Skip to content
Back to skills

Mstar Roles

ASecurity

Morning Star role prompt hub and the **single load-selection authority** for Morning Star roles — `agents/*.md` shells plus full behavior in `references/*.md`. Role files are **identity-first** (mission / responsibilities / NEVER rules); topic `mstar-*` skills appear only as **PM-activated skill presets** (Assignment `Skill presets:` field), not default dependencies — this hub's § Load Order owns the omission / `none` / named-preset / resume / unknown-preset decision. Always load for any Morn...

  • 62 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 20, 2026
ai-agentsshellcode-reviewgitfrontendbackendfullstacksecurityperformance

Works with

  • cli

Security analysis

A100/100

Pro scans all 20 files and shows the line behind each finding

Scanned October 5, 2026

npx -y skills add btspoony/mstar-harness --skill mstar-roles --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Mstar Roles?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Mstar Roles
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/btspoony-mstar-roles/badge)](https://www.skillsdirectory.com/skills/btspoony-mstar-roles)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: mstar-roles
description: Morning Star role prompt hub and the **single load-selection authority** for Morning Star roles — `agents/*.md` shells plus full behavior in `references/*.md`. Role files are **identity-first** (mission / responsibilities / NEVER rules); topic `mstar-*` skills appear only as **PM-activated skill presets** (Assignment `Skill presets:` field), not default dependencies — this hub's § Load Order owns the omission / `none` / named-preset / resume / unknown-preset decision. Always load for any Morning Star role (`project-manager`, `product-manager`, `architect`, `code-reviewer`, `fullstack-dev`, `fullstack-dev-2`, `frontend-dev`, `qa-engineer`, `qc-specialist*`, `ops-engineer`, `writing-specialist`, `prompt-engineer`). Cross-role **Role → skill presets** summary in this SKILL.md; per-role preset menus in `references/*.md` are authoritative once PM activates them. Full topic skill index → **`mstar-harness-core`**.
---

## Load Order

This hub is the **single load-selection authority** for Morning Star roles (Spec A2): `mstar-harness-core` stays the lifecycle/authorization semantic authority and the global entry whenever it is loaded, but this hub owns the selection decision — core does not maintain a second mandatory-role table. When a Morning Star role starts work in a session:

1. Read this `mstar-roles` skill; resolve role mapping and parameter tables below. This hub bootstrap does not require `mstar-harness-core` first.
2. Read the corresponding `references/<role>.md` file — **identity-first**: mission, scope, and NEVER rules come before any skill list. Non-PM roles also read the linked minimal leaf boundary (`references/_shared/leaf-executor-core.md` — role-owned, always loads with the reference).
3. Apply the Assignment **`Skill presets:`** decision — explicit `none` ⇒ no optional topic preset (identity + assignment + role-owned methods only); omitted on a substantive implementation / QC / QA round ⇒ the role's `standard` preset; explicit named preset ⇒ that role's supported members; omitted on a trivial route ⇒ identity only. **Role-owned** QC/QA methods and assigned evidence obligations load regardless of preset. `none` never grants delegation and never waives gates. **Unknown preset** or missing required identity ⇒ return Needs Context / Blocked — never infer `project-manager`.
4. Whenever `mstar-harness-core` is loaded by that decision (PM required reads, `standard` routes, direct lifecycle-topic invocation) it remains the global entry (state machine, gates, routing); if any conflict appears, `mstar-harness-core` remains the authoritative source for lifecycle, gates, routing, and invariants.
5. Resume: retain loaded identity/contract only when the source hashes are unchanged; read changed / phase-required material; never reinterpret `none` as permission.
6. Expand placeholders from role parameters before execution.

The table below summarizes each role's preset menu; when a role file's preset section differs, follow the role file for that session.

Exception: `project-manager` is the core orchestrator and keeps **required reading** (not a preset, never preset-gated) — see `references/project-manager.md`.

