Skip to content

Releases: VaiYav/speckit-product-forge

v1.7.0 — "Ivysaur"

Choose a tag to compare

@VaiYav VaiYav released this 13 Jun 16:23

Product Forge v1.7.0 — "Ivysaur"

A full product-lifecycle orchestrator that ships from one repo in two installable forms (SpecKit extension + Claude Code plugin). This release adds seven roadmap features, each executable and guarded by a deterministic lint-docs/doctor check, followed by an independent two-reviewer code review whose findings are folded in.

✨ New

  • --dry-run preview (normative). Any phase (or forge end-to-end) runs fully but mutates nothing real: writes are redirected under {FEATURE_DIR}/.forge-dry-run/<phase>/, .forge-status.yml is untouched, no external side-effects fire, and each phase emits a DRY-RUN-REPORT.md of what would change. Composes with --ci.
  • Cross-model code review. code-review --cross-model exports the consolidated gate-review.md + diff as a portable package, has a different model review it out-of-band, and ingests its findings back into the single F-NNN namespace (reviewed_by_model stamped on the gate).
  • Parallel implementation. implement --parallel runs path-disjoint task groups concurrently (independence proven by the portfolio conflict matrix), reconciled serially under the state-lock with a single human gate. policy §1.1 carve-out (intra-phase only).
  • Constitution↔code drift layer. sync-verify Layer 10 / verify-full Layer 11 re-assert the project architecture constitution (resilience / EDA / layering / security) against the code as a standing check, not just at planning time.
  • Lessons → reusable skills. retrospective promotes a lesson that recurs across features into a reusable skill via skill_manage (Hermes host) — cross-project, cross-session, idempotent.
  • status --cost. Rolls up per-phase token / tool-call telemetry per feature and across the portfolio (dollar cost when a rate is supplied via PRODUCT_FORGE_COST_RATE_IN/OUT or --rate-in/out).
  • Phase-map single source. docs/schema/phase-map.yml is the canonical phase set + per-mode applicability matrix; the two forge.md tables render it and the linter (PHASEMAP rule) enforces agreement — killing the phase-map drift class, mirroring the enum single-source.

🛠 Fixed (independent code review)

A two-reviewer pass (Node-scripts + doc-contract integrity); all findings reproduced and fixed, each lint-rule fix carrying a regression test.

  • Phase-status scope (HIGH). validate-traceability.js matched name: completed anywhere, so a sibling block keyed by phase name falsely marked phases complete → spurious errors + false --strict FAIL. Now scoped to the phases: block.
  • Layer-count report templates (HIGH). sync-verify's report still emitted {1-9} / {N}/9 after Layer 10 was added — fixed to {1-10} / {N}/{applicable}.
  • Gate carrier schema. reviewed_by_model + cross_model_findings added to the canonical schema and runtime §6 audit trail.
  • skills_promoted read-back. retrospective now reads the carrier to drive create-vs-patch idempotency; added to the lint CARRIER registry.
  • Token-telemetry producer. Added the producer hook in runtime §8.1a (host-dependent) and corrected overstated "already captures" wording.
  • Lint-rule precision. LAYER-COUNT no longer false-positives on both-owner lines; SCRIPT-PATH is per-occurrence; PHASEMAP flags empty/word-form cells; cost-report num() handles decimals + thousands separators.

📦 Install

SpecKit extension:

specify extension add product-forge --from https://github.com/VaiYav/speckit-product-forge/archive/refs/tags/v1.7.0.zip

Claude Code plugin:

claude plugin marketplace add VaiYav/speckit-product-forge@v1.7.0
claude plugin install speckit-product-forge@vaiyav-plugins

✅ Quality gate

31 commands · doctor 15 checks green · lint-docs clean (11 consistency rules) · 6 script self-tests (84 assertions) · claude plugin validate ✔.

Full changelog: https://github.com/VaiYav/speckit-product-forge/blob/v1.7.0/CHANGELOG.md
Compare: v1.6.0...v1.7.0

Product Forge v1.6.0 — Bulbasaur 🌱

Choose a tag to compare

@VaiYav VaiYav released this 29 May 13:20

First codenamed release — Bulbasaur. Minor and fully additive: with no new config keys set, behavior is byte-for-byte identical to v1.5.1.

