Issue Lifecycle

@magistr/issue-lifecyclev2026.10.25.10· MIT· 1d agoBEHAVIORSSKILLS

Security Notice

This extension includes AI agent skills that can modify AI assistant behavior. Review the skill files before installing.

01README

Issue lifecycle model with 9 bundled Claude Code skills for DDD, TDD, moldable development, and parallel code review.

Drives issues from filing through triage, prior-art lookup, DDD + TDD planning, parallel review fan-out (5 review skills), autonomous code-review iteration (zero CRITICAL + zero HIGH gate), optional UAT/KB harvest, and completion. State persists across sessions via the state resource; the hydrate method writes a cheap summary resource for long autonomous loops.

State Machine

filed ──[triage]──> triaged
triaged ──[plan]──> planned
planned ──[review_plan]──> reviewing
reviewing ──[approve_plan]──> approved
reviewing ──[reject_plan]──> planned  (feedback loop)
approved ──[implement]──> implementing
implementing ──[verify]──> verifying
verifying ──[iterate_verification]──> implementing  (autonomous loop)
verifying ──[review_code]──> code_reviewing  (the ONLY path onward)
code_reviewing ──[resolve_findings]──> resolved
code_reviewing ──[iterate]──> implementing  (autonomous loop)
resolved ──[iterate]──> implementing
resolved ──[attest]──> attested  (optional)
resolved ──[harvest]──> harvested  (optional)
resolved ──[complete]──> complete
attested ──[harvest]──> harvested
attested ──[complete]──> complete
harvested ──[complete]──> complete

approve_plan requires full matrix coverage AND zero open CRITICAL AND zero open HIGH findings AND no reviewer FAIL verdict. implement transitions approved → implementing directly; code and its unit tests are written together, with no separate test-review gate. close works from any state. start refuses to overwrite an in-flight issue (any state other than complete/closed) unless force:true is passed.

Pre-PR verification and attestation

verify runs the repository's declared mechanical controls (fmt, lint, typecheck, tests) in one fan-out pass and records per-control status, exit code, duration and runner. review_code is guarded on verifying, so no path reaches code review without running the controls. A control that could not be executed is recorded as error — never as a skip — and blocks exactly as a failure does.

attest emits a manifest (commit sha, SHA-256 config checksums, control results, per-reviewer finding counts) that CI validates in place of re-executing the controls. It asserts every gate before writing and refuses otherwise; it does not approve anything.

Methods

start — file a new issue (refuses to overwrite an in-flight issue unless force:true)
triage — classify with optional confidence/regression/reproduction
record_prior_art — record existing UAT scenarios and KB entries
record_reproduction — record/update the bug-reproduction outcome after triage (optional; callable from triaged or planned)
plan — create/revise plan with DDD analysis, TDD strategy, review matrix
review_plan — enter plan review phase
record_review — record one reviewer's findings (a second submission in the same round replaces, not appends)
approve_plan — approve (gated on coverage + zero blocking findings + no FAIL verdict)
reject_plan — reject with auto/human source tracking
implement — start implementation on a branch (enters implementing); write the code together with its unit tests
verify — run every declared mechanical control in one pass (enters verifying); controls come from agent-constraints/verification-controls.md, never hardcoded
iterate_verification — loop back on a failing control (bumps verificationIteration)
review_code — enter code review phase (requires verifying)
resolve_findings — record resolutions keyed per matching reviewer, snapshot round
iterate — return to implementation (bumps codeReviewIteration)
attest — emit the attestation manifest CI validates (enters attested)
harvest — record UAT/KB improvement proposals
complete — mark done
close — abandon from any state
hydrate — write compact summary for autonomous loops

Bundled Skills

issue-lifecycle — orchestrates the full lifecycle
ddd — domain-driven design building block selection
tdd — red-green-refactor workflow enforcement
moldable-dev — contextual inspectors and live-data queries
review-code — general code review
review-adversarial — adversarial review (7 dimensions)
review-security — OWASP-adapted security audit
review-ux — CLI output and error message review
review-skill — skill quality review

02Release Notes

2026.10.25.10

Repo-wide republish; no functional change.