## Role Reference Mapping

| Agent id | Reference file | Parameterized slots |
| --- | --- | --- |
| `project-manager` | `references/project-manager.md` | — |
| `product-manager` | `references/product-manager.md` | — |
| `architect` | `references/architect.md` | — |
| `code-reviewer` | `references/code-reviewer.md` | — |
| `fullstack-dev` | `references/fullstack-dev-shared.md` | `role_id`, `track` |
| `fullstack-dev-2` | `references/fullstack-dev-shared.md` | `role_id`, `track` |
| `frontend-dev` | `references/frontend-dev.md` | — |
| `qa-engineer` | `references/qa-engineer.md` | — |
| `qc-specialist` | `references/qc-specialist-shared.md` | `role_id`, `reviewer_index`, `focus`, `report_suffix` |
| `qc-specialist-2` | `references/qc-specialist-shared.md` | `role_id`, `reviewer_index`, `focus`, `report_suffix` |
| `qc-specialist-3` | `references/qc-specialist-shared.md` | `role_id`, `reviewer_index`, `focus`, `report_suffix` |
| `ops-engineer` | `references/ops-engineer.md` | — |
| `writing-specialist` | `references/writing-specialist.md` | — |
| `prompt-engineer` | `references/prompt-engineer.md` | — |

### Role → skill presets (PM-activated)

PM-owned activation; the omission / `none` / named-preset / resume / unknown-preset rule is defined once in **§ Load Order** above — this table only summarizes each role's preset menu (role refs own their named member lists). Role-owned files (e.g. `references/qc-specialist/`, `references/qa-engineer/acceptance-gate.md`) are excluded from presets; they always load with the reference.

| Role | Preset menu |
| --- | --- |
| `project-manager` | `mstar-dispatch-gates`, `mstar-phase-gates`, `mstar-conventions`, `mstar-roles` ref; + `references/project-manager/qa-trigger-matrix.md` for QA gate tiers; + `mstar-review-qc` before QC; + `mstar-branch-worktree` / `mstar-artifacts` as the round requires; + `mstar-skill-authoring` for skill work; + `mstar-iteration` for iteration lifecycle (start/drive/close); + `mstar-strategy` for strategic alignment; + `mstar-use-cli` when the round runs or interprets CLI commands; + `mstar-compound` / `mstar-compound-refresh` pre-loaded by `mstar-iteration` § iteration-close |
| `fullstack-dev*`, `frontend-dev` | `mstar-coding-behavior`, `mstar-dispatch-gates`, `mstar-branch-worktree` (if repo writes); plan path symbols from `mstar-conventions` (minimal); `mstar-design-md` when implementing styled UI; `mstar-use-cli` when the round runs or interprets CLI commands |
| `qc-specialist*` | Presets: `mstar-branch-worktree`, `mstar-artifacts` (review bundle paths); `mstar-design-md` when reviewing UI; `mstar-use-cli` when the round runs or interprets CLI commands. Role-owned (never gated): `references/qc-specialist/` workflow/checklist/template (+ lenses on demand) |
| `qa-engineer` | Presets: `mstar-branch-worktree`, `mstar-artifacts` (closing R#); `mstar-design-md` when verifying visual output; `mstar-use-cli` when the round runs or interprets CLI commands. Role-owned (never gated): `references/qa-engineer/acceptance-gate.md` |
| `architect` | `mstar-phase-gates` (Prepare), `mstar-artifacts` (knowledge/specs); `mstar-design-md` (creator + design intent); `mstar-strategy` (STRATEGY.md creation/maintenance); `mstar-use-cli` when the round runs or interprets CLI commands |
| `product-manager` | `mstar-phase-gates` (Prepare), `mstar-artifacts` (knowledge/specs); `mstar-design-md` (creator + design intent); `mstar-strategy` (STRATEGY.md creation/maintenance) |
| `code-reviewer` | `mstar-sdd` (per-task review mode); `mstar-audit` (audit mode: full workflow); `mstar-conventions` (paths); `mstar-artifacts` (plan-quality-bar for audit plans); `mstar-use-cli` when the round runs or interprets CLI commands |
| `ops-engineer` | `mstar-coding-behavior`, `mstar-branch-worktree`; `mstar-use-cli` when the round runs or interprets CLI commands |
| `prompt-engineer` | All topic skills when editing harness text; `mstar-use-cli` when the round runs or interprets CLI commands |

Use skill names (not absolute filesystem paths) in role references.

Role `references/*.md` files include explicit **`NEVER`** sections (anti-recursion, tool misuse, Git discipline). Treat those bullets as **hard gates** alongside `mstar-harness-core`; do not treat them as optional style tips.

## Parameter Table (SSOT)

### Dev track (`fullstack-dev` family)

| role_id | track | Meaning |
| --- | --- | --- |
| `fullstack-dev` | `primary` | Backend-led primary implementation track |
| `fullstack-dev-2` | `parallel_secondary` | Second implementation track for parallel independent modules |

### QC reviewer (`qc-specialist*` family)

**Job:** Independent **code review** on the plan branch diff (logic, security, contracts, maintainability, reliability). **Not** test execution — suites/builds belong to implementer (L1) and `qa-engineer` (L4). See `mstar-review-qc/references/review-responsibility-boundaries.md`.

