feat: add submitted skills review desk

2026-09-04 00:34:53 -03:00
parent a7034db94b
commit 82fff29571
57 changed files with 3380 additions and 1 deletions
@@ -0,0 +1,19 @@
+---
+name: am-i-free
+description: Calculate elapsed work time from the Long Day Factory shift record. Use when the user asks whether they can leave or how much time remains.
+---
+
+# am-i-free
+
+## Workflow
+1. Run `python3 scripts/am_i_free.py`.
+2. Interpret its documented exit code. Ask before any option that writes an assumed lunch break.
+3. Give the result, remaining time or release time, and a concise friendly message.
+
+## Rules
+- Treat malformed or missing state as a recovery question, not a calculation.
+- Read `references/state.md` for schema and timezone behavior.
+- Do not expose unrelated content from the local state file.
+
+## Output
+Report calculation status, remaining time or freedom, and any assumption made.
@@ -0,0 +1,19 @@
+---
+name: angular-access-modifiers
+description: Apply explicit TypeScript access modifiers to Angular component, directive, and pipe members. Use when editing or reviewing Angular class APIs in a repository that adopts this convention.
+---
+
+# angular-access-modifiers
+
+## Workflow
+1. Inspect the component’s template and callers before changing visibility.
+2. Use `protected` for template-facing members when the project supports it, `private` for implementation details, and `public` for intentional external APIs and lifecycle hooks.
+3. Keep existing framework-required visibility when a compiler or decorator requires it.
+4. Run the project typecheck and relevant template tests.
+
+## Rules
+- Do not change visibility only to satisfy a test; fix the test boundary or document the API.
+- Prefer the repository’s established Angular convention if it differs.
+
+## Output
+List changed members, their consumers, and verification results.
@@ -0,0 +1,20 @@
+---
+name: angular-accessibility
+description: Build and review Angular interfaces for accessible semantics, keyboard use, focus behavior, and clear status feedback. Use when changing Angular templates, forms, dialogs, navigation, or custom controls.
+---
+
+# angular-accessibility
+
+## Workflow
+1. Inspect the changed interaction and choose native semantic elements first.
+2. Check keyboard operation, focus order, visible focus, labels, errors, and dynamic announcements.
+3. Use Angular CDK or Material primitives when they provide the expected behavior.
+4. Run available accessibility checks and manually test the changed interaction by keyboard.
+
+## Rules
+- ARIA supplements native semantics; it does not replace them.
+- Do not claim WCAG conformance from one review.
+- Read `references/patterns.md` only for dialogs, tables, or custom composite controls.
+
+## Output
+Return changed issues, evidence, and any remaining manual checks.
@@ -0,0 +1,20 @@
+---
+name: angular-accessibility
+description: Build and review Angular interfaces for accessible semantics, keyboard use, focus behavior, and clear status feedback. Use when changing Angular templates, forms, dialogs, navigation, or custom controls.
+---
+
+# angular-accessibility
+
+## Workflow
+1. Inspect the changed interaction and choose native semantic elements first.
+2. Check keyboard operation, focus order, visible focus, labels, errors, and dynamic announcements.
+3. Use Angular CDK or Material primitives when they provide the expected behavior.
+4. Run available accessibility checks and manually test the changed interaction by keyboard.
+
+## Rules
+- ARIA supplements native semantics; it does not replace them.
+- Do not claim WCAG conformance from one review.
+- Read `references/patterns.md` only for dialogs, tables, or custom composite controls.
+
+## Output
+Return changed issues, evidence, and any remaining manual checks.
@@ -0,0 +1,18 @@
+---
+name: back-to-work
+description: Record the return time for a Long Day Factory lunch break. Use when the user says they have returned to work.
+---
+
+# back-to-work
+
+## Workflow
+1. Confirm the message is an instruction to record the current return time.
+2. Run `bash scripts/back.sh`.
+3. Surface any missing shift or lunch state and explain the next recovery action.
+
+## Rules
+- This command changes local shift state; do not run it for a hypothetical question.
+- Use the shared state schema in `references/state.md`.
+
+## Output
+Confirm the recorded timestamp and any state warning with a light, respectful tone.
@@ -0,0 +1,23 @@
+---
+name: backend-code-reviewer
+description: Review a scoped backend change for evidenced security, reliability, data-access, and API-boundary risks. Use when reviewing a backend diff; do not install tools or modify CI unless the user asks.
+---
+
+# backend-code-reviewer
+
+## Inputs
+A branch diff or changed backend paths and the project’s declared tooling.
