文件历史

26 次代码提交

作者 SHA1 备注 提交日期
ayobamiseun 2e49319164 docs(tdd): make test-driven-development ecosystem-neutral (#404 Phase 1)
- SKILL.md gains a 'Discover the Stack First' step: identify the
  language, build system, checked-in wrappers, test framework, and
  documented commands before choosing any test command, and run the
  repository's own focused/full-suite commands throughout the loop
- verification checklist no longer hardcodes 'npm test'; red flag added
  for reaching for a default test command without checking the repo
- references/testing-patterns.md relabeled in place as JavaScript/
  TypeScript examples illustrating the universal principles (no
  relocation, per the #361/#236 sequencing agreed in the issue)
- new behavioral eval: a Python/unittest fixture verifying the skill
  adapts to non-npm repository tooling
2026-07-19 17:08:30 +01:00
Federico Bartoli 509281da06 docs(security): clarify npm install-script versions
Date the version matrix and distinguish fallback, npm 11.18.x, and npm 12.x behavior using verified lifecycle-script probes.
2026-07-11 14:44:03 +02:00
Federico Bartoli 175013ab41 docs(security): harden package-manager supply-chain guidance 2026-07-11 09:34:05 +02:00
Debbie O'Brien 6ace60a354 Improve Playwright locator examples 2026-07-07 10:21:00 +02:00
Joan Leon 8bc10948f8 docs(dod): align prose with links and cross-link standing items to owning skills
Address review feedback on #317:
- Wire the Definition of Done into incremental-implementation as a final
  per-task gate, so the doc's intro list and the See Also links agree.
- Cross-link the Quality and Ship-readiness items to the skills that own
  their depth (code-review-and-quality, code-simplification,
  security-and-hardening, observability-and-instrumentation,
  shipping-and-launch).
2026-06-23 09:47:27 +02:00
Joan Leon b89a675b4d docs: add Definition of Done reference checklist
Introduce a project-wide Definition of Done as a standing bar every change clears before it counts as done, distinct from the per-task acceptance criteria the project already covers.

The concept existed implicitly across the project (per-task acceptance criteria, per-skill Verification sections, the pre-launch checklist) but was never named or unified. This adds a single reusable checklist and wires it in without duplicating existing content:

- references/definition-of-done.md: the standing checklist, grouped into Correctness, Quality, Integration, Documentation, and Ship-readiness, plus a table contrasting Definition of Done with acceptance criteria.
- using-agent-skills: linked from Core Operating Behavior #6 (Verify, Don't Assume), the bar that applies across all skills.
- planning-and-task-breakdown: See Also note clarifying acceptance criteria sit on top of the standing bar.
- shipping-and-launch: See Also pointer as the floor beneath the deploy-specific gates.
- README: entry in the Reference Checklists table.
2026-06-23 01:04:32 +02:00
Federico Bartoli 05472ac53a docs: add observability-checklist reference as companion to observability skill
Follow-up suggested in #223 review: folds in the useful half of #61
(the observability checklist) as this skill's quick-reference
companion, mirroring the security-and-hardening / security-checklist
pairing.

Aligned with the merged skill's framing: on-call questions first,
RED/USE metrics, cardinality rules, symptom-based alerting with the
page/ticket two-severity rule, telemetry verification, and a
pre-launch gate. Linked from the skill's Verification section and
registered in the README references table and CLAUDE.md.
2026-06-11 02:56:51 +00:00
Addy Osmani cad41cb506 docs(security): complete the OWASP LLM Top 10 quick-reference table
Test Plugin Installation / Validate skill content (push) Has been cancelled
Test Plugin Installation / Validate plugin structure (push) Has been cancelled
Test Plugin Installation / Test plugin installation (push) Has been cancelled
Per federicobartoli's note on #219: the table was headed "Top 10" but
listed only 8. Add the two missing entries (LLM04 Data and Model Poisoning,
LLM09 Misinformation) so the heading matches the contents.
2026-06-07 15:26:33 -07:00
Addy Osmani d1983929db fix(security): address review on #219
Per nucliweb's review:
- Resolve OWASP numbering inconsistency: rename the prevention section to
  "OWASP Top 10 Prevention Patterns" and drop the per-item numbers so it no
  longer implies a ranking that conflicts with the 2021 quick-reference table.
- Harden the SSRF example against DNS rebinding/TOCTOU: resolve all records
  and reject if any is non-unicast, plus a caveat that fetch re-resolves and
  pointers to request-filtering-agent / ssrf-req-filter for high-risk surfaces.
- Add LLM08 (Vector and Embedding Weaknesses) to the LLM section and the
  reference table, covering per-tenant embedding isolation and poisoned docs.
- Promote "Threat Model First" to a "## Process" header per the repo's skill
  anatomy convention.
- Make the LLM "GOOD" example parse defensively (JSON.parse + schema in a
  try/catch) so it models handling untrusted output end to end.
2026-06-07 11:36:31 -07:00
Addy Osmani b7add8c945 docs(security): mirror new coverage into the security checklist
- Threat Modeling "start here" block (trust boundaries, STRIDE, abuse cases)
- SSRF line under Input Validation
- Supply-chain hygiene items under Dependency Security
- AI / LLM Security section + OWASP Top 10 for LLMs quick reference table
2026-06-05 21:57:15 -07:00
Addy Osmani 0bf7398e0d docs(references): note skills/mcpServers frontmatter dropped as teammate
The previous text implied personas behave identically as subagents and
teammates. Per the Agent Teams docs, the skills and mcpServers
frontmatter fields in a subagent definition are not applied when the
definition runs as a teammate — teammates load those from project and
user settings instead.

