mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-18 12:39:28 +00:00
chore: add kiro spec-driven tooling and steering docs
Add the Kiro-style agentic SDLC tooling used to drive this project: the .opencode/skills/kiro-* skill set (discovery, spec init/requirements/design/ tasks, validation, implementation, review, steering), the .kiro/settings templates, and AGENTS.md describing the workflow. Update the spec docs (assessment/design/requirements/tasks) to current state. Scope tests/test_opencode_skills.py to the project's own openultrasast-* skills so the third-party kiro-* tooling (which uses a different frontmatter convention) no longer breaks the frontmatter check. Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
co-authored by
Claude Opus 4.8
parent
8fe8911020
commit
6699f1f8f9
@@ -0,0 +1,109 @@
|
||||
---
|
||||
name: kiro-validate-gap
|
||||
description: Analyze implementation gap between requirements and existing codebase
|
||||
metadata:
|
||||
shared-rules: "gap-analysis.md"
|
||||
---
|
||||
|
||||
|
||||
# Implementation Gap Validation
|
||||
|
||||
<background_information>
|
||||
- **Mission**: Analyze the gap between requirements and existing codebase to inform implementation strategy
|
||||
- **Success Criteria**:
|
||||
- Comprehensive understanding of existing codebase patterns and components
|
||||
- Clear identification of missing capabilities and integration challenges
|
||||
- Multiple viable implementation approaches evaluated
|
||||
- Technical research needs identified for design phase
|
||||
</background_information>
|
||||
|
||||
<instructions>
|
||||
## Core Task
|
||||
Analyze implementation gap for feature **$1** based on approved requirements and existing codebase.
|
||||
|
||||
## Execution Steps
|
||||
|
||||
1. **Load Context**:
|
||||
- Read `.kiro/specs/$1/spec.json` for language and metadata
|
||||
- Read `.kiro/specs/$1/requirements.md` for requirements
|
||||
- Core steering context: `product.md`, `tech.md`, `structure.md`
|
||||
- Additional steering files only when directly relevant to the feature's domain rules, integrations, runtime prerequisites, compliance/security constraints, or existing product boundaries
|
||||
- Relevant local agent skills or playbooks only when they clearly match the feature's host environment or use case and provide analysis-relevant context
|
||||
|
||||
2. **Read Analysis Guidelines**:
|
||||
- Read `rules/gap-analysis.md` from this skill's directory for comprehensive analysis framework
|
||||
|
||||
#### Parallel Research
|
||||
|
||||
The following research areas are independent and can be executed in parallel:
|
||||
1. **Codebase analysis**: Existing implementations, architecture patterns, integration points, extension possibilities
|
||||
2. **External dependency research**: Dependency compatibility, version constraints, known integration challenges (when needed)
|
||||
3. **Context loading**: Requirements, core steering, task-relevant extra steering, relevant local agent skills/playbooks, and gap-analysis rules
|
||||
|
||||
If multi-agent is enabled, spawn sub-agents for each area above. Otherwise execute sequentially.
|
||||
|
||||
After all parallel research completes, synthesize findings for gap analysis.
