Cursor rule

1---
2description: "PLANNING SPINE STEP 3 of 3 — Plan the work: write detailed implementation tasks into the active epic capsule (specs/epics/eNN-slug/). Produces countable-story-format .md specs and runnable -tasks.yaml files. Use after slice-tasks (step 2). Not a substitute for scope-work (step 1) or slice-tasks (step 2)."
3alwaysApply: false
4---
5 
6# story: e45s29
7 
8# Plan Work
9 
10> **Spine position:** Step 3 — scope-work → slice-tasks → plan-work.
11 
12Produce a detailed, verifiable implementation plan in the **active epic capsule directory** (`specs/epics/eNN-slug/`). Output: a story spec `.md` file (countable-story-format) and a decoupled `eNNsYY-tasks.yaml` with runnable verify commands. "I think it works" is not a step.
13 
14> **HARD GATE** — Do NOT proceed with a plan until the task's success criteria are clear. If success is ambiguous, convert the task into "step → verify: `<cmd>`" pairs here before writing tasks — every task ships a runnable `verify:` or the plan is not done.
15>
16> **RECURSIVE DISCIPLINE** — This lifecycle applies to EVERY task, including updating these skills. Never skip planning because a task is "meta" or "just documentation."
17 
18## Pre-flight
19 
20Read: `release-plan.yaml`, `product/SCOPE_LATEST.yaml`, active `epics/<capsule>/epic.yaml`, `tech-architecture/tech-stack.md`, `product/GLOSSARY_LATEST.yaml`.
21 
22> **ZOOM-OUT MANDATE** (v1.17.0) — If modifying an existing module: (1) State the module's **purpose**. (2) Name its **callers**. (3) List its **contracts**. Cannot answer all three? Stop — scope is misunderstood.
23 
24If this plan touches an existing module, run `assess-impact` first to understand blast radius.
25 
26> **DISCOVERY MANDATE** (v1.18.0) — For external API integration, verify the API signature via local docs or search and quote at least one technical detail in the step's context.
27 
28> **MULTIPLE INTERPRETATIONS (HARD GATE)** — If the task admits ≥2 valid interpretations, list them and get a user decision before drafting any steps.
29 
30> **COMPLEXITY PUSHBACK (HARD GATE)** — Every new abstraction MUST include a one-sentence "Reason for Depth." If it can't be filled non-trivially, the abstraction is premature — use inline code instead.
31 
32> **SLOPCHECK (HARD GATE)** — For every external package, tag it `[OK]`, `[SUS]`, or `[SLOP]`. `[SUS]`/`[SLOP]` require human approval before execution.
33 
34## Invocation modes
35 
36- Default: full plan with zoom-out mandate, impact assessment, slopcheck
37- `--fast`: Skip zoom-out and impact assessment. Use for tasks under 3 BCPs with no module interface changes.
38 
39## Process
40 
41> **Timing:** `bash scripts/bp-timing.sh start plan-work` at invocation; `bash scripts/bp-timing.sh end plan-work` before handoff.
42 
431. **Explore** — Use `Explore` subagent to understand affected modules, existing test patterns, similar prior art, and dependencies.
44 
452. **Draft steps** — Break implementation into the smallest possible steps where each step leaves the codebase working, has one observable outcome, and can be verified with a single command. Red-flag check: name any rationalization you caught before moving to step 3.
46 
473. **Write capsule story spec + tasks** — Output two files inside the active epic capsule. See [REFERENCE.md](REFERENCE.md) for file formats and the plan-template. Each task MUST include a `risk:` field (`P0` | `P1` | `P2` | `P3`) based on BCP + story type heuristics (see REFERENCE.md). If a test plan artifact (`specs/tech-architecture/eNN-TEST_PLAN_LATEST.md`) exists, read it and inherit its P0/P1 risk classifications and scenario IDs (`SC-eNNsYY-P0-NN`). Each task optionally includes a `security:` field (`none` / `low` / `medium` / `high`) sourced from the epic's `specs/security/epics/<id>/THREAT_MODEL.md`. Tasks with `security: medium` or `security: high` MUST include "no new security findings in affected paths" in their verify steps. Each task should also include an `allure:` block to drive test reporting: `severity:` maps risk to Allure severity (`P0→critical`, `P1→high`, `P2→normal`, `P3→minor`), and `categories:` is a list of relevant tags like `"Security Review"`, wave names, or test categories (see REFERENCE.md for the full template).