Added — Configurable storage strategies + global config

  • storage_strategy with all four values active: flat (default), domain-nested, ddd (backed by a features/domains.yml registry), workspace (monorepo scope.primary). Internal artifact tree is invariant across strategies.
  • Path-Resolution Contract (docs/runtime.md §12): one rule for resolve(slug) + enumerate(), implemented in scripts/lib-paths.js (with --selftest) and consumed by every command/script.
  • Layered global config~/.product-forge/config.yml (+ XDG fallback): shipped < global < project < per-feature < env, deep-merged.

Added — SDD-flow wave

  • Living spec + full traceability matrix; structured journeys → Playwright E2E; FE↔BE contract-first OpenAPI/AsyncAPI; telemetry MCP wiring (PostHog/Sentry/Amplitude); risk-scored two-layer gate review; first-class express track; 2 new commands (design-system-harvest, spec-merge) — catalog now 31.

Fixed — repo-wide consistency/audit pass (56 findings)

  • 6 broken code-fence templates; version/count coherence (29→31 commands, 1.6.0 everywhere); sync-verify consistently 9-layer; status/gate enum + phase-key schema reconciliation; 3 real helper bugs (gate-risk, validate-traceability, acquire-lock).

Full detail: CHANGELOG.md.

v1.5.1 — Docs patch: surface v-model optional dependency

Choose a tag to compare

@VaiYav VaiYav released this 24 Apr 12:55

[1.5.1] — 2026-04-24

Docs-only patch. No behavioural change — closes a documentation gap
on how users install the optional V-Model dependency.

Changed

  • README.md — new "V-Model mode (optional)" subsection under
    Requirements that names the external leocamello/spec-kit-v-model
    plugin (≥0.5.0), includes the install command, and spells out
    the "hard dependency only for v-model mode" rule with an explicit
    "no silent fallback" note for regulated/safety-critical work.
  • config-template.ymlfeature_mode comment expanded: the
    v-model value now includes the install command for the external
    plugin and the abort-on-missing rule.
  • docs/config.md — rewrite the v-model bullet in feature_mode
    documentation to describe what Product Forge owns vs what the
    V-Model plugin owns, include the install command, and link to
    docs/v-model-integration.md.

No functional code change. The plugin already aborted with the install
command when v-model mode was selected without the dependency; this
release just makes the dependency visible to users before they try.

v1.5.0 — Lifecycle Expansion + Hardening Pass

Choose a tag to compare

@VaiYav VaiYav released this 24 Apr 12:30

[1.5.0] — 2026-04-19

Minor release (additive). Expansion of the lifecycle with portfolio view,
brown-field entry, lite mode, full monorepo support, optional V-Model
integration, unit + integration test phases, and operational readiness
artifacts. Schema v3 for .forge-status.yml is additive over v2 — no
breaking change to existing features; a lazy migration stamps
schema_version: 3 on first write.

Added — 7 new commands

  • speckit.product-forge.portfolio — Cross-cutting portfolio view. Scans
    every features/*/.forge-status.yml, produces feature table, file-conflict
    matrix, dependency graph (Mermaid), and suggested merge order. Read-only.
  • speckit.product-forge.backfill — Brown-field entry. Reverse-engineers
    a feature folder from existing code: retro product-spec, plan, simplified
    tasks, .forge-status.yml with backfilled: true, and a gaps-report of
    missing artifacts.
  • speckit.product-forge.monitoring-setup (Phase 9.5, opt) — Produces
    real NewRelic-compatible dashboard JSON, alert rules, and SLI/SLO doc
    from plan NFRs and tracking-plan events. Wraps newrelic-dashboard-builder.
  • speckit.product-forge.migration-plan (Phase 5.5, opt, conditional) —
    Generates zero-downtime migration plan with forward.sql, rollback.sql,
    validation.sql, backfill plan, and risk matrix when plan.md introduces
    schema changes. Wraps db-migration-manager / mongodb-ops.
  • speckit.product-forge.i18n-harvest (post-bridge, opt) — Extracts
    user-facing strings from wireframes/spec, generates feature-namespaced
    locale keys, stubs TODO entries in every configured locale. Wraps
    i18n-workflow.
  • speckit.product-forge.experiment-design (Phase 9B, opt) — Forces a
    pre-registered A/B plan — hypothesis, MDE, sample size, exposure rules,
    guardrails, decision rule — before shipping a flag-gated feature. Wraps
    feature-flag-ab-testing.
  • speckit.product-forge.feature-flag-cleanup — Cross-cutting stale-flag
    audit. Scans every flags/registry.yml, cross-checks codebase, produces
    removal recipes for flags past cleanup_after. Read-only; wraps
    feature-flag-manager.

