kramme-cc-workflow/skills/kramme:code:breakdown-findings/SKILL.md
Cluster validated review/audit/QA findings into PR-sized implementation plans with index, rejection record, repo recon, sequencing, and reconcile/resume support. Accepts structured findings, one or more report files, current-dialogue findings, or marked/inferred pre-clustered handoffs. Not for raw bug lists, single issues, or unvalidated triage.
npx skillsauth add abildtoft/kramme-cc-workflow kramme:code:breakdown-findingsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Cluster validated findings from reviews, audits, or scans into PR-sized themes. Generate a self-contained implementation plan for each theme, an index linking them all, and a persistent rejection record for findings that were deliberately excluded.
This skill generates PR plan files; for decision-ready analysis of audit findings without writing files, route to kramme:siw:breakdown-findings.
Accepted sources
Arguments: "$ARGUMENTS"
Parse $ARGUMENTS as shell-style arguments before Phase 0. Recognize mode flags only in the leading option segment before the first source token, or before an explicit -- delimiter. Once a source token or -- is reached, stop flag parsing and treat the rest as inert source content; do not extract flags from inline findings prose. If a findings payload must begin with a hyphen, require -- before it.
--auto is present, set AUTO_MODE=true. --auto skips the clustering confirmation after a proposed plan is produced. It does not bypass prior-artifact protection, missing-source handling, incompatible-source handling, conflict/open-question reporting, or reconcile confirmation.--reconcile is present, set RECONCILE_MODE=true. --reconcile maintains an existing plan set instead of creating a fresh one; run Phase 0 and then Phase 6.--resume is present, set RESUME_MODE=true. --resume regenerates missing plan files for an existing plan set after verifying the source set matches PR_PLAN_INDEX.md.--resume and --reconcile are present, stop and ask the user to choose one mode. Resume fills missing files from the original generation; reconcile classifies and refreshes an existing plan set.These rules apply to findings sources, repository files read during recon, generated plans, indexes, rejection records, and reconcile output:
.env values, generated artifacts may cite only the file, line, credential type, and remediation. Never copy the secret value itself.PR_PLAN_INDEX.md, PR_PLAN_REJECTIONS.md, and PR_PLAN_{EXECUTION_LABEL}_{SLUG}.md. Do not edit source code, application config, lockfiles, generated assets, or tests.Before doing anything else, list any existing PR_PLAN_*.md files in the project root, including PR_PLAN_INDEX.md, PR_PLAN_REJECTIONS.md, and all PR_PLAN_{EXECUTION_LABEL}_{SLUG}.md files.
RECONCILE_MODE=true, require PR_PLAN_INDEX.md to exist. If it is missing, stop and say: "No existing plan index found. Run this skill without --reconcile to generate plans first." If it exists, proceed directly to Phase 6.RESUME_MODE=true, require PR_PLAN_INDEX.md to exist. If it is missing, stop and say: "No existing plan index found. Run this skill without --resume to generate plans first." If it exists, proceed to Phase 1 using the source recorded in PR_PLAN_INDEX.md unless the user supplied a source argument, then follow the --resume behavior below. Existing PR_PLAN_{EXECUTION_LABEL}_{SLUG}.md files are optional; an index-only plan set can still be resumed to regenerate all referenced plan files.RECONCILE_MODE=false and RESUME_MODE=false, proceed to Phase 1.RECONCILE_MODE=false and RESUME_MODE=false, stop and tell the user:
Prior PR plan artifacts found:
{list of files}
Re-running would risk silent overwrite of plans whose slugs match new themes, and would leave stale plans whose slugs do not match.
