plugins/developer-kit-specs/skills/constitution/SKILL.md
Creates, updates, validates, and displays the architectural DNA of a project through two shared documents: docs/specs/architecture.md (technology stack, architectural rules, security constraints, AI guardrails) and docs/specs/ontology.md (domain glossary / Ubiquitous Language). Use BEFORE brainstorm as a project setup step, or at any point in the SDD lifecycle to validate specs/tasks against architecture principles. Triggers on 'create constitution', 'update constitution', 'constitution check', 'validate against constitution', 'project principles', 'architectural guardrails', 'setup project architecture', 'define ontology'.
npx skillsauth add giuseppe-trisciuoglio/developer-kit constitutionInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
The Constitution skill manages the architectural DNA of a project through two shared documents:
| File | Purpose |
|------|---------|
| docs/specs/architecture.md | Technology stack, infrastructure, architectural rules, security constraints, AI guardrails |
| docs/specs/ontology.md | Domain glossary (Ubiquitous Language) — terms, definitions, bounded contexts |
These files live at docs/specs/ and are shared across all specifications. Unlike a monolithic constitution.md, these are created/enriched by brainstorm (Phase 6.8.6) and spec-to-tasks (Phase 1.5).
$ARGUMENTS or user intent: create, update, check, or show.AskUserQuestion, then write the files using the templates below.Last Updated date.# Create constitution before first brainstorm
/developer-kit-specs:constitution create
# Validate a spec against architecture and ontology
/developer-kit-specs:constitution check --target=docs/specs/001/2024-01-15--user-auth.md
# Update the security constraints section
/developer-kit-specs:constitution update --file=architecture --section=security
# Show current constitution
/developer-kit-specs:constitution show
| Scenario | Operation |
|----------|-----------|
| New project — define stack and domain language before first brainstorm | create |
| Stack or security rules changed | update |
| Validate a spec, task, or file against architecture and ontology | check |
| Review current architecture and ontology | show |
Trigger phrases:
AskUserQuestion (domains, infrastructure, stack, data, style, rules)Template lookup order:
${CLAUDE_PLUGIN_ROOT}/templates/architecture.mdskills/constitution/references/architecture.md--file=architecture|ontology and --section=<name>Last Updated date--target=<path>)docs/specs/architecture.md and docs/specs/ontology.mdThe Constitution survives context rot through file-based storage:
docs/specs/architecture.md and docs/specs/ontology.mdFor detailed scenarios and recovery protocols, see references/context-rot-prevention.md.
Last Updated date on every changearchived/ — never let specs become stalebrainstorm (Phase 6.8.6) and spec-to-tasks (Phase 1.5)## Constitution Check Report
Target: <file path>
Date: YYYY-MM-DD
### Security Check (CWE/OWASP Compliance)
| Rule | Level | Status | Location | CWE/OWASP |
|------|-------|--------|----------|-----------|
| No SQL injection | CRITICAL | ✅ OK | - | CWE-89 |
### CWE Compliance Report
| CWE | OWASP | Status | Location |
|-----|-------|--------|----------|
| CWE-89 | A03 | ✅ OK | - |
### Architecture Check
| Rule | Status | Detail |
|------|--------|--------|
| Constructor injection | ✅ OK | - |
### Library Verification Check
| Library | Status | Detail |
|---------|--------|--------|
| bcrypt | ✅ OK | Using hash(password, 12) |
### Ontology Check
| Term | Status | Detail |
|------|--------|--------|
| "User" used consistently | ✅ OK | - |
### Summary
- CRITICAL violations: 0
- WARNING violations: 0
- Compliant rules: N
For detailed security patterns (CWE/OWASP mappings), see references/security-patterns.md.
[Session Start] → Read Constitution files
↓
[Optional] constitution create ← this skill (pre-brainstorm setup)
↓
brainstorm ← Constitution loaded before brainstorming
↓
spec-to-tasks ← Constitution validates spec
↓
task-implementation ← Constitution guardrails active
↓
task-review ← Constitution check validates
↓
[Session End] → Constitution files updated if needed
Required loading before:
specs.brainstorm — Validate requirements align with architecturespecs.spec-to-tasks — Check stack compatibilityspecs.task-implementation — Apply AI guardrailsspecs.task-review — Constitution check| File | Purpose |
|------|---------|
| references/architecture.md | Full architecture template |
| references/ontology.md | Full ontology template |
| references/security-patterns.md | CWE/OWASP patterns, verification format |
| references/context-rot-prevention.md | Detailed scenarios and recovery protocols |
| references/constitution-check-report.md | Complete report examples |
For complete templates and detailed reference material, consult the references/ directory.
development
Provides security review capability for TypeScript/Node.js applications, validates code against XSS, injection, CSRF, JWT/OAuth2 flaws, dependency CVEs, and secrets exposure. Use when performing security audits, before deployment, reviewing authentication/authorization implementations, or ensuring OWASP compliance for Express, NestJS, and Next.js. Triggers on "security review", "check for security issues", "TypeScript security audit".
development
Provides final code cleanup after task review approval. Removes debug logs, temporary comments, dead code, optimizes imports, and improves readability. Use when asked to clean up code, polish, finalize, tidy up, remove technical debt, or prepare code for completion after review. Not for refactoring logic or fixing bugs—focused solely on cosmetic and hygiene cleanup.
tools
Ralph Wiggum-inspired automation loop for specification-driven development. Orchestrates task implementation, review, cleanup, and synchronization using a Python script. Use when: user runs /loop command, user asks to automate task implementation, user wants to iterate through spec tasks step-by-step, or user wants to run development workflow automation with context window management. One step per invocation. State machine: init → choose_task → implementation → review → fix → cleanup → sync → update_done. Supports --from-task and --to-task for task range filtering. State persisted in fix_plan.json.
tools
Provides Qwen Coder CLI delegation workflows for coding tasks using Qwen2.5-Coder and QwQ models, including English prompt formulation, execution flags, and safe result handling. Use when the user explicitly asks to use Qwen for tasks such as code generation, refactoring, debugging, or architectural analysis. Triggers on "use qwen", "use qwen coder", "delegate to qwen", "ask qwen", "second opinion from qwen", "qwen opinion", "continue with qwen", "qwen session".