diff --git a/.github/skills/coding-standards/hve-artifact-authoring/SKILL.md b/.github/skills/coding-standards/hve-artifact-authoring/SKILL.md new file mode 100644 index 000000000..fbc8421f4 --- /dev/null +++ b/.github/skills/coding-standards/hve-artifact-authoring/SKILL.md @@ -0,0 +1,324 @@ +--- +name: hve-artifact-authoring +description: > + Create, validate, and package AI artifacts for HVE Core, GitHub Copilot's prompt engineering + framework. Covers agents, prompts, instructions, skills, and collections with frontmatter + contracts, naming conventions, collection packaging, subagent delegation, workspace state + tracking, and CI validation pipelines. Use when building any markdown-based AI artifact that + follows the four-tier delegation model (Prompts → Agents → Instructions → Skills) with + schema-validated frontmatter. +metadata: + authors: "microsoft/hve-core" + spec_version: "1.0.0" + last_updated: "2026-07-20" +--- + +# HVE Artifact Authoring + +## Purpose + +Teach the patterns, contracts, and workflows for authoring AI artifacts in the HVE Core +framework — a markdown-based prompt engineering library for GitHub Copilot. Every artifact +type (agent, prompt, instruction, skill, collection) follows strict frontmatter schemas, +naming conventions, and packaging rules that enable automated validation and distribution. + +## Core Principles + +### 1. Four-Tier Artifact Delegation + +Artifacts compose in a strict hierarchy. Each tier has a distinct responsibility: + +| Tier | Artifact | Role | Key Property | +|------|--------------------------------------|---------------------------------------------|-----------------------------------| +| 1 | **Prompt** (`.prompt.md`) | Captures user intent, routes to agent | `agent:` field delegates | +| 2 | **Agent** (`.agent.md`) | Orchestrates multi-step workflow | `agents:` list, `handoffs:` array | +| 3 | **Instruction** (`.instructions.md`) | Applies coding/style standards passively | `applyTo:` glob auto-matches | +| 4 | **Skill** (`SKILL.md`) | Executes specialized utilities with scripts | Self-contained package | + +**Design rule:** Prompts never contain logic — they capture input and delegate. Agents +orchestrate but reference instructions for standards. Instructions are passive guidance. +Skills are active execution with cross-platform scripts. + +### 2. Frontmatter Is the Contract + +Every artifact's behavior, discoverability, and validation is driven by YAML frontmatter. +VS Code discovers artifacts by frontmatter metadata, not file location alone. + +- Frontmatter MUST be the first content in every markdown file +- Required fields vary by artifact type (see procedures below) +- JSON schemas enforce contracts at CI time +- Schema mapping (`schema-mapping.json`) routes file patterns to schemas + +### 3. Collection-Based Packaging + +Artifacts are never distributed individually. Collections bundle related artifacts with +maturity filtering: + +| Channel | Includes | Use | +|--------------|---------------------------------------|--------------------| +| Stable | `stable` only | Production default | +| Preview | `stable` + `preview` | Early access | +| Experimental | `stable` + `preview` + `experimental` | Full access | + +### 4. Subagent Delegation Without Recursion + +Only top-level orchestrator agents invoke subagents. Subagents (leaf agents) never +invoke other subagents — they use tools (search, read, terminal) and return findings +to their caller. This prevents unbounded delegation chains. + +### 5. Workspace State Tracking + +Complex workflows persist state in `.copilot-tracking/` with date-organized subdirectories. +This enables session persistence across agent handoffs and provides human-inspectable +audit trails. + +--- + +## Procedures + +### Procedure 1: Create an Agent + +1. **Choose location:** `.github/agents/{collection-id}/{name}.agent.md` + - For subagents: `.github/agents/{collection-id}/subagents/{name}.agent.md` + +2. **Write frontmatter** with required and relevant optional fields: + ```yaml + --- + name: My Agent Name + description: 'One-line purpose statement — Brought to you by microsoft/hve-core' + argument-hint: 'How users should invoke this agent' + agents: + - Subagent Name One + - Subagent Name Two + tools: + - codebase + - search + handoffs: + - label: "📋 Next Action" + agent: Target Agent + prompt: /command-name + send: true + --- + ``` + +3. **Write agent body** with these sections (in order): + - `# Agent Name` — H1 title matching frontmatter `name:` + - `## Autonomous Behavior` — decision-making guidelines + - `## Subagent Invocation Protocol` — when/how to delegate (if orchestrator) + - `## Tracking Artifacts` — state management rules (if stateful) + - `## Required Phases` — numbered phase definitions + - `## Success Criteria` — completion conditions + +4. **Key frontmatter decisions:** + - Set `disable-model-invocation: true` for orchestrator agents (prevents auto-invocation) + - Set `user-invocable: false` for subagents (hidden from user picker) + - Use `agents: ["*"]` only when agent needs unrestricted subagent access + - Use specific `agents:` list to constrain allowed subagents + +5. **Register in collection:** Add path + kind to `collections/{id}.collection.yml` + +### Procedure 2: Create a Prompt + +1. **Choose location:** `.github/prompts/{collection-id}/{name}.prompt.md` + +2. **Write frontmatter:** + ```yaml + --- + description: 'Workflow description in 1-200 characters' + agent: Target Agent Name + argument-hint: 'arg=... [option={a|b}]' + --- + ``` + +3. **Write prompt body** with these sections: + - `## Inputs` — list template variables as `${input:varname}` + - `## Requirements` — numbered conditional routing rules + - `## Steps` or `## Conversation Summarization` — execution or state rules + +4. **Design rules:** + - Prompts capture intent, they never contain implementation logic + - Use `agent:` field to delegate to the right orchestrator + - Template variables use `${input:name}` syntax + - Keep description under 200 characters + +5. **Register in collection** + +### Procedure 3: Create an Instruction + +1. **Choose location:** `.github/instructions/{collection-id}/{name}.instructions.md` + - Root-level instructions (no subdirectory) are repo-scoped and never distributed + +2. **Write frontmatter:** + ```yaml + --- + description: 'Target file type and standards scope' + applyTo: '**/*.{ext}' + --- + ``` + +3. **Write instruction body** with these sections: + - `## Scope` — what files this applies to, what standard it enforces + - `## [Topic]` sections — one per concern with practical guidance + - Include XML-delimited example blocks for tool extraction: + ````text + + ```code + [example] + ``` + + ```` + +4. **Design rules:** + - `applyTo` glob patterns auto-match files — instructions are applied passively + - One instruction per concern (don't mix Python + TypeScript) + - Reference `.github/copilot-instructions.md` for repo-wide conventions + - Keep focused and actionable — these are standards, not tutorials + +5. **Register in collection** + +### Procedure 4: Create a Skill + +1. **Create directory:** `.github/skills/{collection-id}/{skill-name}/` + +2. **Required structure:** + ```text + {skill-name}/ + ├── SKILL.md # Required + ├── scripts/ # Optional + │ ├── action.ps1 # PowerShell required if scripts/ exists + │ └── action.sh # Bash recommended + ├── references/ # Optional + ├── assets/ # Optional + ├── examples/ # Optional + └── tests/ # Optional (excluded from distribution) + └── action.Tests.ps1 + ``` + +3. **Write SKILL.md frontmatter:** + ```yaml + --- + name: skill-name + description: 'Brief description, 1-1024 characters' + user-invocable: true + argument-hint: '[input=...] [quality=high|medium|low]' + --- + ``` + +4. **Write SKILL.md body** with sections: What is This Skill?, Use Cases, + Requirements, Installation, Usage, Examples, Troubleshooting + +5. **Implement scripts** — PowerShell (.ps1) is required for cross-platform; + Bash (.sh) recommended as companion + +6. **Register in collection** + +### Procedure 5: Create a Collection + +1. **Create YAML manifest:** `collections/{id}.collection.yml` + ```yaml + id: my-collection + name: Human-Readable Name + description: Purpose and scope + tags: + - tag1 + - tag2 + items: + - path: .github/agents/my-collection/agent.agent.md + kind: agent + maturity: stable + - path: .github/prompts/my-collection/prompt.prompt.md + kind: prompt + ``` + +2. **Create companion markdown:** `collections/{id}.collection.md` + +3. **Organize artifacts** in `{collection-id}` subdirectories under + `.github/agents/`, `.github/prompts/`, `.github/instructions/`, `.github/skills/` + +4. **Collection YAML rules:** + - `id`: lowercase with hyphens only (pattern: `^[a-z0-9-]+$`) + - `items`: minimum 1 item, each with `path` and `kind` + - `kind` values: `agent`, `prompt`, `instruction`, `skill`, `hook` + - Item-level `maturity` overrides collection-level maturity + - `maturity: removed` excludes from all channels + +### Procedure 6: Design an Orchestrator Agent with Subagent Delegation + +1. **Identify the orchestration need:** Multi-phase workflow requiring research, + planning, implementation, or review steps + +2. **Create orchestrator agent** with: + - `agents:` listing specific allowed subagents + - `handoffs:` array with labeled UI buttons for common next actions + - `disable-model-invocation: true` (user explicitly invokes orchestrators) + +3. **Create leaf subagents** at `subagents/{name}.agent.md` with: + - `user-invocable: false` (hidden from user picker) + - No `agents:` field (leaf agents never invoke subagents) + - Focused scope — one responsibility per subagent + +4. **Delegation rules:** + - Orchestrators classify task difficulty before delegating + - Simple tasks: handle directly, no subagents + - Complex tasks: delegate to specialized subagents + - Each subagent returns findings; orchestrator synthesizes + +5. **State handoff** via `.copilot-tracking/`: + ```text + .copilot-tracking/ + ├── research/{YYYY-MM-DD}/ # Investigation findings + ├── plans/{YYYY-MM-DD}/ # Implementation plans + ├── details/{YYYY-MM-DD}/ # Phase-by-phase details + ├── changes/{YYYY-MM-DD}/ # Executed changes + ├── review/{YYYY-MM-DD}/ # Review findings + └── pr/{YYYY-MM-DD}/ # PR descriptions + ``` + +### Procedure 7: Validate Artifacts + +1. **Run full validation:** + ```bash + npm run lint:all + ``` + +2. **Individual checks:** + | Command | What it validates | + |-------------------------------------|----------------------------------| + | `npm run lint:frontmatter` | Frontmatter against JSON schemas | + | `npm run lint:md` | Markdown style (markdownlint) | + | `npm run lint:yaml` | YAML syntax | + | `npm run lint:ps` | PowerShell static analysis | + | `npm run validate:skills` | Skill directory structure | + | `npm run lint:collections-metadata` | Collection manifests | + | `npm run test:ps` | PowerShell Pester tests | + +3. **Schema validation details:** + - Schemas live in `scripts/linting/schemas/` + - `schema-mapping.json` maps glob patterns to schema files + - Most specific pattern match wins when multiple patterns