chore: remove deprecated speckit/OMC/beads toolchain artifacts

[MacAttak]

Summary

• Remove all 15 speckit skill directories, stale config files (optimization-plan.md, skill-chains.json), and .specify/scripts/ and .specify/templates/ directories
• Update ~25 active docs, scripts, rules, and agent files to reference specwright commands (/sw-design, /sw-plan, /sw-build, /sw-verify, /sw-ship)
• Mark ADR-0042 (Linear-Beads traceability) as Superseded; clean beads/OMC references from config and specs

Acceptance Criteria

#	Criterion	Status	Evidence
AC-1	Speckit skill dirs removed	PASS	d14c276 — 15 dirs, 5354 lines deleted
AC-2	Stale files removed	PASS	d14c276 — optimization-plan.md, skill-chains.json, .specify/scripts/, .specify/templates/
AC-3	CLAUDE.md references specwright	PASS	f2d58d3 — Quick Start, Phases, Workflow sections updated
AC-4	Scripts reference specwright	PASS	f2d58d3 — session-recover + pre-pr-gate, syntax validated
AC-5	Rules and agent docs cleaned	PASS	b944185 — 9 files across .claude/rules/, agents/, skills/
AC-6	AGENTS.md references specwright	PASS	f2d58d3 — 8 speckit refs replaced
AC-7	TESTING.md references specwright	PASS	f2d58d3 — 3 occurrences via replace_all
AC-8	workflow-quickref.md rewritten	PASS	b944185 — removed 6 stale agents, all bd/speckit refs
AC-9	ADR-0042 marked Superseded	PASS	938265a — status + index + ADR-0046 cross-ref
AC-10	Config files cleaned	PASS	938265a — beads-sync removed from .specwright/config.json
AC-11	.omc/ refs removed from specs	PASS	938265a — 4f research + tasks, 13 analysis, 4e tasks
AC-12	Constitution template refs removed	PASS	b944185 — .specify/templates/ ref in constitution.md

Gate Results

Gate	Status	Findings (B/W/I)
gate-build	PASS	0/0/0
gate-tests	PASS	0/0/0
gate-security	PASS	0/0/0
gate-wiring	PASS	0/0/1
gate-spec	PASS	0/0/0

gate-wiring INFO: 8 orphaned permission entries in .claude/settings.local.json (gitignored) referenced deleted scripts — cleaned up locally.

Test plan

• 7,794 unit tests pass (zero regressions)
• 843 contract tests pass
• All 20 pre-push hooks pass (lint, format, mypy, bandit, import-linter, traceability, helm)
• grep -r '/speckit\.' CLAUDE.md AGENTS.md TESTING.md scripts/ .claude/rules/ .claude/agents/ returns zero matches
• grep -r 'oh-my-claudecode' .claude/ returns zero matches
• grep -r 'beads-sync' .specwright/config.json returns zero matches

🤖 Generated with Claude Code

[github-actions]

Claude finished @MacAttak's task —— View job

---

Security Review of PR #91 ✅

Completed comprehensive security analysis of all 53 changed files focusing on injection vulnerabilities, authentication/authorization, data exposure, cryptographic issues, input validation, and dangerous constructs.

Security Review Checklist

• Analyze configuration files for secrets/credentials
• Review script files for command injection risks
• Check for hardcoded keys or sensitive data
• Examine input validation in remaining code
• Look for dangerous constructs (shell=True, eval, etc.)
• Review authentication/authorization changes
• Document findings with severity levels

---

Security Findings: NO VULNERABILITIES DETECTED

✅ CLEAN - No security issues found in this PR

This PR consists primarily of cleanup activities (removing deprecated toolchain files and updating documentation references) with minimal security impact.

Detailed Analysis:

1. Configuration Files ✅ SECURE

• .specwright/config.json: Contains only build/test configuration, no secrets
• .specwright/state/workflow.json: Workflow metadata only, no sensitive data
• All API keys referenced properly as environment variables (non-hardcoded)

2. Shell Scripts ✅ SECURE

• scripts/pre-pr-gate: Uses proper bash practices

  • set -euo pipefail for error handling
  • Proper quoting of variables and file paths
  • No user input passed to shell commands
  • Input validation via jq for JSON parsing

• scripts/session-recover: Environment variable handling secure

  • API keys referenced as ${COGNEE_API_KEY:-} and ${OPENAI_API_KEY:-}
  • No shell injection vectors
  • Proper argument parsing and validation

3. Documentation Changes ✅ SECURE

• Updates to CLAUDE.md, AGENTS.md, TESTING.md contain no security concerns
• Removed references to deprecated toolchain components
• Updated workflow documentation with no security implications