03Behaviors1

@magistr/issue-lifecyclev2026.10.25.10extensions/models/issue_lifecycle.ts

fn start(title: string, description: string, labels?: array, force?: boolean)

File a new issue — creates initial state. Refuses to overwrite an

Argument	Type	Required	Description
title	string	yes
description	string	yes
labels?	array	no
force?	boolean	no	Overwrite an in-flight issue (any state other than

fn triage(priority: enum, affectedAreas: array, reasoning?: string, isRegression?: boolean, clarifyingQuestions?: array)

Triage the issue — set priority, category, affected areas, and

Argument	Type	Required
priority	enum	yes
affectedAreas	array	yes
reasoning?	string	no
isRegression?	boolean	no
clarifyingQuestions?	array	no

fn record_prior_art(uatScenarios?: array, kbEntries?: array)

Record existing UAT scenarios and KB entries found during the

Argument	Type	Required	Description
uatScenarios?	array	no
kbEntries?	array	no

fn record_reproduction(status: enum, notes?: string)

Record or update the bug-reproduction outcome after triage —

Argument	Type	Required	Description
status	enum	yes
notes?	string	no

fn plan(summary: string, steps: array, dddAnalysis: string, testStrategy: string, potentialChallenges?: array)

Create or revise the implementation plan with DDD analysis and TDD

Argument	Type	Required	Description
summary	string	yes
steps	array	yes
dddAnalysis	string	yes	Which aggregates, entities, value objects, and domain services are affected
testStrategy	string	yes	What tests to write first, red-green-refactor sequence
potentialChallenges?	array	no

fn review_plan()

Enter the plan review phase — the skill then fans out review skills

fn record_review(reviewer: string, verdict: enum, findings?: array)

Record one reviewer's findings. Call once per active entry in reviewMatrix.

Argument	Type	Required	Description
reviewer	string	yes	Skill name: review-code, review-adversarial, review-security, review-ux, review-skill
verdict	enum	yes
findings?	array	no

fn approve_plan()

Approve the plan. Requires (a) all reviewers in the matrix have

fn reject_plan(reason: string, source?: enum)

Reject the plan — returns to 'planned' state so the next plan call

Argument	Type	Required	Description
reason	string	yes
source?	enum	no

fn implement(branch: string, description?: string)

Start implementation — record the branch name and transition

Argument	Type	Required	Description
branch	string	yes
description?	string	no

fn verify(controls: array, repoDir: string, runner?: string)

Run the repository's mechanical verification controls (fmt, lint,

Argument	Type	Required	Description
controls	array	yes	Control specs from agent-constraints/verification-controls.md
repoDir	string	yes	Absolute path to the repository root the controls run against
runner?	string	no	Identifier of the executing environment, e.g. 'local' or

fn iterate_verification(reason: string, source?: enum)

Return to implementing because verification controls failed.

Argument	Type	Required	Description
reason	string	yes
source?	enum	no

fn review_code()

Enter the code review phase — the skill then fans out reviewers

fn resolve_findings(resolutions: record)

Record resolution for review findings. Merges into cumulative

Argument	Type	Required	Description
resolutions	record	yes	Map of finding description → resolution action

fn iterate(reason: string, source?: enum)

Return to implementation — not all findings resolved. Snapshots

Argument	Type	Required	Description
reason	string	yes
source?	enum	no

fn attest(commitSha: string, repoDir: string, configPaths?: array, prUrl?: string, producedBy?: string)

Emit the attestation manifest — the structured evidence CI

Argument	Type	Required	Description
commitSha	string	yes	The commit the verification ran against (git rev-parse HEAD)
repoDir	string	yes	Absolute path to the repository root, for checksum computation
configPaths?	array	no	Repo-relative paths whose contents are checksummed into the
prUrl?	string	no	Pull request URL, when the PR already exists
producedBy?	string	no	Hostname or worker id that produced the manifest

fn harvest(uatProposals?: array, kbProposals?: array)

Record UAT and KB improvement proposals from this lifecycle.