Added — Monorepo support (first-class)

  • codebase.paths block in project config, with workspace_type
    (pnpm | yarn | npm | turbo | nx | rush | lerna | none) driving test-
    runner resolution. Legacy codebase_path still supported.
  • scope.paths, scope.cross_workspace, scope.primary on
    .forge-status.yml — names which workspaces a feature touches.
  • Workspace-prefixed paths in tasks.md and task_log[].paths (e.g.
    backend:src/users.ts).
  • Per-workspace conflict matrix in /portfolio with grouped "By
    workspace" section.
  • Affected-only test execution in implement + test-run when running
    under nx / turbo / pnpm workspaces.
  • Cross-workspace change propagation — scope widens automatically
    when a change request touches code outside the original scope;
    recorded as gate condition.
  • Documented in runtime.md §9,
    config.md Paths.

Added — V-Model integration (optional extension)

  • optional_extensions block in extension.yml declaring
    leocamello/spec-kit-v-model
    (≥0.5.0) as an opt-in dependency.
  • feature_mode: v-model is now a real mode, not a stub. When
    selected, forge.md detects the V-Model extension and delegates the
    middle of the lifecycle (V1–V13) to its 14 commands: requirements,
    acceptance, system / architecture / module design paired with system /
    integration / unit test plans, trace, peer-review, test-results
    ingestion, audit report.
  • No silent fallback: if V-Model plugin is absent, v-model mode
    aborts with the install command. Regulated work must not degrade.
  • Domain selection via v-model-config.yml
    (iec_62304 | iso_26262 | do_178c | generic).
  • New docs/v-model-integration.md covers
    the full phase map, detection, fallback rules, status-file additions.

Added — Testing strategy (universal)

  • New docs/testing-strategy.md — universal
    (framework-agnostic) pyramid, when unit vs integration vs contract vs
    E2E, per-layer coverage criteria, anti-patterns, flaky-test handling,
    test-data management, monorepo-aware execution.
  • test-plan.md §5E Unit Tests (TC-UNIT-NNN) — derived from module
    boundaries + behavioural acceptance criteria. Framework-agnostic.
  • test-plan.md §5F Integration Tests (TC-INT-NNN) — beyond endpoint
    contracts: service↔DB, service↔cache, event emitter↔listener,
    middleware stacks, cross-workspace integration.
  • test-run.md §4E Unit and §4F Integration — non-browser
    execution with the same auto-fix loop; §4F handles testcontainers /
    docker-compose / in-memory / shared-DB isolation strategies.

Added — Structural capabilities

  • .forge-status.yml schema v3 — Additive over v2. New fields:
    feature_mode, backfilled, v2_native, phase started_at/completed_at/tokens_in
    /tokens_out/tool_calls/digest_path/skipped/skip_reason, task_log[]
    (renamed from early-draft tasks[] to avoid collision with phases.tasks)
    with size (XS/S/M/L/XL), paths, and commit_sha, gates[].approvals,
    gates[].skip_reason, dependencies.depends_on /
    depended_on_by, role_approvals.solo_mode /
    required_roles_per_phase. New status enum value not_applicable for
    out-of-mode and backfilled phases. Full spec in
    docs/schema/forge-status-v3.schema.yml.
    Migration rules in docs/schema/migration-v2-to-v3.md.
    Optional helper script scripts/migrate-status-v2-to-v3.ts.
  • State-lock protocol.forge-status.yml.lock file-based lock with
    TTL-based takeover. Prevents concurrent-writer corruption between the
    orchestrator and sub-skills. Documented in
    docs/runtime.md §2.
  • Per-phase digests — Every major phase (research, product_spec,
    plan, tasks, implement, verify) now writes <phase>/digest.md.
    Runtime refuses to mark a phase completed without a digest. Downstream
    phases (verify-full, portfolio, retrospective) read digests first to keep
    context budgets small. Template:
    docs/templates/phase-digest.md.
  • Lite mode — New feature_mode field selects a 5-phase map
    (problem-discovery opt → product-specplanimplementverify)
    for small features. Escalation to standard is append-only. Details in
    docs/policy.md §4.
  • Skip-reason policy — Skipping an optional phase now requires a
    free-text reason when require_skip_reason: true (default). Reason is
    persisted on both the phase and the gate entry. Enforced by all skippable
    commands. Details in docs/policy.md §3.
  • Learning loop.product-forge/lessons.md append-only log. Written
    by retrospective at launch close, read by research as a new dimension
    ("Prior lessons that apply") scored by tag overlap. Format in
    docs/lessons-format.md.
  • Drift budgetsync-verify now categorizes drift as structural
    (always human-in-the-loop) or cosmetic (whitespace, ordering, stale
    dates). Opt-in sync_verify.auto_resolve.cosmetic auto-fixes whitelisted
    drift only; structural drift never auto-resolves. Budget warns when
    cosmetic count exceeds threshold.
  • Release-readiness becomes an artifact producer — Step 1D now invokes
    feature-flag-manager to produce flags/registry.yml; Step 3D invokes
    newrelic-dashboard-builder to produce monitoring/dashboard.json,
    alerts.yml, slo.md. Graceful fallback when provider skills are missing.

