f3ee4722a8
Implements the MVP cutline from the planning artifact: - Phase A: skeleton + CLI dispatch + provider interface + stub model doctor - Phase B: scanner + git probe + 12 static analyzers + reporters + pipeline - Phase B fixtures: clean-repo, insecure-repo, degraded-repo 12 static analyzers per PROMPT.md "Suggested Static Checks For MVP": hardcoded_paths, shell_execution, raw_sql_interpolation, broad_cors, secret_patterns, large_files, todo_comments, missing_tests, env_file_committed, unsafe_file_io, exposed_mutation_endpoint, hardcoded_local_ip. Acceptance gates passing: - B1 (intake produces accurate counts) ✓ - B2 (insecure fixture fires ≥8 distinct check_ids — actually 11/12) ✓ - B3 (clean fixture produces 0 confirmed findings — no false positives) ✓ - B4 (scrum mode produces all 6 required markdown + JSON reports) ✓ - B5 (receipts.json marks degraded phases honestly) ✓ - F (self-review on this repo runs without crashing) ✓ — exit 66 (degraded because Phase C LLM review is hardcoded skipped) Phases C (LLM review), D (validation cross-check), E (memory + diff + rules subcommands) deferred per the cutline. The MVP delivers the evidence-first path; LLM is purely additive. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
74 lines
1.1 KiB
Markdown
Executable File
74 lines
1.1 KiB
Markdown
Executable File
# Scrum Test Template
|
|
|
|
## Verdict
|
|
|
|
State whether the repository is:
|
|
|
|
- production-ready
|
|
- prototype-ready
|
|
- demo-only
|
|
- blocked
|
|
|
|
Do not soften the verdict.
|
|
|
|
## Evidence
|
|
|
|
List commands run, files inspected, and outputs generated.
|
|
|
|
## Confirmed Risks
|
|
|
|
Each confirmed risk must include:
|
|
|
|
- file path
|
|
- evidence
|
|
- severity
|
|
- impact
|
|
- suggested fix
|
|
|
|
## Suspected Risks
|
|
|
|
Each suspected risk must explain what evidence is missing.
|
|
|
|
## Blocked Checks
|
|
|
|
List checks that could not run.
|
|
|
|
For each blocked check, include:
|
|
|
|
- reason
|
|
- dependency
|
|
- next command
|
|
- risk of not running it
|
|
|
|
## Sprint Backlog
|
|
|
|
Use this format:
|
|
|
|
```text
|
|
Sprint 0: Reproducibility Gate
|
|
Sprint 1: Trust Boundary Gate
|
|
Sprint 2: Memory Correctness Gate
|
|
Sprint 3: Agent Loop Reality Gate
|
|
Sprint 4: Deployment Gate
|
|
```
|
|
|
|
## Acceptance Gates
|
|
|
|
Each gate must be testable.
|
|
|
|
Bad:
|
|
|
|
```text
|
|
Improve security.
|
|
```
|
|
|
|
Good:
|
|
|
|
```text
|
|
SQL interpolation scanner detects unsafe SELECT/INSERT/UPDATE/DELETE string assembly and emits confirmed findings with file evidence.
|
|
```
|
|
|
|
## Next Commands
|
|
|
|
List only commands that can actually be run.
|