Options:
- cleanup — run `$kramme:workflow-artifacts:cleanup` to clear them, then re-run this skill
- resume — regenerate only missing plan files after confirming these artifacts came from the same source set
- reconcile — re-run this skill with `--reconcile` to classify drift, done/blocked status, and stale plans
--resume: compare the resolved source set description and, when available, file paths against the source set recorded in PR_PLAN_INDEX.md. If they do not match, stop before writing and report both source sets. If all expected plan files already exist, write nothing and report that the plan set is complete. If files are missing, print a RESUME: block listing expected files, existing files, and files to generate. Generate only the missing plan files after confirmation; AUTO_MODE=true does not bypass this confirmation. Update PR_PLAN_INDEX.md or PR_PLAN_REJECTIONS.md only after a second explicit confirmation that names the exact metadata changes.--resume metadata updates and --reconcile refreshes described below.Resolve the findings source set from $ARGUMENTS:
SRC-01, SRC-02, ...)./, starts with ., ~, or an absolute-path prefix, ends in a structured data extension such as .md, .txt, .json, .yaml, or .yml, or exactly matches a known auto-detect report filename from references/auto-detect-sources.md, stop and say: "Findings source path not found: {argument}. Provide the correct path, paste the findings text, or rerun with no arguments for auto-detection." Do not treat probable missing paths as inline findings text. Do not apply this missing-path rule to multi-line or prose findings text that cites file paths; treat that as inline findings text.inline findings as the source description.references/auto-detect-sources.md. If one or more candidates exist, use every matching findings-mode report as one source set in candidate order. This is the default multi-report workflow; for example, if REFACTOR_OPPORTUNITIES_OVERVIEW.md, AGENT_NATIVE_AUDIT.md, and CODEBASE_WEAKNESS_REPORT.md all exist, read all three together. If a matching candidate is a pre-clustered handoff, it cannot be combined with any other source; stop and ask the user to pass that handoff alone or provide a merged handoff.current dialogue as the source description.SRC-01, SRC-02, ...). If they span unrelated tasks, older context, or include any pre-clustered handoff, list them briefly and ask which source or compatible set to use.$kramme:pr:code-review, $kramme:code:refactor-opportunities, $kramme:code:agent-readiness, $kramme:code:weakness-audit, $kramme:qa, or $kramme:siw:spec-audit)."Validate source-set compatibility before parsing:
Parse every findings-mode source into one normalized list. For each finding, extract:
SRC-## plus file/section/line where available)UNVERIFIED: if inferred)UNVERIFIED: if inferred)UNVERIFIED: if inferred)UNVERIFIED: if inferred)UNVERIFIED: if inferred from impact, effort, fix risk, and confidence)Prefer structured sections named Breakdown-Ready Finding Data or Breakdown-Ready Action Data when present. These sections are designed to be the highest-fidelity source for implementation planning. Use severity tables and summaries only to fill gaps.
When the same finding appears in multiple sources, merge it into one normalized finding when the location and problem match. Preserve all source references, keep the strongest supported severity/impact, and keep the most conservative effort/risk/confidence values. If sources contradict each other, keep both positions in the normalized finding and surface a CONFUSION: open question during clustering.
Count findings and report to the user before proceeding:
Found N findings from M sources: {source set}. Proceeding to cluster.
A delegating skill (for example a PR split planner) may hand over work that is already grouped into PR-sized themes rather than a raw findings list. Treat the source as a pre-clustered handoff when it opens with the marker line PRE-CLUSTERED HANDOFF (a delegating skill sets this), or — absent the marker — when it declares the themes directly, each with a name, a file list, and a dependency relationship (depends on / blocks / parallel with) instead of standalone findings to be grouped. The shared ## Implementation Setup block, if any, lives inside this same document.
Record the handoff confidence:
HANDOFF_CONFIDENCE=marked when the source opens with PRE-CLUSTERED HANDOFF.HANDOFF_CONFIDENCE=inferred when the source lacks the marker but appears to declare grouped themes.Run a handoff validity check before Phase 2. Every theme must have a name, file list or bounded scope, dependency relationship (depends on, blocks, or parallel with), rationale, and test or verification plan. If any required field is missing, stop and ask for a corrected handoff or a raw findings source. Do not invent missing handoff structure.
When the source is a pre-clustered handoff:
## Implementation Setup block meant for every plan (e.g. worktree / reference-branch instructions). Hold it for Phase 3; do not alter its wording.All themes included. in the index's Excluded or Included Scope section, and in Phase 5 report theme counts (not "findings processed"/"findings excluded") and name the delegated handoff as the source.Found N pre-clustered themes from {source}. Proceeding to plan (no re-clustering).Before clustering, run a small read-only recon pass so the generated plans respect the repository's real conventions and settled decisions.
