task-toolkit

Security gate and audit for ANY project, driven by the company's own checklists — a 74-item engineering checklist (network · server config · deployment · programming · database · client UI) and the 153-requirement customer web-application checksheet — plus an OWASP quick reference. Two modes: TASK mode triages what one change actually touches and writes 01-discovery/security.md (cheap, runs on every task that touches auth, data, secrets, uploads, infra or external calls); AUDIT mode answers the full checklists for a release or customer submission and writes 05-delivery/security-checklist-<date>.md. Trigger on "check bảo mật", "security review/checklist", "rà an ninh", "điền checksheet bảo mật", "task này có rủi ro bảo mật gì", or as the security gate of analyze-spec. NOT a penetration test and not a substitute for an independent audit — it is the builder's own net. For fact-checking a document use verify-claims; for reviewing argument quality use report-reviewer. Locale vn (default) / en / ja.

Initialize a generic task workspace tasks/{TICKET-ID}/ for ANY project — a 5-stage folder layout (01-discovery, 02-plan, 03-backlog, 04-quality, 05-delivery) where every folder carries its own README telling the reader what belongs there, who writes it and what to read first. Folders and placeholder files are created up front so the shape of the work is visible before any stage runs. Trigger on "khởi tạo task", "init task workspace", "tạo workspace cho ticket", or as STAGE 1 of the /task-toolkit:report pipeline when a workspace is needed but missing. If the current repo has its own /task-toolkit:task-init command (e.g. kaigo's version with legacy-PR fetching), that version wins — this is the generic fallback. Creates the empty shape only — it does NOT investigate, plan or write tickets; those are task-survey, planning and backlog-ticket. Locale vn (default) / en / ja.

Design the unit-test viewpoints for a task before any test code is written — walk the 30-viewpoint matrix (A equivalence · B boundary · C branch/condition · D exception & interaction · E state & non-determinism · F Japanese-locale and project-specific logic), decide which apply and why, and emit a reviewable plan of Given–When–Then cases into 04-quality/ut-design.md. Runs a SPEC GATE first: `expected` must be derived from the spec, never from the current implementation. Offers to install the companion unittest-toolkit plugin for the full design → generate → audit flow; if declined, does the design here with the knowledge bundled in reference/. Trigger on "thiết kế UT", "ut design", "quan điểm unit test", "viết test cho hàm/module nào", "cần test những gì", or as the 04-quality stage of the task pipeline. Does NOT generate test code — that is ut-generate in the companion plugin. Locale vn (default) / en / ja.

Kiểm từng khẳng định trong một tài liệu có ĐÚNG SỰ THẬT không — bóc mọi claim kiểm được (số lượng, tên bảng/route/hàm, phiên bản, licence, "chỉ dùng ở X", đường dẫn, lệnh, giá trị config), nêu cách kiểm, kiểm thật bằng code-evidence-method, ra bảng Claim | Cách kiểm | Thực tế | Verdict. Dùng cho report trước khi gửi khách, và cho tài liệu mô tả hiện trạng hệ thống (architecture, inventory, investigation). KHÔNG review cấu trúc, văn phong, IA, hay mâu thuẫn nội tại — đó là việc khác. Trigger "kiểm số liệu", "verify claim", "doc này có đúng không", "soát lại trước khi gửi".