Changed

  • commands/forge.md refactored. Operating rules moved to
    docs/policy.md; runtime flow (config, state lock,
    detection, resume, pre-flight, sync, gate audit, digest enforcement,
    context budget) moved to docs/runtime.md; status
    schema narrative moved to docs/schema.md. The
    orchestrator file now focuses on phase delegation and the mode-
    resolution entry. No behavioral change; cross-references only.
  • config-template.yml — New keys: default_feature_mode,
    require_skip_reason, sync_verify.drift_budget.{cosmetic, structural},
    sync_verify.auto_resolve.cosmetic.
  • research.md Step 2.5 — Consults .product-forge/lessons.md for
    matching prior lessons and surfaces them in research/README.md.
  • retrospective.md Step 5 — Drafts lesson blocks, confirms with user,
    appends to lessons.md, records count in phases.retrospective.lessons_added.

Release-prep hardening

Surfaced by the plugin test plan dry-run and closed before release:

  • Broken historical refs removed from CHANGELOG.md, README.md,
    and docs/how-it-works-v2.md — pointed to archive directories that
    are not in this tree.
  • Policy.md §3 tightened — empty skip reasons under
    require_skip_reason: true now explicitly reject the gate and
    re-prompt; no skipped gate entry is written until a non-empty
    reason is supplied.
  • Enum validation added to commands/forge.md Mode Resolution and
    docs/runtime.md §4 pre-flight — invalid feature_mode,
    phases.<name>.status, or gates[].decision values abort with a
    clear message instead of falling through silently.
  • tasks.md Step 4.1 — hard structural checks for task-ID
    uniqueness and monorepo workspace-prefix validation. Duplicates and
    unknown workspace names now abort the phase with a pointer to the
    offending line instead of propagating into task_log[].
  • Test-plan self-references...
Read more

v1.4.0 — Spec Quality & Lifecycle Hardening

Choose a tag to compare

@VaiYav VaiYav released this 04 Apr 10:27

What's New in v1.4.0

Phase 1 — Research: Codebase Constraints & Event Patterns

research.md now instructs the codebase analysis agent to capture two new mandatory artifacts: a Codebase Constraints table (naming conventions, mandatory patterns, ADR rules, shared utilities) and an Event / Message Patterns table with exact enum identifiers, payload interface references, and source file paths.

Phase 3 — Revalidation: Richer Review History

revalidate.md now initializes review.md with three structured sections: Open Questions Resolution, Decision Log, and Change History. Each revision cycle (Step 3D) writes to all four sub-sections. New Step 4B-post auto drift-check writes a ⚠️ Drift Warning if product-spec.md diverges from an existing spec.md at approval time.

Phase 4 — Bridge: Richer spec.md

New steps: FEATURE_TYPE detection (shared_infrastructure vs end_user) and Dependency Discovery (Step 2.5). New spec.md sections: Prerequisites, NFR Measurement Contract, Codebase Constraints, EDA Events with exact identifiers + Step 4.5 verification, Consumer Contract (shared infra only), Testing Specification. Step 5 self-checks expanded from 5 → 10 with conditional guards.

