Skip to content
Back to skills

E38 Traceability Gate

ASecurity

STORY KEY: E38-S06 TITLE: Create gate-trace skill — deterministic quality gate before release TYPE: Story PARENT: e38 STATUS: Draft AUTHOR: dvm DATE: 2026-07-03 MATURITY: 3 SIZE: S The traceability pipeline now has a coverage matrix (e38s01) and blind-spot detector (e38s04), but there is no single gate that combines them into a release-blocking decision. The gate-trace skill reads both artifacts, applies deterministic decision rules (TEA-inspired PASS/CONCERN...

  • 274 stars
  • 0 votes
  • 0 copies
  • 3 views
  • Added October 25, 2026
development

Security analysis

A100/100

Pro scans all 20 files and shows the line behind each finding

Scanned October 25, 2026

npx -y skills add danielvm-git/bigpowers --skill e38-traceability-gate --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of E38 Traceability Gate?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for E38 Traceability Gate
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/danielvm-git-e38-traceability-gate/badge)](https://www.skillsdirectory.com/skills/danielvm-git-e38-traceability-gate)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
STORY KEY: E38-S06
TITLE:     Create gate-trace skill — deterministic quality gate before release
TYPE:      Story
PARENT:    e38
STATUS:    Draft
AUTHOR:    dvm           DATE: 2026-07-03
MATURITY:  3
SIZE:      S

### 1. Business narrative
The traceability pipeline now has a coverage matrix (e38s01) and blind-spot
detector (e38s04), but there is no single gate that combines them into a
release-blocking decision. The gate-trace skill reads both artifacts, applies
deterministic decision rules (TEA-inspired PASS/CONCERNS/FAIL/WAIVED), and
applies oracle confidence downgrades — if >50% of trace links come from
heuristics rather than explicit story tags, the verdict is downgraded one level.
This makes the gate auditable and honest: the agent knows when it's guessing.

### 2. Value statement
As a release engineer, I want a single deterministic gate that combines coverage
and blind-spot data into a PASS/FAIL decision before release, so I don't have
to manually interpret two separate reports.

### 3. Actors and permissions
- Agent (system) — executes gate-trace skill.
- Release engineer (internal) — reviews gate decision and rationale.

### 4. Trigger and preconditions
Trigger: invocation before release (via release-branch).
Precondition: specs/traceability-matrix.json exists (e38s01).
Precondition: specs/blind-spots.json exists (e38s04).

### 5. Main flow and business logic
1. Read specs/traceability-matrix.json and specs/blind-spots.json.
2. Apply gate decision rules:
   - Any undone story with 0 code tags → FAIL.
   - Any story done but no verify → CONCERNS.
   - P0 story with 0% coverage → FAIL.
   - Overall coverage < 60% → CONCERNS.
   - Overall ≥ 80% + no critical gaps + all verify → PASS.
3. Apply oracle confidence downgrade:
   - > 50% trace links from heuristics (not explicit tags) → one level downgrade.
   - > 80% from heuristics → two levels (PASS→FAIL, CONCERNS→FAIL).
4. Output gate decision + rationale to stdout.
5. Update specs/execution-status.yaml with gate-trace result.

### 6. Alternative flows and exceptions
6a. Matrix or blind-spots.json missing — gate returns WAIVED with reason.
6b. execution-status.yaml has conflicts — report conflict, gate CONCERNS.

### 7. Interface elements
Context: new (skills/gate-trace/SKILL.md).
Static elements: gate decision rules, oracle confidence downgrade table.
Dynamic elements: PASS/CONCERNS/FAIL/WAIVED verdict per run.

### 8. Domain model
Entities read: specs/traceability-matrix.json, specs/blind-spots.json.
Entities written: specs/execution-status.yaml (gate-trace field).

### 9. Integrations and boundaries
- trace-stories.sh (direction: in) — produces traceability matrix.
- check-blind-spots.sh (direction: in) — produces blind-spots.json.
- release-branch SKILL.md (direction: out) — consumer of gate decision.
- sync-skills.yml (direction: out) — CI consumer.

### 10-16. Not applicable (standard skill creation pattern)

### 17. Acceptance criteria
Scenario: Clean codebase passes gate
  GIVEN overall ≥ 80% coverage, no critical gaps, all verify done
  WHEN gate-trace runs
  THEN it returns PASS
  AND output includes rationale citing coverage and blind-spot results

Scenario: P0 story untagged
  GIVEN a P0 story has 0% code coverage
  WHEN gate-trace runs
  THEN it returns FAIL
  AND rationale names the offending story

Scenario: Heuristic downgrade
  GIVEN > 50% of trace links come from file-name heuristics
  WHEN gate-trace runs with otherwise PASS
  THEN it returns CONCERNS
  AND rationale cites the heuristic link ratio

### 18. Out of scope
- Auto-remediating traceability gaps (gate-trace is decision-only).
- Replacing the human release decision (gate is advisory for CONCERNS).

### 19. Open questions
- Should WAIVED be a permanent state or require re-evaluation on next release?
  Re-evaluation: WAIVED means "cannot decide now," not "permanently excused."

### 20. References
- BMAD TEA traceability approach (market survey 2026-07-02).
- scripts/trace-stories.sh (e38s01).
- scripts/check-blind-spots.sh (e38s04).
- specs/execution-status.yaml (output target).

Files in this skill

  • e38s01-tasks.yaml1.6 KB
  • e38s01-trace-matrix-builder.md7.7 KB
  • e38s02-build-epic-integration.md4.9 KB
  • e38s02-tasks.yaml585 B
  • e38s03-ci-gate.md2.6 KB
  • e38s03-tasks.yaml568 B
  • e38s04-blind-spots-detector.md3.5 KB
  • e38s04-tasks.yaml954 B
  • e38s05-tasks.yaml470 B
  • e38s05-verify-work-integration.md2.2 KB
  • e38s06-gate-trace-skill.md4 KB
  • e38s06-tasks.yaml677 B
  • e38s07-release-branch-gate.md2.5 KB
  • e38s07-tasks.yaml481 B
  • e38s08-tasks.yaml417 B
  • e38s08-traceability-mandate.md2.2 KB
  • e38s09-tasks.yaml599 B
  • e38s09-traceability-guide.md3 KB
  • epic.yaml5.9 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.