okf-pro 1.0.0

data/lib/okf/pro/template/gem/.claude/skills/okf-pro/guides/board.md

@@ -0,0 +1,55 @@
+# Board anatomy
+
+`board.md` is the only cross-work view: the entire commitment surface
+on one bounded page. Sections, in this order:
+
+* **In flight** — one *next-action* line per demand. One line, not the
+  list: the full outstanding list stays in the project's own
+  `index.md`, because a board that carries every step is a project plan
+  wearing a board's clothes, and it stops being readable at a glance.
+* **Backlog** — captured, real, and not started. No next action yet;
+  writing one is part of promoting it.
+* **Waiting** — who / what / when asked / chase date, the last written
+  literally as `chase YYYY-MM-DD`. This is the class
+  that rots silently: nothing here fails loudly, it just quietly never
+  arrives, and the chase date is the only thing standing between a
+  dependency and a month of drift.
+* **Inbox** — dated capture lines — `- YYYY-MM-DD — <the words you
+  heard>` — five seconds each, with an optional one-sentence gist. Not a filing
+  decision — capture is cheap precisely because it defers filing.
+  Conflict lines from Rule 1 (in [SKILL.md](../SKILL.md)) live here too:
+  an unsettled contradiction is undifferentiated work until someone
+  triages it.
+* **To read** — documents shared with you. Reading *is* the action, and
+  only reading takes the line away; a briefing an agent summarised is
+  not read, and its line stays.
+* **Deadlines** — dates in the world, one per line, the date first:
+  `- YYYY-MM-DD — <what lands>`. They arrive whether or not anyone
+  acts, so they sit explicitly outside the pipeline and outside the cap.
+
+The dates are grammar, not style, and so is the bullet. Board lines
+start `- ` at column zero — a `*` bullet or an indented dash is a line
+no counter can see, including the cap. The counters read exactly three
+date shapes — a leading `- YYYY-MM-DD` on Inbox and Deadlines lines, a
+literal `chase YYYY-MM-DD` on Waiting lines — and a date in any other
+spelling parses to nothing. Rather than let any of that count as a
+quiet zero (a deadline the 7-day warning cannot see is a deadline that
+lands unclaimed), the audit and the stop gate flag the unreadable line.
+HTML comments are not board content when they keep to their place: a
+comment is `<!-- ... -->` balanced on one line, anywhere on the line,
+and a longer note is a stack of single-line comments. Any `<!--`
+without its `-->` on the same line hides nothing and is flagged —
+comment-intended text must not feed the counters in silence.
+
+A section earns its own file only when it stops being bounded (it no
+longer fits on the page) or stops flowing (lines arrive and never
+leave). Until then: one page, atomic edits, and `git log board.md` is
+the state timeline nobody had to maintain.
+
+The board is state, not a concept — but OKF exempts only `index.md` and
+`log.md` from the frontmatter rule, so it carries a minimal block with
+`type: Board`. That is the ninth type, and its reason is exactly this:
+the format requires a declaration, and the board is none of the other
+eight. Read the frontmatter as a conformance receipt; the page below it
+is the whole point.
+

data/lib/okf/pro/template/gem/.claude/skills/okf-pro/guides/closing.md

@@ -0,0 +1,21 @@
+# Closing a piece of work — four moves, none of them moves a file
+
+First, extract the durable part to `learnings/` or `glossary/` — this
+is the moment that habit fires, or the lesson is archived with the work
+and relearned later at full price. Second, mark the project's own
+`index.md` closed on its first line, with the date right after the
+word, separated only by spaces, a colon, a dash (`-`, `–`, `—`),
+asterisks, or an opening parenthesis — these exact forms count:
+`# Title — closed 2026-08-12` · `Closed: 2026-05-01` ·
+`**Closed** 2026-08-12` · `closed (2026-08-12)`. A sentence is not a
+marker ("closed the deal on 2026-08-05", "not closed: 2026-08-12", and
+"we closed, 2026-01-05, the books" all leave the project open), and
+neither is `_closed_` in underscores, which glue to the word.
+<!-- rule: okf-pro-closure-marker -->
+Third, remove its board lines — closure is the one event that takes
+lines away wholesale.
+Fourth, a dated `log.md` entry. The directory stays exactly where it
+is: shared-layer concepts cite into `projects/`, and a move breaks
+every citation to buy a tidiness nobody asked for. Lifecycle is
+metadata; location is filing.
+

