From 9cf27d10ae16b9cf45b15ca9be91871f602d6e8a Mon Sep 17 00:00:00 2001 From: Baptiste LAFOURCADE Date: Sun, 11 Oct 2026 21:17:10 +0200 Subject: [PATCH] fix(aidd-dev): name one severity scale across assert, audit and refactor The review grades findings critical, major, minor since #977, but assert's architecture check, the audit template and refactor still named the middle level `warning`. An audit feeds refactor and the review grades the same code, so one severity carried two names depending on the skill that wrote it. `warning` becomes `major` in the three skills, with the audit's definition unchanged. A guard fails on any `warning` left in an aidd-dev skill, and one per skill pins its scale; each goes red under its own mutation. Measured with `claude -p` against the plugin from this tree: three code-quality audits counted `0 critical, 1 major, 3 minor`, and two architecture checks rated their violations `major`. No run wrote `warning`. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01VE16AxC1V9wAMGmGgefe4z --- .../actions/02-assert-architecture.md | 2 +- .../skills/04-audit/assets/audit-template.md | 4 +- plugins/aidd-dev/skills/07-refactor/SKILL.md | 2 +- ...idd-dev-severities-share-one-scale.test.js | 47 +++++++++++++++++++ 4 files changed, 51 insertions(+), 4 deletions(-) create mode 100644 scripts/__tests__/aidd-dev-severities-share-one-scale.test.js diff --git a/plugins/aidd-dev/skills/03-assert/actions/02-assert-architecture.md b/plugins/aidd-dev/skills/03-assert/actions/02-assert-architecture.md index cea6c9813..5173abb4f 100644 --- a/plugins/aidd-dev/skills/03-assert/actions/02-assert-architecture.md +++ b/plugins/aidd-dev/skills/03-assert/actions/02-assert-architecture.md @@ -15,7 +15,7 @@ A conformance report listing each violation, grouped macro and micro, with sever 1. **Load.** Read the architecture sources: the architecture memory, the micro diagrams for an in-scope module, and the decision records. Extract the expected project tree. 2. **Macro.** Compare the code structure against the documented tree. Flag files outside their boundary and direct imports between independent services. 3. **Micro.** For each in-scope module, check import directions against the layer constraints. The domain layer imports nothing external. The application layer reaches the domain only through ports. No circular dependencies. Adapters implement their interfaces. -4. **Report.** One entry per violation, grouped macro and micro, each with severity (`critical` or `warning`), file, constraint, and a one-line fix. +4. **Report.** One entry per violation, grouped macro and micro, each with severity (`critical` or `major`), file, constraint, and a one-line fix. 5. **Summarize.** The total violations, the critical count, and the recommended next actions. ## Test diff --git a/plugins/aidd-dev/skills/04-audit/assets/audit-template.md b/plugins/aidd-dev/skills/04-audit/assets/audit-template.md index 6566f8ccc..82e7b9670 100644 --- a/plugins/aidd-dev/skills/04-audit/assets/audit-template.md +++ b/plugins/aidd-dev/skills/04-audit/assets/audit-template.md @@ -11,7 +11,7 @@ argument-hint: N/A - **Date**: {{yyyy_mm_dd}} - **Scope**: {{scope}} - **Health**: {{good | fair | poor}} -- **Findings**: {{n_critical}} critical, {{n_warning}} warning, {{n_minor}} minor +- **Findings**: {{n_critical}} critical, {{n_major}} major, {{n_minor}} minor Health: `good` = no critical findings; `fair` = critical findings exist but are isolated and addressable; `poor` = systemic or widespread critical findings. @@ -21,7 +21,7 @@ One row per issue. Every row MUST cite a concrete `file:line`. Sort by severity Severity (shared rubric across every audit pillar, so a full audit ranks consistently): - 🔴 critical - exploitable security hole, data loss, or broken correctness. Fix