48 
49   **Requirement delta tags (e45s29):** When a story modifies existing behavior, the story spec § Requirements MUST use OpenSpec-style delta tags with mandatory before/after content:
50 
51   | Tag | When | Required content |
52   |-----|------|------------------|
53   | `ADDED` | New requirement | Full requirement text |
54   | `MODIFIED` | Changed behavior | **Before:** prior behavior · **After:** new behavior |
55   | `REMOVED` | Retired requirement | **Before:** what existed · **After:** (removed) + rationale |
56   | `RENAMED` | ID or title change only | **Before:** old ID/title · **After:** new ID/title |
57 
58   Net-new stories (greenfield) use `ADDED` only. `MODIFIED`/`REMOVED`/`RENAMED` without before/after blocks fail the plan-work gate.
59 
604. **Verify step format** — Every step MUST follow: `N. <What to do> → verify: <runnable command>`. See [REFERENCE.md](REFERENCE.md) for good/bad examples.
61 
624a. **Cross-artifact consistency pass (HARD GATE — e45s04)** — Before handoff, run:
63 
64```bash
65bash scripts/lib/plan-consistency-check.sh specs/epics/&lt;capsule&gt;/
66```
67 
68Print CRITICAL / HIGH / MED findings. **CRITICAL or HIGH blocks code generation** — fix capsule artifacts first. MED requires explicit user acknowledgment.
69 
704b. **tasks.yaml failing ledger (e45s06)** — Every new task entry starts with `status: failing`. Only flip to `status: passing` after its `verify:` command exits 0 during `develop-tdd` or `verify-work`. Never pre-mark passing at plan time.
71 
725. **Review with user** — Confirm step order, granularity, and that verify commands are runnable in this project.
73 
74## Lifecycle Gates (e45s09)
75 
76| Gate | When | Pass condition |
77|------|------|----------------|
78| **Pre-Implementation** | Before `kickoff-branch` / first RED commit | Root-cause stated for bugs; `assess-impact` done for module changes; plan-consistency-check PASS |
79| **Validation** | Story marked done | All tasks `status: passing`; verify evidence in `specs/verifications/` |
80| **Reopen-don't-refile** | Regression on shipped story | Reopen existing story/bug — do not create duplicate capsule entries |
81 
82After writing capsule tasks, suggest `kickoff-branch` (if not already on a feature branch) then `build-epic`, `execute-plan`, or `develop-tdd`.
83 
84## Verify
85 
86→ verify: `test -f scripts/lib/plan-consistency-check.sh && EPIC=$(ls -d specs/epics/*/ 2>/dev/null | grep -v archive | sort | head -1) && test -n "$EPIC" && bash scripts/lib/plan-consistency-check.sh "$EPIC" >/dev/null 2>&1`
87 
88 
89 
90## Handoff
91 
92Gate: READY -> next: kickoff-branch
93Writes: state.yaml handoff.next_skill = kickoff-branch
94 
95 
96<!-- story: e01s01 -->
97<!-- story: e02s02 -->
98<!-- story: e06s01 -->
99<!-- story: e06s02 -->
100 
101---
102 
103# Plan Work — Reference
104 
105## Navigation
106 
107| Lines | Section |
108|-------|---------|
109| 1 | Title |
110| 3–25 | Navigation |
111| 26–27 | Output file formats |
112| 28–31 | Story spec: `specs/epics/<capsule>/eNNsYY-<slug>.md` |
113| 32–61 | Task checklist: `specs/epics/<capsule>/eNNsYY-tasks.yaml` |
114| 62–64 | Plan template |
115| 65–71 | Story [X.Y]: [title] — Implementation Steps |
116| 72–77 | Steps |
117| 78–85 | Verification Script (Step-by-Step) |
118| 86–89 | Out of scope |
119| 90–94 | Risks |
120| 95–114 | Verify step format rules |
121| 115–116 | Sub-operations |
122| 117–127 | Risk Assignment Heuristics |
123| 128–143 | Requirement delta tags (e45s29) |
124| 144–152 | Define Success |
125| 153–161 | Zoom-Out Check |
126| 162–169 | Slopcheck |
127 
128## Output file formats
129 
130### Story spec: `specs/epics/<capsule>/eNNsYY-<slug>.md`
131 
132Populated countable-story-format with all 20 sections. Minimum maturity: 3 (Countable). Acceptance criteria in §17.
133 
134### Task checklist: `specs/epics/<capsule>/eNNsYY-tasks.yaml`
135 
136```yaml
137story_id: e01s01
138title: Login
139status: failing
140bcps: 3
141tasks:
142  - id: 1
143    description: "Add login form component tests"
144    verify: "npm test -- login-form.test.tsx"
145    risk: P1
146    status: failing   # flip to passing only after verify exits 0 (e45s06)
147    allure:
148      severity: high              # P0→critical, P1→high, P2→normal, P3→minor
149      categories:
150        - "Auth"
151        - "Security Review"
152```
153 
154**Allure severity mapping:**
155- `P0` → `critical`
156- `P1` → `high`
157- `P2` → `normal`
158- `P3` → `minor`
159 
160`categories` is a list of relevant tags — wave names, test categories (e.g. `"unit"`, `"integration"`), or thematic groupings (e.g. `"Security Review"`).