data/lib/okf/pro/template/gem/.claude/skills/okf-pro/guides/frontmatter.md

@@ -0,0 +1,73 @@
+# Frontmatter policy
+
+| Field | Who writes it | When | Meaning |
+|-------|---------------|------|---------|
+| `generated: {by, at}` | An agent | At creation, always | A machine produced this. It has not been checked. |
+| `verified:` (a list) | **The owner's decision** — the agent may hold the pen | Only after actually reading | Who confirmed this, and when. |
+| `stale_after:` | Whoever files the concept | At creation, per the table below | The day this becomes stale — `today >= stale_after`, inclusive. Reports; never gates. |
+| `sources:` | Whoever files the concept | Whenever a claim came from somewhere else | What this was derived from, and the key each claim is attributed through. |
+| `status:` | Whoever settles a collision | On supersession | `draft`, `stable` (the default, so it may be left off), or `deprecated`. |
+
+Write concepts with Edit or Write, never with a shell redirect: the
+trust guards read the tool event, and a `Bash` command carries no file
+path and no added text for them to see. A shell command that looks like
+it writes markdown into the bundle is routed to the owner instead, and
+the commit door asks git directly whether a past journal day changed —
+whoever wrote it.
+
+Both fields name an **actor**, in one of three forms: `<producer>/<version>`
+for an agent, `human:<id>` for a person, `process:<id>` for an automated
+check. The form is not decoration — the trust tier is read off it. A
+`verified` entry whose `by` is a `human:` actor makes the concept
+**human-reviewed**; entries by anything else make it **machine-confirmed**;
+no `verified` key at all is **unverified**. The To-read line is cleared by
+human review and by nothing else, so a nightly process confirming a briefing
+does not discharge the owner's read.
+
+```yaml
+generated: { by: claude/opus-5, at: 2026-08-15T09:12:00Z }
+verified:
+  - { by: human:rod, at: 2026-08-15T18:40:00Z }
+```
+
+Write `verified` as a list, or as one bare `{ by, at }` mapping — those are
+the two shapes the reader accepts. A **scalar** (`verified: human:rod`, or a
+bare date) is not one of them, and it fails in the worst possible direction:
+the guard fires on the word, so the write is routed to you for approval, and
+then the reader drops the malformed value, the tier stays unverified, and the
+To-read line is demanded forever. `okf validate` says so — *verified should be
+a mapping or a list of mappings* — and the gate now surfaces that warning
+rather than discarding it.
+
+Concepts an agent authors carry `generated:` from creation. `verified:`
+records **the owner's decision**, made only after actually reading —
+for a briefing, the same event that removes its To-read line. The agent
+may scribe the block, but the hooks turn that write into an explicit
+owner approval, and the approval is the attestation; unattended, with
+nobody to approve, the write is refused. Absent `verified:` on a
+`generated:` concept is not a defect to be tidied away; it is the
+truth.
+
+Staleness windows — owned by `/areas/corpus.md`, operative here. To
+change a window: record the decision in `/areas/corpus.md` first, then
+update this table, then a dated `log.md` line — in that order, so the
+bundle's own standard never lags the rule being applied:
+
+| Type | `stale_after:` |
+|------|----------------|
+| Briefing | source date + 90d |
+| Term | + 180d |
+| Finding, when it reports measured external figures | + 90d |
+| Learning, Decision, Journal Entry, Transcript, Overview | none |
+
+Records don't decay; claims do. A journal entry is true forever — it
+says what happened on a day. A briefing about someone else's pricing is
+a claim about the world, and the world moves.
+
+`okf lint .okf --only expired` is what answers *what has gone stale?*,
+and the boundary is the format's rather than this bundle's: a concept
+is stale when the day arrives, inclusive. It reports at `info` and
+never gates — a date passes on the calendar, not on a change, so a gate
+here would fail a morning nobody chose and the only available fix would
+be to falsify a date.
+