+
+## Workflow
+1. Identify runtime, framework, and existing checks from the repository.
+2. Review changed data access, async boundaries, error handling, API contracts, secrets, and resource limits.
+3. Report findings only when a concrete path and consequence are visible; label hypotheses separately.
+4. Run existing, approved checks and include their evidence.
+
+## Rules
+- Do not download or pipe remote installers into a shell.
+- Do not claim missing indexes, retries, or architectural violations without repository evidence.
+- Read `references/rules.md` for framework-specific checks.
+
+## Output
+Return severity, location, evidence, impact, recommendation, and checks run.
@@ -0,0 +1,22 @@
+---
+name: code-style-review
+description: Run the configured formatter and static checks for a scoped code change. Use after editing code or before a review; discover project commands rather than assuming a stack.
+---
+
+# code-style-review
+
+## Inputs
+Changed files and the repository root.
+
+## Workflow
+1. Inspect package/build configuration for the project’s documented lint, format, and style commands.
+2. Run the narrowest relevant check first. Apply formatting only to the requested files unless the user asks for a wider change.
+3. Review the diff for accidental rewrites, then rerun the same checks.
+
+## Rules
+- Do not invent directories or install tools without approval.
+- Report unavailable checks as not run, not passed.
+- Treat unused-code removal as a separate semantic change.
+
+## Output
+List each command, result, changed files, and any remaining failure.
@@ -0,0 +1,20 @@
+---
+name: codebase-map
+description: Maintain FEATURE_MAP.md as a concise, verified index of feature entry points. Use before locating code for a change and after a change moves or adds an entry point.
+---
+
+# codebase-map
+
+## Workflow
+1. If `FEATURE_MAP.md` exists, check whether the relevant entry path still exists.
+2. Use a valid entry as the starting point; otherwise search normally.
+3. After locating the feature, update the existing entry or add one concise entry point.
+4. Run `scripts/check-feature-map.mjs` when available.
+
+## Rules
+- Preserve a stale entry until a replacement is known, then update it in the same edit.
+- Index features and flows, not every file.
+- Do not make map edits when a change leaves entry points unchanged.
+
+## Output
+State whether the map was used, changed, or unavailable.
@@ -0,0 +1,23 @@
+---
+name: confectionery-orders
+description: Create or prepare a confectionery order from confirmed customer and item details. Use when a user asks to register an order or counter sale; confirm before sending it to an external system.
+---
+
+# confectionery-orders
+
+## Inputs
+Customer, pickup or delivery choice, items, quantities, prices, and optional discount.
+
+## Workflow
+1. Validate required fields and positive quantities.
+2. Calculate the proposed total and show a concise order summary.
+3. Ask for confirmation before creating or transmitting an order.
+4. Return the saved identifier or a clearly labeled draft.
+
+## Rules
+- Do not invent recipe availability, prices, addresses, or customer details.
+- Keep payment and personal data out of logs.
+- Read `references/order-schema.md` when mapping to the order system.
+
+## Output
+Return a valid order payload plus validation warnings and confirmation state.
@@ -0,0 +1,24 @@
+---
+name: copy-quote-info-to-payload
+description: Populate a quote-command skeleton from quote data without fabricating values. Use when a quote JSON and command skeleton are supplied and the user asks to create a populated command.
+---
+
+# copy-quote-info-to-payload
+
+## Inputs
+One source quote JSON and one target command skeleton.
+
+## Workflow
+1. Identify source and target; ask when the roles are ambiguous.
+2. Parse both documents and start from the target structure.
+3. Apply the mappings in `reference.md`; preserve unmatched target fields and item order.
+4. Validate that the resulting document is valid JSON.
+5. Return the payload and a short mapping summary.
+
+## Rules
+- Every populated value must come from the source or an explicit user instruction.
+- Never silently choose between duplicate IDs or conflicting values.
+- Do not alter item content unless the user requests it.
+
+## Output
+Return one valid JSON document, then unresolved placeholders and mapping warnings.
@@ -0,0 +1,22 @@
+---
+name: duplicate-code-check
+description: Review a branch or merge-request diff for newly introduced, meaningful code duplication. Use when a user asks about repeated logic or copy-paste code in a diff.
+---
+
+# duplicate-code-check
+
+## Inputs
+Source branch or MR and target branch; use the repository default base only after reporting it.
+
+## Workflow
+1. Obtain the merge-base diff and list files examined.
+2. Compare changed blocks with nearby and existing code; distinguish deliberate repetition, generated code, and test fixtures.
