fraqtal/agentic-dev
Template
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity
Files
bae4b66fa4798a15b0b4a2aa49b3b00bfd00a4fb
agentic-dev/docs/work/ci-security-and-supply-chain/08-reviewer-prompt-update/_story.md
Danijel Martinek bae4b66fa4 refactor(work): drop date prefixes + move _state.json into _system/ 
Convention shift: epic folders + PRD filenames + frontmatter id
fields are now bare slugs. The created: timestamp (Phase 2) carries
the date; folder names don't repeat it. A future <task-id>-<slug>
shape (e.g. ClickUp) lands cleanly when that integration ships.

Renames (git mv preserves history):
- docs/work/2026-05-13-binder-wrap-helper/
    -> docs/work/binder-wrap-helper/
- docs/work/2026-05-14-library-evaluation-policy/
    -> docs/work/library-evaluation-policy/
- docs/work/2026-05-14-ci-security-and-supply-chain/
    -> docs/work/ci-security-and-supply-chain/
- docs/work/prds/2026-05-13-binder-wrap-helper.prd.md
    -> docs/work/prds/binder-wrap-helper.prd.md
- docs/work/prds/2026-05-13-coverage-architecture.prd.md
    -> docs/work/prds/coverage-architecture.prd.md
- docs/work/prds/2026-05-14-library-evaluation-policy.prd.md
    -> docs/work/prds/library-evaluation-policy.prd.md
- docs/work/prds/2026-05-14-ci-security-and-supply-chain.prd.md
    -> docs/work/prds/ci-security-and-supply-chain.prd.md

Frontmatter updates inside the renamed files: epic id, epic prd,
story epic, PRD id, PRD builds-on all drop date prefixes.

System folder + state file move:
- New docs/work/_system/ holds framework-managed state.
- docs/work/_state.json -> docs/work/_system/_state.json.
- state-builder.mjs adds _system to SKIP_FOLDERS.
- cli.mjs + state-sync-guard.mjs + .husky/pre-commit point at the
  new path.

template-reset-v1 epic deleted entirely (one-off cleanup epic from
the pre-date-convention era; status was already done).

Generator-template updates (so new artifacts ship in the right
shape):
- .sandcastle/decomposer.prompt.md emits bare-slug folder names +
  ISO created: timestamp.
- .claude/skills/to-prd/SKILL.md template uses bare-slug filename +
  bare-slug id field + ISO created: timestamp.

Doc reference updates: glossary, runbook, agent-first-workflow-
and-conformance, reviewer prompt, ADR-020, ADR-022, ADR-023 all
point at the new paths/slugs.
2026-05-14 21:16:51 +02:00

2.9 KiB
Raw Blame History

id, epic, title, type, status, feature, depends-on, blocks, created, updated
id epic title type status feature depends-on blocks created updated
08-reviewer-prompt-update ci-security-and-supply-chain Sandcastle reviewer prompt update technical-story done tooling
02-socket-integration
06-codeql-and-audit-signatures
09-ci-security-guide-and-docs
2026-05-14T18:59:12+02:00 2026-05-14T19:16:52.691Z

Goal

Extend .sandcastle/reviewer.prompt.md with a "CI security checks" section that instructs the reviewer agent to read Socket CI output and CodeQL findings via gh run view, and reject the slice with specific notes if any critical Socket finding or error-severity CodeQL finding is present.

Why

The sandcastle reviewer is the single composable gate for agent PRs (ADR-019 constraint). Without an explicit section, an agent reviewer has no machine-readable instruction to check Socket + CodeQL outputs and may approve a slice that introduced a flagged dependency or a static-analysis error. Landing this after Stories 02 + 06 ensures the reviewer references gates that actually exist in CI.

External dependency: library-evaluation epic story 06 (sandcastle reviewer prompt) must be complete — the reviewer prompt must exist and have the library-trace check section that this story composes with. That epic is marked done.

Done when

  • .sandcastle/reviewer.prompt.md has a "CI security checks" section added after the existing library-trace check section.
  • The section instructs the reviewer to: (a) run gh run view <run-id> --log (or equivalent) for the PR's check suite; (b) scan the output for Socket findings of severity critical — if found, reject with notes naming the finding and referencing the failure-mode hierarchy in docs/guides/ci-security.md; (c) scan the output for CodeQL findings of severity error — same rejection pattern.
  • The reviewer composes these checks with the existing library-trace presence check (both must pass for approval).
  • pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff all pass (prose-only change; no executable code).

In scope

  • .sandcastle/reviewer.prompt.md — new "CI security checks" section only; existing sections unchanged.

Out of scope

  • Automated tests for the reviewer prompt — it's a prose runbook for an agent; success is verified manually (PRD testing decisions).
  • Extending the reviewer for pnpm audit signatures step failures — those surface as standard CI job failures, already handled by the reviewer's existing "all CI checks must pass" instruction.

Tasks

  • Extend .sandcastle/reviewer.prompt.md with a "CI security checks" section after the library-trace check: instruct the reviewer to read gh run view output for Socket critical findings and CodeQL error findings, reject on either with notes naming the finding and citing docs/guides/ci-security.md failure-mode hierarchy; one commit, all gates pass.