|
||||
|
||||
3. **Execute Gap Analysis**:
|
||||
- Follow gap-analysis.md framework for thorough investigation
|
||||
- Analyze existing codebase using Grep and Read tools
|
||||
- Use WebSearch/WebFetch for external dependency research if needed
|
||||
- Evaluate multiple implementation approaches (extend/new/hybrid)
|
||||
- Use language specified in spec.json for output
|
||||
|
||||
4. **Generate Analysis Document**:
|
||||
- Create comprehensive gap analysis following the output guidelines in gap-analysis.md
|
||||
- Present multiple viable options with trade-offs
|
||||
- Flag areas requiring further research
|
||||
|
||||
5. **Write Gap Analysis to Disk**:
|
||||
|
||||
**Write the gap analysis to disk so it survives session boundaries and can be referenced during design phase.**
|
||||
|
||||
- Save the gap analysis to `.kiro/specs/$1/research.md`
|
||||
- If the file already exists, append the new analysis (separated by a horizontal rule `---`) rather than overwriting previous research
|
||||
- Verify the file was written by reading it back
|
||||
|
||||
## Important Constraints
|
||||
- **Information over Decisions**: Provide analysis and options, not final implementation choices
|
||||
- **Multiple Options**: Present viable alternatives when applicable
|
||||
- **Thorough Investigation**: Use tools to deeply understand existing codebase
|
||||
- **Explicit Gaps**: Clearly flag areas needing research or investigation
|
||||
- **Context Discipline**: Start with core steering and expand only with analysis-relevant steering or use-case-aligned local agent skills/playbooks
|
||||
</instructions>
|
||||
|
||||
## Tool Guidance
|
||||
- **Read first**: Load spec, core steering, relevant local playbooks/agent skills, and rules before analysis
|
||||
- **Grep extensively**: Search codebase for patterns, conventions, and integration points
|
||||
- **WebSearch/WebFetch**: Research external dependencies and best practices when needed
|
||||
- **Write last**: Generate analysis only after complete investigation
|
||||
|
||||
## Output Description
|
||||
Provide output in the language specified in spec.json with:
|
||||
|
||||
1. **Analysis Summary**: Brief overview (3-5 bullets) of scope, challenges, and recommendations
|
||||
2. **Document Status**: Confirm analysis approach used
|
||||
3. **Next Steps**: Guide user on proceeding to design phase
|
||||
|
||||
**Format Requirements**:
|
||||
- Use Markdown headings for clarity
|
||||
- Keep summary concise (under 300 words)
|
||||
- Detailed analysis follows gap-analysis.md output guidelines
|
||||
|
||||
## Safety & Fallback
|
||||
|
||||
### Error Scenarios
|
||||
- **Missing Requirements**: If requirements.md doesn't exist, stop with message: "Run `/kiro-spec-requirements $1` first to generate requirements"
|
||||
- **Requirements Not Approved**: If requirements not approved, warn user but proceed (gap analysis can inform requirement revisions)
|
||||
- **Empty Steering Directory**: Warn user that project context is missing and may affect analysis quality
|
||||
- **Complex Integration Unclear**: Flag for comprehensive research in design phase rather than blocking
|
||||
- **Language Undefined**: Default to English (`en`) if spec.json doesn't specify language
|
||||
|
||||
### Next Phase: Design Generation
|
||||
|
||||
**If Gap Analysis Complete**:
|
||||
- Review gap analysis insights
|
||||
- Run `/kiro-spec-design $1` to create technical design document
|
||||
- Or `/kiro-spec-design $1 -y` to auto-approve requirements and proceed directly
|
||||
|
||||
**Note**: Gap analysis is optional but recommended for brownfield projects to inform design decisions.
|
||||
@@ -0,0 +1,144 @@
|
||||
# Gap Analysis Process
|
||||
|
||||
## Objective
|
||||
Analyze the gap between requirements and existing codebase to inform implementation strategy decisions.
|
||||
|
||||
## Analysis Framework
|
||||
|
||||
### 1. Current State Investigation
|
||||
|
||||
- Scan for domain-related assets:
|
||||
- Key files/modules and directory layout
|
||||
- Reusable components/services/utilities
|
||||
- Dominant architecture patterns and constraints
|
||||
|
||||
- Extract conventions:
|
||||
- Naming, layering, dependency direction
|
||||
- Import/export patterns and dependency hotspots
|
||||
- Testing placement and approach
|
||||
|
||||
- Note integration surfaces:
|
||||
- Data models/schemas, API clients, auth mechanisms
|
||||
|
||||
### 2. Requirements Feasibility Analysis
|
||||
|
||||
- From EARS requirements, list technical needs:
|
||||
- Data models, APIs/services, UI/components
|
||||
- Business rules/validation
|
||||
- Non-functionals: security, performance, scalability, reliability
|
||||
|
||||
- Identify gaps and constraints:
|
||||
- Missing capabilities in current codebase
|
||||