data/lib/okf/pro/template/gem/.claude/skills/okf-pro/guides/okf-rules.md

@@ -0,0 +1,25 @@
+# OKF rules
+
+* Every `.md` except `index.md` and `log.md` carries YAML frontmatter
+  with a non-empty `type`, `title` and `description`.
+* Directory `index.md` files carry **no** frontmatter and list every
+  concept in their directory. The root `index.md` carries `okf_version`
+  and nothing else — `okf_version: "0.2"`.
+* One concept per file.
+* Links are absolute and bundle-relative: `/reference/thing.md`.
+* After any change: update the directory index and add a dated `log.md`
+  entry.
+* **Do not run `okf validate` and `okf lint` after every edit.** The
+  gates run themselves — the PostToolUse hook runs both, in process, on
+  every Edit and Write, and refuses with what they found. Running them
+  by hand afterwards re-reads a bundle that has already been read and
+  re-answers a question already answered. Run them when you need the
+  *detail behind a refusal*, or when you edited outside the agent's
+  tools; otherwise the gate has it.
+* The gates are also runnable by hand when you want the answer before
+  the refusal: `okf pro audit .` runs every invariant at once, `okf pro
+  state .` says what is on the board, `okf pro unverified .` lists what
+  still awaits the owner's read, and `okf pro snapshot .` computes the
+  day's line. None of those writes anything.
+* Scratch work goes under `.tmp/` at the repository root, outside the
+  bundle entirely.

data/lib/okf/pro/template/gem/.githooks/pre-commit

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# The commit-time door — second of three, between the hooks (agent-time) and
+# CI (push-time). It exists for the edit the other two never see: a change made
+# in your own editor and committed from your own shell.
+#
+# Same contract as .claude/hooks/run: everything it can detect, it refuses
+# loudly. A gate that waves a commit through because its checker is missing has
+# converted "unchecked" into "checked and fine".
+#
+# What gets audited is the STAGED tree, not the worktree. They differ in both
+# directions, and each direction was a hole: stage a broken edit, fix the
+# worktree without re-adding, and a worktree audit passes the broken commit;
+# stage a clean edit next to an unrelated dirty file, and a worktree audit
+# refuses a commit that is fine. The staged tree is what the commit will
+# contain, so it is the only thing worth asking about.
+#
+# One-time setup per clone (hooks do not travel with a checkout):
+#   git config core.hooksPath .githooks
+set -u
+
+root="$(git rev-parse --show-toplevel)" || exit 1
+
+if ! command -v okf > /dev/null 2>&1; then
+  echo "COMMIT REFUSED — \`okf\` is not on PATH, so the bundle cannot be audited. Run \`gem install okf okf-pro\`." >&2
+  exit 1
+fi
+
+# IDENTITY, NOT EXISTENCE — the same proof .claude/hooks/run makes, for the
+# same reason it states: `command -v okf` finds a NAME, and a stray `okf` on
+# PATH that exits 0 is indistinguishable from a clean gate by status alone.
+# Without this, a shim was two silent passes and a commit, at the one door that
+# exists for the edit the agent hooks never see.
+#
+# The handshake runs a real gate through the hook door, because that is where
+# the marker is written and it is written before the check runs — so its
+# presence means okf-pro was actually reached, not merely that something
+# answered to the name. The event is an empty object: it reaches the check,
+# the check has nothing to say about it, and nothing is written anywhere.
+MARKER='okf-pro-enforcer v1'
+if ! printf '{}' | okf pro hook guard-verified 2>&1 > /dev/null | grep -q "^${MARKER}\$"; then
+  echo "COMMIT REFUSED — \`okf\` did not identify itself as the enforcer, so nothing was audited. Either okf-pro is not installed (\`gem install okf-pro\`), or something else on PATH answers to \`okf\`." >&2
+  exit 1
+fi
+
+staged="$(mktemp -d)" || {
+  echo "COMMIT REFUSED — could not create a temp directory to materialise the staged tree." >&2
+  exit 1
+}
+trap 'rm -rf "$staged"' EXIT
+
+# checkout-index writes exactly what the index holds — HEAD plus whatever is
+# staged, minus whatever is not. The trailing slash on --prefix is load-bearing.
+if ! git -C "$root" checkout-index -a --prefix="$staged/" 2> /dev/null; then
+  echo "COMMIT REFUSED — could not materialise the staged tree for audit." >&2
+  exit 1
+fi
+
+# Two questions, and they need different inputs. The append-only record is a
+# question about the CHANGE, so it reads the index directly — materialise the
+# staged tree and the modification is no longer visible as one. It runs first:
+# a rewritten record is not a lint finding, it is the artefact gone.
+#
+# Both verbs answer 0 clean, 1 findings, 2 could-not-run, and this door treats
+# 1 and 2 alike: a commit is refused either way. The distinction is for the
+# reader, and it is why neither verb spells "the checker broke" as 1.
+okf pro records "$root" || exit 1
+
+okf pro audit "$staged" || exit 1

