fs
576a0c51cd
Add architecture test ViewLayerOutputEscapingContractTest that flags raw <?php echo in .phtml files. Legitimate uses (pre-built ARIA attrs from navActive(), hardcoded role values, pre-rendered HTML fragments) must carry an inline // raw-html-ok: reason marker. Annotated all 11 existing raw echo sites with justification markers. Added guard to catalog, enforcement map (automated), CLAUDE.md security section, and never-do-this list. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
.agents/
Centralized home for the 7-role agent workflow system.
Structure
workflow.md ← Roles, state machine, handover rules (start here)
contracts/ ← JSON schemas for role outputs (7 roles)
templates/ ← Starter JSON payloads per role (7 templates)
prompts/ ← Role-specific prompt baselines (7 prompts)
checks/ ← Guard catalog (22 guards), quality gates (9), checklists
← Enforcement policy + guard enforcement map
skills/ ← Reusable skill packages (guardrails, planner, grid, PHP CI)
runs/ ← Runtime artifacts per workflow run (gitignored)
Roles
| # | Role | Artifact | Guards |
|---|---|---|---|
| 1 | Analyst | analysis.json |
— |
| 2 | Planner | plan.json |
selects guards |
| 3 | Executor | execution-report.json |
provides evidence |
| 4 | Code Reviewer | review-code.json |
13 guards (GR-CORE/TEST/UI) |
| 5 | Security Reviewer | review-security.json |
9 guards (GR-SEC) |
| 6 | Acceptance Tester | review-acceptance.json |
SC-* criteria |
| 7 | Finalizer | finalize.json |
all reviews + CI |
Quick Links
| What | Where |
|---|---|
| Workflow & roles | workflow.md |
| Guard catalog (22 guards) | checks/guard-catalog.json |
| Quality gates (9 gates) | checks/quality-gates.json |
| Enforcement policy | checks/enforcement-policy.json |
| Guard enforcement map | checks/guard-enforcement-map.json |
| Code review checklist | checks/guard-checklist.md |
| Acceptance checklist | checks/acceptance-checklist.md |
| Module manifest schema | contracts/module-manifest.schema.json |
Project Context
See CLAUDE.md (repo root) for tech stack, architecture rules, and conventions.