Argument	Type	Required	Description
uatProposals?	array	no
kbProposals?	array	no

fn complete(summary?: string)

Mark the issue as complete. Accepts either 'resolved' (harvest

Argument	Type	Required	Description
summary?	string	no

fn close(reason: string)

Close/abandon the issue from any state

Argument	Type	Required	Description
reason	string	yes

fn hydrate()

Return a compact summary for the autonomous loop's decision-making:

Resources

state(infinite)— Issue lifecycle state — persists across sessions

summary(infinite)— Compact decision-making summary written by the `hydrate` method.

attestation(infinite)— Attestation manifest written by the `attest` method — commit sha,

04Skills9

issue-lifecycle45 files

ddd6 files

tdd5 files

moldable-dev5 files

review-code4 files

review-adversarial4 files

review-security4 files

review-ux4 files

review-skill5 files

05Previous Versions19

2026.10.21.1MITOct 20, 2026

2026.10.21.1

Fixed

The type failed to register on 2026.10.15.1–2026.10.15.9 ("Upgrades ... are not in chronological order"): repo-wide version bumps had rewritten every earlier identity upgrade entry to the new version, duplicating toVersion. The chain is restored with distinct versions and a test now pins it strictly ascending. No schema change.

2026.10.15.9MITOct 15, 2026

2026.10.15.9

Changed

Repo-wide maintenance release: version bump to republish the current source. No schema change.

2026.10.15.8MITOct 15, 2026

2026.10.15.8

Changed

Repo-wide maintenance release: version bump to republish the current source. No schema change.

2026.10.15.6MITOct 15, 2026

2026.10.15.6

Changed

Repo-wide maintenance release: version bump to republish the current source. No schema change.

2026.10.15.5MITOct 15, 2026

2026.10.15.5

Changed

Repo-wide maintenance release: version bump to republish the current source. No schema change.

2026.10.15.4MITOct 15, 2026

2026.10.15.4

Changed

Repo-wide maintenance release: version bump to republish the current source. No schema change.

2026.10.15.3MITOct 15, 2026

2026.10.15.3

Changed

Repo-wide maintenance release: version bump to republish the current source. No schema change.

2026.10.15.2MITOct 15, 2026

2026.10.15.2

Changed

Repo-wide maintenance release: version bump to republish the current source. No schema change.

2026.10.15.1MITOct 14, 2026

2026.10.15.1

Changed

Repo-wide maintenance release: version bump to republish the current source. No schema change.

2026.10.14.2MIT(was none)Oct 14, 2026

2026.10.14.2

Changed

Repo-wide maintenance release: version bump to republish the current source. No schema change.

2026.09.20.2Sep 19, 2026

2026.09.20.2

Changed

Version bump — CI publish of record for the test-review removal. 2026.09.20.1 carried the same change but was pushed directly to the registry; this release lands the identical source through the normal merge/CI pipeline. No schema change.

Modified 1 skills

2026.09.20.1Sep 19, 2026

Modified 1 behaviors. Modified 1 skills

2026.09.19.2Sep 19, 2026

2026.09.19.2

Changed

Repo-wide maintenance release: version bump to republish the current source. No schema change.

2026.09.17.1Sep 17, 2026

2026.09.17.1

Changed

Repo-wide maintenance release: version bump to republish the current source. No schema change.

2026.08.31.1Sep 1, 2026

2026.08.31.1 — pre-PR verification + attestation

Model behavior change — model type version bumped to 2026.08.31.1. Adds the mechanical half of the verification loop and the evidence artifact CI validates in place of re-running it. Ships as an identity upgrades[] migration: existing records gain verificationIteration: 1 from the schema default, and verification / attestation stay unset until the new methods run.