Adds a qualifier so persona authors don't assume a skills: [...] block
will load in both modes. Flagged in review.
2026-04-19 20:34:06 -07:00
Addy Osmani 93dd9b4602 docs: correct Agent Teams system-prompt handling (appended, not replaced)
Per the Agent Teams docs, a persona body is appended to the teammate's
system prompt as additional instructions — not a replacement. The prior
wording implied the persona owned the whole prompt, which would mislead
a persona author about what coordination instructions they inherit from
the lead (SendMessage, task-list tools, etc.).

Fixes the same inaccuracy in two locations (agents/README.md and
references/orchestration-patterns.md). Flagged in review.
2026-04-19 20:33:53 -07:00
Addy Osmani 78039be06e docs(references): add Agent Teams worked example for competing-hypothesis debugging
Walk through a realistic scenario (intermittent 30-second checkout hang
with four plausible root causes) where Agent Teams beats /ship's subagent
fan-out: teammates can challenge each other's hypotheses directly via
inter-teammate messaging, which subagents cannot do.

Includes the one-time CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 setup, a
copy-paste trigger prompt that reuses the existing personas as teammate
types, an explicit anti-pattern warning against wrapping the workflow as
a /debug slash command (which would lose the inter-teammate messaging),
and a 'when not to use Agent Teams' decision rule.
2026-04-18 23:33:04 -07:00
Addy Osmani d01ec538db docs: document Claude Code subagent and Agent Teams compatibility
Verify the orchestration design against the official Claude Code docs and
make the platform mapping explicit:

- /ship now names the Agent tool and the subagent_type field directly,
  with a fallback note for harnesses that lack an Agent tool.
- AGENTS.md notes that personas work as both subagents and Agent Teams
  teammates, and lists the unsupported plugin frontmatter fields.
- agents/README.md gains a Claude Code interop section and notes that
  rule #2 is also a hard platform constraint.
- references/orchestration-patterns.md gains a Claude Code compatibility
  appendix covering plugin paths, the subagents-vs-teams comparison, the
  built-in Explore/Plan/general-purpose subagents, and the parallel
  Agent tool call requirement. Pattern 5 now points at Explore first.

