Engineering plan review

Skill wfprieto/wcbs-build-kit/skills/engineering-plan-review

Use when reviewing implementation plans, architecture plans, refactor plans, migration plans, technical proposals, and APIVR Phase 2 blueprints for engineering soundness, risk, module boundaries, dependency direction, testability, operational readiness, and source-of-truth alignment before code changes begin.From its SKILL.md

Install

npx -y skills add wfprieto/wcbs-build-kit --skill engineering-plan-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.7 KB, as published. Nobody here has run it

Engineering Plan Review

Use this skill after skills/writing-plans/SKILL.md drafts a plan and before APIVR Phase 3 implementation begins.

<HARD-GATE> Do not approve a plan that cannot be executed and verified without inventing missing technical decisions. </HARD-GATE>

Review Order

Scope: objective, non-goals, acceptance criteria, and preserved behavior.
Architecture: source of truth, module boundaries, dependency direction, and data flow.
Testability: failing tests, characterization tests, contract tests, or evidence-first substitutes.
Risk: security, data integrity, migration, performance, cost, release, and rollback.
Operations: logs, metrics, health, retries, backfill, and incident recovery.
External integration gate: for provider callbacks, webhooks, OAuth/Auth redirects, cron routes, payments, email/SMS providers, or Preview/Production env splits, confirm skills/external-integration-launch-gate/SKILL.md was applied and route contracts exist.
20 Pass Protocol: for high-stakes plans, agent handoffs, source-file precise remediation, release instructions, or forensic audit outputs, confirm skills/20-pass-protocol/SKILL.md was applied or a compressed pass is justified.
Execution: exact files, commands, sequence, and stop conditions.

Decision Flow

flowchart TD
  A["Plan ready for review"] --> B{"Zero placeholders?"}
  B -- "No" --> X["Return to writing-plans"]
  B -- "Yes" --> C{"Architecture source of truth named?"}
  C -- "No" --> X
  C -- "Yes" --> D{"Test/evidence path proves behavior?"}
  D -- "No" --> X
  D -- "Yes" --> E{"Risk and rollback fit tier?"}
  E -- "No" --> F["Escalate APIVR tier or narrow scope"]
  E -- "Yes" --> G["Approve for APIVR Phase 3"]

Review Findings

Use this format:

Finding:
Severity: Blocking / Important / Advisory
APIVR phase affected:
Evidence state:
Required correction:

Worked Example

Scenario: A plan adds OAuth login.

Blocking finding: plan names provider setup but omits callback validation and state/nonce checks.
APIVR effect: security evidence remains Unknown; release gate C fails.
Required correction: add auth threat model, tests for invalid state, provider error handling, secret storage, and rollback to password login.
Verdict: return to Phase 2 until the evidence path is complete.

Scenario: A plan adds a Stripe webhook.

Blocking finding: plan tests the route handler directly but omits deployed provider delivery through middleware and deployment protection.
APIVR effect: release gates C, E, and H remain Unknown.
Required correction: add external integration launch gate route contract, middleware/layout/deployment-protection checks, provider dashboard replay, database proof, and log evidence.
Verdict: return to Phase 2 until the external-world evidence path is complete.