apply + +--- + +## Markdown Standards + +All artifact files must follow these markdown rules (enforced by markdownlint): + +- ATX-style headings only (`#`, `##`, `###`) +- Single H1 per file (unless frontmatter has `title:` field — then start at H2) +- Increase heading levels by one (no skipping) +- Blank lines above and below headings +- No trailing punctuation on headings +- Frontmatter MUST be at file start, before all content +- UTF-8 encoding, plain ASCII punctuation + +--- + +## Reference Links + +- Frontmatter schemas: [references/frontmatter-schemas.md](references/frontmatter-schemas.md) +- Collection manifest schema: [references/frontmatter-schemas.md](references/frontmatter-schemas.md) +- Agent template: [assets/agent-template.md](assets/agent-template.md) +- Prompt template: [assets/prompt-template.md](assets/prompt-template.md) +- Instruction template: [assets/instruction-template.md](assets/instruction-template.md) +- Skill template: [assets/skill-template.md](assets/skill-template.md) +- Collection template: [assets/collection-template.yml](assets/collection-template.yml) diff --git a/.github/skills/coding-standards/hve-artifact-authoring/assets/agent-template.md b/.github/skills/coding-standards/hve-artifact-authoring/assets/agent-template.md new file mode 100644 index 000000000..b5d043f46 --- /dev/null +++ b/.github/skills/coding-standards/hve-artifact-authoring/assets/agent-template.md @@ -0,0 +1,47 @@ +--- +name: Agent Name +description: 'One-line description of what this agent does — Brought to you by microsoft/hve-core' +argument-hint: 'How users should interact with this agent' +agents: + - Subagent Name +tools: + - codebase +handoffs: + - label: "📋 Action Label" + agent: Target Agent + prompt: /command-name + send: true +--- + +# Agent Name + +Brief description of what this agent does and when to use it. + +## Autonomous Behavior + +* Make technical decisions through research and analysis. +* Determine task difficulty early and adjust workflow accordingly. +* Resolve ambiguity by investigating before asking the user. + +## Required Phases + +### Phase 1: [Phase Name] + +1. Step one description +2. Step two description +3. Step three description + +### Phase 2: [Phase Name] + +1. Step one description +2. Step two description + +## Success Criteria + +* Criterion one +* Criterion two +* Criterion three + +--- + +*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.* diff --git a/.github/skills/coding-standards/hve-artifact-authoring/assets/collection-template.yml b/.github/skills/coding-standards/hve-artifact-authoring/assets/collection-template.yml new file mode 100644 index 000000000..d19dee9bb --- /dev/null +++ b/.github/skills/coding-standards/hve-artifact-authoring/assets/collection-template.yml @@ -0,0 +1,16 @@ +id: collection-id +name: Human-Readable Collection Name +description: Purpose and scope of this collection +tags: + - tag1 + - tag2 +items: + - path: .github/agents/collection-id/agent-name.agent.md + kind: agent + maturity: stable + - path: .github/prompts/collection-id/prompt-name.prompt.md + kind: prompt + - path: .github/instructions/collection-id/instruction-name.instructions.md + kind: instruction + - path: .github/skills/collection-id/skill-name + kind: skill diff --git a/.github/skills/coding-standards/hve-artifact-authoring/assets/instruction-template.md b/.github/skills/coding-standards/hve-artifact-authoring/assets/instruction-template.md new file mode 100644 index 000000000..f40ec62f8 --- /dev/null +++ b/.github/skills/coding-standards/hve-artifact-authoring/assets/instruction-template.md @@ -0,0 +1,32 @@ +--- +description: 'Target file type and standards scope' +applyTo: '**/*.ext' +--- + +# Standard Name + +## Scope + +* Applies to all [file type] files in this codebase +* Enforced by [tool] in [config file] +* When in doubt, prefer clarity and consistency + +## [Topic 1] + +* Guideline one +* Guideline two + + +```text +[Example code] +``` + + +## [Topic 2] + +* Guideline one +* Guideline two + +--- + +*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.* diff --git a/.github/skills/coding-standards/hve-artifact-authoring/assets/prompt-template.md b/.github/skills/coding-standards/hve-artifact-authoring/assets/prompt-template.md new file mode 100644 index 000000000..3a0a01a65 --- /dev/null +++ b/.github/skills/coding-standards/hve-artifact-authoring/assets/prompt-template.md @@ -0,0 +1,27 @@ +--- +description: 'Workflow description in 1-200 characters' +agent: Target Agent Name +argument-hint: 'arg=... [option={a|b}]' +--- + +# Prompt Name + +## Inputs + +* ${input:task}: Task description (required) +* ${input:option}: Optional parameter + +## Requirements + +1. When ${input:task} provided, use as primary task +2. When ${input:option} provided, apply as constraint + +## Steps + +1. Execute the primary workflow +2. Validate results against requirements +3. Present findings to user + +--- + +*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.* diff --git a/.github/skills/coding-standards/hve-artifact-authoring/assets/skill-template.md b/.github/skills/coding-standards/hve-artifact-authoring/assets/skill-template.md new file mode 100644 index 000000000..811960719 --- /dev/null +++ b/.github/skills/coding-standards/hve-artifact-authoring/assets/skill-template.md @@ -0,0 +1,38 @@ +--- +name: skill-name +description: 'Brief description of what this skill does, 1-1024 characters' +user-invocable: true +argument-hint: '[input=...] [option=value]' +--- + +# Skill Name + +## What is This Skill? + +Brief description of purpose and use case. + +## Use Cases + +* Use case one +* Use case two + +## Requirements + +* Prerequisite one +* Prerequisite two + +## Usage + +How to invoke and use the skill. + +## Examples + +Concrete usage examples with expected output. + +## Troubleshooting + +Common issues and solutions. + +--- + +*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.* diff --git a/.github/skills/coding-standards/hve-artifact-authoring/references/frontmatter-schemas.md b/.github/skills/coding-standards/hve-artifact-authoring/references/frontmatter-schemas.md new file mode 100644 index 000000000..9bb98de37 --- /dev/null +++ b/.github/skills/coding-standards/hve-artifact-authoring/references/frontmatter-schemas.md @@ -0,0 +1,85 @@ +--- +description: 'Frontmatter field reference for agents, prompts, instructions, skills, and collection manifests' +--- + +# Frontmatter Schema Reference + +## Agent Frontmatter (`agent-frontmatter.schema.json`) + +| Field | Type | Required | Notes | +|----------------------------|----------------------------------|----------|--------------------------------------------| +| `description` | string (minLength 1) | **Yes** | Shown as placeholder in chat input | +| `name` | string | No | Defaults to filename | +| `argument-hint` | string | No | Guidance text in chat input | +| `agents` | array of strings OR `"*"` | No | Allowed subagents; `"*"` = all | +| `tools` | array of strings | No | Available tools (builtin, MCP, extensions) | +| `model` | string OR array of strings | No | Model override | +| `target` | `"vscode"` or `"github-copilot"` | No | Execution target | +| `handoffs` | array of handoff objects | No | Agent delegation buttons | +| `user-invocable` | boolean | No | Default: true | +| `disable-model-invocation` | boolean | No | Default: false | +| `mcp-servers` | array of MCP server configs | No | MCP server declarations | + +### Handoff Object + +```yaml +handoffs: + - label: "Button Label" # Required: UI button text + agent: Target Agent Name # Required: agent to hand off to + prompt: "/command args" # Optional: prompt to send + send: true # Optional: auto-send (default: false) +``` + +## Prompt Frontmatter (`prompt-frontmatter.schema.json`) + +| Field | Type | Required | Notes | +|-----------------|----------------------|----------|-----------------------------------| +| `description` | string (1-200 chars) | **Yes** | Workflow description | +| `name` | string | No | Used after "/" in chat | +| `agent` | string | No | Named custom agent to delegate to | +| `argument-hint` | string | No | Argument guidance | +| `model` | string | No | Model override | +| `tools` | array of strings | No | Available tools | + +## Instruction Frontmatter (`instruction-frontmatter.schema.json`) + +| Field | Type | Required | Notes | +|---------------|-----------------------|----------|--------------------------------| +| `description` | string (minLength 1) | **Yes** | Target and scope | +| `name` | string | No | Defaults to filename | +| `applyTo` | string (glob pattern) | No | Auto-application file matching | + +## Skill Frontmatter (`skill-frontmatter.schema.json`) + +| Field | Type | Required | Notes | +|----------------------------|-----------------------|----------|-----------------------------| +| `name` | string (kebab-case) | **Yes** | Lowercase with hyphens | +| `description` | string (1-1024 chars) | **Yes** | Brief description | +| `user-invocable` | boolean | No | Default: true | +| `disable-model-invocation` | boolean | No | Default: false | +| `argument-hint` | string | No | Argument hints | +| `license` | string | No | SPDX license identifier | +| `compatibility` | string | No | Runtime requirements | +| `metadata` | object | No | Authors, spec_version, etc. | + +## Collection Manifest (`collection-manifest.schema.json`) + +| Field | Type | Required | Notes | +|--------------------|---------------------------------|----------|----------------------------------------------------| +| `id` | string (pattern `^[a-z0-9-]+$`) | **Yes** | Unique ID | +| `name` | string (minLength 1) | **Yes** | Display name | +| `description` | string (minLength 1) | **Yes** | Brief description | +| `items` | array (minItems 1) | **Yes** | Artifact references | +| `maturity` | enum | No | stable, preview, experimental, deprecated, removed | +| `tags` | array of strings | No | Discovery tags | +| `display.ordering` | `"alpha"` or `"manual"` | No | Default: alpha | + +### Item Object + +```yaml +items: + - path: .github/agents/collection-id/name.agent.md # Required + kind: agent # Required: agent|prompt|instruction|skill|hook + usage: "Usage guidance text" # Optional + maturity: stable # Optional: overrides collection maturity +``` diff --git a/collections/coding-standards.collection.md b/collections/coding-standards.collection.md index 3012e6b75..976a6a98b 100644 --- a/collections/coding-standards.collection.md +++ b/collections/coding-standards.collection.md @@ -47,11 +47,12 @@ Enforce language-specific coding conventions and best practices across your proj ### Skills -| Name | Description | -|---------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **code-review** | Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output. | -| **pr-reference** | Generates PR reference XML with commit history and unified diffs between branches, with extension and path filtering. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. | -| **python-foundational** | Foundational Python best practices, idioms, and code quality fundamentals | -| **telemetry-foundations** | Declarative OpenTelemetry-aligned telemetry vocabulary and instrumentation conventions for traces, metrics, logs, and PII handling | +| Name | Description | +|----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **code-review** | Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output. | +| **hve-artifact-authoring** | Create, validate, and package AI artifacts for HVE Core, GitHub Copilot's prompt engineering framework. Covers agents, prompts, instructions, skills, and collections with frontmatter contracts, naming conventions, collection packaging, subagent delegation, workspace state tracking, and CI validation pipelines. Use when building any markdown-based AI artifact that follows the four-tier delegation model (Prompts → Agents → Instructions → Skills) with schema-validated frontmatter. | +| **pr-reference** | Generates PR reference XML with commit history and unified diffs between branches, with extension and path filtering. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. | +| **python-foundational** | Foundational Python best practices, idioms, and code quality fundamentals | +| **telemetry-foundations** | Declarative OpenTelemetry-aligned telemetry vocabulary and instrumentation conventions for traces, metrics, logs, and PII handling | diff --git a/collections/coding-standards.collection.yml b/collections/coding-standards.collection.yml index 91ccf6d42..9bedf45f8 100644 --- a/collections/coding-standards.collection.yml +++ b/collections/coding-standards.collection.yml @@ -93,6 +93,9 @@ items: - path: .github/skills/coding-standards/code-review kind: skill maturity: experimental + - path: .github/skills/coding-standards/hve-artifact-authoring + kind: skill + maturity: stable - path: .github/skills/coding-standards/python-foundational kind: skill maturity: experimental diff --git a/collections/hve-core-all.collection.md b/collections/hve-core-all.collection.md index 6fca62cc6..0a759c057 100644 --- a/collections/hve-core-all.collection.md +++ b/collections/hve-core-all.collection.md @@ -265,59 +265,60 @@ Use this edition when you want access to everything without choosing a focused c ### Skills -| Name | Description | -|-------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **accessibility** | Consolidated accessibility skill entrypoint for WCAG 2.2, ARIA Authoring Practices, cognitive accessibility, Section 508, EN 301 549, and the Accessibility Planner workflow. | -| **adr-author** | Authoring skill for Architecture Decision Records (ADRs) supporting capture, from-planner-handoff, and adopt-template entry modes with selectable Y-Statement or MADR v4.0.0 output templates, supersession lineage, and ASR trigger evaluation. | -| **architecture-diagrams** | Architecture diagram authoring for cloud infrastructure: parse Azure IaC, map relationships, and render either ASCII block diagrams or Mermaid flowcharts based on the caller's chosen output format | -| **backlog-templates** | Shared work-item templates and conventions for ADO and GitHub backlog handoff across the RAI, Security, SSSC, Accessibility, and Privacy planners | -| **caveman** | Ultra-compressed response style that reduces output token count while preserving technical accuracy, with intensity levels and auto-clarity safety rules | -| **code-review** | Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output. | -| **customer-card-render** | Generate customer-card PowerPoint content YAML from Design Thinking canonical artifacts and build using the shared PowerPoint skill pipeline | -| **documentation** | Canonical documentation capability for audit, drift, validate, and author modes in hve-core. | -| **dt-coaching-foundation** | Design Thinking coaching foundation knowledge: coach identity and philosophy, quality and fidelity constraints, method sequencing, coaching state schema, and the canonical deck workflow | -| **dt-curriculum** | Design Thinking learning curriculum covering nine progressive modules across the full Problem, Solution, and Implementation Space methods plus a shared manufacturing reference scenario for teaching and practice | -| **dt-methods** | Design Thinking method coaching knowledge across all nine methods including per-method techniques, deep expertise, and industry context (energy, financial services, healthcare, manufacturing, nonprofit and social impact, pharmaceuticals and life sciences, professional services, public sector, retail and CPG) | -| **dt-rpi-integration** | Design Thinking to RPI handoff knowledge covering the DT-to-RPI handoff contract, DT-aware research/planning/implement/review contexts, subagent handoff workflow, and Method 5 image prompt generation | -| **gh-code-scanning** | Retrieves and groups GitHub code scanning alerts by rule and severity using the gh CLI | -| **gitlab** | Manage GitLab merge requests and pipelines with a Python CLI | -| **hve-builder** | Author, review, or validate Copilot prompt-engineering artifacts through independent review, behavior testing, and host checks. | -| **hve-builder-tester** | Test HVE artifact behavior with black-box scenarios, contained simulation or approved native execution, independent grading, and evidence reports. | -| **hve-core-installer** | Decision-driven HVE-Core installer with multiple clone-based and extension install methods, environment detection, and agent customization | -| **jira** | Jira issue workflows for search, issue updates, transitions, comments, and field discovery via the Jira REST API. Use when you need to search with JQL, inspect an issue, create or update work items, move an issue between statuses, post comments, or discover required fields for issue creation. | -| **mural** | Mural workspace, room, mural, and widget workflows via the Mural REST API exposed through a Python CLI. Use when you need to read or write Mural content or automate widget creation. | -| **owasp-agentic** | OWASP Agentic Security Top 10 knowledge base for identifying, assessing, and remediating AI agent system security risks. | -| **owasp-cicd** | OWASP CI/CD Top 10 knowledge base for identifying, assessing, and remediating CI/CD pipeline security risks. | -| **owasp-infrastructure** | OWASP Infrastructure Top 10 knowledge base for identifying, assessing, and remediating internal IT infrastructure security risks. | -| **owasp-llm** | OWASP Top 10 for LLM Applications (2025) knowledge base for identifying, assessing, and remediating large language model security risks. | -| **owasp-mcp** | OWASP MCP Top 10 knowledge base for identifying, assessing, and remediating Model Context Protocol security risks. | -| **owasp-top-10** | OWASP Top 10 for Web Applications (2025) knowledge base for identifying, assessing, and remediating web application security risks. | -| **powerpoint** | PowerPoint slide deck generation and management using python-pptx with YAML-driven content and styling | -| **pr-reference** | Generates PR reference XML with commit history and unified diffs between branches, with extension and path filtering. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. | -| **privacy-standards** | Privacy planning reference for data-flow reasoning, standards mapping, and DPIA thresholds | -| **prompt-analyze** | Compatibility alias for read-only prompt artifact review. Routes static and behavior analysis to hve-builder review mode. | -| **prompt-builder** | Compatibility alias for legacy prompt-building requests. Routes creation and improvement to the hve-builder skill. | -| **prompt-refactor** | Compatibility alias for behavior-preserving prompt artifact cleanup. Routes refactoring to hve-builder refactor mode. | -| **python-foundational** | Foundational Python best practices, idioms, and code quality fundamentals | -| **rai-planner** | On-demand RAI planner reference pack covering Phase 1 capture, Phase 2 risk classification, Phase 5 impact assessment, and Phase 6 review and backlog handoff. | -| **rai-standards** | Consolidated Responsible AI standards reference: NIST AI RMF 1.0, AI STRIDE threat-modeling overlay, EU AI Act risk tiers, and an open-standards catalog with phase mapping | -| **requirements-author** | Requirements authoring guide for BRD and PRD across Discover, Define, and Govern with canonical templates and handoff contracts | -| **rpi-implement** | Execute approved implementation phases, update tracking artifacts, and hand off review-ready results. | -| **rpi-plan** | Create implementation-ready planning artifacts and validation evidence for RPI tasks. | -| **rpi-quick** | Umbrella RPI playbook that sequences Research, Plan, Implement, Review, and Discover for one-shot task execution with quality gates. | -| **rpi-research** | Research-only RPI playbook that gathers task evidence, writes dated research artifacts under .copilot-tracking/research/, and hands off planning-ready findings. Use when the user needs evidence, alternatives, or task framing first. | -| **rpi-review** | Review-only RPI playbook that validates implementation evidence, checks phase completion, and closes the loop with explicit next steps. Use when the user needs review coverage or acceptance evidence. | -| **rpi-walkthrough** | Guided, conversational walkthrough that explains code, UI, UX, features, or .copilot-tracking artifacts one line or block at a time with navigable evidence links, deep subagent review, and captured change requests for RPI handoff. Use when the user wants to understand how something works or why it was changed. | -| **secure-by-design** | Secure by Design principles knowledge base for assessing security-first design, development, and deployment across the software lifecycle. | -| **security-planning** | Security planning reference set for operational buckets, STRIDE analysis, standards mapping, NIST control families, and backlog scaffolding. | -| **security-reviewer-formats** | Format specifications and data contracts for the security reviewer orchestrator and its subagents. | -| **supply-chain-security** | Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies. | -| **telemetry-foundations** | Declarative OpenTelemetry-aligned telemetry vocabulary and instrumentation conventions for traces, metrics, logs, and PII handling | -| **tts-voiceover** | Text-to-speech voice-over generation from YAML speaker notes using Azure Speech SDK with SSML pronunciation control | -| **vally-tests** | Authors Vally conformance tests for prompts, instructions, agents, and skills, including refusals for jailbreak, prompt-injection, harmful-elicitation, TOS, CoC, and PII-extraction stimuli | -| **vex** | OpenVEX v0.2.0 specification reference plus VEX management playbooks - Brought to you by microsoft/hve-core. | -| **video-to-gif** | Video-to-GIF conversion with FFmpeg two-pass optimization | -| **vscode-playwright** | VS Code screenshot capture using Playwright MCP with serve-web for slide decks and documentation | +| Name | Description | +|-------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **accessibility** | Consolidated accessibility skill entrypoint for WCAG 2.2, ARIA Authoring Practices, cognitive accessibility, Section 508, EN 301 549, and the Accessibility Planner workflow. | +| **adr-author** | Authoring