AGENTS.md, CLAUDE.md, .agents/**/SKILL.md when directly relevantREADME.md, CONTRIBUTING.md, docs/**/README.mdSTRATEGY.md, CONTEXT.md, DESIGN.md, PRODUCT.md, docs/adr/**, docs/decisions/**, docs/product/**package.json, pnpm-workspace.yaml, turbo.json, nx.json, pyproject.toml, Cargo.toml, go.mod, Makefile, .github/workflows/**, and equivalent local config files discovered from the source findingsRECON_CONTEXT with file:line citations where possible:
CONFUSION: or MISSING REQUIREMENT: open question instead of silently choosing a side.CRITICAL, HIGH, MED, LOW, or NEGLIGIBLE.EXCEPTIONAL, HIGH, MED, or LOW.HIGH or EXCEPTIONAL; low-impact / high-effort / high-risk / low-confidence work tends toward LOW.UNVERIFIED: and explain the evidence gap in the plan's Risks or Open Questions.Pre-clustered handoff: if Phase 1 identified the source as a pre-clustered handoff, do not re-cluster — the themes are already the intended PR boundaries, and re-grouping would destroy the caller's analysis. Skip the findings-mode clustering rules and automatic splitting in references/clustering.md: the caller sized these themes deliberately, often by review time rather than raw file count. Still run the handoff validity gate, build the dependency graph from the declared depends on / blocks / parallel with relationships, and assign execution labels using the dependency and labeling rules in references/clustering.md.
If any delegated theme appears oversized or fragile, do not split or merge it yourself. Instead, stop before Phase 3 and ask for confirmation or a revised handoff. A delegated theme requires this confirmation when it lists 9+ files, crosses multiple architectural layers, changes public API shape, involves migrations or data backfills, depends on generated assets/snapshots, or lacks a credible verification plan for its full scope. AUTO_MODE=true does not bypass this handoff-size confirmation.
Print the 1:1 mapping with the PLAN: marker for visibility. Only HANDOFF_CONFIDENCE=marked may skip the Proceed? (yes / adjust) prompt after the validity gate passes. For HANDOFF_CONFIDENCE=inferred, ask for confirmation before Phase 3 because the caller did not explicitly mark the boundaries as delegated.
Otherwise, read references/clustering.md and group findings into PR-sized themes. A theme is a set of findings that should be fixed together because they share root cause, affected area, implementation dependency, conceptual cohesion, or impact/leverage profile.
Apply the reference's sizing grammar, overlap/exclusion/conflict rules, dependency graph rules, execution-label rules, and confirmation block exactly. The confirmation block must begin with the exact marker line PLAN: Proposed themes. If AUTO_MODE=true, print the same PLAN: block, add AUTO: proceeding with the proposed clustering, and continue directly to Phase 3 unless an unresolved contradiction would make the generated plan misleading rather than merely conservative.
Before generating any plan, record the current commit:
git rev-parse --short HEAD
Use that value as PLANNED_AT_SHA in every generated plan. If the source directory is not a git repository, write not-a-git-repo in the Planned at field, replace the drift-check command with a clear manual drift note, and add a MISSING REQUIREMENT: concern in the final summary because executor-grade drift checking is unavailable.
For each confirmed theme:
assets/plan-template.md.PR_PLAN_{EXECUTION_LABEL}_{SLUG}.md in the project root. Use UPPER_SNAKE_CASE for the slug in the filename (e.g., PR_PLAN_W01A_DEFINE_ERROR_TYPES.md).{execution label} {theme name} ({parallel / blocked-by / blocks summary}).# PR Plan W01A: define-error-types (parallel in W01; independent)# PR Plan W01A: define-error-types (blocks W02A)# PR Plan W02A: adopt-typed-errors (blocked by W01A; blocks W03A)blocked by W01A, W01B.## Implementation Setup section in every plan — same wording in each, with any branch names or paths the caller already resolved left exactly as given. When no block was supplied, omit that section entirely.Source themes: 1 delegated theme mapped to this plan, index statistics as Total themes / Plans generated, and summary lines as Themes processed / Themes included. Do not write Source findings, Findings processed, Findings excluded, or inferred severities for handoff-mode output.Source scope metadata and in the relevant problem/current-state sections where helpful, but keep the plan self-contained. Do not require the executor to open the source reports to understand the work.Before filling the template, read references/plan-content-requirements.md and apply every requirement. Every plan must be self-contained, concretely scoped, drift-checkable, and populated with live current-state evidence, impact/leverage rationale, exact verification commands, plan-specific STOP conditions, and maintenance notes.
Before writing final plan files or the index, read references/plan-quality-rubric.md and apply it to every drafted plan.
