kms-sync-rules

# KMS Sync Rules (Auto-Detect) Detect changed files and emit only the synchronization sub-rules that apply to your current changes. ## Step 1 — Detect Changes Run the following to discover what has changed: ```bash # Staged + unstaged changes (working tree): git diff --name-only HEAD # Only staged changes (about to be committed): git diff --name-only --cached # Changes on this branch vs develop baseline: git diff --name-only origin/develop...HEAD 2>/dev/null || git diff --name-only HEAD~1 ``` Collect the union of changed paths. If no files are detected, ask the user to describe what they changed. ## Step 2 — Map Paths to Sub-Rules Apply this path → rule mapping to the detected file list: | Path pattern | Sub-rules triggered | |---|---| | `crate/server/src/routes/**` (new/modified handler) | **4.2**, 4.10 | | `crate/kmip/src/**` or `crate/server/src/core/operations/**` | **4.3**, 4.10 | | `crate/clients/clap/src/**` or `crate/clients/ckms/src/**` | **4.4**, 4.15 | | `ui/src/**` (new UI feature path) | **4.1**, 4.4 | | `crate/clients/wasm/src/**` | **4.5** | | `crate/server/src/config/**` | **4.6**, 4.7 | | `crate/server_database/**` | **4.18** | | `crate/server/src/middlewares/**` or `crate/server/src/config/wizard/auth_wizard.rs` | **4.9** | | `test_data/vectors/**` or `crate/test_kms_server/**` | verify 4.10 completeness | | `test_data/configs/**`, `test_data/spire/config/**`, or a `.mise/**` / `crate/**/tests/**` change that writes a KMS, Auth Verifier or ckms config | **4.20** | | `Cargo.lock` or `ui/pnpm-lock.yaml` | **4.11**, 4.19 | | `crate/server/src/routes/aws_xks/**` or `azure_ekm/**` or `google_cse/**` or `ms_dke/**` | **4.12**, 4.10 | | `crate/hsm/**` | **4.13** | | `documentation/**` or `README.md` | **4.14** | | `ui/tests/e2e/**` | **4.16** | | `crate/crypto/build.rs` | **4.17** | | `**/Cargo.toml`, `supply-chain/**`, `deny.toml`, `.cargo/audit.toml`, `ui/package.json`, `crate/clients/wasm/package.json`, `**/requirements*.in`, `**/requirements*.txt`, `**/go.mod`, `**/go.sum`, `**/Dockerfile*`, `.github/dependabot.yml` (dependency added, bumped or re-sourced), or a submodule gitlink (`authentication`, `documentation/theme`, `kmip`, `test_data`, `.github/reusable_scripts`) | **4.19** | > **Instruction files are normative.** Every rule below except **4.8** has a corresponding > `.github/instructions/*.instructions.md` file with an `applyTo` frontmatter — that file is the > single source of truth for its checklist and auto-attaches when the agent edits a matching path. > This skill is the source of truth for the git-diff detection flow, the path→rule map, and the > heuristics no glob can express (like 4.8); it intentionally does not restate the checklists. Additional heuristic checks: - If any changed Rust file contains `#[cfg(feature = "non-fips")]` changes → add **4.8** - If `crate/clients/ckms/src/commands.rs` changed → add **4.15** - If `crate/server/src/start_kms_server.rs` changed → verify 4.1, 4.2, 4.8, 4.9 as applicable - If any changed file is in `crate/server/src/middlewares/`, `crate/server/src/core/operations/`, or `crate/crypto/src/` **and** the change fixes a security bug → remind: **update `SECURITY.md`** with a `COSMIAN-YYYY-NNN` entry (run `/security-review` to generate it) - If a changed file under `.github/workflows/`, `.github/actions/` or `.mise/` adds or changes a `uses:` reference, a tool install (`cargo install`, `go install`, `pip install`, `npm install -g`) or a `curl`/`wget` download → add **4.19** - Changed path matches no pattern in the table above and `omp-jev-tools` is installed (OMP only — not available in VS Code Copilot Chat, Copilot CLI, or Copilot Cloud Agent): call `jev_route` with `options` set to the sub-rule numbers from the table (one short description per rule) to get a candidate rule plus an ACT/CONFIRM/ESCALATE gate. Treat ACT as a candidate to verify manually before emitting it; treat CONFIRM or ESCALATE as a reason to ask the user which rule applies instead of guessing. Without the