data/lib/okf/pro/template/gem/.github/workflows/okf-pro.yml

@@ -0,0 +1,69 @@
+name: okf-pro
+
+# The third door, behind the Claude Code hooks (agent-time) and
+# .githooks/pre-commit (commit-time). Hooks fire only at the agent's tool
+# boundary and git hooks only on machines that configured them, so a push can
+# still carry an edit nothing checked. This is where it gets checked. Nothing is
+# published; the bundle is the artefact.
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.3"
+
+      - name: Install okf-pro
+        run: gem install okf-pro
+
+      # The CLI is asked directly, and on purpose, even though `okf pro audit`
+      # runs the same two analyzers. A checker that is the only thing verifying
+      # the bundle can be wrong in the one direction nobody notices — always
+      # passing — and then CI is decorative in a way no test would catch. These
+      # two steps are the independent authority; audit below adds what only the
+      # checker knows.
+      - name: Validate — OKF conformance
+        run: okf validate .okf
+
+      # `okf lint` exits 0 even when it finds problems. Without --fail-on warn
+      # this step is decorative: green forever, and green for reasons unrelated
+      # to the bundle being any good.
+      - name: Lint — curation quality
+        run: okf lint .okf --fail-on warn
+
+      # The invariants that are not conformance: a snapshot under the log's
+      # newest day, every open project paired to a board line, every unverified
+      # briefing still owed a read. These are the ones an editor-made commit
+      # bypasses entirely, and they are the reason this door exists.
+      - name: Audit — the bundle's own invariants
+        run: okf pro audit .
+
+      # Attestation reports; it does not gate. "Unverified" is the truth about a
+      # concept, not a defect in it, and a gate here would pressure toward the
+      # one lie the whole system guards against — so it lands in the run summary,
+      # where a person reads it while deciding what to look at.
+      #
+      # Staleness is asked of `okf lint` rather than of this gem: `stale_after`
+      # is the format's own field (§5.5), the kernel owns where its boundary
+      # falls, and a second implementation of "is this past its window" that
+      # disagreed by a day would be worse than none.
+      - name: Attestation and staleness — report only
+        if: always()
+        run: |
+          {
+            echo "## Attestation and staleness"
+            echo
+            echo "Advisory. Unverified is the truth, not a defect; a passed window is a prompt to look."
+            echo
+            echo '```'
+            okf pro unverified .
+            okf lint .okf --only expired || true
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

data/lib/okf/pro/template/seed/.claude/settings.json

@@ -0,0 +1,24 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      { "matcher": "Edit|Write|MultiEdit",
+        "hooks": [
+          { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/run guard-verified" },
+          { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/run journal-guard" } ] },
+      { "matcher": "Bash",
+        "hooks": [
+          { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/run shell-guard" } ] }
+    ],
+    "PostToolUse": [
+      { "matcher": "Edit|Write|MultiEdit",
+        "hooks": [
+          { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/run post-edit" } ] }
+    ],
+    "Stop": [
+      { "hooks": [ { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/run stop-gate" } ] }
+    ],
+    "SessionStart": [
+      { "hooks": [ { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/run session-context" } ] }
+    ]
+  }
+}