- Unknowns to be researched later (mark as "Research Needed")
|
||||
- Constraints from existing architecture and patterns
|
||||
|
||||
- Note complexity signals:
|
||||
- Simple CRUD / algorithmic logic / workflows / external integrations
|
||||
|
||||
### 3. Implementation Approach Options
|
||||
|
||||
#### Option A: Extend Existing Components
|
||||
**When to consider**: Feature fits naturally into existing structure
|
||||
|
||||
- **Which files/modules to extend**:
|
||||
- Identify specific files requiring changes
|
||||
- Assess impact on existing functionality
|
||||
- Evaluate backward compatibility concerns
|
||||
|
||||
- **Compatibility assessment**:
|
||||
- Check if extension respects existing interfaces
|
||||
- Verify no breaking changes to consumers
|
||||
- Assess test coverage impact
|
||||
|
||||
- **Complexity and maintainability**:
|
||||
- Evaluate cognitive load of additional functionality
|
||||
- Check if single responsibility principle is maintained
|
||||
- Assess if file size remains manageable
|
||||
|
||||
**Trade-offs**:
|
||||
- ✅ Minimal new files, faster initial development
|
||||
- ✅ Leverages existing patterns and infrastructure
|
||||
- ❌ Risk of bloating existing components
|
||||
- ❌ May complicate existing logic
|
||||
|
||||
#### Option B: Create New Components
|
||||
**When to consider**: Feature has distinct responsibility or existing components are already complex
|
||||
|
||||
- **Rationale for new creation**:
|
||||
- Clear separation of concerns justifies new file
|
||||
- Existing components are already complex
|
||||
- Feature has distinct lifecycle or dependencies
|
||||
|
||||
- **Integration points**:
|
||||
- How new components connect to existing system
|
||||
- APIs or interfaces exposed
|
||||
- Dependencies on existing components
|
||||
|
||||
- **Responsibility boundaries**:
|
||||
- Clear definition of what new component owns
|
||||
- Interfaces with existing components
|
||||
- Data flow and control flow
|
||||
|
||||
**Trade-offs**:
|
||||
- ✅ Clean separation of concerns
|
||||
- ✅ Easier to test in isolation
|
||||
- ✅ Reduces complexity in existing components
|
||||
- ❌ More files to navigate
|
||||
- ❌ Requires careful interface design
|
||||
|
||||
#### Option C: Hybrid Approach
|
||||
**When to consider**: Complex features requiring both extension and new creation
|
||||
|
||||
- **Combination strategy**:
|
||||
- Which parts extend existing components
|
||||
- Which parts warrant new components
|
||||
- How they interact
|
||||
|
||||
- **Phased implementation**:
|
||||
- Initial phase: minimal viable changes
|
||||
- Subsequent phases: refactoring or new components
|
||||
- Migration strategy if needed
|
||||
|
||||
- **Risk mitigation**:
|
||||
- Incremental rollout approach
|
||||
- Feature flags or configuration
|
||||
- Rollback strategy
|
||||
|
||||
**Trade-offs**:
|
||||
- ✅ Balanced approach for complex features
|
||||
- ✅ Allows iterative refinement
|
||||
- ❌ More complex planning required
|
||||
- ❌ Potential for inconsistency if not well-coordinated
|
||||
### 4. Out-of-Scope for Gap Analysis
|
||||
|
||||
- Defer deep research activities to the design phase.
|
||||
- Record unknowns as concise "Research Needed" items only.
|
||||
|
||||
### 5. Implementation Complexity & Risk
|
||||
|
||||
- Effort:
|
||||
- S (1–3 days): existing patterns, minimal deps, straightforward integration
|
||||
- M (3–7 days): some new patterns/integrations, moderate complexity
|
||||
- L (1–2 weeks): significant functionality, multiple integrations or workflows
|
||||
- XL (2+ weeks): architectural changes, unfamiliar tech, broad impact
|
||||
- Risk:
|
||||
- High: unknown tech, complex integrations, architectural shifts, unclear perf/security path
|
||||
- Medium: new patterns with guidance, manageable integrations, known perf solutions
|
||||
- Low: extend established patterns, familiar tech, clear scope, minimal integration
|
||||
|
||||
### Output Checklist
|
||||
|
||||
- Requirement-to-Asset Map with gaps tagged (Missing / Unknown / Constraint)
|
||||
- Options A/B/C with short rationale and trade-offs
|
||||
- Effort (S/M/L/XL) and Risk (High/Medium/Low) with one-line justification each
|
||||
- Recommendations for design phase:
|
||||
- Preferred approach and key decisions
|
||||
- Research items to carry forward
|
||||
|
||||
## Principles
|
||||
|
||||
- **Information over decisions**: Provide analysis and options, not final choices
|
||||
- **Multiple viable options**: Offer credible alternatives when applicable
|
||||
- **Explicit gaps and assumptions**: Flag unknowns and constraints clearly
|
||||
- **Context-aware**: Align with existing patterns and architecture limits
|
||||
- **Transparent effort and risk**: Justify labels succinctly
|
||||
Reference in New Issue
Block a user