Added

verifying state between implementing and code_reviewing. review_code is now guarded on verifying, so no path reaches code review without running the repository's declared controls. Every iterate from the code-review loop lands in implementing and must pass through it again.
attested state between resolved and harvested/complete.
verify — runs every declared control (fmt, lint, typecheck, tests) in one fan-out pass, recording per-control status, exit code, duration, runner and a bounded stderr tail. Control specs are supplied by the caller from agent-constraints/verification-controls.md; the model hardcodes no build command. A control that cannot be spawned is error, and a managed-tier control on a local runner is skipped — both block exactly as fail does, because "the tool could not evaluate this" is not evidence of a clean tree.
iterate_verification — returns to implementing on a failing control, snapshotting a verification round to reviewHistory and bumping verificationIteration. Mirrors iterate / iterate_tests.
attest — emits the attestation manifest: commit sha, SHA-256 checksums of every declared config input, control results, and per-reviewer open-finding counts by severity. Written both onto state and to a dedicated attestation resource keyed by commit sha. It re-asserts every gate before writing (verification round exists, every required control passed, no FAIL verdict, zero open CRITICAL/HIGH, every config path readable) and refuses otherwise — it asserts, it does not approve.
attestation resource and the AttestationSchema / ControlSpecSchema / ControlResultSchema / VerificationSchema public types.
hydrate now reports verificationIteration and controls: {ran, total, blocking[]} so the autonomous loop can see control state without parsing the full blob.
agent-constraints/verification-controls.md — the control declaration this repo runs, mirroring the deno-check CI job step for step.
Skill references verification.md (Phase 4c) and attestation.md (Phase 5b); SKILL.md, state-machine.md, implementation.md, code-review.md and autonomous-loop.md updated to match.

Changed

harvest accepts resolved and attested; complete accepts resolved, attested and harvested.
implementation.md Step 5 no longer tells you to track the PR externally — attest carries a first-class prUrl, and the PR is opened after attesting, not before.
The model is no longer pure logic. verify spawns subprocesses and attest reads files. Both effects are injected (CommandRunner, FileReader) so tests never spawn anything, and the adversarial suite covers the new surface: control cwd escaping the repo root, absolute cwd, spawn failure, denied allow-run, stderr truncation, and every attest refusal.

Modified 1 behaviors. Modified 1 skills

2026.08.19.1Aug 19, 2026

Modified 1 skills

2026.08.02.1Aug 2, 2026

2026.08.02.1 — latent-bug fixes (IL-1/2/4/7) + five-suite quality

Model behavior change — model type version bumped to 2026.08.02.1 (first release since the 2026.07.16.2 five-suite quality backfill). Real fixes for four of the seven latent bugs triaged in the LOCAL issue-lifecycle model issue-lifecycle-latent-bugs; three are explicitly re-affirmed as intentional behavior, not fixed. No globalArguments or resource-schema change — the version bump ships as an identity upgrades[] migration.

Fixed

IL-1 — start used to overwrite whatever current held with no read-before-write — approved plans, review history, everything — with no guard or confirmation. It now reads existing state first: a fresh instance (no current yet) or one already in a terminal state (complete/closed) proceeds as before; anything else throws unless the new force: boolean argument (default false) is passed.
IL-2 — approve_plan/tests_approved gated only on hasBlockingFindings (open CRITICAL/HIGH count), so a reviewer could post verdict: "FAIL" with zero findings (or all findings resolved/non-blocking) and approval would still succeed. Both methods now also call the new failingReviewers() helper and block if any reviewer's verdict is FAIL, after the existing blocking-findings check (gate order preserved so "N CRITICAL and M HIGH" fires first when both conditions hold). tests_approved's override_reason now bypasses both gates together, as before. SUGGEST_CHANGES remains non-blocking by design — only FAIL hard blocks, so the autonomous zero-CRITICAL/zero-HIGH loop can still converge without a human override.
IL-4 — resolutions is a flat Record<string, string> keyed by finding description text; two different reviewers whose findings happened to share description text collapsed into one entry. resolve_findings now expands each supplied key against the current round's findings: every reviewer whose finding matches that description gets its own `${reviewer} :: ${description}` composite key. A key matching no finding is stored verbatim (legacy-safe; unaffected: empty-map callers).
IL-7 — record_review appended every submission unconditionally, so recording the same reviewer twice in one round double-counted their open findings in the blocking gate. It now replaces (last-write-wins) the reviewer's earlier entry in place instead of appending a duplicate.

Kept as designed (re-affirmed, not fixed)

IL-3 — no model-enforced iteration cap on iterate/iterate_tests. MAX_CODE_ITERATIONS/MAX_TEST_ITERATIONS stay skill-layer policy; enforcing a cap in the pure model would couple it to skill policy and could break the human override_reason escape hatch.
IL-5 — close has no guardState call and works from any state, including terminal ones. This is intentional: close is the abandon/escape hatch (manifest.yaml has always documented "works from any state") and an escape hatch must never itself be blockable.
IL-6 — hydrate's summary.snapshotAt is stamped fresh via now() on every call, so two calls produce two different values even though current is never mutated. snapshotAt is a wall-clock capture stamp — it should differ per call; the property suite already proves non-mutation of current by freezing the clock (@std/testing FakeTime), which is the invariant that actually matters here.

