OSS Plan
Turn audit findings into a staged implementation plan that is ready to paste into a GitHub issue or PR description.
Context: $ARGUMENTS
Input Contract
- Primary input:
OSS_AUDIT.md.
- Optional input: user constraints, milestone boundaries, contributor capacity, or "only do P0/P1".
- Fallback: if
OSS_AUDIT.md is missing, derive a minimal audit summary from the repository and clearly label it as reconstructed.
Output Contract
Create or update OSS_PLAN.md in the repository root. The file must contain:
- Scope summary: what this hardening pass covers and excludes.
- A staged checklist that can be pasted into a GitHub issue or PR description.
- For every checklist item:
- Purpose
- Change points
- Acceptance criteria
- Suggested command(s)
- Estimated impact radius
- An explicit execution order with stop points.
Use this item shape exactly:
- [ ] Add CLI regression tests
Purpose: protect the main user flow before refactoring.
Change points: `tests/test_cli.py`, `src/cli.py`.
Acceptance criteria: happy-path and invalid-input flows pass locally and in CI.
Suggested commands: `python -m unittest`, `python src/cli.py --help`.
Estimated impact radius: low; test-only plus light CLI guard changes.
Also include a short "minimum shippable subset" section for contributors who only have one small PR available.
Non-goals
- Do not implement code changes in this step.
- Do not pad the plan with aspirational work unrelated to the audit.
- Do not turn one small repo improvement into a multi-quarter roadmap.
Workflow
Step 1: Read and normalize the audit
- Collapse duplicate findings.
- Merge recommendations that touch the same files or commands.
- Separate foundational work from follow-on polish.
Step 2: Build an execution order
Prefer this dependency order unless the repository clearly needs a different one:
- Safety and correctness
- Minimal structural refactor
- Tests and reproducibility seams
- CI
- Docs, licensing, and release metadata
Step 3: Write checklist items
Each item should be independently reviewable. If an item feels too big for one PR, split it.
Good checklist items are:
- file-specific
- command-aware
- acceptance-testable
- small enough to review
Step 4: Mark stop points
Add explicit pause points such as:
- Stop after refactor if behavior changed unexpectedly.
- Stop after tests if mocks are not trustworthy yet.
- Stop before CI if local commands still fail nondeterministically.
Anti-patterns
- Do not restate the audit verbatim; convert it into reviewable, actionable work items.
- Do not create checklist items without file paths, commands, and acceptance criteria.
- Do not mix launch blockers (
P0) with aspirational roadmap work in the same checklist tier.
- Do not create items so large they cannot fit in a single reviewable PR.
Self-check
Before declaring this stage complete, verify:
Failure Handling
- If the audit is incomplete, keep the plan narrow and call out the missing audit areas.
- If estimated impact is uncertain, say so and recommend a smaller first PR.
- If the repo has no runnable command, mark "establish reproducible local run command" as the first checklist item.
- If the repo lacks a chosen license or a public-safe sample path for data/model assets, treat that as a first-class blocker instead of burying it in polish work.
Done Criteria
OSS_PLAN.md exists and contains a scope summary, staged markdown checklist, execution order, explicit stop points, and a minimum shippable subset section.
- Every checklist item includes purpose, change points, acceptance criteria, suggested commands, and estimated impact radius.
- No item is so large it cannot fit in one reviewable PR.
1---2name: oss-plan3description: Convert an open-source hardening audit into an executable implementation plan. Use when the user says "turn this audit into a plan", "make a checklist", "write a GitHub issue", or wants a PR-ready checklist with acceptance criteria and commands for a software repo or paper-code release.4---56# OSS Plan78Turn audit findings into a staged implementation plan that is ready to paste into a GitHub issue or PR description.910## Context: $ARGUMENTS1112## Input Contract1314- Primary input: `OSS_AUDIT.md`.15- Optional input: user constraints, milestone boundaries, contributor capacity, or "only do P0/P1".16- Fallback: if `OSS_AUDIT.md` is missing, derive a minimal audit summary from the repository and clearly label it as reconstructed.1718## Output Contract1920Create or update `OSS_PLAN.md` in the repository root. The file must contain:21221. Scope summary: what this hardening pass covers and excludes.232. A staged checklist that can be pasted into a GitHub issue or PR description.243. For every checklist item:25 - Purpose26 - Change points27 - Acceptance criteria28 - Suggested command(s)29 - Estimated impact radius304. An explicit execution order with stop points.3132Use this item shape exactly:3334```markdown35- [ ] Add CLI regression tests36 Purpose: protect the main user flow before refactoring.37 Change points: `tests/test_cli.py`, `src/cli.py`.38 Acceptance criteria: happy-path and invalid-input flows pass locally and in CI.39 Suggested commands: `python -m unittest`, `python src/cli.py --help`.40 Estimated impact radius: low; test-only plus light CLI guard changes.41```4243Also include a short "minimum shippable subset" section for contributors who only have one small PR available.4445## Non-goals4647- Do not implement code changes in this step.48- Do not pad the plan with aspirational work unrelated to the audit.49- Do not turn one small repo improvement into a multi-quarter roadmap.5051## Workflow5253### Step 1: Read and normalize the audit5455- Collapse duplicate findings.56- Merge recommendations that touch the same files or commands.57- Separate foundational work from follow-on polish.5859### Step 2: Build an execution order6061Prefer this dependency order unless the repository clearly needs a different one:62631. Safety and correctness642. Minimal structural refactor653. Tests and reproducibility seams664. CI675. Docs, licensing, and release metadata6869### Step 3: Write checklist items7071Each item should be independently reviewable. If an item feels too big for one PR, split it.7273Good checklist items are:7475- file-specific76- command-aware77- acceptance-testable78- small enough to review7980### Step 4: Mark stop points8182Add explicit pause points such as:8384- Stop after refactor if behavior changed unexpectedly.85- Stop after tests if mocks are not trustworthy yet.86- Stop before CI if local commands still fail nondeterministically.8788## Anti-patterns8990- Do not restate the audit verbatim; convert it into reviewable, actionable work items.91- Do not create checklist items without file paths, commands, and acceptance criteria.92- Do not mix launch blockers (`P0`) with aspirational roadmap work in the same checklist tier.93- Do not create items so large they cannot fit in a single reviewable PR.9495## Self-check9697Before declaring this stage complete, verify:9899- [ ] `OSS_PLAN.md` exists in the repo root.100- [ ] It contains a scope summary, staged checklist, execution order, explicit stop points, and a minimum shippable subset section.101- [ ] Every checklist item includes purpose, change points, acceptance criteria, suggested commands, and estimated impact radius.102- [ ] No checklist item is so large it cannot plausibly fit in one reviewable PR.103104## Failure Handling105106- If the audit is incomplete, keep the plan narrow and call out the missing audit areas.107- If estimated impact is uncertain, say so and recommend a smaller first PR.108- If the repo has no runnable command, mark "establish reproducible local run command" as the first checklist item.109- If the repo lacks a chosen license or a public-safe sample path for data/model assets, treat that as a first-class blocker instead of burying it in polish work.110111## Done Criteria112113- `OSS_PLAN.md` exists and contains a scope summary, staged markdown checklist, execution order, explicit stop points, and a minimum shippable subset section.114- Every checklist item includes purpose, change points, acceptance criteria, suggested commands, and estimated impact radius.115- No item is so large it cannot fit in one reviewable PR.