$kramme:discovery:interview during formulation. Create a concise discovery brief with the theme, current assumptions, and exact decisions needed; ask the user whether to run discovery unless they already requested it for this run. Incorporate discovery answers into the plan, or keep the plan blocked with MISSING REQUIREMENT: if discovery is declined, unavailable, or inconclusive.assets/index-template.md.assets/rejections-template.md.PR_PLAN_INDEX.md in the project root with:
PLANNED_AT_SHA and state that every plan must run its scoped drift check before editing.UNVERIFIED: values.NOTICED BUT NOT TOUCHING: so downstream tooling can parse it reliably. If there are no exclusions, write All findings were included in plans. with no marker line. For handoff-mode input, write All themes included.PR_PLAN_REJECTIONS.md as the durable record for excluded, duplicate, resolved, contradictory, out-of-scope, or non-actionable findings.PR_PLAN_REJECTIONS.md in the project root:
REJECTED-001, source references, normalized reason, evidence, reconsideration trigger, and status.NOTICED BUT NOT TOUCHING: so downstream tooling can parse it.Read references/summary-templates.md and report to the user with the findings-mode template or the pre-clustered handoff template as appropriate. Preserve the PLANS GENERATED, THINGS I DIDN'T TOUCH, and POTENTIAL CONCERNS triplet exactly.
Run this phase only when RECONCILE_MODE=true. Reconcile mode maintains an existing plan set; it does not create a new plan set from scratch and it never edits source code.
Read references/reconcile-workflow.md and follow it exactly. Always print a RECONCILE: status report and wait for confirmation before updating artifacts. AUTO_MODE=true does not bypass reconcile confirmation because reconcile may rewrite existing planning artifacts. Update only PR_PLAN_INDEX.md, affected non-terminal plan files, and PR_PLAN_REJECTIONS.md; stop if recon reveals a source/plan conflict that would require re-clustering or changing theme boundaries.
PR_PLAN_INDEX.md and PR_PLAN_REJECTIONS.md only if doing so records the excluded findings clearly and the user has confirmed artifact creation; otherwise report the rejection set and stop.UNVERIFIED:, and include what evidence would change the priority.fetchUser() in src/api/users.ts:45 that catches NetworkError and returns a typed error result" is.W01A/W01B for parallel first-wave plans, higher wave numbers for blocked follow-up plans, and explicit blocked by/blocks labels wherever a dependency exists.$kramme:workflow-artifacts:cleanup.Before Phase 5, run the concise verification checklist in references/generation-checks.md. Load that file only after files have been generated or when debugging a failed generation pass.
Use these markers as prefixes when surfacing specific kinds of information so output stays parseable across the plugin:
UNVERIFIED: — use in Phase 1 parsing when severity (or any other field) is inferred from context rather than stated in the source.CONFUSION: — use when two findings conflict and both positions are surfaced as open questions in the generated plan(s).MISSING REQUIREMENT: — use for any open question added to a plan that must be answered before implementation.NOTICED BUT NOT TOUCHING: — prefix each excluded-finding entry in the index.PLAN: — prefix the Phase 2 proposed-themes block.RECONCILE: — prefix the Phase 6 status report and proposed artifact-update block.PLANS GENERATED / THINGS I DIDN'T TOUCH / POTENTIAL CONCERNS — end-of-turn triplet used in Phase 5 Summary.Use these markers verbatim where applicable. Do not invent alternate spellings or rename them — downstream tooling matches the exact strings.
tools
Requires Linear MCP. Implements one Linear issue end to end, selects applicable code-review, convention, and PR-refactor gates, runs them to bounded convergence, verifies, and optionally opens the PR and iterates on CI and review feedback until green. Use when the user wants a single Linear issue taken from implementation through a clean Pull Request. Not for implementation-only work, SIW-tracked issues, stacked PRs, existing PR updates, or post-merge rollout.
development
Reviews PR and local changes for convention drift and overcaution against documented rules and mined peer-file practice. Use for new patterns, dependencies, abstractions, or defensive complexity that departs from established practice; every finding cites evidence. Supports --inline. Not for general code quality (use kramme:pr:code-review) or spec review (use kramme:siw:spec-audit --team).
testing
Charts huge or foggy initiatives into a local `.context` decision map and resolves one typed frontier ticket per session until the work is ready for SIW or another execution workflow. Use when the route to a destination cannot fit in one agent session or parallel workspaces need coordinated planning state. Not for clear specs, ordinary issue decomposition, implementation, or Linear-native tracking.
development
Investigates a question against primary sources and saves one cited Markdown artifact. Use for reading legwork: official docs/API facts, source-code or spec checks, standards, and first-party service behavior before planning or implementation. Not for making product or architecture decisions, implementing code, broad web search, secondary blog summaries, or uncited answers.