**Default (SDD):** plan QC tri-review — `qc-specialist` / `qc-specialist-2` / `qc-specialist-3` → `{SDD_DIR}/review/qc1.md`…`qc3.md` + `qc-consolidated.md` when **`Execution mode: sdd`**.

**Exception (`inline` / hotfix):** single-seat → `{SDD_DIR}/review/qc.md` (`QC mode: single`).

| role_id | reviewer_index | focus | report_suffix |
| --- | --- | --- | --- |
| `qc-specialist` | `1` | Architecture coherence and maintainability risk | `qc1` → `{SDD_DIR}/review/qc1.md` |
| `qc-specialist-2` | `2` | Security and correctness risk | `qc2` → `{SDD_DIR}/review/qc2.md` |
| `qc-specialist-3` | `3` | Performance and reliability risk | `qc3` → `{SDD_DIR}/review/qc3.md` |

PM consolidated (tri mode): `{SDD_DIR}/review/qc-consolidated.md` (same folder; no `<plan-id>` basename prefix) + durable main-plan summary. Naming SSOT: `mstar-artifacts/references/plan-files-and-reports.md`.

> **Engine check (when available):** run `mstar roles validate` (or import `validateRoleMapping` / `lintLoadOrder` from `@mstar-harness/engine` in a host hook) to validate the mapping and parameter tables above against the on-disk `references/*.md` layout (shared families included) and lint load-order declarations: `mstar-*` topics declare core-first with only exact-identity exemptions; this hub's bootstrap declares the § Load Order decision matrix. On `fail` -> do not proceed; fix and re-run. Skill text below remains authoritative when the runtime is absent.

## Maintenance Rules

- Edit behavior in `references/*.md`.
- Edit role family parameters in this file.
- Keep shared-family roles (`fullstack-dev*`, `qc-specialist*`) on one shared reference file.
- Role references stay **identity-first**: mission / responsibilities / NEVER rules before any skill list; topic-skill loads live only in the **Skill Preset (PM-Activated)** section.
- Add new roles by updating mapping, parameters (if needed), and adding corresponding `agents/*.md` shell.

## Workflow

加载顺序:Read 本 skill(角色映射 + 参数表;本 skill 即加载选择权威)→ 解析对应 `references/<role>.md`(身份优先:mission / NEVER / responsibilities 在前)+ 非 PM 角色读取其链接的 leaf 边界 → 按 § Load Order 的 `Skill presets:` 决策加载专题 skill(解释权只在 § Load Order;角色 ref 只列成员名单)。映射 / 参数表与磁盘 `references/*.md` 布局不符时先修再继续。

## Evidence

Correct structural evidence = `mstar roles validate` reports zero mapping and load-order violations: lifecycle topics declare core-first, and the hub declares identity-first / none / standard / role-owned methods / unknown-preset decisions. Reference files match the mapping; shared families use one reference. This validation does not establish model compliance or waive lifecycle authority.

## References

- 角色正文 → `references/<role>.md`(本 skill 内;leaf QC / QA 等子目录见 `references/qc-specialist/`、`references/qa-engineer/`)
- 全局角色 → `mstar-harness-core` 加载矩阵与专题 skill 索引

- Explicit independent E2E/browser/device requests → `mstar-e2e` (PM orchestrates; `ops-engineer` executes; routine QA does not trigger it).

Files in this skill

  • SKILL.md11.3 KB
  • references/_shared/leaf-executor-core.md6.4 KB
  • references/architect.md5.4 KB
  • references/code-reviewer.md13.8 KB
  • references/frontend-dev.md4.2 KB
  • references/fullstack-dev-shared.md4.8 KB
  • references/ops-engineer.md3.6 KB
  • references/product-manager.md4.7 KB
  • references/project-manager.md23.8 KB
  • references/project-manager/dispatch-and-assignment.md21.4 KB
  • references/project-manager/plan-management.md9 KB
  • references/project-manager/qa-trigger-matrix.md4.9 KB
  • references/project-manager/qc-and-residuals.md7.2 KB
  • references/project-manager/routing-and-dev-allocation.md5.1 KB
  • references/prompt-engineer.md4.1 KB
  • references/qa-engineer.md8.6 KB
  • references/qa-engineer/acceptance-gate.md9.3 KB
  • references/qc-specialist-shared.md8.1 KB
  • references/qc-specialist/deep-review-lenses.md10.3 KB
  • references/qc-specialist/report-template.md5.7 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.