skill for Architecture Decision Records (ADRs) supporting capture, from-planner-handoff, and adopt-template entry modes with selectable Y-Statement or MADR v4.0.0 output templates, supersession lineage, and ASR trigger evaluation. | +| **architecture-diagrams** | Architecture diagram authoring for cloud infrastructure: parse Azure IaC, map relationships, and render either ASCII block diagrams or Mermaid flowcharts based on the caller's chosen output format | +| **backlog-templates** | Shared work-item templates and conventions for ADO and GitHub backlog handoff across the RAI, Security, SSSC, Accessibility, and Privacy planners | +| **caveman** | Ultra-compressed response style that reduces output token count while preserving technical accuracy, with intensity levels and auto-clarity safety rules | +| **code-review** | Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output. | +| **customer-card-render** | Generate customer-card PowerPoint content YAML from Design Thinking canonical artifacts and build using the shared PowerPoint skill pipeline | +| **documentation** | Canonical documentation capability for audit, drift, validate, and author modes in hve-core. | +| **dt-coaching-foundation** | Design Thinking coaching foundation knowledge: coach identity and philosophy, quality and fidelity constraints, method sequencing, coaching state schema, and the canonical deck workflow | +| **dt-curriculum** | Design Thinking learning curriculum covering nine progressive modules across the full Problem, Solution, and Implementation Space methods plus a shared manufacturing reference scenario for teaching and practice | +| **dt-methods** | Design Thinking method coaching knowledge across all nine methods including per-method techniques, deep expertise, and industry context (energy, financial services, healthcare, manufacturing, nonprofit and social impact, pharmaceuticals and life sciences, professional services, public sector, retail and CPG) | +| **dt-rpi-integration** | Design Thinking to RPI handoff knowledge covering the DT-to-RPI handoff contract, DT-aware research/planning/implement/review contexts, subagent handoff workflow, and Method 5 image prompt generation | +| **gh-code-scanning** | Retrieves and groups GitHub code scanning alerts by rule and severity using the gh CLI | +| **gitlab** | Manage GitLab merge requests and pipelines with a Python CLI | +| **hve-artifact-authoring** | Create, validate, and package AI artifacts for HVE Core, GitHub Copilot's prompt engineering framework. Covers agents, prompts, instructions, skills, and collections with frontmatter contracts, naming conventions, collection packaging, subagent delegation, workspace state tracking, and CI validation pipelines. Use when building any markdown-based AI artifact that follows the four-tier delegation model (Prompts → Agents → Instructions → Skills) with schema-validated frontmatter. | +| **hve-builder** | Author, review, or validate Copilot prompt-engineering artifacts through independent review, behavior testing, and host checks. | +| **hve-builder-tester** | Test HVE artifact behavior with black-box scenarios, contained simulation or approved native execution, independent grading, and evidence reports. | +| **hve-core-installer** | Decision-driven HVE-Core installer with multiple clone-based and extension install methods, environment detection, and agent customization | +| **jira** | Jira issue workflows for search, issue updates, transitions, comments, and field discovery via the Jira REST API. Use when you need to search with JQL, inspect an issue, create or update work items, move an issue between statuses, post comments, or discover required fields for issue creation. | +| **mural** | Mural workspace, room, mural, and widget workflows via the Mural REST API exposed through a Python CLI. Use when you need to read or write Mural content or automate widget creation. | +| **owasp-agentic** | OWASP Agentic Security Top 10 knowledge base for identifying, assessing, and remediating AI agent system security risks. | +| **owasp-cicd** | OWASP CI/CD Top 10 knowledge base for identifying, assessing, and remediating CI/CD pipeline security risks. | +| **owasp-infrastructure** | OWASP Infrastructure Top 10 knowledge base for identifying, assessing, and remediating internal IT infrastructure security risks. | +| **owasp-llm** | OWASP Top 10 for LLM Applications (2025) knowledge base for identifying, assessing, and remediating large language model security risks. | +| **owasp-mcp** | OWASP MCP Top 10 knowledge base for identifying, assessing, and remediating Model Context Protocol security risks. | +| **owasp-top-10** | OWASP Top 10 for Web Applications (2025) knowledge base for identifying, assessing, and remediating web application security risks. | +| **powerpoint** | PowerPoint slide deck generation and management using python-pptx with YAML-driven content and styling | +| **pr-reference** | Generates PR reference XML with commit history and unified diffs between branches, with extension and path filtering. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. | +| **privacy-standards** | Privacy planning reference for data-flow reasoning, standards mapping, and DPIA thresholds | +| **prompt-analyze** | Compatibility alias for read-only prompt artifact review. Routes static and behavior analysis to hve-builder review mode. | +| **prompt-builder** | Compatibility alias for legacy prompt-building requests. Routes creation and improvement to the hve-builder skill. | +| **prompt-refactor** | Compatibility alias for behavior-preserving prompt artifact cleanup. Routes refactoring to hve-builder refactor mode. | +| **python-foundational** | Foundational Python best practices, idioms, and code quality fundamentals | +| **rai-planner** | On-demand RAI planner reference pack covering Phase 1 capture, Phase 2 risk classification, Phase 5 impact assessment, and Phase 6 review and backlog handoff. | +| **rai-standards** | Consolidated Responsible AI standards reference: NIST AI RMF 1.0, AI STRIDE threat-modeling overlay, EU AI Act risk tiers, and an open-standards catalog with phase mapping | +| **requirements-author** | Requirements authoring guide for BRD and PRD across Discover, Define, and Govern with canonical templates and handoff contracts | +| **rpi-implement** | Execute approved implementation phases, update tracking artifacts, and hand off review-ready results. | +| **rpi-plan** | Create implementation-ready planning artifacts and validation evidence for RPI tasks. | +| **rpi-quick** | Umbrella RPI playbook that sequences Research, Plan, Implement, Review, and Discover for one-shot task execution with quality gates. | +| **rpi-research** | Research-only RPI playbook that gathers task evidence, writes dated research artifacts under .copilot-tracking/research/, and hands off planning-ready findings. Use when the user needs evidence, alternatives, or task framing first. | +| **rpi-review** | Review-only RPI playbook that validates implementation evidence, checks phase completion, and closes the loop with explicit next steps. Use when the user needs review coverage or acceptance evidence. | +| **rpi-walkthrough** | Guided, conversational walkthrough that explains code, UI, UX, features, or .copilot-tracking artifacts one line or block at a time with navigable evidence links, deep subagent review, and captured change requests for RPI handoff. Use when the user wants to understand how something works or why it was changed. | +| **secure-by-design** | Secure by Design principles knowledge base for assessing security-first design, development, and deployment across the software lifecycle. | +| **security-planning** | Security planning reference set for operational buckets, STRIDE analysis, standards mapping, NIST control families, and backlog scaffolding. | +| **security-reviewer-formats** | Format specifications and data contracts for the security reviewer orchestrator and its subagents. | +| **supply-chain-security** | Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies. | +| **telemetry-foundations** | Declarative OpenTelemetry-aligned telemetry vocabulary and instrumentation conventions for traces, metrics, logs, and PII handling | +| **tts-voiceover** | Text-to-speech voice-over generation from YAML speaker notes using Azure Speech SDK with SSML pronunciation control | +| **vally-tests** | Authors Vally conformance tests for prompts, instructions, agents, and skills, including refusals for jailbreak, prompt-injection, harmful-elicitation, TOS, CoC, and PII-extraction stimuli | +| **vex** | OpenVEX v0.2.0 specification reference plus VEX management playbooks - Brought to you by microsoft/hve-core. | +| **video-to-gif** | Video-to-GIF conversion with FFmpeg two-pass optimization | +| **vscode-playwright** | VS Code screenshot capture using Playwright MCP with serve-web for slide decks and documentation | ### Hooks diff --git a/collections/hve-core-all.collection.yml b/collections/hve-core-all.collection.yml index e75af204d..70d57e3ce 100644 --- a/collections/hve-core-all.collection.yml +++ b/collections/hve-core-all.collection.yml @@ -564,6 +564,8 @@ items: - path: .github/skills/coding-standards/code-review kind: skill maturity: experimental +- path: .github/skills/coding-standards/hve-artifact-authoring + kind: skill - path: .github/skills/coding-standards/python-foundational kind: skill maturity: experimental diff --git a/docs/reference/README.md b/docs/reference/README.md index 0b991ab65..6bbfdb730 100644 --- a/docs/reference/README.md +++ b/docs/reference/README.md @@ -2,7 +2,7 @@ title: Reference description: Generated reference documentation for HVE Core GenAI assets. sidebar_position: 0 -ms.date: 2026-07-13 +ms.date: 2026-07-22 --- @@ -13,5 +13,5 @@ This page lists the generated reference documentation, grouped by asset kind. | [Agents](agents/README.md) | 77 | | [Instructions](instructions/README.md) | 73 | | [Prompts](prompts/README.md) | 75 | -| [Skills](skills/README.md) | 53 | +| [Skills](skills/README.md) | 54 | diff --git a/docs/reference/skills/README.md b/docs/reference/skills/README.md index 9fc7c994b..ef92e5e11 100644 --- a/docs/reference/skills/README.md +++ b/docs/reference/skills/README.md @@ -2,65 +2,66 @@ title: Skills description: Reference documentation for HVE Core skills. sidebar_position: 0 -ms.date: 2026-07-13 +ms.date: 2026-07-22 --- This page lists the generated reference documentation for HVE Core skills. -| Asset | Description | -|----------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| [accessibility](accessibility/accessibility.md) | Consolidated accessibility skill entrypoint for WCAG 2.2, ARIA Authoring Practices, cognitive accessibility, Section 508, EN 301 549, and the Accessibility Planner workflow. | -| [code-review](coding-standards/code-review.md) | Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output. | -| [python-foundational](coding-standards/python-foundational.md) | Foundational Python best practices, idioms, and code quality fundamentals | -| [dt-coaching-foundation](design-thinking/dt-coaching-foundation.md) | Design