4. File Deletions ✅ POSITIVE SECURITY IMPACT

• Removed 15 deprecated skill directories (5,354 lines of old code)
• Eliminated stale configuration files
• Reduced attack surface by removing unused components

5. Cross-File Security Patterns ✅ EXCELLENT

• No eval(), exec(), pickle.loads() usage detected
• No shell=True in subprocess calls
• No hardcoded secrets or credentials
• Proper use of environment variables for sensitive data
• All test fixtures use reference patterns (not actual secrets)

Security Best Practices Observed:

• ✅ SecretStr pattern used consistently for sensitive data
• ✅ Environment variables used for API keys
• ✅ Proper input validation in shell scripts
• ✅ Safe subprocess usage throughout codebase
• ✅ No dynamic code execution patterns

Remediation Required: NONE

This PR demonstrates excellent security hygiene and actually improves the overall security posture by reducing the codebase size and eliminating unused components.

---

[greptile-apps]

Greptile Summary

Large housekeeping PR that removes the deprecated speckit/OMC/beads toolchain and replaces it with Specwright (/sw-design, /sw-plan, /sw-build, /sw-verify, /sw-ship). Deletes 15 speckit skill directories (~5,300 lines), stale config files, and .specify/scripts/ + .specify/templates/ directories. Updates ~25 active docs, scripts, rules, and agent files to reference Specwright commands. Marks ADR-0042 as Superseded and adds the new .specwright/config.json.

• Deleted: 15 speckit skill dirs, optimization-plan.md, skill-chains.json, .specify/scripts/, .specify/templates/
• Updated: CLAUDE.md, AGENTS.md, TESTING.md, workflow-quickref.md, 2 scripts, 5 rules/agents, 4 spec files, 3 ADR files
• Added: .specwright/config.json with project config, gate definitions, and guardrails
• Issue found: scripts/pre-pr-gate still reads from .agent/quality-state.json with old field names — the error messages say "Run /sw-verify" but the state-checking logic hasn't been updated to read from the new Specwright state file. This may silently bypass the quality gate.
• Minor: One stale bd update reference in quality-escalation.md and two accidentally right-aligned markdown table columns in workflow-quickref.md
• Note: Many older spec files (e.g., specs/001-*, specs/2a-*, specs/3a-*) still contain speckit references — these appear to be historical records and were intentionally left unchanged per the PR scope

Confidence Score: 3/5

• Mostly safe documentation/config cleanup, but the pre-pr-gate script has a logic gap that could silently bypass quality checks.
• The bulk of changes are clean doc/config renames with no runtime code impact. However, scripts/pre-pr-gate still reads .agent/quality-state.json with legacy field names while its error messages were updated to say /sw-verify — if Specwright writes gates to .specwright/state/workflow.json instead, the quality gate is effectively a no-op. One missed bd update reference and minor markdown formatting issues bring it down slightly.
• Pay close attention to scripts/pre-pr-gate — the state file path and field names need to match wherever Specwright writes gate results.

Important Files Changed

Filename	Overview
scripts/pre-pr-gate	Error messages updated to reference /sw-verify, but the script still reads from the legacy .agent/quality-state.json path with old field names — may silently bypass quality gate if Specwright writes to .specwright/state/workflow.json instead. Also has an unused integration_check_passed variable.
scripts/session-recover	All speckit/bd references cleanly replaced with Specwright equivalents across phase context, skill listings, and epic auto-mode recovery.
CLAUDE.md	Quick Start, phases table, and workflow sections cleanly migrated from speckit commands to /sw-* equivalents.
AGENTS.md	All 8 speckit references replaced with specwright commands; development workflow and phase diagrams updated consistently.
TESTING.md	Three /speckit.test-review references replaced with /sw-verify; doc cross-reference updated to point to Specwright gate-tests.
.specwright/config.json	New Specwright config with project settings, commands, gates, git conventions, and guardrails. Clean, well-structured, no beads-sync or OMC references.
.specwright/state/workflow.json	Current work updated to toolchain-cleanup, docker-packaging-strategy moved to completed, gate notes stripped to findings-only, new work unit wu-12 added.
.claude/rules/skill-invocation.md	Specwright workflow table added, OMC Agent Integration section removed, skill chains updated to remove deprecated speckit chains.
.claude/rules/quality-escalation.md	Pre-PR reference updated from /speckit.test-review to /sw-verify, but one stale bd update reference remains on line 310.
docs/guides/workflow-quickref.md	Major rewrite from speckit-centric to Specwright-centric workflow. Two markdown table columns accidentally right-aligned. Content is comprehensive and well-organized.
docs/architecture/adr/0042-linear-beads-traceability.md	Status correctly changed from Accepted to Superseded with date and replacement note.
.claude/agents/test-debt-analyzer.md	Added missing tools field to agent frontmatter.

