|
| 1 | +--- |
| 2 | +name: rubric-audit |
| 3 | +description: Audit a Go CLI against the 37signals CLI rubric |
| 4 | +--- |
| 5 | + |
| 6 | +# CLI Rubric Audit |
| 7 | + |
| 8 | +Audit a Go CLI repository against the 37signals CLI rubric (RUBRIC.md). |
| 9 | + |
| 10 | +## Usage |
| 11 | + |
| 12 | +Run this skill in the root of a Go CLI repository to produce a gap report. |
| 13 | + |
| 14 | +## Audit Process |
| 15 | + |
| 16 | +### 1. Identify the CLI |
| 17 | + |
| 18 | +- Find the main binary (check `cmd/` directory or Makefile) |
| 19 | +- Build it: `make build` or `go build ./cmd/<name>` |
| 20 | +- Determine the profile: API CLI (wraps a web API) or TUI tool (full-screen interface) |
| 21 | + |
| 22 | +### 2. Check Tier 1: Agent Contract |
| 23 | + |
| 24 | +#### 1A. Structured Output (API CLI only) |
| 25 | +- [ ] Run `<cli> --help` — does `--json` flag exist? |
| 26 | +- [ ] Pipe a command: `<cli> <cmd> | cat` — does it output JSON automatically? |
| 27 | +- [ ] Run with `--json`: verify `{ok: true, data: ...}` envelope |
| 28 | +- [ ] Run invalid command: verify `{ok: false, error: ..., code: ...}` envelope |
| 29 | +- [ ] Check for `--quiet`, `--agent`, `--ids-only`, `--count`, `--markdown` flags |
| 30 | +- [ ] Grep for `json.Decoder.UseNumber` or `json.Number` in output code |
| 31 | + |
| 32 | +#### 1B. Exit Codes |
| 33 | +- [ ] Run with bad args: should exit 1 |
| 34 | +- [ ] Access nonexistent resource: should exit 2 |
| 35 | +- [ ] Run without auth: should exit 3 |
| 36 | +- [ ] Check error types in code: look for typed error constructors |
| 37 | + |
| 38 | +#### 1C. Programmatic Discovery (API CLI only) |
| 39 | +- [ ] Run `--help --agent`: should emit structured JSON |
| 40 | +- [ ] Check responses for breadcrumbs |
| 41 | +- [ ] Look for `commands --json` or catalog command |
| 42 | + |
| 43 | +#### 1D. Authentication |
| 44 | +- [ ] Check for `APP_TOKEN` env var support |
| 45 | +- [ ] Check for keyring usage (go-keyring dependency) |
| 46 | +- [ ] Check for file fallback with 0600 perms |
| 47 | +- [ ] Check for token refresh logic |
| 48 | + |
| 49 | +### 3. Check Tier 2: Reliability |
| 50 | + |
| 51 | +#### 2A. Surface Stability |
| 52 | +- [ ] `--version` flag exists and shows version/commit/date |
| 53 | +- [ ] Surface snapshot script or tool exists |
| 54 | +- [ ] CI runs surface compat check |
| 55 | + |
| 56 | +#### 2B. Resilience |
| 57 | +- [ ] Grep for retry/backoff logic |
| 58 | +- [ ] Check for 429/rate limit handling |
| 59 | + |
| 60 | +#### 2C. Configuration |
| 61 | +- [ ] Check config loading order (flag > env > file) |
| 62 | +- [ ] Check for HTTPS enforcement |
| 63 | +- [ ] Check for XDG directory usage |
| 64 | + |
| 65 | +### 4. Check Tier 3: Agent Integration (API CLI only) |
| 66 | + |
| 67 | +- [ ] Check for SKILL.md and go:embed |
| 68 | +- [ ] Check for .claude-plugin/ directory |
| 69 | +- [ ] Check for --limit, --all flags on list commands |
| 70 | +- [ ] Check for --verbose, APP_DEBUG |
| 71 | + |
| 72 | +### 5. Check Tier 4: Distribution & Ecosystem |
| 73 | + |
| 74 | +- [ ] Check for .goreleaser.yaml |
| 75 | +- [ ] Check for Homebrew tap |
| 76 | +- [ ] Check for e2e tests |
| 77 | +- [ ] Check for golangci-lint config |
| 78 | +- [ ] Check for CONTRIBUTING.md, AGENTS.md |
| 79 | + |
| 80 | +## Output Format |
| 81 | + |
| 82 | +Produce a scorecard: |
| 83 | + |
| 84 | +``` |
| 85 | +## Scorecard: <CLI Name> |
| 86 | +
|
| 87 | +| Tier | Score | Max | |
| 88 | +|------|-------|-----| |
| 89 | +| T1: Agent Contract | X/21 | 21 | |
| 90 | +| T2: Reliability | X/14 | 14 | |
| 91 | +| T3: Agent Integration | X/9 | 9 | |
| 92 | +| T4: Distribution | X/19 | 19 | |
| 93 | +| **Total** | **X/63** | **63** | |
| 94 | +
|
| 95 | +### Critical Gaps |
| 96 | +1. [Most impactful gap] |
| 97 | +2. [Second gap] |
| 98 | +... |
| 99 | +
|
| 100 | +### Recommended Priority |
| 101 | +1. [First thing to fix — highest leverage] |
| 102 | +2. [Second] |
| 103 | +... |
| 104 | +``` |
0 commit comments