Phase 5 — Plan: Constitution Compliance Auto-Check

New Step 3.5 locates the project constitution (config.yml → constitution_path.specify/memory/constitution.md → skip) and checks plan.md across Resilience, Privacy, Testing, EDA patterns, and Code Quality before the approval gate. config-template.yml updated with commented constitution_path key.

Bug Fixes

  • Removed meta-instruction blockquotes that would have leaked verbatim into generated spec.md files
  • Fixed duplicate phrase in plan.md Step 4
  • Removed accidental double --- separator after NFR Measurement Contract

v1.3.0 — Lifecycle Expansion

Choose a tag to compare

@VaiYav VaiYav released this 01 Apr 14:07

Product Forge v1.3.0 — Lifecycle Expansion

Product Forge now covers the full product lifecycle with 14 phases, cross-artifact consistency checking, and formal change management — up from 9 phases in v1.2.1.

What's New

5 New Commands

Command Phase Description
sync-verify Cross-cutting 7-layer artifact consistency checker. Detects forward drift (spec not in code) and backward drift (code decisions not in spec). Runs automatically between phase transitions (--quick) or full scan on demand. Human-in-the-loop for every CRITICAL/WARNING resolution.
pre-impl-review 5C Combined design review + architecture review + risk assessment before writing any code. Checks state completeness, UX compliance, accessibility, structural soundness, NFR coverage. Produces a risk register with rollout strategy recommendation.
code-review 6B Multi-agent code review with 4 parallel dimensions: Quality (SOLID/DRY), Security (OWASP surface scan from plan.md), Patterns (consistency with codebase-analysis.md), Tests (coverage vs spec.md). Findings use REV-NNN IDs.
release-readiness 9 Pre-ship checklist: feature flags, rollout/rollback strategy, documentation, monitoring & alerts, analytics, deployment dependencies. Consolidates api-docs + security-check + tracking-plan status into one gate.
change-request Cross-cutting Formal scope change management. Captures change → impact analysis across all artifacts → effort delta → decision gate → propagates with CR-NNN markers → runs sync-verify. Deferred changes tracked in backlog.md.

Upgraded Commands

  • forge.md — Full rewrite: 14 phases (was 9), Phase 0 in orchestrator, auto sync-verify between transitions, complete gate audit trail
  • implement.md — Progressive verification every N tasks with implementation-log.md. CRITICAL drift pauses implementation with user options
  • status.md — Shows all 14 phases, gate audit trail, sync-verify history, change request tracking
  • bridge.md — Now delegates to Product Forge plan/tasks wrappers for cross-validation benefits

Schema & Configuration

  • .forge-status.yml schema v2schema_version field for migration detection, 5 new phase fields (pre_impl_review, code_review, release_readiness, problem_discovery, retrospective), gates:[] audit trail, sync_runs: history, change_requests:[] tracking, documented extension blocks for all supporting commands
  • Auto-migration from v1 to v2 schema — existing features are upgraded transparently
  • 3 new config keysprogressive_verify_interval (default: 3), auto_sync_between_phases (default: true), release_readiness (default: "optional")

Bug Fixes (16 issues)

  • Fix CR-NNN ID collision between change-request and code-review (code review now uses REV-NNN)
  • Rewrite docs/phases.md (was frozen at v1.0 content — now documents all 14 phases)
  • Fix README verify version, product-spec.md template, forge description
  • Update problem-discovery.md and research.md to write schema v2
  • Document 3 new config keys in docs/config.md
  • Fix bridge.md to delegate to product-forge wrappers instead of SpecKit directly
  • Relax retrospective.md prerequisite (verify:completed minimum, testing optional)
  • Complete status.md detailed view with all phases
  • Document completed_with_known_issues state and supporting command schema fields

