✨ [feat] routes: two doors into the board, security check in QA, skill map refresh (3.3.0) by EricTechPro · Pull Request #86 · EricTechPro/super-board

EricTechPro · 2026-10-28T00:46:12Z

Note

⏳ In review · round 1 · ✅ 8/9 AC · head d2ca404

Problem

Where: the skill map (diagrams/) and the lane skills super-qa, super-review, super-collect
Who: anyone deciding how work enters the board, and every PR the board checks
What happened: the map showed one way in, with no split between ideas and bugs; the security check ran in Review instead of QA; super-collect filed findings straight to Backlog with no spec step; and nothing wrote down which path to take

Solution

Merged security-skills and docs/security-audit-page
pr-security-review (Anthropic's claude-code-security-review, MIT) runs in super-qa on every PR and replaces QA's built-in /security-review call; it is out of super-review
security-audit is a standalone optional skill
super-collect writes one findings doc (docs/super-board/findings/collect-<date>.md) → /to-spec → /to-tickets → fork: 1–5 tickets → /implement-spec (on confirm), 6+ → Backlog
Exceptions: --direct and scheduled runs and github-source issues go straight to Backlog; it also falls back to that when the skills are missing
New docs/super-board/routing.md rule: which path to take, in plain words
Skill map: two doors (Ideas: grill-me/wayfinder; Bugs: super-collect), the "How many tickets?" fork, super-deploy shown as planned, security-audit in a side column
/visual Examples tab with 4 example pages; shared template skills/visual/assets/template.html; .github/workflows/pages.yml now serves the examples
Pages stamp the repo VERSION at build (diagrams/_shared/stamp_version.py); pages read "dev" from disk, no more hardcoded v3.0.2
3.3.0 notes also list 🐛 [fix] state: keep board state inside a submodule's own repo #88, 🐛 [fix] reads: malformed agent reads exit 64 instead of halting #89, ✨ [feat] pr-body: fold history, read needs-you in the status alert #90 (EricOS fork ports)
Version 3.3.0

Acceptance criteria

Offline safety suites pass
↳ bash tests/run-safety.sh · all suites pass on macOS at d2ca404
/visual tests pass
↳ 7 test_visual_* pass
Skill map renders with no overlaps
↳ visual.py check · 58 views, 0 overlaps
Explore cards match the registry
↳ python3 diagrams/_shared/sync_explore.py --check passes
pr-security-review runs in super-qa, not super-review
↳ covered by the safety suites above
super-collect routes findings through /to-spec and /to-tickets, with the Backlog fallback
↳ covered by the safety suites above
Live site shows the repo VERSION, not a typed release
↳ tests/test_pages_version.py · 4 failures on 47bc443, 6/6 on d2ca404
macOS py3.12 safety failure was a flake
↳ test-collect-file.sh 13/13 local passes (8 in parallel); gh run rerun --failed of run 40610878773 passed
super-deploy has its own spec and tickets
↳ not verified: follow-up, shown as planned on the map

Iteration history

Lane	Done	Time	Details
🔨 builder	✅	Oct 27, 17:46 PDT	PR open · `47bc443`
🔨 builder	✅	Oct 29, 01:48 PDT	pages VERSION stamp, 3.3.0 notes · `d2ca404`

Risk

🟡 Medium · changes which lane runs the security check and how super-collect files work.

Door: two-way · revert the PR and QA, Review and super-collect go back to the old flow
Blast radius: board lanes · projects that upgrade to 3.3.0 get the new QA security step and collect hand-off
Follow-up: super-deploy gets its own spec and tickets later