Thinking coaching foundation knowledge: coach identity and philosophy, quality and fidelity constraints, method sequencing, coaching state schema, and the canonical deck workflow | -| [dt-curriculum](design-thinking/dt-curriculum.md) | Design Thinking learning curriculum covering nine progressive modules across the full Problem, Solution, and Implementation Space methods plus a shared manufacturing reference scenario for teaching and practice | -| [dt-methods](design-thinking/dt-methods.md) | Design Thinking method coaching knowledge across all nine methods including per-method techniques, deep expertise, and industry context (energy, financial services, healthcare, manufacturing, nonprofit and social impact, pharmaceuticals and life sciences, professional services, public sector, retail and CPG) | -| [.Github/Skills/Design Thinking/Dt Methods/References/Dt Coach Telemetry](design-thinking/dt-methods/references/dt-coach-telemetry.md) | Design Thinking Coach telemetry overlay applying telemetry-foundations vocabulary to DT session artifacts | -| [dt-rpi-integration](design-thinking/dt-rpi-integration.md) | Design Thinking to RPI handoff knowledge covering the DT-to-RPI handoff contract, DT-aware research/planning/implement/review contexts, subagent handoff workflow, and Method 5 image prompt generation | -| [caveman](experimental/caveman.md) | Ultra-compressed response style that reduces output token count while preserving technical accuracy, with intensity levels and auto-clarity safety rules | -| [customer-card-render](experimental/customer-card-render.md) | Generate customer-card PowerPoint content YAML from Design Thinking canonical artifacts and build using the shared PowerPoint skill pipeline | -| [mural](experimental/mural.md) | Mural workspace, room, mural, and widget workflows via the Mural REST API exposed through a Python CLI. Use when you need to read or write Mural content or automate widget creation. | -| [powerpoint](experimental/powerpoint.md) | PowerPoint slide deck generation and management using python-pptx with YAML-driven content and styling | -| [tts-voiceover](experimental/tts-voiceover.md) | Text-to-speech voice-over generation from YAML speaker notes using Azure Speech SDK with SSML pronunciation control | -| [video-to-gif](experimental/video-to-gif.md) | Video-to-GIF conversion with FFmpeg two-pass optimization | -| [vscode-playwright](experimental/vscode-playwright.md) | VS Code screenshot capture using Playwright MCP with serve-web for slide decks and documentation | -| [gh-code-scanning](github/gh-code-scanning.md) | Retrieves and groups GitHub code scanning alerts by rule and severity using the gh CLI | -| [gitlab](gitlab/gitlab.md) | Manage GitLab merge requests and pipelines with a Python CLI | -| [architecture-diagrams](hve-core/architecture-diagrams.md) | Architecture diagram authoring for cloud infrastructure: parse Azure IaC, map relationships, and render either ASCII block diagrams or Mermaid flowcharts based on the caller's chosen output format | -| [documentation](hve-core/documentation.md) | Canonical documentation capability for audit, drift, validate, and author modes in hve-core. | -| [hve-builder-tester](hve-core/hve-builder-tester.md) | Test HVE artifact behavior with black-box scenarios, contained simulation or approved native execution, independent grading, and evidence reports. | -| [hve-builder](hve-core/hve-builder.md) | Author, review, or validate Copilot prompt-engineering artifacts through independent review, behavior testing, and host checks. | -| [prompt-analyze](hve-core/prompt-analyze.md) | Compatibility alias for read-only prompt artifact review. Routes static and behavior analysis to hve-builder review mode. | -| [prompt-builder](hve-core/prompt-builder.md) | Compatibility alias for legacy prompt-building requests. Routes creation and improvement to the hve-builder skill. | -| [prompt-refactor](hve-core/prompt-refactor.md) | Compatibility alias for behavior-preserving prompt artifact cleanup. Routes refactoring to hve-builder refactor mode. | -| [vally-tests](hve-core/vally-tests.md) | Authors Vally conformance tests for prompts, instructions, agents, and skills, including refusals for jailbreak, prompt-injection, harmful-elicitation, TOS, CoC, and PII-extraction stimuli | -| [hve-core-installer](installer/hve-core-installer.md) | Decision-driven HVE-Core installer with multiple clone-based and extension install methods, environment detection, and agent customization | -| [jira](jira/jira.md) | Jira issue workflows for search, issue updates, transitions, comments, and field discovery via the Jira REST API. Use when you need to search with JQL, inspect an issue, create or update work items, move an issue between statuses, post comments, or discover required fields for issue creation. | -| [adr-author](project-planning/adr-author.md) | Authoring skill for Architecture Decision Records (ADRs) supporting capture, from-planner-handoff, and adopt-template entry modes with selectable Y-Statement or MADR v4.0.0 output templates, supersession lineage, and ASR trigger evaluation. | -| [privacy-standards](project-planning/privacy-standards.md) | Privacy planning reference for data-flow reasoning, standards mapping, and DPIA thresholds | -| [rai-planner](project-planning/rai-planner.md) | On-demand RAI planner reference pack covering Phase 1 capture, Phase 2 risk classification, Phase 5 impact assessment, and Phase 6 review and backlog handoff. | -| [requirements-author](project-planning/requirements-author.md) | Requirements authoring guide for BRD and PRD across Discover, Define, and Govern with canonical templates and handoff contracts | -| [security-planning](project-planning/security-planning.md) | Security planning reference set for operational buckets, STRIDE analysis, standards mapping, NIST control families, and backlog scaffolding. | -| [rai-standards](rai/rai-standards.md) | Consolidated Responsible AI standards reference: NIST AI RMF 1.0, AI STRIDE threat-modeling overlay, EU AI Act risk tiers, and an open-standards catalog with phase mapping | -| [rpi-implement](rpi/rpi-implement.md) | Execute approved implementation phases, update tracking artifacts, and hand off review-ready results. | -| [rpi-plan](rpi/rpi-plan.md) | Create implementation-ready planning artifacts and validation evidence for RPI tasks. | -| [rpi-quick](rpi/rpi-quick.md) | Umbrella RPI playbook that sequences Research, Plan, Implement, Review, and Discover for one-shot task execution with quality gates. | -| [rpi-research](rpi/rpi-research.md) | Research-only RPI playbook that gathers task evidence, writes dated research artifacts under .copilot-tracking/research/, and hands off planning-ready findings. Use when the user needs evidence, alternatives, or task framing first. | -| [rpi-review](rpi/rpi-review.md) | Review-only RPI playbook that validates implementation evidence, checks phase completion, and closes the loop with explicit next steps. Use when the user needs review coverage or acceptance evidence. | -| [rpi-walkthrough](rpi/rpi-walkthrough.md) | Guided, conversational walkthrough that explains code, UI, UX, features, or .copilot-tracking artifacts one line or block at a time with navigable evidence links, deep subagent review, and captured change requests for RPI handoff. Use when the user wants to understand how something works or why it was changed. | -| [owasp-agentic](security/owasp-agentic.md) | OWASP Agentic Security Top 10 knowledge base for identifying, assessing, and remediating AI agent system security risks. | -| [owasp-cicd](security/owasp-cicd.md) | OWASP CI/CD Top 10 knowledge base for identifying, assessing, and remediating CI/CD pipeline security risks. | -| [owasp-docker](security/owasp-docker.md) | OWASP Docker Top 6 knowledge base for identifying, assessing, and remediating Docker container security risks. | -| [owasp-infrastructure](security/owasp-infrastructure.md) | OWASP Infrastructure Top 10 knowledge base for identifying, assessing, and remediating internal IT infrastructure security risks. | -| [owasp-llm](security/owasp-llm.md) | OWASP Top 10 for LLM Applications (2025) knowledge base for identifying, assessing, and remediating large language model security risks. | -| [owasp-mcp](security/owasp-mcp.md) | OWASP MCP Top 10 knowledge base for identifying, assessing, and remediating Model Context Protocol security risks. | -| [owasp-top-10](security/owasp-top-10.md) | OWASP Top 10 for Web Applications (2025) knowledge base for identifying, assessing, and remediating web application security risks. | -| [secure-by-design](security/secure-by-design.md) | Secure by Design principles knowledge base for assessing security-first design, development, and deployment across the software lifecycle. | -| [security-reviewer-formats](security/security-reviewer-formats.md) | Format specifications and data contracts for the security reviewer orchestrator and its subagents. | -| [supply-chain-security](security/supply-chain-security.md) | Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies. | -| [vex](security/vex.md) | OpenVEX v0.2.0 specification reference plus VEX management playbooks - Brought to you by microsoft/hve-core. | -| [backlog-templates](shared/backlog-templates.md) | Shared work-item templates and conventions for ADO and GitHub backlog handoff across the RAI, Security, SSSC, Accessibility, and Privacy planners | -| [pr-reference](shared/pr-reference.md) | Generates PR reference XML with commit history and unified diffs between branches, with extension and path filtering. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. | -| [telemetry-foundations](shared/telemetry-foundations.md) | Declarative OpenTelemetry-aligned telemetry vocabulary and instrumentation conventions for traces, metrics, logs, and PII handling | +| Asset | Description | +|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| [accessibility](accessibility/accessibility.md) | Consolidated accessibility skill entrypoint for WCAG 2.2, ARIA Authoring Practices, cognitive accessibility, Section 508, EN 301 549, and the Accessibility Planner workflow. | +| [code-review](coding-standards/code-review.md) | Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output. | +| [hve-artifact-authoring](coding-standards/hve-artifact-authoring.md) | Create, validate, and package AI artifacts for HVE Core, GitHub Copilot's prompt engineering framework. Covers agents, prompts, instructions, skills, and collections with frontmatter contracts, naming conventions, collection packaging, subagent delegation, workspace state tracking, and CI validation pipelines. Use when building any markdown-based AI artifact that follows the four-tier delegation model (Prompts → Agents → Instructions → Skills) with schema-validated frontmatter. | +| [python-foundational](coding-standards/python-foundational.md) | Foundational Python best practices, idioms, and code quality fundamentals | +| [dt-coaching-foundation](design-thinking/dt-coaching-foundation.md) | Design Thinking coaching foundation knowledge: coach identity and philosophy, quality and fidelity constraints, method sequencing, coaching state schema, and the canonical deck workflow | +| [dt-curriculum](design-thinking/dt-curriculum.md) | Design Thinking learning curriculum covering nine progressive modules across the full Problem, Solution, and Implementation Space methods plus a shared manufacturing reference scenario for teaching and practice | +| [dt-methods](design-thinking/dt-methods.md) | Design Thinking method coaching knowledge across all nine methods including per-method techniques, deep expertise, and industry context (energy, financial services, healthcare, manufacturing, nonprofit and social impact, pharmaceuticals and life sciences, professional services, public sector, retail and CPG) | +| [.Github/Skills/Design Thinking/Dt Methods/References/Dt Coach Telemetry](design-thinking/dt-methods/references/dt-coach-telemetry.md) | Design Thinking Coach telemetry overlay applying telemetry-foundations vocabulary to DT session artifacts | +| [dt-rpi-integration](design-thinking/dt-rpi-integration.md) | Design Thinking to RPI handoff knowledge covering the DT-to-RPI handoff contract, DT-aware research/planning/implement/review contexts, subagent handoff workflow, and Method 5 image prompt generation | +| [caveman](experimental/caveman.md) | Ultra-compressed response style that reduces output token count while preserving technical accuracy, with intensity levels and auto-clarity safety rules | +| [customer-card-render](experimental/customer-card-render.md) | Generate customer-card PowerPoint content YAML from Design Thinking canonical artifacts and build using the shared PowerPoint skill pipeline | +| [mural](experimental/mural.md) | Mural workspace, room, mural, and widget workflows via the Mural REST API exposed through a Python CLI. Use when you need to read or write Mural content or automate widget creation. | +| [powerpoint](experimental/powerpoint.md) | PowerPoint slide deck generation and management using python-pptx with YAML-driven content and styling | +| [tts-voiceover](experimental/tts-voiceover.md) | Text-to-speech voice-over generation from YAML speaker notes using Azure Speech SDK with SSML pronunciation control | +| [video-to-gif](experimental/video-to-gif.md) | Video-to-GIF conversion with FFmpeg two-pass optimization | +| [vscode-playwright](experimental/vscode-playwright.md) | VS Code screenshot capture using Playwright MCP with serve-web for slide decks and documentation | +| [gh-code-scanning](github/gh-code-scanning.md) | Retrieves and groups GitHub code scanning alerts by rule and severity using the gh CLI | +| [gitlab](gitlab/gitlab.md) | Manage GitLab merge requests and pipelines with a Python CLI | +| [architecture-diagrams](hve-core/architecture-diagrams.md) | Architecture diagram authoring for cloud infrastructure: parse Azure IaC, map relationships, and render either ASCII block diagrams or Mermaid flowcharts based on the caller's chosen output format | +| [documentation](hve-core/documentation.md) | Canonical documentation capability for audit, drift, validate, and author modes in hve-core. | +| [hve-builder-tester](hve-core/hve-builder-tester.md) | Test HVE artifact behavior with black-box scenarios, contained simulation or approved native execution, independent grading, and evidence reports. | +| [hve-builder](hve-core/hve-builder.md) | Author, review, or validate Copilot prompt-engineering artifacts through independent review, behavior testing, and host checks. | +| [prompt-analyze](hve-core/prompt-analyze.md) | Compatibility alias for read-only prompt artifact review. Routes static and behavior analysis to hve-builder review mode. | +| [prompt-builder](hve-core/prompt-builder.md) | Compatibility alias for legacy prompt-building requests. Routes creation and improvement to the hve-builder skill. | +| [prompt-refactor](hve-core/prompt-refactor.md) | Compatibility alias for behavior-preserving prompt artifact cleanup. Routes refactoring to hve-builder refactor mode. | +| [vally-tests](hve-core/vally-tests.md) | Authors Vally conformance tests for prompts, instructions, agents, and skills, including refusals for jailbreak, prompt-injection, harmful-elicitation, TOS, CoC, and PII-extraction stimuli | +| [hve-core-installer](installer/hve-core-installer.md) | Decision-driven HVE-Core installer with multiple clone-based and extension install methods, environment detection, and agent customization | +| [jira](jira/jira.md) | Jira issue workflows for search, issue updates, transitions, comments, and field discovery via the Jira REST API. Use when you need to search with JQL, inspect an issue, create or update work items, move an issue between statuses, post comments, or discover required fields for issue creation. | +| [adr-author](project-planning/adr-author.md) | Authoring skill for Architecture Decision Records (ADRs) supporting capture, from-planner-handoff, and adopt-template entry modes with selectable Y-Statement or MADR v4.0.0 output templates, supersession lineage, and ASR trigger evaluation. | +| [privacy-standards](project-planning/privacy-standards.md) | Privacy planning reference for data-flow reasoning, standards mapping, and DPIA thresholds | +| [rai-planner](project-planning/rai-planner.md) | On-demand RAI planner reference pack covering Phase 1 capture, Phase 2 risk classification, Phase 5 impact assessment, and Phase 6 review and backlog handoff. | +| [requirements-author](project-planning/requirements-author.md) | Requirements authoring guide for BRD and PRD across Discover, Define, and Govern with canonical templates and handoff contracts | +| [security-planning](project-planning/security-planning.md) | Security planning reference set for operational buckets, STRIDE analysis, standards mapping, NIST control families, and backlog scaffolding. | +| [rai-standards](rai/rai-standards.md) | Consolidated Responsible AI standards reference: NIST AI RMF 1.0, AI STRIDE threat-modeling overlay, EU AI Act risk tiers, and an open-standards catalog with phase mapping | +| [rpi-implement](rpi/rpi-implement.md) | Execute approved implementation phases, update tracking artifacts, and hand off review-ready results. | +| [rpi-plan](rpi/rpi-plan.md) | Create implementation-ready planning artifacts and validation evidence for RPI tasks. | +| [rpi-quick](rpi/rpi-quick.md) | Umbrella RPI playbook that sequences Research, Plan, Implement, Review, and Discover for one-shot task execution with quality gates. | +| [rpi-research](rpi/rpi-research.md) | Research-only RPI playbook that gathers task evidence, writes dated research artifacts under .copilot-tracking/research/, and hands off planning-ready findings. Use when the user needs evidence, alternatives, or task framing first. | +| [rpi-review](rpi/rpi-review.md) | Review-only RPI playbook that validates implementation evidence, checks phase completion, and closes the loop with explicit next steps. Use when the user needs review coverage or acceptance evidence. | +| [rpi-walkthrough](rpi/rpi-walkthrough.md) | Guided, conversational walkthrough that explains code, UI, UX, features, or .copilot-tracking artifacts one line or block at a time with navigable evidence links, deep subagent review, and captured change requests for RPI handoff. Use when the user wants to understand how something works or why it was changed. | +| [owasp-agentic](security/owasp-agentic.md) | OWASP Agentic Security Top 10 knowledge base for identifying, assessing, and remediating AI agent system security risks. | +| [owasp-cicd](security/owasp-cicd.md) | OWASP CI/CD Top 10 knowledge base for identifying, assessing, and remediating CI/CD pipeline security risks. | +| [owasp-docker](security/owasp-docker.md) | OWASP Docker Top 6 knowledge base for identifying, assessing, and remediating Docker container security risks. | +| [owasp-infrastructure](security/owasp-infrastructure.md) | OWASP Infrastructure Top 10 knowledge base for identifying, assessing, and remediating internal IT infrastructure security risks. | +| [owasp-llm](security/owasp-llm.md) | OWASP Top 10 for LLM Applications (2025) knowledge base for identifying, assessing, and remediating large language model security risks. | +| [owasp-mcp](security/owasp-mcp.md) | OWASP MCP Top 10 knowledge base for identifying, assessing, and remediating Model Context Protocol security risks. | +| [owasp-top-10](security/owasp-top-10.md) | OWASP Top 10 for Web Applications (2025) knowledge base for identifying, assessing, and remediating web application security risks. | +| [secure-by-design](security/secure-by-design.md) | Secure by Design principles knowledge base for assessing security-first design, development, and deployment across the software lifecycle. | +| [security-reviewer-formats](security/security-reviewer-formats.md) | Format specifications and data contracts for the security reviewer orchestrator and its subagents. | +| [supply-chain-security](security/supply-chain-security.md) | Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies. | +| [vex](security/vex.md) | OpenVEX v0.2.0 specification reference plus VEX management playbooks - Brought to you by microsoft/hve-core. | +| [backlog-templates](shared/backlog-templates.md) | Shared work-item templates and conventions for ADO and GitHub backlog handoff across the RAI, Security, SSSC, Accessibility, and Privacy planners | +| [pr-reference](shared/pr-reference.md) | Generates PR reference XML with commit history and unified diffs between branches, with extension and path filtering. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. | +| [telemetry-foundations](shared/telemetry-foundations.md) | Declarative OpenTelemetry-aligned telemetry vocabulary and instrumentation conventions for traces, metrics, logs, and PII handling | diff --git a/docs/reference/skills/coding-standards/hve-artifact-authoring.md b/docs/reference/skills/coding-standards/hve-artifact-authoring.md new file mode 100644 index 000000000..8e87f1b9b --- /dev/null +++ b/docs/reference/skills/coding-standards/hve-artifact-authoring.md @@ -0,0 +1,31 @@ +--- +title: hve-artifact-authoring +description: "Create, validate, and package AI artifacts for HVE Core, GitHub Copilot's prompt engineering framework. Covers agents, prompts, instructions, skills, and collections with frontmatter contracts, naming conventions, collection packaging, subagent delegation, workspace state tracking, and CI validation pipelines. Use when building any markdown-based AI artifact that follows the four-tier delegation model (Prompts → Agents → Instructions → Skills) with schema-validated frontmatter." +sidebar_position: 2 +ms.date: 2026-07-22 +--- + + +| Field | Value | +|-------------|----------------------------------------------------------| +| Kind | skill | +| Source | `.github/skills/coding-standards/hve-artifact-authoring` | +| Invocation | Loaded on demand by referencing agents | +| Interactive | No | + + +## What it does + + +Create, validate, and package AI artifacts for HVE Core, GitHub Copilot's prompt engineering framework. Covers agents, prompts, instructions, skills, and collections with frontmatter contracts, naming conventions, collection packaging, subagent delegation, workspace state tracking, and CI validation pipelines. Use when building any markdown-based AI artifact that follows the four-tier delegation model (Prompts → Agents → Instructions → Skills) with schema-validated frontmatter. + + +## When to use it + + +Describe the situations where this asset is the right choice, and when to reach for a different asset instead. + +## Example usage + + +Provide a concrete example that shows the asset in action, including representative input and the resulting output. diff --git a/docs/reference/skills/coding-standards/python-foundational.md b/docs/reference/skills/coding-standards/python-foundational.md index 5123c67b0..0b5603654 100644 --- a/docs/reference/skills/coding-standards/python-foundational.md +++ b/docs/reference/skills/coding-standards/python-foundational.md @@ -1,8 +1,8 @@ --- title: python-foundational description: "Foundational Python best practices, idioms, and code quality fundamentals" -sidebar_position: 2 -ms.date: 2026-07-03 +sidebar_position: 3 +ms.date: 2026-07-22 --- diff --git a/plugins/coding-standards/README.md b/plugins/coding-standards/README.md index a0909c8d8..7b71ab8b3 100644 --- a/plugins/coding-standards/README.md +++ b/plugins/coding-standards/README.md @@ -52,12 +52,13 @@ Enforce language-specific coding conventions and best practices across your proj ### Skills -| Name | Description | -|---------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **code-review** | Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output. | -| **pr-reference** | Generates PR reference XML with commit history and unified diffs between branches, with extension and path filtering. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. | -| **python-foundational** | Foundational Python best practices, idioms, and code quality fundamentals | -| **telemetry-foundations** | Declarative OpenTelemetry-aligned telemetry vocabulary and instrumentation conventions for traces, metrics, logs, and PII handling | +| Name | Description | +|----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **code-review** | Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output. | +| **hve-artifact-authoring** | Create, validate, and package AI artifacts for HVE Core, GitHub Copilot's prompt engineering framework. Covers agents, prompts, instructions, skills, and collections with frontmatter contracts, naming conventions, collection packaging, subagent delegation, workspace state tracking, and CI validation pipelines. Use when building any markdown-based AI artifact that follows the four-tier delegation model (Prompts → Agents → Instructions → Skills) with schema-validated frontmatter. | +| **pr-reference** | Generates PR reference XML with commit history and unified diffs between branches, with extension and path filtering. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. | +| **python-foundational** | Foundational Python best practices, idioms, and code quality fundamentals | +| **telemetry-foundations** | Declarative OpenTelemetry-aligned telemetry vocabulary and instrumentation conventions for traces, metrics, logs, and PII handling | diff --git a/plugins/coding-standards/skills/coding-standards/hve-artifact-authoring b/plugins/coding-standards/skills/coding-standards/hve-artifact-authoring new file mode 120000 index 000000000..1c724d78b --- /dev/null +++ b/plugins/coding-standards/skills/coding-standards/hve-artifact-authoring @@ -0,0 +1 @@ +../../../../.github/skills/coding-standards/hve-artifact-authoring \ No newline at end of file diff --git a/plugins/hve-core-all/README.md b/plugins/hve-core-all/README.md index fbe1e9be7..a5956cf8e 100644 --- a/plugins/hve-core-all/README.md +++ b/plugins/hve-core-all/README.md @@ -270,59 +270,60 @@ Use this edition when you want access to everything without choosing a focused c ### Skills -| Name | Description | -|-------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **accessibility** | Consolidated accessibility skill entrypoint for WCAG 2.2, ARIA Authoring Practices, cognitive accessibility, Section 508, EN 301 549, and the Accessibility Planner workflow. | -| **adr-author** | Authoring skill for Architecture Decision Records (ADRs) supporting capture, from-planner-handoff, and adopt-template entry modes with selectable Y-Statement or MADR v4.0.0 output templates, supersession lineage, and ASR trigger evaluation. | -| **architecture-diagrams** | Architecture diagram authoring for cloud infrastructure: parse Azure IaC, map relationships, and render either ASCII block diagrams or Mermaid flowcharts based on the caller's chosen output format | -| **backlog-templates** | Shared work-item templates and conventions for ADO and GitHub backlog handoff across the RAI, Security, SSSC, Accessibility, and Privacy planners | -| **caveman** | Ultra-compressed response style that reduces output token count while preserving technical accuracy, with intensity levels and auto-clarity safety rules | -| **code-review** | Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output. | -| **customer-card-render** | Generate customer-card PowerPoint content YAML from Design Thinking canonical artifacts and build using the shared PowerPoint skill pipeline | -| **documentation** | Canonical documentation capability for audit, drift, validate, and author modes in hve-core. | -| **dt-coaching-foundation** | Design Thinking coaching foundation knowledge: coach identity and philosophy, quality and fidelity constraints, method sequencing, coaching state schema, and the canonical deck workflow | -| **dt-curriculum** | Design Thinking learning curriculum covering nine progressive modules across the full Problem, Solution, and Implementation Space methods plus a shared manufacturing reference scenario for teaching and practice | -| **dt-methods** | Design Thinking method coaching knowledge across all nine methods including per-method techniques, deep expertise, and industry context (energy, financial services, healthcare, manufacturing, nonprofit and social impact, pharmaceuticals and life sciences, professional services, public sector, retail and CPG) | -| **dt-rpi-integration** | Design Thinking to RPI handoff knowledge covering the DT-to-RPI handoff contract, DT-aware research/planning/implement/review contexts, subagent handoff workflow, and Method 5 image prompt generation | -| **gh-code-scanning** | Retrieves and groups GitHub code scanning alerts by rule and severity using the gh CLI | -| **gitlab** | Manage GitLab merge requests and pipelines with a Python CLI | -| **hve-builder** | Author, review, or validate Copilot prompt-engineering artifacts through independent review, behavior testing, and host checks. | -| **hve-builder-tester** | Test HVE artifact behavior with black-box scenarios, contained simulation or approved native execution, independent grading, and evidence reports. | -| **hve-core-installer** | Decision-driven HVE-Core installer with multiple clone-based and extension install methods, environment detection, and agent customization | -| **jira** | Jira issue workflows for search, issue updates, transitions, comments, and field discovery via the Jira REST API. Use when you need to search with JQL, inspect an issue, create or update work items, move an issue between statuses, post comments, or discover required fields for issue creation. | -| **mural** | Mural workspace, room, mural, and widget workflows via the Mural REST API exposed through a Python CLI. Use when you need to read or write Mural content or automate widget creation. | -| **owasp-agentic** | OWASP Agentic Security Top 10 knowledge base for identifying, assessing, and remediating AI agent system security risks. | -| **owasp-cicd** | OWASP CI/CD Top 10 knowledge base for identifying, assessing, and remediating CI/CD pipeline security risks. | -| **owasp-infrastructure** | OWASP Infrastructure Top 10 knowledge base for identifying, assessing, and remediating internal IT infrastructure security risks. | -| **owasp-llm** | OWASP Top 10 for LLM Applications (2025) knowledge base for identifying, assessing, and remediating large language model security risks. | -| **owasp-mcp** | OWASP MCP Top 10 knowledge base for identifying, assessing, and remediating Model Context Protocol security risks. | -| **owasp-top-10** | OWASP Top 10 for Web Applications (2025) knowledge base for identifying, assessing, and remediating web application security risks. | -| **powerpoint** | PowerPoint slide deck generation and management using python-pptx with YAML-driven content and styling | -| **pr-reference** | Generates PR reference XML with commit history and unified diffs between branches, with extension and path filtering. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. | -| **privacy-standards** | Privacy planning reference for data-flow reasoning, standards mapping, and DPIA thresholds | -| **prompt-analyze** | Compatibility alias for read-only prompt artifact review. Routes static and behavior analysis to hve-builder review mode. | -| **prompt-builder** | Compatibility alias for legacy prompt-building requests. Routes creation and improvement to the hve-builder skill. | -| **prompt-refactor** | Compatibility alias for behavior-preserving prompt artifact cleanup. Routes refactoring to hve-builder refactor mode. | -| **python-foundational** | Foundational Python best practices, idioms, and code quality fundamentals | -| **rai-planner** | On-demand RAI planner reference pack covering Phase 1 capture, Phase 2 risk classification, Phase 5 impact assessment, and Phase 6 review and backlog handoff. | -| **rai-standards** | Consolidated Responsible AI standards reference: NIST AI RMF 1.0, AI STRIDE threat-modeling overlay, EU AI Act risk tiers, and an open-standards catalog with phase mapping | -| **requirements-author** | Requirements authoring guide for BRD and PRD across Discover, Define, and Govern with canonical templates and handoff contracts | -| **rpi-implement** | Execute approved implementation phases, update tracking artifacts, and hand off review-ready results. | -| **rpi-plan** | Create implementation-ready planning artifacts and validation evidence for RPI tasks. | -| **rpi-quick** | Umbrella RPI playbook that sequences Research, Plan, Implement, Review, and Discover for one-shot task execution with quality gates. | -| **rpi-research** | Research-only RPI playbook that gathers task evidence, writes dated research artifacts under .copilot-tracking/research/, and hands off planning-ready findings. Use when the user needs evidence, alternatives, or task framing first. | -| **rpi-review** | Review-only RPI playbook that validates implementation evidence, checks phase completion, and closes the loop with explicit next steps. Use when the user needs review coverage or acceptance evidence. | -| **rpi-walkthrough** | Guided, conversational walkthrough that explains code, UI, UX, features, or .copilot-tracking artifacts one line or block at a time with navigable evidence links, deep subagent review, and captured change requests for RPI handoff. Use when the user wants to understand how something