No behavior changes; documentation only.
2026-04-18 23:32:17 -07:00
Addy Osmani f091d49cb3 docs(references): add orchestration patterns catalog
Catalog the five endorsed patterns (direct invocation, single-persona
slash command, parallel fan-out with merge, user-driven sequential
pipeline, research isolation) and four anti-patterns (router persona,
persona-calls-persona, sequential paraphrasing orchestrator, deep
persona trees). Includes a decision flow and a gate for when to add
new patterns to the catalog.
2026-04-18 23:30:35 -07:00
Joan Leon b0deb8637e docs: expand INP coverage in performance checklist
Add an INP-specific measurement workflow covering field data via CrUX Vis,
DevTools interaction tracing, and mid-range Android device testing. Extend
the web-vitals snippet with the attribution build to surface inputDelay,
processingDuration, and presentationDelay. Add a checklist item for
deferring non-critical work out of event handlers to avoid delaying
interaction response.
2026-04-18 10:42:45 +02:00
Addy Osmani c8e426a9c8 Merge pull request #54 from BogdanCerovac/keyboard-skip-to-content-visible
Update accessibility checklist for skip-to-content link
2026-04-11 18:24:58 -07:00
Addy Osmani 4503f4024b Merge pull request #55 from BogdanCerovac/a11y-forms-autocomplete
Add autocomplete requirement for known fields
2026-04-11 18:23:29 -07:00
Joan Leon 3d55f997e8 Expand performance checklist with fonts section and yieldToMain pattern
- Add Fonts subsection with 9 actionable checks covering family/weight
  limits, WOFF2 format, self-hosting, LCP font preload, font-display,
  unicode-range subsetting, variable fonts, fallback metric overrides
  (size-adjust, ascent-override, descent-override), and system font stack
- Remove font bullets from CSS section (now live in Fonts)
- Add long task / yielding items to JavaScript: yieldToMain pattern,
  scheduler.yield() / isInputPending() / postTask(), requestIdleCallback,
  and third-party script guidance
- Add fetchpriority check for non-image resources under Network
- Add content-visibility: auto and bfcache checks under Rendering
- Update "Blocking main thread" anti-pattern to reference scheduler.yield() / yieldToMain
- Fix TOC: add missing TTFB Diagnosis entry
2026-04-11 14:21:06 +02:00
Bogdan Cerovac da0479581b Add autocomplete requirement for known fields
Added checklist item for using autocomplete in known fields.
2026-04-10 23:13:16 +02:00
Bogdan Cerovac af1f09634a Update accessibility checklist for skip-to-content link
Clarified the requirement for the skip-to-content link to be visible on keyboard focus - as it is mostly beneficial to users that can see the screen (but also others)
2026-04-10 23:07:48 +02:00
Joan Leon 22df069c40 docs(perf): update image best practices and TTFB thresholds based on feedback
- Add width/height to <source> elements for correct aspect-ratio in art direction.
- Use realistic 'sizes' attributes in hero image examples.
- Remove 'decoding=sync' from hero images to avoid blocking the main thread.
- Align TTFB 'good' threshold with web.dev standards (800ms).
2026-04-08 11:24:16 +02:00
Joan Leon 7a9887cedb Refine performance-optimization skill and checklist based on feedback
- Optimize Hero/LCP images: use aspect-ratio, fetchpriority="high", and decoding="sync".
- Optimize below-the-fold images: add decoding="async" alongside loading="lazy".
- Update tree-shaking advice: clarify ESM and sideEffects: false requirements.
- Add Suspense wrapper to code-splitting examples for completeness.
- Ensure image checks include both dimensions and aspect-ratio as non-exclusive.
2026-04-08 08:37:26 +02:00
Joan Leon c2c4f56d05 Improve performance-optimization skill with clearer guidance
- Distinguish synthetic (Lighthouse) vs RUM (web-vitals) measurement approaches,
  clarifying when each is appropriate: synthetic for CI regression detection,
  RUM to validate real user impact.

- Expand TTFB diagnosis from a single vague hint into a decision tree that breaks
  down each component (DNS, TCP/TLS, server processing) with specific next steps.
  Mirrors the tree in the skill and adds a dedicated checklist section.

- Fix image optimization example: the previous "GOOD" example applied loading="lazy"
  without distinguishing the LCP hero image from below-the-fold images. Hero images
  must never be lazy-loaded. New example separates both cases explicitly.

- Add art direction + resolution switching to the hero image example using <picture>
  with media queries for mobile/desktop crops and srcset for density variants.
  Mobile-first: <img src> fallback points to the mobile version.
  Covers AVIF → WebP → JPG format cascade and fetchpriority="high" for LCP.

- Correct the date-fns tree-shaking example: modern bundlers (Vite, webpack 5+)
  handle named imports automatically. The "BAD" pattern was not actually bad,
  and following it could lead to unnecessary micro-optimizations. Real gains
  come from dynamic imports and route-level code splitting, which the example
  now illustrates instead.
2026-04-08 00:25:19 +02:00
Federico Bartoli fea75b1647 Align skill descriptions with Anthropic best practices
Update all SKILL.md descriptions to lead with what the skill does
(third person) followed by trigger conditions, per Anthropic's
skill authoring docs. All original trigger conditions preserved.
Update description max chars to match Anthropic spec (1024).
Retain workflow-summary warning in skill-anatomy.md to prevent
agents from following descriptions instead of reading full skills.
Add Table of Contents to reference files longer than 100 lines so
Claude can see the full scope of available information even when
previewing with partial reads.
2026-03-31 22:41:45 +02:00
Addy Osmani dfba53259a add references and examples 2026-02-15 14:28:33 -08:00