🤖 Generated with Claude Code

- New /security-audit/ page: Cloudflare's security-audit skill (commit c1c8a8c) on the shared sdlc layout, six phases, 63 parts with when/what/how/behind-the-scenes popovers and line-linked sources. - layout_sdlc: optional meta.labels, per-stage name and icon, and `parallel` categories (no arrows, no START); SDLC maps rebuilt with identical diagrams. - Registry, nav, Explore card, 960x600 thumb, Cloudflare logo, pages.yml and README link. - skill-map.json: external security-audit node in its own root child view (six main steps), re-rendered with 0 crossings; visual tests pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…rity-audit (3.2.0) - new bundled skill pr-security-review: Anthropic's local /security-review, prompt verbatim, diff target = PR base (MIT notice + source commit 0c6a49f) - super-review runs it on every PR; findings are Bug · blocker routed to Super Build - get.sh and onboard repair fetch cloudflare/security-audit-skill via npx skills; skills-lock.json detection, --no-helper-skills respected - skills-ready: pr-security-review required in Review, security-audit optional - super-qa drops its /security-review call; README, main page, skill map, simulator, manifests, onboard.md updated - tests: get.sh security-audit cases, onboard repair order, readiness entries Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- pr-security-review runs on every PR; security-audit installs as a helper skill (3.2.0) - Merged clean onto origin/main; safety suites pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- Keep one security-audit node: docs-branch what/how plus the install and lane notes from security-skills - Keep pr-security-review, the anthropics author and the security-audit view with its 6 phases - Regenerate visual/skill-map.html and index.html from the merged skill-map.json with visual.py render - run-safety.sh: 62 suites pass; visual tests and sync_explore --check pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- super-qa runs pr-security-review on every PR as its one security check (folds the old /security-review call) - each kept finding fails QA: ❌ line, [builder] thread, QA → Ready; skill missing → Block - super-review drops its security step; the rest of the lane is unchanged - skills-ready: pr-security-review required in qa, security-audit optional in qa; docs, families, manifests, README synced Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- new collect_handoff.py: route (to-spec/to-tickets installed?), doc (one grouped findings doc), fork (1–5 → /implement-spec, 6+ → Backlog) - findings doc at docs/super-board/findings/collect-<YYYY-MM-DD>.md, never overwritten; dry run prints it and writes nothing - missing /to-spec or /to-tickets, or --direct → today's Backlog filing, with the reason printed; scheduled intake uses --direct - tests/test_collect_handoff.py; SKILL.md, README, docs flow and AGENTS.md block updated Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- docs/super-board/routing.md: clear idea, foggy idea, bugs → /to-spec → /to-tickets - build fork: 1–5 tickets → /implement-spec, 6+ → super-board; super-deploy planned - linked from README and the super-board SKILL.md Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- root: Ideas (/grill-me, /wayfinder) and Bugs (/super-collect) meet at /to-spec → /to-tickets; 1–5 tickets → /implement-spec, 6+ → /super-board; planned super-deploy; /security-audit joins the side tools - pr-security-review moves from super-review to super-qa; super-collect hands a findings doc to /to-spec - visual template: When · What · How · Example · Behind the scenes tabs, ==highlight==, examples gallery, planned nodes, loop edges, wrapping bullets on phones - tests: test_visual_* pass (families and main-steps updated for the new root) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- VERSION, skills/super-board/VERSION, plugin.json and README badge → 3.3.0 - RELEASE-NOTES: security check in QA, super-collect planning hand-off, routing doc - bash tests/run-safety.sh: 63 suites pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- examples: PR description (recap of this branch), super-deploy plan, architecture map, command and script interface - each has a full-size PNG and a thumb under 100 KB; Pages serves them at /skill-map/examples/ - landing thumb redrawn from the new root view; sync_explore --check passes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- collect-submit view: findings doc, /to-spec, /to-tickets, then 1–5 to /implement-spec on yes, 6+ to Backlog - --direct, scheduled runs, GitHub issues and a missing /to-spec or /to-tickets go straight to Backlog - collect-file node and its edges reworded to match SKILL.md and collect_handoff.py - re-rendered skill-map.html and index.html; test_visual_*, visual check, sync_explore and run-safety pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

qodo-code-review · 2026-10-28T00:46:17Z

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

- fails today: index, onboarding and writing-standard hardcode v3.0.2 - pins the dev placeholder, the build stamp and the VERSION path trigger Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- data-sb-version placeholders read "dev" from disk, stamped at deploy - pages.yml runs stamp_version.py and redeploys when VERSION changes - release pill links to releases/latest Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- notes name the VERSION stamp on the public site - the three EricOS fork ports each get a line with their PR Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

EricTechPro and others added 12 commits October 24, 2026 17:41

🔒 [security] review: merge security-skills into skill-map routes

7303120

- pr-security-review runs on every PR; security-audit installs as a helper skill (3.2.0) - Merged clean onto origin/main; safety suites pass Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

🔀 [merge] skill map: two doors, route fork and /visual examples

a4b7a2f

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

EricTechPro and others added 2 commits October 29, 2026 01:24

🧪 [test] pages: live site shows repo VERSION, not a typed release

72d11d4

- fails today: index, onboarding and writing-standard hardcode v3.0.2 - pins the dev placeholder, the build stamp and the VERSION path trigger Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

EricTechPro mentioned this pull request Oct 29, 2026

🐛 [fix] state: keep board state inside a submodule's own repo #88

Merged

3 tasks done

📝 [docs] release: 3.3.0 notes list the pages stamp and #88 #89 #90

d2ca404

- notes name the VERSION stamp on the public site - the three EricOS fork ports each get a line with their PR Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

EricTechPro merged commit e249d76 into main Oct 29, 2026
13 checks passed

EricTechPro deleted the feat/skill-map-routes branch October 29, 2026 19:24

Navigation Menu

Repository navigation

✨ [feat] routes: two doors into the board, security check in QA, skill map refresh (3.3.0) - #86

✨ [feat] routes: two doors into the board, security check in QA, skill map refresh (3.3.0)#86
EricTechPro merged 15 commits into
mainfrom
feat/skill-map-routes

EricTechPro commented Oct 28, 2026 •

edited

Loading

Uh oh!

qodo-code-review Bot commented Oct 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

EricTechPro commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Acceptance criteria

Iteration history

Risk

Uh oh!

qodo-code-review Bot commented Oct 28, 2026

Qodo reviews are paused for this user.

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

EricTechPro commented Oct 28, 2026 •

edited

Loading