Updated Lifecycle

Phase 0   Problem Discovery (optional)
Phase 1   Research (parallel: competitors, UX, codebase, tech, metrics)
Phase 2   Product Spec (interactive, multi-document)
Phase 3   Revalidation (iterative approval cycle)
Phase 4   Bridge → SpecKit (spec.md generation)
Phase 5   Plan (technical plan with cross-validation)
Phase 5B  Tasks (task breakdown with coverage validation)
Phase 5C  Pre-Implementation Review (design + arch + risk)        ← NEW
Phase 6   Implementation (with progressive verification)          ← UPGRADED
Phase 6B  Code Review (multi-agent: quality/security/patterns)    ← NEW
Phase 7   Verify Full (6-layer traceability check)
Phase 8A  Test Plan (optional — Playwright test generation)
Phase 8B  Test Run (optional — execution with auto-fix loop)
Phase 9   Release Readiness (optional — pre-ship checklist)       ← NEW
Post:     Retrospective (predicted vs actual metrics)

Cross-cutting:
  sync-verify (artifact consistency, runnable anytime)            ← NEW
  change-request (formal scope change management)                 ← NEW

Install / Update

# Install
specify extension add product-forge --from https://github.com/VaiYav/speckit-product-forge/archive/refs/tags/v1.3.0.zip

# Update
specify extension update product-forge --from https://github.com/VaiYav/speckit-product-forge/archive/refs/tags/v1.3.0.zip

Full Changelog

See CHANGELOG.md for complete details.

v1.2.1 — plan / tasks / implement split into independent commands

Choose a tag to compare

@VaiYav VaiYav released this 30 Mar 19:13

Breaking change: implement split into 3 standalone commands

speckit.product-forge.implement was a monolith that bundled plan + tasks + implementation into one command. Starting from v1.2.1 it is split into three independent, standalone commands:

Command Phase Does
/speckit.product-forge.plan 5 Generates plan.md from spec.md, cross-validates vs product-spec, exits after approval
/speckit.product-forge.tasks 5B Generates tasks.md from plan.md, validates all story/FR coverage, exits after approval
/speckit.product-forge.implement 6 Executes implementation from tasks.md only, exits when all tasks are [x]

Why this matters for community extensions

Each boundary between these commands is now an explicit extension point. You can insert your own commands between any two phases:

/speckit.product-forge.plan
    ↓  ← insert: architecture-review, cost-estimation, ADR creation, ...
/speckit.product-forge.tasks
    ↓  ← insert: sprint-planning, capacity-check, stakeholder-approval, ...
/speckit.product-forge.implement
    ↓  ← insert: pr-creation, code-review-gate, manual-qa, ...
/speckit.product-forge.verify-full

The forge orchestrator (forge.md) respects .forge-status.yml — it always resumes from the last completed phase, so custom steps just need to update the status file before handing back.

Migration

If you call speckit.product-forge.implement directly and expect it to run plan + tasks too:

# Before (v1.2.0)
/speckit.product-forge.implement

# After (v1.2.1)
/speckit.product-forge.plan
/speckit.product-forge.tasks
/speckit.product-forge.implement

Or just use /speckit.product-forge.forge — the orchestrator handles the full sequence automatically.

Install / Update

specify extension add product-forge --from https://github.com/VaiYav/speckit-product-forge/archive/refs/tags/v1.2.1.zip

Full changelog

See CHANGELOG.md

v1.2.0 — 5 new commands: Problem Discovery, API Docs, Security Check, Tracking Plan, Retrospective

Choose a tag to compare

@VaiYav VaiYav released this 30 Mar 19:07

What's new in v1.2.0

Product Forge now covers the full product lifecycle — from validating the problem exists, to measuring real impact after launch. 5 new commands added.


/speckit.product-forge.problem-discovery — Phase 0 (new)

Validate the problem before committing to research:

  • JTBD analysis (functional / emotional / social job layers)
  • Competing Forces model — Push + Pull vs Inertia + Anxiety
  • Problem Statement Canvas → problem-discovery/problem-statement.md
  • User interview script with scoring rubric
  • Go / Investigate further / No-go decision
  • Outputs hypotheses H1–HN that focus Phase 1 research agents

/speckit.product-forge.api-docs — post-implement (new)

Generate production-ready API documentation from plan.md contracts:

  • OpenAPI 3.1 openapi.yml — import into Swagger UI, Redoc, Stoplight
  • postman-collection.json — with auto-token-save login flow
  • Consistency check: plan.md vs actual implementation drift report
  • Auto-detects framework (NestJS / Express / FastAPI) and auth scheme

/speckit.product-forge.security-check — post-implement (new)