Five-suite quality (carried from the `2026.07.16.2` backfill, updated)

extensions/models/issue_lifecycle_methods_test.ts — success + exact guardState-throw-message regression for each of the 20 model methods, a sweep pinning "No issue state found — run 'start' first" on every method but start, and a sweep pinning the REAL (not assumed) unknown-key behavior of every method's zod arguments schema: swamp model type describe --json renders additionalProperties: false (its own JSON-Schema view), but none of the 20 methods call .strict(), so a bare .parse() silently strips an unrecognized key rather than throwing.
extensions/models/issue_lifecycle_adversarial_test.ts — illegal out-of-order transitions from varied source states, malformed reviewer input (bad severity/verdict enums rejected by zod), hostile approve_plan gate combinations (missing-matrix-reviewer, combined CRITICAL+HIGH counts), corrupted-stored-state pins for the "no plan found" branches in approve_plan/tests_approved, whitespace override_reason still gated, and pins asserting the FIXED IL-1/IL-2/IL-4/IL-7 behavior above plus the re-affirmed IL-3/IL-5 by-design behavior.
extensions/models/issue_lifecycle_coverage_test.ts — branch fill for allMatrixReviewersRecorded across the security/ux/skill matrix dimensions,

2026.07.16.2Jul 16, 2026

Release 2026.07.16.2 — align model versions with manifests

Maintenance release across the @magistr extensions. For most packages this carries no functional change: the only edit is the model's version: field, brought back in line with its manifest version so the published model type version and the package version no longer drift.

Functional changes in this release are limited to:

anime-cron: normalizeTitle now strips a ": subtitle" suffix and a trailing parenthesized year before comparison, fixing dedup false-misses where the torrent title carries a subtitle or year that the AniList romaji does not.
arckit: first publish. Standalone ArcKit port — a 12-phase architecture governance state machine with 65 bundled templates, driven by a bundled skill.

Also tracks three extensions (kaiten, observability-agent, music-library) that previously existed only as untracked working-tree directories, recovered from stashes.

Added 1, removed 1 behaviors. Added 9 skills

2026.06.12.3Jun 12, 2026

Merge pull request #14 from umag/feat/issue-lifecycle-scenario-9-resume-eval

feat(issue-lifecycle): eval scenario-9 — resume-dispatch from the TDD sub-cycle (2026.06.12.3)

Modified 1 skills

06Stats

100 / 100

Downloads

Archive size

142.4 KB

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types (deprecated)1/1earned
Dependencies pass trust audit2/2earned
Docs keep secrets in a vault1/1earned
Has description1/1earned
Platform support declared (or universal)2/2earned
License2/2earned
Verified public repository2/2earned

Repository

https://github.com/umag/swamp-workspace

07Platforms

linux · x86_64 linux · aarch64 macOS · x86_64 macOS · aarch64 windows · x86_64

08Labels

#issue-tracking #tdd #ddd #review #lifecycle #sdlc

State Machine

Pre-PR verification and attestation

Methods

Bundled Skills

2026.10.25.10

Resources

2026.10.21.1

Fixed

2026.10.15.9

Changed

2026.10.15.8

Changed

2026.10.15.6

Changed

2026.10.15.5

Changed

2026.10.15.4

Changed

2026.10.15.3

Changed

2026.10.15.2

Changed

2026.10.15.1

Changed

2026.10.14.2

Changed

2026.09.20.2

Changed

2026.09.19.2

Changed

2026.09.17.1

Changed

2026.08.31.1 — pre-PR verification + attestation

Added

Changed

2026.08.02.1 — latent-bug fixes (IL-1/2/4/7) + five-suite quality

Fixed

Kept as designed (re-affirmed, not fixed)

Five-suite quality (carried from the 2026.07.16.2 backfill, updated)

Five-suite quality (carried from the `2026.07.16.2` backfill, updated)