HVE Core

HVE Core is an enterprise prompt engineering framework for GitHub Copilot. It consists of several component categories, most of which are non-executable artifacts. The security posture is characterized by strong automated controls (100% automated) across supply chain, code quality, access control, and vulnerability management.

Primary Components

1. Prompt Engineering Artifacts: Markdown files with YAML frontmatter (located in .github/instructions/, .github/prompts/, .github/agents/, and .github/skills/) consumed by GitHub Copilot. These contain no executable code.
2. PowerShell Scripts: Located in scripts/, these are used for linting, validation, and CI/CD automation. They do not make external network connections except for documented tool downloads.
3. GitHub Actions Workflows: Located in .github/workflows/, these handle PR validation, security scanning (CodeQL, dependency review), and release automation.
4. VS Code Extension: Located in extension/, containing packaging configuration and the extension manifest. It does not collect telemetry or data.
5. Mural Skill Runtime: Located in .github/skills/experimental/mural/. This is a Python CLI and embedded stdio MCP server. Unlike other components, it executes locally, manages OAuth tokens via an OS keyring or an encrypted file fallback (mode 0600), and performs outbound HTTPS requests to the Mural REST API.

The Azure DevOps integration provides several types of artifacts to automate engineering workflows directly from VS Code:

Chat Agents

Specialized agents for complex orchestration tasks:

• ado-backlog-manager: Orchestrates triage, discovery, sprint planning, and PRD-to-work-item conversion.
• ado-prd-to-wit: Analyzes PRDs to plan Azure DevOps work item hierarchies.
• rpi-planner: Manages RPI plan phases within shared planning artifacts.
• rpi-researcher: Executes RPI research lanes and writes evidence.

Prompts

Conversational triggers for specific tasks:

• ado-add-work-item: Create a single work item with field collection.
• ado-create-pull-request: Create a PR with descriptions, linked items, and reviewers.
• ado-discover-work-items: Search or analyze artifacts to find work items.
• ado-get-build-info: Retrieve build status and logs.
• ado-get-my-work-items: Retrieve assigned work items into a planning file.
• ado-process-my-work-items-for-task-planning: Generates task-planning-logs.md handoff files.
• ado-sprint-plan: Plans sprints by analyzing capacity and backlog gaps.
• ado-triage-work-items: Classifies fields and detects duplicates.
• ado-update-wit-items: Updates work items from planning files.

Instructions

Workflow definitions and protocols:

• ado/ado-backlog-sprint: Sprint planning workflow.
• ado/ado-backlog-triage: Triage workflow.
• ado/ado-create-pull-request: PR creation protocol.
• ado/ado-get-build-info: Build information retrieval.
• ado/ado-interaction-templates: Formatting templates for descriptions and comments.
• ado/ado-update-wit-items: Work item creation/update protocol using MCP ADO tools.
• ado/ado-wit-discovery: Discovery via assignment or artifact analysis.
• ado/ado-wit-planning: Planning files, templates, and search protocols.
• shared/hve-core-location: Fallback guidance for locating missing assets.

Skills

Functional capabilities:

• pr-reference: Generates PR reference XML with commit history and unified diffs.
• rpi-plan: Creates evidence-based RPI plans.
• rpi-plan-critique: Read-only assessment of RPI plans.
• rpi-research: Gathers task evidence and writes to .copilot-tracking/research/.

The Project Planning collection includes specialized Chat Agents designed to guide users through structured engineering and planning workflows. These agents handle specific domains such as accessibility, architecture, requirements, security, and privacy, often producing structured outputs like evidence registers, risk classifications, or backlog handoffs.

Key Agents include:

• accessibility-planner: Guides WCAG 2.2, ARIA APG, and Section 508 planning.
• adr-creation: A phase-gated creator for Architecture Decision Records (ADRs).
• agile-coach: Refines user stories and acceptance criteria.
• brd-builder / prd-builder: Guided builders for Business and Product Requirements Documents.
• rai-planner: Evaluates against NIST AI RMF 1.0 for Responsible AI.
• security-planner: Produces security models and standards mappings.
• sssc-planner: Assesses repository supply chain security (OpenSSF, SLSA, etc.).
• rpi-agent: Coordinates the Research, Plan, Implement, Review, and Follow-up lifecycle.

