相关职业SOC
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CleanExpo/Unite-Group --skill definition-of-done-builder命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
基于 SOC 职业分类
| id | definition-of-done-builder |
| name | definition-of-done-builder |
| type | Capability Uplift |
| version | 1.0.0 |
| created | 20/03/2026 |
| modified | 20/03/2026 |
| status | active |
| triggers | ["what does done mean","define done","what needs to be true","when is it finished","what are the success criteria","build a definition of done","what criteria","acceptance criteria"] |
| description | > |
Purpose: Transform vague outcome language into measurable, verifiable DoD criteria. Every criterion must be binary: either PROVEN or not. No "mostly done."
Use this skill when:
Do NOT use this skill for:
Map the goal to one or more of these production categories:
| Category | Scope |
|---|---|
| Frontend | Pages, components, auth flows, responsiveness, visual quality |
| Backend | API endpoints, health checks, auth middleware, error handling |
| Data / Security | Database, migrations, backups, CORS, rate limiting, JWT |
| Payments | Provider mode, webhooks, test transactions, refund flow |
| Integrations | Third-party APIs, email, webhooks |
| Deployment | CI/CD, SSL, DNS, rollback |
| Business | Support, legal, analytics, monitoring |
| Visual | Design system compliance, screenshot proof |
For each relevant category, write criteria as binary statements:
Format: □ [Verb] [measurable condition] — Proof: [exact artifact]
Examples (good):
□ Production URL responds with HTTP 200 — Proof: curl -I output□ Test suite passes with 0 failures — Proof: pytest/vitest output□ No rounded-lg classes in component — Proof: grep search outputExamples (bad — rejected):
□ The UI looks nice (not measurable)□ Tests are passing (no proof specified)□ It works (not binary)For each criterion, assign status based on current evidence:
| Status | Meaning | Required |
|---|---|---|
PROVEN | Evidence exists and has been verified | Proof artifact on file |
UNKNOWN | Not yet verified — could be true or false | Must verify before claiming done |
MISSING | Confirmed absent or broken | Must fix before claiming done |
For every UNKNOWN item, specify:
UNKNOWN — requires: [exact command or action to verify]
Example:
UNKNOWN — requires: curl -I https://production-url.com
UNKNOWN — requires: Run pnpm test and capture full output
UNKNOWN — requires: Screenshot of production login flow
DEFINITION OF DONE
═══════════════════════════════════════════════════
Goal: [restated goal]
Scope: [categories included]
FRONTEND
─────────
□ [criterion] — PROVEN | Proof: [artifact]
□ [criterion] — UNKNOWN | requires: [action]
□ [criterion] — MISSING | Fix: [remediation]
BACKEND
─────────
□ [criterion] — PROVEN | Proof: [artifact]
...
[CONTINUE FOR EACH RELEVANT CATEGORY]
SUMMARY
─────────
PROVEN: [N] criteria
UNKNOWN: [N] criteria — must verify
MISSING: [N] criteria — must fix
GATE: ALL criteria must be PROVEN before completion can be claimed.
═══════════════════════════════════════════════════
Before outputting the DoD:
pnpm test and capture output")| Failure | Recovery |
|---|---|
| Goal is too vague to categorise | Ask: "What does success look like for a user?" |
| Criteria are subjective | Rewrite as binary observable outcomes |
| Proof artifact is vague | Specify exact command, file path, or screenshot requirement |
| Too many criteria (> 30) | Split into Phase 1 (critical) and Phase 2 (nice-to-have) |
Input: "The auth flow is done"
Output:
DEFINITION OF DONE
═══════════════════════════════════════════════════
Goal: Authentication flow complete
Scope: Frontend, Backend, Security
FRONTEND
─────────
□ Login page renders without console errors — UNKNOWN | requires: Browser screenshot + console log
□ Login form submits and redirects to dashboard — UNKNOWN | requires: Playwright test run
□ Logout clears JWT cookie and redirects to login — UNKNOWN | requires: Browser network tab screenshot
BACKEND
─────────
□ POST /api/auth/login returns 200 with JWT — UNKNOWN | requires: curl -X POST output
□ Invalid credentials return 401 — UNKNOWN | requires: curl with wrong password output
□ Protected routes reject requests without JWT — UNKNOWN | requires: curl without Authorization header output
SECURITY
─────────
□ JWT secret is not the default value — UNKNOWN | requires: Check JWT_SECRET_KEY env var
□ Token expiry is set to <= 60 minutes — UNKNOWN | requires: Check JWT_EXPIRE_MINUTES env var
□ Rate limiting active on /api/auth/login — UNKNOWN | requires: 10 rapid requests + response log
SUMMARY
─────────
PROVEN: 0 criteria
UNKNOWN: 9 criteria — must verify
MISSING: 0 criteria
GATE: ALL criteria must be PROVEN before auth flow can be claimed complete.
═══════════════════════════════════════════════════
Input: "Is auth done?" Output: "The auth looks complete, tests are passing."
Reason rejected: No criteria listed, no proof artifacts, vague summary.
The authoritative environment-variable registry for the Unite-Group Nexus. Use whenever adding, reading, renaming, or debugging an env var or secret — new integration config, a `process.env.X` read, an auth/OAuth wiring, a cron secret, a "which variable holds this" question, or a "works locally but not in prod" symptom. Also use before pinning any variable name in code, and when reconciling the two credential planes (Vercel prod vs the local hermes fleet). Prevents the `APIFY_API_KEY` vs `APIFY_API_TOKEN` class of drift.
Create, verify, and promote Supabase schema changes via database branches. Every schema change/migration must be validated on a Supabase database branch before prod (see CLAUDE.md line 44).
Verify production Supabase schema before shipping code that touches it. Use BEFORE writing or reviewing ANY code that reads or writes a Supabase table in the Nexus — new queries, inserts, updates, CHECK-constrained values, RLS-dependent reads, cron data access — even one-line changes and even when the table "obviously" exists. Also use immediately when a query fails with "column does not exist", when inserts appear to succeed but produce no rows, or when generated TypeScript types disagree with runtime behaviour.