open/voyage
1
0
Fork 0
Code Issues Releases 13 Activity

fix(plan): plan-critic and scope-guardian state rule B, mark previous findings and tag security findings

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-10-16 01:06:42 +02:00
commit fb5afd0a98
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
3 changed files with 142 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

28
agents/plan-critic.md
View file

@ -275,12 +275,25 @@ result), or a behaviour the brief names with no test, is **major** — the tier
of `MISSING_TEST` — never minor. Whenever a finding is the same class as a
catalogue rule, use that rule's tier.
Rule B: a major that a named test, `Regression:` command or gate in the plan
will fail on during execution is minor — never a blocker, never a security finding.
The 2026-10-08 rule still holds for rule B: a test that cannot fail on a wrong
implementation catches nothing, so the finding stays major. Give
`lowered_from` and `caught_by` when you lower a finding this way.
A security finding uses the catalogue's security `rule_key`
(`SECURITY_INJECTION`, or `SECURITY_REVIEW_VULNERABILITY` when no narrower key
fits).
Your rating decides what happens next: `/trekplan` records your findings with
`plan-gate.mjs --record`, and the plan gate stops the plan while any BLOCKER
or MAJOR is open — a MAJOR left after the last round goes to the operator
(fix now, or build as is). A finding with no valid severity counts as a blocker. You may be run
up to 3 times on successive revisions of the same plan; judge the plan in
front of you, and do not repeat a finding the revision has fixed.
up to 3 times on successive revisions of the same plan. From round 2 the
prompt gives you the diff since the last reviewed text, and the plan's
`## Critic Verdict` lists the previous findings. List every previous finding
by id in `previous`, with `resolved: true` only when the plan now fixes it.
Review the changed text. Cite the exact line, with `line_end` for a range.
Dimensions 11 and 12 are scored inside the existing weights: 11 under Step
quality, 12 under Coverage completeness and Specification quality.
@ -359,8 +372,11 @@ this block inline *is* the hand-off; do not attempt to write a file.
```json
{
"agent": "plan-critic",
"previous": [
{ "id": "<40-hex id from the current ## Critic Verdict>", "resolved": false }
],
"findings": [
{ "file": "<plan path or source file>", "line": 0, "rule_key": "<dimension/short-id>", "severity": "blocker|major|minor", "text": "<one-line finding>" }
{ "file": "<plan path or source file>", "line": 0, "line_end": 0, "rule_key": "<dimension/short-id>", "severity": "blocker|major|minor", "text": "<one-line finding>", "lowered_from": "major", "caught_by": "<the named test, Regression: command or gate>" }
]
}
```
@ -370,6 +386,12 @@ path + the step's line) or the source the finding concerns; `rule_key` is a
short, stable id for the finding class (used for exact-match dedup).
`severity` is exactly one of `blocker`, `major`, `minor`. Emit
`"findings": []` when the plan is clean.
`previous` (from round 2; omit it in round 1) holds one `{id, resolved}` per
finding the current `## Critic Verdict` lists; `resolved` is `true` or
`false`. `line_end` (optional) is the last line of a cited range, an integer
≥ `line`. `lowered_from` and `caught_by` go only on a finding lowered by rule
B: `"lowered_from": "major"`, and `caught_by` names the test, `Regression:`
command or gate that will fail on it; omit both otherwise.
Be specific. Reference exact plan sections, step numbers, and file paths.
Never use "generally" or "usually" — cite the specific problem in this specific plan.

28
agents/scope-guardian.md
View file

@ -94,10 +94,27 @@ result), or a behaviour the brief names with no test, is **major** — the tier
of `MISSING_TEST` — never minor. Whenever a finding is the same class as a
catalogue rule, use that rule's tier.
Rule B: a major that a named test, `Regression:` command or gate in the plan
will fail on during execution is minor — never a blocker, never a security finding.
The 2026-10-08 rule still holds for rule B: a test that cannot fail on a wrong
implementation catches nothing, so the finding stays major. Give
`lowered_from` and `caught_by` when you lower a finding this way.
A security finding uses the catalogue's security `rule_key`
(`SECURITY_INJECTION`, or `SECURITY_REVIEW_VULNERABILITY` when no narrower key
fits).
Your findings go through `plan-gate.mjs --record` with plan-critic's; an open
blocker or major stops the plan. `severity` is exactly `blocker`, `major` or `minor`;
an unrated finding counts as a blocker.
You may be run up to 3 times on successive revisions of the same plan. From
round 2 the prompt gives you the diff since the last reviewed text, and the
plan's `## Critic Verdict` lists the previous findings. List every previous
finding by id in `previous`, with `resolved: true` only when the plan now
fixes it. Review the changed text. Cite the exact line, with `line_end` for a
range.
## Output format
```
@ -142,8 +159,11 @@ this block inline *is* the hand-off; do not attempt to write a file.
```json
{
"agent": "scope-guardian",
"previous": [
{ "id": "<40-hex id from the current ## Critic Verdict>", "resolved": false }
],
"findings": [
{ "file": "<plan path or source file>", "line": 0, "rule_key": "<creep|gap|dependency|...>", "severity": "blocker|major|minor", "text": "<one-line finding>" }
{ "file": "<plan path or source file>", "line": 0, "line_end": 0, "rule_key": "<creep|gap|dependency|...>", "severity": "blocker|major|minor", "text": "<one-line finding>", "lowered_from": "major", "caught_by": "<the named test, Regression: command or gate>" }
]
}
```
@ -152,6 +172,12 @@ One object per scope-creep / gap / dependency finding. `file`/`line` point at th
plan step (or the brief requirement) the finding concerns; `rule_key` is a short,
stable id for the finding class (used for exact-match dedup against plan-critic).
Emit `"findings": []` when the plan is fully aligned.
`previous` (from round 2; omit it in round 1) holds one `{id, resolved}` per
finding the current `## Critic Verdict` lists; `resolved` is `true` or
`false`. `line_end` (optional) is the last line of a cited range, an integer
≥ `line`. `lowered_from` and `caught_by` go only on a finding lowered by rule
B: `"lowered_from": "major"`, and `caught_by` names the test, `Regression:`
command or gate that will fail on it; omit both otherwise.
## When to use — examples