now. -- 🟡 warning - real debt or risk that will bite later. Fix soon. +- 🟡 major - real debt or risk that will bite later. Fix soon. - 🟢 minor - nit or cleanup. Fix when convenient. Effort: `S` (under 1h), `M` (under 1d), `L` (over 1d). diff --git a/plugins/aidd-dev/skills/07-refactor/SKILL.md b/plugins/aidd-dev/skills/07-refactor/SKILL.md index bcfabc6fd..6b00f42eb 100644 --- a/plugins/aidd-dev/skills/07-refactor/SKILL.md +++ b/plugins/aidd-dev/skills/07-refactor/SKILL.md @@ -25,5 +25,5 @@ Before running an action, read its file in `actions/`, not only the table or ass - Scope: run the one named axis, or for an unscoped request ask once "all applicable axes, or one?" before running. A request to delete or remove code runs `cleanup` directly, with no axis question. Never silently default to one axis. - Behavior-preserving for cleanup, performance, and architecture: public inputs and outputs stay identical, verified by tests, type checks, or a side-by-side run. Security may alter behavior to close a vulnerability, and must call that out explicitly. - Audit-fed, optional: when the caller pushes an audit report (a path under `aidd_docs/tasks/audits/` or pasted findings), take its findings for this axis as the fix list and skip the scan. The bridge is the report artifact; this skill never loads or calls another skill. The audit `code-quality` pillar feeds the `cleanup` axis; the other axes map by name. -- Severity uses the shared 3-level scale: 🔴 critical, 🟡 warning, 🟢 minor. +- Severity uses the shared 3-level scale: 🔴 critical, 🟡 major, 🟢 minor. - Stay inside the axis: dependency upgrades and UI redesign are out of scope. Add tests only as a regression for a security fix, never otherwise. diff --git a/scripts/__tests__/aidd-dev-severities-share-one-scale.test.js b/scripts/__tests__/aidd-dev-severities-share-one-scale.test.js new file mode 100644 index 000000000..edba76cb7 --- /dev/null +++ b/scripts/__tests__/aidd-dev-severities-share-one-scale.test.js @@ -0,0 +1,47 @@ +const assert = require("node:assert/strict"); +const fs = require("node:fs"); +const path = require("node:path"); +const { describe, it } = require("node:test"); + +const SKILLS = path.resolve(__dirname, "../../plugins/aidd-dev/skills"); + +/** + * An audit feeds refactor, and assert and review grade the same code: a finding keeps its severity + * from one skill to the next only when every skill names the same three levels. + */ + +function read(relative) { + return fs.readFileSync(path.join(SKILLS, relative), "utf8"); +} + +function everyMarkdown(directory, into) { + for (const entry of fs.readdirSync(directory, { withFileTypes: true })) { + const full = path.join(directory, entry.name); + if (entry.isDirectory()) everyMarkdown(full, into); + else if (entry.name.endsWith(".md")) into.push(full); + } + return into; +} + +describe("aidd-dev severities share one scale", () => { + it("no skill names a severity the scale does not have", () => { + const strays = everyMarkdown(SKILLS, []) + .filter((file) => /\bwarning\b/iu.test(fs.readFileSync(file, "utf8"))) + .map((file) => path.relative(SKILLS, file)); + assert.deepEqual(strays, []); + }); + + it("an audit counts and defines its findings as critical, major, minor", () => { + const template = read("04-audit/assets/audit-template.md"); + assert.match(template, /\{\{n_critical\}\} critical, \{\{n_major\}\} major, \{\{n_minor\}\} minor/u); + assert.match(template, /^- 🟡 major - /mu); + }); + + it("refactor reads an audit's findings on the same scale", () => { + assert.match(read("07-refactor/SKILL.md"), /🔴 critical, 🟡 major, 🟢 minor/u); + }); + + it("an architecture violation is critical or major", () => { + assert.match(read("03-assert/actions/02-assert-architecture.md"), /severity \(`critical` or `major`\)/u); + }); +});