Feature-scoped OWASP audit — checks only what this feature actually does:

  • Builds threat model from plan.md (auth, input, payments, files, webhooks)
  • Covers OWASP A01–A08 for detected surfaces only
  • Scans for hardcoded secrets, missing ownership checks, mass assignment, missing rate limiting
  • Findings: Critical / High / Medium / Low with code evidence + fix patterns
  • Ship-readiness verdict: ✅ Ready / ⚠️ Fix critical first / 🔴 Not ready

/speckit.product-forge.tracking-plan — post-spec (new)

Analytics tracking plan generated directly from user journeys:

  • Auto-detects SDK (Mixpanel, Amplitude, PostHog, Firebase, Segment)
  • Event taxonomy with property schemas, required/optional flags, examples
  • Conversion funnels + abandonment funnels mapped to success metrics
  • Ready-to-paste typed SDK snippets for the detected framework
  • Coverage matrix: each user story → key event → success metric

/speckit.product-forge.retrospective — post-launch (new)

Close the loop — run ≥14 days after shipping:

  • Loads predicted KPIs from research/metrics-roi.md
  • Queries NewRelic (via MCP) for real performance data since launch
  • Predicted vs actual: adoption, completion rate, latency, error rate
  • Research accuracy audit: were Phase 1 predictions correct?
  • Lessons learned for the next feature

Full lifecycle: 15 commands

Phase 0   problem-discovery   → validate the problem (JTBD, Go/No-go)
Phase 1   research            → competitors, UX, codebase, tech, metrics
Phase 2   product-spec        → user journeys, wireframes, mockups
Phase 3   revalidate          → approval loop
Phase 4   bridge              → spec.md (Classic or V-Model)
Phase 5-6 implement           → plan + tasks + code
Phase 7   verify-full         → traceability audit
Phase 8A  test-plan           → test cases + .spec.ts files
Phase 8B  test-run            → playwright-cli execution + bug fix loop
Post-impl api-docs            → OpenAPI 3.1 + Postman collection
Post-impl security-check      → OWASP audit scoped to this feature
Post-spec tracking-plan       → analytics events + SDK snippets
Post-ship retrospective       → predicted vs actual metrics
Any time  status              → lifecycle progress view

Install / Update

specify extension add product-forge --from https://github.com/VaiYav/speckit-product-forge/archive/refs/tags/v1.2.0.zip

Full changelog

See CHANGELOG.md

v1.1.3 — playwright-cli integration + improved docs

Choose a tag to compare

@VaiYav VaiYav released this 28 Mar 18:34

What's new

playwright-cli as Phase 8B execution engine

Phase 8B (test-run) now uses playwright-cli as the interactive browser execution engine:

  • Agent opens browser with playwright-cli open, drives each test step (click, fill, snapshot, screenshot)
  • Auth sessions managed with playwright-cli -s=pf-auth state-save/load — login once, reuse across all tests
  • Evidence captured via playwright-cli screenshot + tracing-start/stop

Dual execution model documented

Model Artifact Tool
Agent-driven (Phase 8B) testing/test-cases.md playwright-cli
CI/CD pipeline testing/playwright-tests/*.spec.ts npx playwright test

test-cases.md action table format

Each test case now includes a playwright-cli action table — every step maps 1:1 to a CLI command, no interpretation needed by Phase 8B.

README improvements

  • playwright-cli added to Requirements with install instructions
  • Installation section rewritten with proper specify extension add/update commands (latest + pinned version)
  • Post-install config setup guide

Install / Update

# Install
specify extension add product-forge --from https://github.com/VaiYav/speckit-product-forge/archive/refs/tags/v1.1.3.zip

# Update
specify extension update product-forge --from https://github.com/VaiYav/speckit-product-forge/archive/refs/tags/v1.1.3.zip

Full changelog

See CHANGELOG.md

v1.1.0 — Test planning, test execution, adaptive research

Choose a tag to compare

@VaiYav VaiYav released this 28 Mar 17:59
New commands:
  product-forge.test-plan  — Phase 8A: generate Playwright specs from user stories
  product-forge.test-run   — Phase 8B: execute, auto-fix P0/P1 bugs, produce test-report

Other changes:
  Adaptive research depth (input richness scoring 0–8)
  9-phase lifecycle orchestrator
  Full docs and file structure updates