works or why it was changed. | -| **secure-by-design** | Secure by Design principles knowledge base for assessing security-first design, development, and deployment across the software lifecycle. | -| **security-planning** | Security planning reference set for operational buckets, STRIDE analysis, standards mapping, NIST control families, and backlog scaffolding. | -| **security-reviewer-formats** | Format specifications and data contracts for the security reviewer orchestrator and its subagents. | -| **supply-chain-security** | Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies. | -| **telemetry-foundations** | Declarative OpenTelemetry-aligned telemetry vocabulary and instrumentation conventions for traces, metrics, logs, and PII handling | -| **tts-voiceover** | Text-to-speech voice-over generation from YAML speaker notes using Azure Speech SDK with SSML pronunciation control | -| **vally-tests** | Authors Vally conformance tests for prompts, instructions, agents, and skills, including refusals for jailbreak, prompt-injection, harmful-elicitation, TOS, CoC, and PII-extraction stimuli | -| **vex** | OpenVEX v0.2.0 specification reference plus VEX management playbooks - Brought to you by microsoft/hve-core. | -| **video-to-gif** | Video-to-GIF conversion with FFmpeg two-pass optimization | -| **vscode-playwright** | VS Code screenshot capture using Playwright MCP with serve-web for slide decks and documentation | +| Name | Description | +|-------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **accessibility** | Consolidated accessibility skill entrypoint for WCAG 2.2, ARIA Authoring Practices, cognitive accessibility, Section 508, EN 301 549, and the Accessibility Planner workflow. | +| **adr-author** | Authoring skill for Architecture Decision Records (ADRs) supporting capture, from-planner-handoff, and adopt-template entry modes with selectable Y-Statement or MADR v4.0.0 output templates, supersession lineage, and ASR trigger evaluation. | +| **architecture-diagrams** | Architecture diagram authoring for cloud infrastructure: parse Azure IaC, map relationships, and render either ASCII block diagrams or Mermaid flowcharts based on the caller's chosen output format | +| **backlog-templates** | Shared work-item templates and conventions for ADO and GitHub backlog handoff across the RAI, Security, SSSC, Accessibility, and Privacy planners | +| **caveman** | Ultra-compressed response style that reduces output token count while preserving technical accuracy, with intensity levels and auto-clarity safety rules | +| **code-review** | Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output. | +| **customer-card-render** | Generate customer-card PowerPoint content YAML from Design Thinking canonical artifacts and build using the shared PowerPoint skill pipeline | +| **documentation** | Canonical documentation capability for audit, drift, validate, and author modes in hve-core. | +| **dt-coaching-foundation** | Design Thinking coaching foundation knowledge: coach identity and philosophy, quality and fidelity constraints, method sequencing, coaching state schema, and the canonical deck workflow | +| **dt-curriculum** | Design Thinking learning curriculum covering nine progressive modules across the full Problem, Solution, and Implementation Space methods plus a shared manufacturing reference scenario for teaching and practice | +| **dt-methods** | Design Thinking method coaching knowledge across all nine methods including per-method techniques, deep expertise, and industry context (energy, financial services, healthcare, manufacturing, nonprofit and social impact, pharmaceuticals and life sciences, professional services, public sector, retail and CPG) | +| **dt-rpi-integration** | Design Thinking to RPI handoff knowledge covering the DT-to-RPI handoff contract, DT-aware research/planning/implement/review contexts, subagent handoff workflow, and Method 5 image prompt generation | +| **gh-code-scanning** | Retrieves and groups GitHub code scanning alerts by rule and severity using the gh CLI | +| **gitlab** | Manage GitLab merge requests and pipelines with a Python CLI | +| **hve-artifact-authoring** | Create, validate, and package AI artifacts for HVE Core, GitHub Copilot's prompt engineering framework. Covers agents, prompts, instructions, skills, and collections with frontmatter contracts, naming conventions, collection packaging, subagent delegation, workspace state tracking, and CI validation pipelines. Use when building any markdown-based AI artifact that follows the four-tier delegation model (Prompts → Agents → Instructions → Skills) with schema-validated frontmatter. | +| **hve-builder** | Author, review, or validate Copilot prompt-engineering artifacts through independent review, behavior testing, and host checks. | +| **hve-builder-tester** | Test HVE artifact behavior with black-box scenarios, contained simulation or approved native execution, independent grading, and evidence reports. | +| **hve-core-installer** | Decision-driven HVE-Core installer with multiple clone-based and extension install methods, environment detection, and agent customization | +| **jira** | Jira issue workflows for search, issue updates, transitions, comments, and field discovery via the Jira REST API. Use when you need to search with JQL, inspect an issue, create or update work items, move an issue between statuses, post comments, or discover required fields for issue creation. | +| **mural** | Mural workspace, room, mural, and widget workflows via the Mural REST API exposed through a Python CLI. Use when you need to read or write Mural content or automate widget creation. | +| **owasp-agentic** | OWASP Agentic Security Top 10 knowledge base for identifying, assessing, and remediating AI agent system security risks. | +| **owasp-cicd** | OWASP CI/CD Top 10 knowledge base for identifying, assessing, and remediating CI/CD pipeline security risks. | +| **owasp-infrastructure** | OWASP Infrastructure Top 10 knowledge base for identifying, assessing, and remediating internal IT infrastructure security risks. | +| **owasp-llm** | OWASP Top 10 for LLM Applications (2025) knowledge base for identifying, assessing, and remediating large language model security risks. | +| **owasp-mcp** | OWASP MCP Top 10 knowledge base for identifying, assessing, and remediating Model Context Protocol security risks. | +| **owasp-top-10** | OWASP Top 10 for Web Applications (2025) knowledge base for identifying, assessing, and remediating web application security risks. | +| **powerpoint** | PowerPoint slide deck generation and management using python-pptx with YAML-driven content and styling | +| **pr-reference** | Generates PR reference XML with commit history and unified diffs between branches, with extension and path filtering. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries. | +| **privacy-standards** | Privacy planning reference for data-flow reasoning, standards mapping, and DPIA thresholds | +| **prompt-analyze** | Compatibility alias for read-only prompt artifact review. Routes static and behavior analysis to hve-builder review mode. | +| **prompt-builder** | Compatibility alias for legacy prompt-building requests. Routes creation and improvement to the hve-builder skill. | +| **prompt-refactor** | Compatibility alias for behavior-preserving prompt artifact cleanup. Routes refactoring to hve-builder refactor mode. | +| **python-foundational** | Foundational Python best practices, idioms, and code quality fundamentals | +| **rai-planner** | On-demand RAI planner reference pack covering Phase 1 capture, Phase 2 risk classification, Phase 5 impact assessment, and Phase 6 review and backlog handoff. | +| **rai-standards** | Consolidated Responsible AI standards reference: NIST AI RMF 1.0, AI STRIDE threat-modeling overlay, EU AI Act risk tiers, and an open-standards catalog with phase mapping | +| **requirements-author** | Requirements authoring guide for BRD and PRD across Discover, Define, and Govern with canonical templates and handoff contracts | +| **rpi-implement** | Execute approved implementation phases, update tracking artifacts, and hand off review-ready results. | +| **rpi-plan** | Create implementation-ready planning artifacts and validation evidence for RPI tasks. | +| **rpi-quick** | Umbrella RPI playbook that sequences Research, Plan, Implement, Review, and Discover for one-shot task execution with quality gates. | +| **rpi-research** | Research-only RPI playbook that gathers task evidence, writes dated research artifacts under .copilot-tracking/research/, and hands off planning-ready findings. Use when the user needs evidence, alternatives, or task framing first. | +| **rpi-review** | Review-only RPI playbook that validates implementation evidence, checks phase completion, and closes the loop with explicit next steps. Use when the user needs review coverage or acceptance evidence. | +| **rpi-walkthrough** | Guided, conversational walkthrough that explains code, UI, UX, features, or .copilot-tracking artifacts one line or block at a time with navigable evidence links, deep subagent review, and captured change requests for RPI handoff. Use when the user wants to understand how something works or why it was changed. | +| **secure-by-design** | Secure by Design principles knowledge base for assessing security-first design, development, and deployment across the software lifecycle. | +| **security-planning** | Security planning reference set for operational buckets, STRIDE analysis, standards mapping, NIST control families, and backlog scaffolding. | +| **security-reviewer-formats** | Format specifications and data contracts for the security reviewer orchestrator and its subagents. | +| **supply-chain-security** | Software supply chain security reference for OpenSSF Scorecard, SLSA, Sigstore, SBOM, and posture/backlog taxonomies. | +| **telemetry-foundations** | Declarative OpenTelemetry-aligned telemetry vocabulary and instrumentation conventions for traces, metrics, logs, and PII handling | +| **tts-voiceover** | Text-to-speech voice-over generation from YAML speaker notes using Azure Speech SDK with SSML pronunciation control | +| **vally-tests** | Authors Vally conformance tests for prompts, instructions, agents, and skills, including refusals for jailbreak, prompt-injection, harmful-elicitation, TOS, CoC, and PII-extraction stimuli | +| **vex** | OpenVEX v0.2.0 specification reference plus VEX management playbooks - Brought to you by microsoft/hve-core. | +| **video-to-gif** | Video-to-GIF conversion with FFmpeg two-pass optimization | +| **vscode-playwright** | VS Code screenshot capture using Playwright MCP with serve-web for slide decks and documentation | ### Hooks diff --git a/plugins/hve-core-all/skills/coding-standards/hve-artifact-authoring b/plugins/hve-core-all/skills/coding-standards/hve-artifact-authoring new file mode 120000 index 000000000..1c724d78b --- /dev/null +++ b/plugins/hve-core-all/skills/coding-standards/hve-artifact-authoring @@ -0,0 +1 @@ +../../../../.github/skills/coding-standards/hve-artifact-authoring \ No newline at end of file