The hve-core-all plugin provides a comprehensive collection of specialized chat agents, workflows, and conventions. These artifacts cover various domains including:

• Mural (Experimental): Seeding patterns, writeback hygiene, and asymmetric writing styles.
• GitHub & Jira: Full backlog lifecycles including discovery, planning, triage, and execution/update workflows.
• Project Planning: Architecture Decision Record (ADR) authoring via the ADR Creator, including identity management, handoff protocols, and standards (MADR v4.0.0).
• Security & Privacy: Specialized planners (Security, Privacy, SSSC) using six-phase orchestration, and VEX (Vulnerability Exploitability eXchange) generation rules.
• Responsible AI (RAI): RAI Planner identity and license posture mapping.
• Core Engineering Standards: Commit message formats, Git merge/rebase workflows, Markdown authoring, and Pull Request generation.
• Office Integration: PowerPoint Builder conventions.

The Jira integration provides a suite of agents, prompts, instructions, and a Python skill to manage Jira workflows (discovery, triage, execution, and planning) directly from VS Code.

Chat Agents

• jira-backlog-manager: Orchestrates discovery, triage, execution, and single-issue actions.
• jira-prd-to-wit: Analyzes PRDs and plans Jira issue hierarchies (read-only; does not mutate Jira).

Prompts

• jira-discover-issues: Discovers issues via queries, artifact analysis, or JQL and produces planning files.
• jira-execute-backlog: Executes plans by creating, updating, transitioning, and commenting on issues from a handoff file.
• jira-prd-to-wit: Analyzes PRD artifacts to plan hierarchies without mutating Jira.
• jira-setup: An interactive, non-destructive assistant for configuring Jira credentials.
• jira-triage-issues: Recommends fields and detects duplicates for triage.

Skills

• jira: Provides access to the Jira REST API for searching (JQL), inspecting, creating, updating, transitioning, and commenting on issues, as well as discovering required fields.

The HVE Core repository includes a wide range of specialized artifacts (agents/skills) designed for engineering, accessibility, security, and product management workflows. These artifacts can be categorized into several functional domains:

Accessibility

• accessibility-framework-assessor: Assesses accessibility framework scopes and returns structured findings.
• accessibility-planner: A phase-based planner for WCAG 2.2, ARIA APG, Cognitive Accessibility, Section 508, and EN 301 549.
• accessibility-reviewer: Orchestrates codebase profiling and accessibility findings reporting.
• accessibility-surface-inventory: Discovers runtime surfaces and interaction states to emit accessibility runtime configs.
• code-review-accessibility: A subagent for reviewing precomputed diffs for accessibility conformance.

Code Review & Engineering

• code-review: A human-gated orchestrator that scopes hotspots and merges findings from various perspective subagents.
• code-review-explainer: Answers factual symbol or function questions.
• code-review-functional: Reviews diffs for functional correctness.
• code-review-pr: Turns diffs into factual walkthroughs.
• code-review-readiness: Reviews PR deliverable readiness and non-code documentation.
• code-review-security: Reviews diffs for security issues.
• code-review-standards: Reviews diffs against project coding standards.
• code-review-walkback: Activates rpi-research for bounded investigations.
• codebase-profiler: Scans repositories to build technology profiles.
• adr-creation: Produces Architecture Decision Records (ADRs).

Security & Vulnerability Management

• cve-analyzer: Performs deep exploitability analysis and determines VEX status.
• finding-deep-verifier: Performs adversarial verification of FAIL and PARTIAL findings.
• codebase-profiler: Selects applicable security skills based on the technology profile.

Product & Project Management

• ado-backlog-manager: Orchestrates Azure DevOps (ADO) for triage, planning, and execution.
• ado-prd-to-wit: Analyzes PRDs to plan ADO work item hierarchies.
• github-backlog-manager: Orchestrates GitHub backlog management.
• agile-coach: Refines user stories and acceptance criteria.
• brd-builder: Builds Business Requirements Documents (BRDs).
• brd-quality-reviewer: Reviews BRD quality using BRD_STANDARD_FINDINGS_V1 and BRD_QUALITY_REPORT_V1 payloads.

Data, Design & Documentation

• gen-data-spec: Generates data dictionaries and machine-readable profiles.
• gen-jupyter-notebook: Creates EDA Jupyter notebooks.
• gen-streamlit-dashboard: Develops multi-page Streamlit dashboards.
• documentation: Orchestrates documentation audit, drift, and validation.
• dt-coach: Guides teams through the 9-method Design Thinking framework.
• experiment-designer: Coaches the design of Minimum Viable Experiments (MVE).

HVE Core enforces dependency pinning to mitigate supply chain attacks. Every dependency reference must resolve to a specific, immutable version. The Test-DependencyPinning.ps1 scanner validates these references during CI and produces SARIF reports for GitHub code scanning.