161 
162Update `specs/epics/<capsule>/epic.yaml` manifest to list the story and its BCPs. Run `bash scripts/sync-status-from-epics.sh` after structural changes.
163 
164## Plan template
165 
166```
167### Story [X.Y]: [title] — Implementation Steps
168 
169**type:** feat | fix | refactor
170**risk:** P0 | P1 | P2 | P3
171**context:** domain | infra
172**Context**: [One paragraph: what this story implements and why]
173 
174## Steps
175 
1761. [Step description] (ref: ADR-NNNN or commit SHA) → verify: `<runnable command>`
1772. [Step description] (ref: ADR-NNNN or commit SHA) → verify: `<runnable command>`
178...
179 
180## Verification Script (Step-by-Step)
181 
182[A human-readable, step-by-step script for the user to verify the story's outcome.]
183 
1841. [Action 1: e.g. Start the server]
1852. [Action 2: e.g. Open browser to http://localhost:3000]
1863. [Observation: e.g. Verify that the login modal appears]
187 
188## Out of scope
189 
190- [Explicit exclusions]
191 
192## Risks
193 
194- [Anything that could go wrong and how to detect it early]
195```
196 
197## Verify step format rules
198 
199Every step MUST follow this exact format:
200```
201N. <What to do> → verify: <runnable command that proves it worked>
202```
203 
204**Good examples:**
205```
2061. Add User model with email and name fields → verify: npm test -- user.test.ts
2072. Add POST /users endpoint → verify: curl -s -X POST http://localhost:3000/users -d '{"email":"a@b.com"}' | jq .id
2083. Add email uniqueness constraint → verify: npm test -- user-uniqueness.test.ts
209```
210 
211**Bad examples (no verify command):**
212```
2131. Implement the user creation flow
2142. Write tests for the API
215```
216 
217## Sub-operations
218 
219### Risk Assignment Heuristics
220 
221Every task and story MUST be assigned a `risk:` level (P0, P1, P2, P3). When `specs/tech-architecture/eNN-TEST_PLAN_LATEST.md` exists for the epic, defer to its scenario risk mapping (`SC-eNNsYY-P0-NN`). Otherwise, apply these heuristics based on BCP and story type:
222 
223- **P0**: Critical path, data loss risk, auth/security boundary, external integration, or high BCP (≥ 5).
224- **P1**: Core feature logic, state mutations, standard business value (BCP 3-4).
225- **P2**: Utility functions, UI layout changes, display-only data, low risk (BCP 2).
226- **P3**: Documentation, cosmetic tweaks, CSS variables, zero behavioral change (BCP 1).
227 
228`verify-work` scales its UAT depth based on this field.
229 
230### Requirement delta tags (e45s29)
231 
232When modifying existing behavior in story spec § Requirements:
233 
234```markdown
235#### MODIFIED: User can reset password via email link
236**Before:** Password reset required admin approval.
237**After:** Self-service reset via signed email link (expires 1h).
238 
239#### REMOVED: Legacy OAuth1 login
240**Before:** OAuth1 provider supported for enterprise SSO.
241**After:** (removed) — provider deprecated; OAuth2 only.
242```
243 
244Tags: `ADDED`, `MODIFIED`, `REMOVED`, `RENAMED`. `MODIFIED`/`REMOVED`/`RENAMED` without before/after → plan-work gate FAIL.
245 
246### Define Success
247 
248Before planning, convert task statements into observable "step → verify: <cmd>" pairs:
249- Break the task into observable outcomes (behaviors) rather than implementation steps
250- Write pairs in the format: `[What must be true] → verify: <runnable command>`
251- Challenge completeness: are all required behaviors covered?
252- Get user confirmation: "Does this capture everything the task requires?"
253- Once confirmed, these pairs become the skeleton for plan-work steps
254 
255### Zoom-Out Check
256 
257When modifying an existing module, confirm scope is understood:
258- State the module's **purpose** — what is it responsible for?
259- Name the **callers** — who depends on it?
260- List the **contracts** — what invariants or interfaces must be preserved?
261 
262If you cannot answer all three without deep code archaeology, scope is misunderstood. Clarify with the user before writing steps.
263 
264### Slopcheck
265 
266For every external package proposed in the plan, tag each with one of:
267- `[OK]` — package is mature, actively maintained, appropriate scope
268- `[SUS]` — suspiciously broad, has maintenance concerns, or unclear fit
269- `[SLOP]` — unmaintained, known security issues, or out of scope
270 
271`[SUS]` and `[SLOP]` require explicit human approval before the step may execute. Document tags inline next to the package name.
272