…g parallel landing

…ies + classifications (#260)

* feat(#257): /dfd skill — extract Data Flow Diagram with trust boundaries + classifications

Introduces /dfd as the canonical Data Flow Diagram producer. The DFD
becomes the source of truth for /threat-model and /compliance-check —
both refactored in this commit to consume from
projects/<name>/architecture/dfd.md instead of regenerating their own
data-flow views.

Six-axis discovery (external actors, processes, data stores, data
flows, trust boundaries, data classifications). Classifications detect
via three additive pathways: code annotations (@pii, @sensitive,
CLASSIFIED:), env-var heuristics (*_SECRET, *_TOKEN, EMAIL_*), and
schema-column heuristics (email, phone, card_number). An optional
explicit registry at docs/data-classification.{md,yaml} overrides
heuristic labels.

Two output formats: Mermaid markdown (default, renders inline on
GitHub, zero new toolchain) and OWASP Threat Dragon v2 JSON (on
--format=dragon, for visual editing in Threat Dragon). The Dragon
serialiser is a pure function over the in-memory model so #255
(/threat-model --format=dragon) can share or import it.

Multi-repo discovery via a new shared helper _lib-multi-repo-trace.sh
(intended to also be consumed by /process #256). Three resolvers:
mrt_resolve_target (hostname/URL/topic → registered project),
mrt_is_third_party (known SaaS vendor detection), mrt_workspace_for
(workspace clone path resolution).

The refactors of /threat-model and /compliance-check are surgical —
Step 1 of /threat-model now reads dfd.md and offers /dfd first if it
doesn't exist; Step 4 of /compliance-check reads the classifications +
external-services list from dfd.md for cross-border-transfer and DPA
detection. Output formats and audit-history persistence contracts in
both consumers are unchanged.

AgDR-0024 captures the design rationale: Mermaid as primary, Threat
Dragon as secondary; classifications as a first-class concept; the
single-source-of-truth refactor; the shared multi-repo trace helper.

Cross-PR coordination:
  - #255 (/threat-model --format=dragon) — shares the Threat Dragon
    serialiser; if #255 lands first with the serialiser inside
    /threat-model, this skill imports from there
  - #256 (/process) — shares the _lib-multi-repo-trace.sh helper; if
    /process extracted its own version first, the consumer that lands
    later should consolidate

Tests (.claude/skills/dfd/tests/smoke.sh, 52 assertions) cover all
three fixtures from the AC: single-service six-axis discovery,
cross-service trust-boundary detection, three-pathway classification
detection. Plus Mermaid generator output shape, Threat Dragon JSON
schema validation, and verification that /threat-model and
/compliance-check actually reference dfd.md.

Closes #257

* fix(#257): renumber AgDR to 0026 — #258 + #259 took 0024 + 0025 during parallel landing

* fix(#257): address Rex blockers — shellcheck SC2221/2222, MD032, lychee 404, AgDR refs

- _lib-multi-repo-trace.sh: drop redundant subset patterns in third-party detector
  (e.g. *api.amplitude.com* covered by broader *amplitude.com*) — clears SC2221/2222.
- dfd/SKILL.md: blank lines around Discovery + Classifications lists — clears MD032.
- dfd/SKILL.md: Threat Dragon schema link now points to the repo root (sub-path 404'd).
- AgDR cross-refs across 5 files renumbered 0024 → 0026 (renumber missed downstream).

---------

Co-authored-by: me2resh <ahmed.abdelaliem@gmail.com>

…ut (#259)

* feat(#256): /process skill — extract process from code, BPMN 2.0 output

- New skill at .claude/skills/process/SKILL.md that maps a named business
  process by scanning across seven discovery axes (explicit workflow defs,
  queue/job chains, cron triggers, state-column transitions, API
  choreography, existing BPMN/Mermaid, documented steps), interviews only
  on gaps, then emits a lint-clean BPMN 2.0 file the operator can open in
  Camunda Modeler.

- Anchor-scoped discovery (operator supplies process slug + entry point —
  endpoint / state machine / queue job / directory) with reachability
  bounding from the anchor. No exhaustive scans.

- Cross-repo traversal via apexyard.projects.yaml — when a handoff target
  matches a registered project, the skill recurses into that repo (offers
  to clone workspace/<name>/ if missing, default-yes). Unregistered
  targets render as external participant pools.

- generate-bpmn.sh emits valid BPMN 2.0 XML with bpmn:laneSet,
  bpmn:messageFlow for cross-pool handoffs, source citations via
  bpmn:documentation on every element. Pipes through `npx bpmn-auto-layout`
  for <bpmndi> coords; falls back to bare BPMN with warning when Node is
  missing.