+3. Report evidenced candidates with both locations, similarity, maintenance risk, and a proportionate suggestion.
+
+## Rules
+- Do not modify or remove code without explicit approval.
+- Do not label repeated literals alone as duplication without a maintenance consequence.
+- Report scope limits and skipped generated files.
+
+## Output
+Return a Markdown table: candidate, locations, evidence, confidence, risk, suggested next step.
@@ -0,0 +1,23 @@
+---
+name: generated-code-explanation
+description: Explain a code change, its supported rationale, trade-offs, and verification for a named audience. Use when a user asks what changed, why it changed, or how to validate it.
+---
+
+# generated-code-explanation
+
+## Inputs
+A diff, files, or a confirmed description of the change; intended audience.
+
+## Workflow
+1. Read the supplied code or diff before making claims.
+2. Explain behavior first, then the evidence-backed reason and trade-offs.
+3. Adapt vocabulary and depth to the audience.
+4. State verification that was run and checks that remain.
+
+## Rules
+- Mark unknown intent as unknown; do not infer motivation.
+- Do not add comments or documentation only to make an explanation easier.
+- Read project-specific conventions from a reference only in that project.
+
+## Output
+Use: What changed, Why this approach, Trade-offs, How to verify.
@@ -0,0 +1,18 @@
+---
+name: long-day-start
+description: Start a Long Day Factory shift by recording the current time and clearing lunch state. Use when the user explicitly says they have started their day.
+---
+
+# long-day-start
+
+## Workflow
+1. Check whether an incomplete shift record exists.
+2. If it does, explain that starting a new shift replaces its lunch state and ask for confirmation.
+3. Run `bash scripts/start.sh` after explicit start authorization.
+
+## Rules
+- Do not reset a shift for a hypothetical or informational request.
+- Store and document times in timezone-aware ISO 8601 format.
+
+## Output
+Confirm the new start timestamp and whether a prior shift was replaced.
@@ -0,0 +1,18 @@
+---
+name: lunch-time
+description: Record the start of a Long Day Factory lunch break. Use when the user explicitly says they are starting lunch.
+---
+
+# lunch-time
+
+## Workflow
+1. Confirm the request records a lunch start now.
+2. Check for a started shift and an existing open lunch.
+3. If an open lunch exists, ask before replacing it; otherwise run `bash scripts/lunch.sh`.
+
+## Rules
+- This command changes local state; do not run it for a question about lunch time.
+- Use `references/state.md` for recovery rules.
+
+## Output
+Confirm the lunch timestamp and any missing or conflicting state.
@@ -0,0 +1,23 @@
+---
+name: ndo-repro
+description: Reproduce or validate an NDO issue through approved local build, dev-environment deployment, BOM API calls, and live logs. Use only when the user names the service and target environment.
+---
+
+# ndo-repro
+
+## Safety boundary
+Read-only diagnosis is allowed after environment selection. Build, push, deploy, rollback, and credential changes require explicit approval for the named environment and action.
+
+## Workflow
+1. Run `scripts/doctor.sh` and resolve the environment using the bundled registry.
+2. Build and test locally; confirm the exact image reference.
+3. Before a shared-environment mutation, restate service, environment, image, and rollback plan; wait for approval.
+4. Drive the smallest API flow that tests the acceptance criterion, then collect image, response, and log evidence.
+
+## Rules
+- Read credentials from approved environment variables or a secret manager; never embed or echo them.
+- Use paths relative to this package.
+- Do not infer a pass from a nearby signal.
+
+## Output
+Report approval, deployed image, criterion-by-criterion evidence, and untested criteria.
@@ -0,0 +1,23 @@
+---
+name: sql-injection-audit
+description: Audit a changed code path for SQL injection. Use when code constructs or executes SQL, query-builder fragments, or ORM raw queries.
+---
+
+# sql-injection-audit
+
+## Inputs
+Changed files, branch diff, or a named query path.
+
+## Workflow
+1. Find SQL execution sinks and trace request, CLI, external, and stored user input to them.
+2. Confirm values use driver or ORM parameters. For dynamic identifiers, confirm a finite allowlist maps a user choice to a trusted token.
+3. Review raw-query escape hatches and stored procedures.
+4. Report only evidenced findings with source, sink, location, impact, and a safe pattern.
+
+## Rules
+- Escaping is not a substitute for parameterization.
+- Passing tests are supporting evidence, not proof of safety.
+- Do not modify code unless the user asks for a fix.
+
+## Output
+Return a findings table and the scope reviewed; say explicitly when a path could not be traced.