mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-20 05:29:28 +00:00
chore: add kiro spec-driven tooling and steering docs
Add the Kiro-style agentic SDLC tooling used to drive this project: the .opencode/skills/kiro-* skill set (discovery, spec init/requirements/design/ tasks, validation, implementation, review, steering), the .kiro/settings templates, and AGENTS.md describing the workflow. Update the spec docs (assessment/design/requirements/tasks) to current state. Scope tests/test_opencode_skills.py to the project's own openultrasast-* skills so the third-party kiro-* tooling (which uses a different frontmatter convention) no longer breaks the frontmatter check. Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
co-authored by
Claude Opus 4.8
parent
8fe8911020
commit
6699f1f8f9
@@ -0,0 +1,49 @@
|
||||
# EARS Format Guidelines
|
||||
|
||||
## Overview
|
||||
EARS (Easy Approach to Requirements Syntax) is the standard format for acceptance criteria in spec-driven development.
|
||||
|
||||
EARS patterns describe the logical structure of a requirement (condition + subject + response) and are not tied to any particular natural language.
|
||||
All acceptance criteria should be written in the target language configured for the specification (for example, `spec.json.language` / `en`).
|
||||
Keep EARS trigger keywords and fixed phrases in English (`When`, `If`, `While`, `Where`, `The system shall`, `The [system] shall`) and localize only the variable parts (`[event]`, `[precondition]`, `[trigger]`, `[feature is included]`, `[response/action]`) into the target language. Do not interleave target-language text inside the trigger or fixed English phrases themselves.
|
||||
|
||||
## Primary EARS Patterns
|
||||
|
||||
### 1. Event-Driven Requirements
|
||||
- **Pattern**: When [event], the [system] shall [response/action]
|
||||
- **Use Case**: Responses to specific events or triggers
|
||||
- **Example**: When user clicks checkout button, the Checkout Service shall validate cart contents
|
||||
|
||||
### 2. State-Driven Requirements
|
||||
- **Pattern**: While [precondition], the [system] shall [response/action]
|
||||
- **Use Case**: Behavior dependent on system state or preconditions
|
||||
- **Example**: While payment is processing, the Checkout Service shall display loading indicator
|
||||
|
||||
### 3. Unwanted Behavior Requirements
|
||||
- **Pattern**: If [trigger], the [system] shall [response/action]
|
||||
- **Use Case**: System response to errors, failures, or undesired situations
|
||||
- **Example**: If invalid credit card number is entered, then the website shall display error message
|
||||
|
||||
### 4. Optional Feature Requirements
|
||||
- **Pattern**: Where [feature is included], the [system] shall [response/action]
|
||||
- **Use Case**: Requirements for optional or conditional features
|
||||
- **Example**: Where the car has a sunroof, the car shall have a sunroof control panel
|
||||
|
||||
### 5. Ubiquitous Requirements
|
||||
- **Pattern**: The [system] shall [response/action]
|
||||
- **Use Case**: Always-active requirements and fundamental system properties
|
||||
- **Example**: The mobile phone shall have a mass of less than 100 grams
|
||||
|
||||
## Combined Patterns
|
||||
- While [precondition], when [event], the [system] shall [response/action]
|
||||
- When [event] and [additional condition], the [system] shall [response/action]
|
||||
|
||||
## Subject Selection Guidelines
|
||||
- **Software Projects**: Use concrete system/service name (e.g., "Checkout Service", "User Auth Module")
|
||||
- **Process/Workflow**: Use responsible team/role (e.g., "Support Team", "Review Process")
|
||||
- **Non-Software**: Use appropriate subject (e.g., "Marketing Campaign", "Documentation")
|
||||
|
||||
## Quality Criteria
|
||||
- Requirements must be testable, verifiable, and describe a single behavior.
|
||||
- Use objective language: "shall" for mandatory behavior, "should" for recommendations; avoid ambiguous terms.
|
||||
- Follow EARS syntax: [condition], the [system] shall [response/action].
|
||||
@@ -0,0 +1,51 @@
|
||||
# Requirements Review Gate
|
||||
|
||||
Before writing `requirements.md`, review the draft requirements and repair local issues until the draft passes or a true scope ambiguity is discovered.
|
||||
|
||||
## Boundary Continuity
|
||||
|
||||
Use boundary terminology consistently across phases without turning requirements into design:
|
||||
|
||||
- **Discovery** identifies `Boundary Candidates`
|
||||
- **Requirements** make inclusion, exclusion, and adjacent expectations explicit when scope could be misread
|
||||
- **Design** turns those into `Boundary Commitments`
|
||||
- **Tasks** use `_Boundary:_` to constrain executable work
|
||||
|
||||
Requirements should clarify the feature boundary in user- or operator-observable terms, not in architecture ownership or implementation detail.
|
||||
|
||||
## Scope and Coverage Review
|
||||
|
||||
- The draft must cover the feature's core user journeys, major scope boundaries, primary error cases, and meaningful edge conditions that are visible to the user or operator.
|
||||
- If the feature touches adjacent systems, specs, or workflows, the draft must make clear what this feature expects from them and what it does not own when that distinction affects user-visible behavior or operator expectations.
|
||||
- Business/domain rules, compliance constraints, security/privacy expectations, and operational constraints that materially shape user-visible behavior must be reflected explicitly when they are in scope.
|
||||
- If coverage is missing because the draft is incomplete, repair the draft and review again.
|
||||
- If coverage cannot be completed cleanly because the project description or steering context is ambiguous, contradictory, or underspecified, stop and ask the user to clarify instead of guessing.
|
||||
|
||||
## EARS and Testability Review
|
||||
|
||||
- Every acceptance criterion must follow the EARS rules defined in `ears-format.md`.
|
||||
- Every requirement must be testable, observable, and specific enough that later design and validation can verify it.
|
||||
- Remove implementation details that belong in `design.md` rather than `requirements.md`.
|
||||
- Requirement headings must use numeric IDs only; do not mix numeric and alphabetic labels.
|
||||
|
||||
## Structure and Quality Review
|
||||
|
||||
- Group related behaviors into coherent requirement areas without duplicating the same obligation across multiple sections.
|
||||
- Make inclusion/exclusion boundaries explicit when the feature scope could otherwise be misread.
|
||||
- Keep boundary statements lightweight and observable: describe feature responsibility and adjacent expectations without prescribing components, layers, or internal ownership.
|
||||
- Ensure non-functional expectations remain user-observable or operator-observable; move technology choices and internal architecture detail out of requirements.
|
||||
- Normalize vague language such as "fast", "robust", or "secure" into concrete user-visible expectations whenever the source material supports it.
|
||||
|
||||
## Mechanical Checks
|
||||
|
||||
Before applying judgment, verify these mechanically:
|
||||
- **Numeric IDs present**: Every requirement heading has a numeric ID (1, 1.1, 2, etc.). Scan the draft for headings without IDs.
|
||||
- **Acceptance criteria exist**: Every requirement has at least one EARS-format acceptance criterion. Scan for requirements with no "When/If/While/Where" acceptance statements.
|
||||
- **No implementation language**: Scan for technology-specific terms (database names, framework names, API patterns) that belong in design, not requirements. Flag any found.
|
||||
|
||||
## Review Loop
|
||||
|
||||
- Run mechanical checks first, then judgment-based review.
|
||||
- If issues are local to the draft, repair the draft and re-run the review gate.
|
||||
- Keep the loop bounded: no more than 2 review-and-repair passes before escalating a real ambiguity back to the user.
|
||||
- Write `requirements.md` only after the review gate passes.
|
||||
Reference in New Issue
Block a user