- lint.sh wraps `bpmnlint` (recommended ruleset + label-required +
  no-disconnected + no-implicit-split) as the merge gate; overridable via
  per-project .bpmnlintrc.

- AgDR-0024 captures the seven sub-decisions: BPMN 2.0 over alternatives
  (DMN/CMMN/Mermaid sequence/raw flowchart), bpmn-auto-layout over manual
  coords, bpmnlint as the gate, read-first-then-ask over operator-only
  authoring, swimlanes-default vs pools-opt-in, registry-lookup vs
  heuristic URL matching, on-demand cloning offer vs black-box fallback.

- Three test scripts cover discovery (smoke.sh — 18 checks across all
  seven axes on a synthetic Express+Prisma+BullMQ+XState fixture),
  cross-repo registry lookup (test_cross_repo.sh — 6 checks), and BPMN
  emission edge cases (test_bpmn_emit.sh — 21 checks: special-char XML
  escaping, message flows, --pools mode, flow refs, xmllint validity).

- CLAUDE.md skill registry bumped to 44; docs/multi-project.md "How
  skills behave" table updated.

Closes #256

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(#256): renumber AgDR to 0025 — #258 took 0024 during parallel landing

* fix(#256): align AgDR-0025 frontmatter id (renumber missed YAML field)

---------

Co-authored-by: me2resh <ahmed.abdelaliem@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ies + classifications (#260)

* feat(#257): /dfd skill — extract Data Flow Diagram with trust boundaries + classifications

Introduces /dfd as the canonical Data Flow Diagram producer. The DFD
becomes the source of truth for /threat-model and /compliance-check —
both refactored in this commit to consume from
projects/<name>/architecture/dfd.md instead of regenerating their own
data-flow views.

Six-axis discovery (external actors, processes, data stores, data
flows, trust boundaries, data classifications). Classifications detect
via three additive pathways: code annotations (@pii, @sensitive,
CLASSIFIED:), env-var heuristics (*_SECRET, *_TOKEN, EMAIL_*), and
schema-column heuristics (email, phone, card_number). An optional
explicit registry at docs/data-classification.{md,yaml} overrides
heuristic labels.

Two output formats: Mermaid markdown (default, renders inline on
GitHub, zero new toolchain) and OWASP Threat Dragon v2 JSON (on
--format=dragon, for visual editing in Threat Dragon). The Dragon
serialiser is a pure function over the in-memory model so #255
(/threat-model --format=dragon) can share or import it.

Multi-repo discovery via a new shared helper _lib-multi-repo-trace.sh
(intended to also be consumed by /process #256). Three resolvers:
mrt_resolve_target (hostname/URL/topic → registered project),
mrt_is_third_party (known SaaS vendor detection), mrt_workspace_for
(workspace clone path resolution).

The refactors of /threat-model and /compliance-check are surgical —
Step 1 of /threat-model now reads dfd.md and offers /dfd first if it
doesn't exist; Step 4 of /compliance-check reads the classifications +
external-services list from dfd.md for cross-border-transfer and DPA
detection. Output formats and audit-history persistence contracts in
both consumers are unchanged.

AgDR-0024 captures the design rationale: Mermaid as primary, Threat
Dragon as secondary; classifications as a first-class concept; the
single-source-of-truth refactor; the shared multi-repo trace helper.

Cross-PR coordination:
  - #255 (/threat-model --format=dragon) — shares the Threat Dragon
    serialiser; if #255 lands first with the serialiser inside
    /threat-model, this skill imports from there
  - #256 (/process) — shares the _lib-multi-repo-trace.sh helper; if
    /process extracted its own version first, the consumer that lands
    later should consolidate

Tests (.claude/skills/dfd/tests/smoke.sh, 52 assertions) cover all
three fixtures from the AC: single-service six-axis discovery,
cross-service trust-boundary detection, three-pathway classification
detection. Plus Mermaid generator output shape, Threat Dragon JSON
schema validation, and verification that /threat-model and
/compliance-check actually reference dfd.md.

Closes #257

* fix(#257): renumber AgDR to 0026 — #258 + #259 took 0024 + 0025 during parallel landing

* fix(#257): address Rex blockers — shellcheck SC2221/2222, MD032, lychee 404, AgDR refs

- _lib-multi-repo-trace.sh: drop redundant subset patterns in third-party detector
  (e.g. *api.amplitude.com* covered by broader *amplitude.com*) — clears SC2221/2222.
- dfd/SKILL.md: blank lines around Discovery + Classifications lists — clears MD032.
- dfd/SKILL.md: Threat Dragon schema link now points to the repo root (sub-path 404'd).
- AgDR cross-refs across 5 files renumbered 0024 → 0026 (renumber missed downstream).

---------

Co-authored-by: me2resh <ahmed.abdelaliem@gmail.com>