Flowchart

flowchart TD
    A["/sw-design"] --> B["/sw-plan"]
    B --> C["/sw-build"]
    C --> D["/sw-verify"]
    D -->|gates pass| E["/sw-ship"]
    D -->|findings found| F["Fix findings"]
    F --> D
    E --> G["PR Created"]

    subgraph "Quality Gates (gate-*)"
        D1["gate-build"]
        D2["gate-tests"]
        D3["gate-security"]
        D4["gate-wiring"]
        D5["gate-spec"]
    end

    D --> D1 & D2 & D3 & D4 & D5

    subgraph "State Files"
        S1[".specwright/state/workflow.json"]
        S2[".specwright/config.json"]
    end

    D1 & D2 & D3 & D4 & D5 -->|results written to| S1
    S2 -->|gate config| D

    subgraph "Pre-PR Hook"
        H["scripts/pre-pr-gate"]
        H2[".agent/quality-state.json ⚠️ legacy path"]
    end

    E -->|triggers| H
    H -->|reads| H2
    H2 -.->|should read| S1

Loading

_{Last reviewed commit: 50c0ff5}

[greptile-apps]

_{53 files reviewed, 5 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Additional Comments (3)

scripts/pre-pr-gate
Unused variable declaration

integration_check_passed is declared on line 63 but never assigned or used — it appears to be a leftover from before wiring_check_passed replaced it. The local declaration serves no purpose and may confuse future readers.

    local wiring_check_passed

Prompt To Fix With AI

This is a comment left during a code review.
Path: scripts/pre-pr-gate
Line: 63:63

Comment:
**Unused variable declaration**

`integration_check_passed` is declared on line 63 but never assigned or used — it appears to be a leftover from before `wiring_check_passed` replaced it. The `local` declaration serves no purpose and may confuse future readers.

```suggestion
    local wiring_check_passed
```

How can I resolve this? If you propose a fix, please make it concise.

---

scripts/pre-pr-gate
State file still reads legacy .agent/ path

The script reads quality state from .agent/quality-state.json with legacy field names (test_review_passed, wiring_check_passed, merge_check_passed). However, the PR description and workflow-quickref.md indicate quality gate results are now tracked in .specwright/state/workflow.json. The error messages were updated to say "Run /sw-verify" but the actual state-checking logic still looks for the old file and old fields.

If Specwright's /sw-verify writes gate results to .specwright/state/workflow.json (as shown in that file's gates section) rather than .agent/quality-state.json, this script will always fall through to "No quality state file found" and proceed with basic checks only — silently bypassing the quality gate.

Prompt To Fix With AI

This is a comment left during a code review.
Path: scripts/pre-pr-gate
Line: 20:20

Comment:
**State file still reads legacy `.agent/` path**

The script reads quality state from `.agent/quality-state.json` with legacy field names (`test_review_passed`, `wiring_check_passed`, `merge_check_passed`). However, the PR description and `workflow-quickref.md` indicate quality gate results are now tracked in `.specwright/state/workflow.json`. The error messages were updated to say "Run `/sw-verify`" but the actual state-checking logic still looks for the old file and old fields.

If Specwright's `/sw-verify` writes gate results to `.specwright/state/workflow.json` (as shown in that file's `gates` section) rather than `.agent/quality-state.json`, this script will always fall through to "No quality state file found" and proceed with basic checks only — silently bypassing the quality gate.

How can I resolve this? If you propose a fix, please make it concise.

---

.claude/rules/quality-escalation.md
Missed bd reference

This line still references bd update, a command from the deprecated toolchain. Other files in this PR have been updated to remove bd references — this one was missed.

3. **Record in session notes** via notepad or session memory

Prompt To Fix With AI

This is a comment left during a code review.
Path: .claude/rules/quality-escalation.md
Line: 310:310

Comment:
**Missed `bd` reference**

This line still references `bd update`, a command from the deprecated toolchain. Other files in this PR have been updated to remove `bd` references — this one was missed.

```suggestion
3. **Record in session notes** via notepad or session memory
```

How can I resolve this? If you propose a fix, please make it concise.

[MacAttak]

All three review findings addressed in 61c22ca (rebased to f497498):

1. Unused variable (pre-pr-gate:63): integration_check_passed → wiring_check_passed
2. Legacy state path (pre-pr-gate:20): Migrated from .agent/quality-state.json to .specwright/state/workflow.json and rewrote check_quality_state() to read the specwright gate structure (gates.<work-id>.<gate>.status)
3. Stale bd reference (quality-escalation.md:310): bd update → "notepad or session memory"