + "complexity_policy": "enforcing for product-code; N/A for docs-only / skill-markdown-only with reason in evidence", "phase": "H2", - "moscow": "Must" + "moscow": "Must", + "delta_2026_08_25": "Quality column N/100 + blocked footer de-dupe (DECIDED)" } diff --git a/docs/plan/slices/08-H-frontline-agent-hooks/slice-26-api-output-contract.md b/docs/plan/slices/08-H-frontline-agent-hooks/slice-26-api-output-contract.md index 48c3d36..adeebfd 100644 --- a/docs/plan/slices/08-H-frontline-agent-hooks/slice-26-api-output-contract.md +++ b/docs/plan/slices/08-H-frontline-agent-hooks/slice-26-api-output-contract.md @@ -4,7 +4,9 @@ ## Outcome -Documented contract for actual `tripwire scan` JSON output and the mapping from Supabase `heatmap_status` to the six UI states (`fresh` / `stale` / `unscanned` / `scanning` / `not-found` / `red`). Shared human Markdown table and machine JSON shape match `internal-docs/04_frontline/main_prompt.md`. +Documented contract for actual `tripwire scan` JSON output and the mapping from Supabase `heatmap_status` to the six UI states (`fresh` / `stale` / `unscanned` / `scanning` / `not-found` / `red`). Shared human Markdown table and machine JSON shape match `internal-docs/04_frontline/main_prompt.md` (with Wave H deltas below). + +**Delta (2026-08-25):** Human columns gain **Quality**; machine JSON gains nullable `quality_score`; shared blocked message is a **table footer** when any `will_be_blocked`. Evidence state: **DECIDED**. ## GWT acceptance specification @@ -13,16 +15,20 @@ Thin scaffolds — full DISTILL ATs deferred per DECISIONS; design ATs before ma 1. **Six states are named and mapped** - Given the contract doc, when an operator looks up each UI state, then `fresh`, `stale`, `unscanned`, `scanning`, `not-found`, and `red` each have a defined display and source mapping from `heatmap_status` / resolution. 2. **Human table columns are fixed** - - Given the contract doc, when rendering a verify/scan response, then the human Markdown table columns are Name | Type | Status | Note. + - Given the contract doc, when rendering a verify/scan response, then the human Markdown table columns are **Name | Type | Status | Quality | Note**. + - Quality cell format: **`N/100`** when `quality_score` is present (Tessl skill-review axis, 0–100, higher better); otherwise `—`. 3. **Machine JSON shape is fixed** - - Given the contract doc, when emitting machine output, then each artifact includes at least `name`, `resolved_path`, `type`, `state`, `rag`, `scanned_at`, `stale`, `will_be_blocked`, `note` (or an explicit backlog note for fields pending API introspection). -4. **Scan JSON introspection recorded** + - Given the contract doc, when emitting machine output, then each artifact includes at least `name`, `resolved_path`, `type`, `state`, `rag`, `scanned_at`, `stale`, `will_be_blocked`, `quality_score` (nullable number), `note` (or an explicit backlog note for fields pending API introspection). +4. **Blocked footer contract** + - Given any artifact with `will_be_blocked=true`, when the human table is rendered, then **Will be blocked when Tripwire is enabled** appears once under the table (not repeated in every Note). Distinct per-row notes remain in Note. +5. **Scan JSON introspection recorded** - Given a live or fixture `tripwire scan` response, when the contract is finalized for H2 skills, then the documented fields match observed output (or mark BACKLOG fields explicitly). ## Design / test treatment - Docs-first contract slice: introspect existing CLI/API; do not invent fields. - Prefer a single SSOT doc under `docs/` (or frontline plan path) linked from skills work in 27–30. +- Quality maps to persisted `items.quality_score` (same axis as Live / user-guide Tessl quality glossary) — not risk. - **AT design required before IN PROGRESS** — may be docs-only with binary `rg`/file checks; note complexity N/A with reason if no product code. ## Before-Checks [GATE] @@ -34,15 +40,16 @@ Thin scaffolds — full DISTILL ATs deferred per DECISIONS; design ATs before ma ## TDD execution -RED: add contract presence / mapping GWTs (`rg` or schema fixture assertions). +RED: add contract presence / mapping GWTs (`rg` or schema fixture assertions) including Quality column and `quality_score`. GREEN: write the shared human+machine contract doc from introspection. REFACTOR: keep BACKLOG fields explicit; no silent invention. ## After-Checks [GATE] - [ ] Contract doc exists at the path recorded in gate evidence -- [ ] `rg` proves all six states and Name|Type|Status|Note columns -- [ ] Machine JSON example matches main_prompt shape (or BACKLOG deltas listed) +- [ ] `rg` proves all six states and Name|Type|Status|Quality|Note columns +- [ ] Machine JSON example includes `quality_score` (or BACKLOG deltas listed) +- [ ] Footer blocked-message contract documented - [ ] Named check command(s) exit 0 (record in gate evidence) - [ ] Coverage/complexity: **N/A for docs-only** with reason in evidence, else enforcing for any product-code touched - [ ] `docs/plan/gate-evidence/slice-26.json` records commands, reviewers, and `verdict: PASS` @@ -53,7 +60,7 @@ REFACTOR: keep BACKLOG fields explicit; no silent invention. | # | Check | |---|--------| -| 1 | Human Markdown table + machine JSON published | +| 1 | Human Markdown table + machine JSON published (Quality + footer) | | 2 | heatmap_status → six UI states mapping complete | | 3 | Links to main_prompt + skill slices 27–30 | | 4 | Cross-link gate-evidence ↔ TRAIL/PROGRESS | diff --git a/docs/plan/slices/08-H-frontline-agent-hooks/slice-28-tw-verify.md b/docs/plan/slices/08-H-frontline-agent-hooks/slice-28-tw-verify.md index 98100bc..b52a38b 100644 --- a/docs/plan/slices/08-H-frontline-agent-hooks/slice-28-tw-verify.md +++ b/docs/plan/slices/08-H-frontline-agent-hooks/slice-28-tw-verify.md @@ -4,7 +4,9 @@ ## Outcome -`/tw-verify` resolves multiple names, reports every artifact in one pass via the shared human table + machine JSON, covers all six states, always notes RED will be blocked when enabled, offers `/tw-scan` for unscanned, and returns a useful human message for not-found. +`/tw-verify` resolves multiple names, reports every artifact in one pass via the shared human table + machine JSON, covers all six states, surfaces Tessl **Quality** as **`N/100`** when `items.quality_score` is present, de-duplicates the shared blocked message into a **table footer**, offers `/tw-scan` for unscanned, and returns a useful human message for not-found. + +**Delta (2026-08-25):** Quality column + blocked-note footer de-dupe (Quality-only metrics; amend-in-place — no new slice). Evidence state: **DECIDED** until skill implementation ships. ## GWT acceptance specification @@ -13,41 +15,52 @@ Thin scaffolds — full DISTILL ATs deferred per DECISIONS; design ATs before ma 1. **Multi-name one-pass table** - Given two or more resolvable names, when `/tw-verify` runs, then every name appears as a row in one Markdown table (and matching machine artifacts) without stopping at the first issue. 2. **State coverage** - - Given fixtures for fresh/stale/unscanned/scanning/not-found/red, when verify runs, then each state renders per the slice-26 contract. -3. **RED block note** - - Given a RED artifact, when verify reports it, then the Note (or equivalent) includes that it will be blocked when Tripwire is enabled. -4. **Unscanned offers scan** + - Given fixtures for fresh/stale/unscanned/scanning/not-found/red, when verify runs, then each state renders per the slice-26 contract (including Quality column). +3. **Quality column (`N/100`)** + - Given a found skill with stored `items.quality_score`, when verify reports it, then the Quality cell shows **`N/100`** (scale bound visible; never a bare integer or `Q N` alone). + - Given MCP, unscanned, not-found, or null score, when verify reports it, then Quality is `—`. +4. **Driver exposes `quality_score`** + - Given the Step-4 status driver JSON, when an artifact has an item row, then `quality_score` is present as a nullable number (0–100); human render owns the `/100` display. +5. **Blocked note de-dupe (footer)** + - Given one or more rows with `will_be_blocked=true`, when verify renders the table, then the phrase **Will be blocked when Tripwire is enabled** appears **once** under the table (footer), not repeated in every Note. + - Row Notes keep *distinct* copy only (AMBER threshold, STALE remedy, CHANGED, NOT FOUND locus, UNSCANNED, alias hints). +6. **Unscanned offers scan** - Given an unscanned artifact, when verify reports it, then the operator is offered `/tw-scan` for that name. -5. **Not-found is human-readable** +7. **Not-found is human-readable** - Given a name with no resolution match, when verify runs, then the response includes a useful human message (not a bare error). ## Design / test treatment -- Name resolution uses Claude visibility into skills/MCP/tools; path(s) passed to existing status sources (Supabase `heatmap_status` pattern). -- Output must satisfy slice-26 dual audience contract. +- Name resolution uses the deterministic resolve driver (`resolve_operator_name`); status via `get_item_status` (item already includes `quality_score`). +- Output must satisfy amended slice-26 dual audience contract: columns `Name | Type | Status | Quality | Note`. +- Do **not** invoke Tessl CLI from `/tw-verify` — read persisted `items.quality_score` only. +- Out of scope this delta: Risk, scanner counts, scan age, other non-quality metrics. +- Files at implementation: `agent-hooks/skills/tw-verify/SKILL.md` (Steps 4–5), `agent-hooks/skills/tw-self-check/SKILL.md` (mirror), optional promote of `quality_score` in the inline status driver JSON; then `tripwire setup-agent-hooks`. - **AT design required before IN PROGRESS** (≤7 acceptance tests). ## Before-Checks [GATE] - [ ] Slices 26 and 27 gate-evidence `verdict` are `PASS` -- [ ] Branch `slice/28-tw-verify` created from current `main` +- [ ] Branch `slice/28-tw-verify` (or `slice/28-tw-verify-quality`) created from current `main` - [ ] Slice-26 contract path recorded as the output SSOT in evidence - [ ] Coverage/complexity targets TBD until AT design completes ## TDD execution -RED: add verify GWTs for multi-name table, six states, RED note, unscanned offer, not-found message. -GREEN: implement `/tw-verify` against existing status APIs only as needed. +RED: add verify GWTs for multi-name table, six states, Quality `N/100`, footer blocked de-dupe, unscanned offer, not-found message. +GREEN: implement `/tw-verify` skill render + driver field against existing status APIs only as needed. REFACTOR: share formatting helpers with later `/tw-scan` / `/tw-self-check`. ## After-Checks [GATE] - [ ] Multi-name one-pass and six-state GWTs pass -- [ ] RED block note and unscanned→offer-scan asserted observably +- [ ] Quality cell asserts `/100` when score present; `—` when absent +- [ ] Blocked footer appears once when any `will_be_blocked`; Notes lack repeated blocked sentence +- [ ] Unscanned→offer-scan asserted observably - [ ] Not-found human message asserted (not bare error) - [ ] Named test command(s) from AT design exit 0 (record in gate evidence) - [ ] Coverage target: set at AT design before IN PROGRESS; recorded % meets that target -- [ ] Complexity policy: **enforcing** for product-code; evidence cites quality-gates / complexity report +- [ ] Complexity policy: **enforcing** for product-code; evidence cites quality-gates / complexity report; **N/A** for skill-markdown-only with reason - [ ] `docs/plan/gate-evidence/slice-28.json` records commands, coverage, complexity, reviewers, and `verdict: PASS` - [ ] Review: `acceptance: APPROVED` and `implementation: APPROVED` (or docs-only exception in DECISIONS) - [ ] `PROGRESS.md` + `TRAIL.md` show slice 28 ✅ @@ -56,9 +69,9 @@ REFACTOR: share formatting helpers with later `/tw-scan` / `/tw-self-check`. | # | Check | |---|--------| -| 1 | `/tw-verify` multi-name + one-pass behaviour documented | -| 2 | Link to slice-26 output contract | -| 3 | RED block note + unscanned offer + not-found messaging stated | +| 1 | `/tw-verify` multi-name + one-pass + Quality `N/100` + blocked footer documented in skill SSOT | +| 2 | Link to amended slice-26 output contract | +| 3 | sync-docs on ship: `tw-verify` + `tw-self-check` + `tw-disable` wording + `agent-hooks/README` + CHANGELOG | | 4 | Cross-link gate-evidence ↔ TRAIL/PROGRESS | ## Gate Status diff --git a/docs/plan/slices/08-H-frontline-agent-hooks/slice-30-tw-self-check.md b/docs/plan/slices/08-H-frontline-agent-hooks/slice-30-tw-self-check.md index e7274e9..e86b6f9 100644 --- a/docs/plan/slices/08-H-frontline-agent-hooks/slice-30-tw-self-check.md +++ b/docs/plan/slices/08-H-frontline-agent-hooks/slice-30-tw-self-check.md @@ -4,7 +4,7 @@ ## Outcome -`/tw-self-check` reuses `/tw-verify` status/staleness/tabular logic scoped only to the five `/tw-*` skills, with optional `--force` / `force` to drive rescan behaviour where applicable. +`/tw-self-check` reuses `/tw-verify` status/staleness/tabular logic scoped only to the five `/tw-*` skills, with optional `--force` / `force` to drive rescan behaviour where applicable. Table columns follow the amended slice-26/28 contract: **Name | Type | Status | Quality | Note** (Quality as `N/100` or `—`; blocked message as table footer). ## GWT acceptance specification @@ -13,7 +13,7 @@ Thin scaffolds — full DISTILL ATs deferred per DECISIONS; design ATs before ma 1. **Scoped to five /tw-* skills** - Given installed Tripwire control skills, when `/tw-self-check` runs without names, then only the five `/tw-*` skills appear in the table (not arbitrary demos/other skills). 2. **Same verify logic** - - Given known states among those five, when self-check runs, then states/notes match `/tw-verify` contract behaviour (fresh/stale/unscanned/scanning/red handling). + - Given known states among those five, when self-check runs, then states/notes/Quality/footer match `/tw-verify` contract behaviour (fresh/stale/unscanned/scanning/red handling + Quality `N/100` + blocked footer). 3. **Optional force** - Given `--force` or bare `force`, when self-check runs, then force semantics align with rescan/verify-adjacent behaviour defined at AT design (documented in evidence).