tool, ask the user directly. ## Step 3 — Emit the Applicable Checklist Output **only** the sub-rules that were triggered. For each, print the full checklist from the reference below. --- ## Sub-Rule Reference Full checklists live in `.github/instructions/`, which is normative and auto-attaches when the agent edits a matching path. This table is a rule-number → instruction-file index only. | Rule | Title | Trigger | Normative checklist | |---|---|---|---| | 4.1 | Server SPA routes ⇔ React Router ⇔ Menu items | `ui/src/**` (new page/action) | `ui-routes.instructions.md` | | 4.2 | REST endpoints ⇔ OpenAPI ⇔ Route registration | `crate/server/src/routes/**` | `routes.instructions.md` | | 4.3 | KMIP operations: types → dispatch → implementation | `crate/kmip/src/**`, `crate/server/src/core/operations/**` | `kmip-operations.instructions.md` | | 4.4 | CLI ⇔ Web UI feature parity | `crate/clients/clap/src/**`, `crate/clients/ckms/src/**`, `ui/src/actions/**` | `cli-ui-sync.instructions.md` | | 4.5 | WASM bindings ⇔ Web UI | `crate/clients/wasm/src/**` | `wasm.instructions.md` | | 4.6 | Server configuration ⇔ Wizard ⇔ TOML templates | `crate/server/src/config/**` | `server-config.instructions.md` | | 4.7 | Server wizard ⇔ Client wizard | `crate/server/src/config/wizard/**` | `server-config.instructions.md` | | 4.8 | Non-FIPS gating across the stack | heuristic: `#[cfg(feature = "non-fips")]` diff, not a path | kept in this skill — see below | | 4.9 | Auth middleware consistency | `crate/server/src/middlewares/**`, `crate/server/src/config/wizard/auth_wizard.rs` | `middlewares.instructions.md` | | 4.10 | Test vectors: directory → runner → README | `test_data/vectors/**`, `crate/test_kms_server/**` | `test-vectors.instructions.md` | | 4.11 | Nix vendor hashes ⇔ lock files | `Cargo.lock`, `ui/pnpm-lock.yaml` | `lockfile-hashes.instructions.md` | | 4.12 | Cloud provider integrations | `crate/server/src/routes/{aws_xks,azure_ekm,google_cse,ms_dke}/**` | `cloud-providers.instructions.md` | | 4.13 | HSM backend support | `crate/hsm/**` | `hsm.instructions.md` | | 4.14 | Documentation ⇔ mdBook ⇔ README | `documentation/**`, `README.md` | `docs.instructions.md` | | 4.15 | CLI documentation auto-generation | `crate/clients/ckms/src/**`, `crate/clients/clap/src/**` | `cli-ui-sync.instructions.md` | | 4.16 | E2E test documentation | `ui/tests/e2e/**` | `playwright.instructions.md` | | 4.17 | OpenSSL version updates | `crate/crypto/build.rs` | `openssl-build.instructions.md` | | 4.18 | Database schema/backend ⇔ docs | `crate/server_database/**` | `rust-database.instructions.md` (table-level detail: `database-tables.instructions.md`) | | 4.19 | Third-party dependencies ⇔ supply-chain gates (#1265) | dependency manifests and lock files, `supply-chain/**`, `**/Dockerfile*`, workflow `uses:`/tool installs, submodule bumps | `dependencies.instructions.md` | | 4.20 | Test KMS / Auth Verifier configs: complete fixtures in `test_data`, no partial inline configs | `test_data/configs/**`, `test_data/spire/config/**`, `.mise/**`, `crate/**/tests/**` | `test-configs.instructions.md` | ### Rule 4.8 — Non-FIPS gating across the stack > Triggered by: non-fips feature changes detected in diff (heuristic, not a path — no instruction > file exists because `applyTo` globs cannot match on diff content). - [ ] Server implementation — `#[cfg(feature = "non-fips")]` at **function/module level**, not inline - [ ] `crate/server/src/start_kms_server.rs` — scope wrapped in `#[cfg(feature = "non-fips")] { ... }` - [ ] `crate/server/src/core/operations/dispatch.rs` — dispatch arm gated if needed - [ ] CLI actions — `#[cfg(feature = "non-fips")]` on module or function - [ ] WASM bindings — `#[cfg(feature = "non-fips")]` on exported function - [ ] UI — menu items/routes hidden when FIPS mode active (`FIPS_MODE` env var) - [ ] E2E tests — `test.skip(FIPS_MODE, "non-fips only")` in Playwright specs - [ ] Test vectors — placed in `test_data/vectors/non-fips/` or runner gated with `#[cfg(feature = "non-fips")]`