data/lib/okf/pro/template/seed/.okf/areas/corpus.md

@@ -0,0 +1,73 @@
+---
+type: Overview
+title: Corpus
+description: The standard this knowledge base is kept at — the naming policy, ownership of the staleness windows, and the limit reconciliation runs against.
+---
+
+# The standard
+
+Every adopter has exactly one area on day one: tending the thing they are
+reading right now. It has no done. It has a level, and the level is this — **a
+claim in here can be found by someone who does not already know it is here,
+and does not sit next to its own contradiction.**
+
+This file holds the standard, never the state. Counts live in
+[log.md](/log.md); open work lives on [board.md](/board.md). If you find
+yourself updating this file daily, something that belongs on the board has
+leaked into it.
+
+# Reconciliation
+
+The discipline itself is operative as Rule 1 of the okf-pro skill, which
+every bundle-touching session loads: search before filing, read bodies rather
+than titles, deprecate the loser at ingestion, and send what cannot be settled
+to [board.md](/board.md) as one dated conflict line.
+
+One operative copy, and it is not this one — this area holds the standard that
+rule serves, and the rule's limit: it catches collisions as well as the search
+vocabulary does, and no better. That limit is what makes the next section
+load-bearing rather than cosmetic.
+
+# Naming policy
+
+* **Never name a concept, tag, or type after something that already means
+  three things in your domain.** A file called `status.md` in a bundle where
+  "status" is a ticket field, a deploy state, and a weekly email is a file
+  nobody can search for.
+* Prefer the phrase you would actually say out loud to a colleague. The search
+  that matters is the one made by someone who has forgotten the filing.
+* Types are a small vocabulary, added to reluctantly: Briefing, Decision,
+  Finding, Learning, Term, Journal Entry, Transcript, Overview, Board. A tenth
+  type needs a reason that survives being said aloud.
+* [glossary/](/glossary/) is where a contested word goes to get one meaning.
+  When two concepts disagree because they are using a word differently, the
+  fix is usually a Term, not an argument.
+* **A directory is a retrieval question, and a room pays rent by answering one
+  no other room answers.** The five here are the starting set rather than the
+  closed set — but a sixth is earned by an incident, never anticipated. What is
+  forbidden is the *catch-all*: a room meaning "everything else" is a blind spot
+  by construction, because things enter it and nothing enumerates them again,
+  and nobody has ever searched for the thing that did not fit. That is also why
+  this bundle splits what PARA keeps as one Resources room into
+  [reference/](/reference/), [learnings/](/learnings/) and
+  [glossary/](/glossary/): three questions, asked at three different moments.
+
+# Staleness
+
+This area **owns** the staleness table — deciding what decays, and how fast.
+The table itself lives in the okf-pro skill
+(`.claude/skills/okf-pro/SKILL.md`), next to the frontmatter policy it
+governs, because one operative copy beats two agreeing copies until the day
+they stop agreeing.
+
+Ownership means: when a window proves wrong in use — briefings going stale
+while still accurate, terms rotting before their date — the number changes
+here first as a decision, then in the skill as the rule, and the change gets a
+[log.md](/log.md) line.
+
+`stale_after:` reports; it never gates. A date that has passed is a prompt to
+look, not a verdict that the concept is wrong. Where the boundary falls is the
+format's to say and not this bundle's: a concept is stale when the day has
+arrived, inclusive, and `okf lint --only expired` is what answers the
+question. A second implementation of it that disagreed by a day would be worse
+than none.

data/lib/okf/pro/template/seed/.okf/areas/index.md

@@ -0,0 +1,6 @@
+# Areas
+
+Standards held indefinitely. An area has a level, not a finish line — which is
+what separates it from a project.
+
+* [corpus.md](/areas/corpus.md) - the standard this knowledge base is kept at.

data/lib/okf/pro/template/seed/.okf/board.md

@@ -0,0 +1,21 @@
+---
+type: Board
+title: Board
+description: The single page of forward state — every commitment, in six sections, on one page you can read at a glance.
+---
+
+# Board
+
+**In flight: 0/5** · updated never
+
+## In flight
+
+## Backlog
+
+## Waiting
+
+## Inbox
+
+## To read
+
+## Deadlines

data/lib/okf/pro/template/seed/.okf/glossary/index.md

@@ -0,0 +1,13 @@
+# Glossary
+
+Terms that need one fixed meaning here, because they mean three things
+elsewhere.
+
+A term earns a file when two concepts disagree and the disagreement turns out
+to be about a word. The fix is usually a Term, not an argument.
+
+Naming is governed by the policy in [areas/corpus.md](/areas/corpus.md): never
+mint a name that already means something else in your own domain, and prefer
+the phrase you would actually say out loud to a colleague.
+
+Nothing defined yet.

data/lib/okf/pro/template/seed/.okf/index.md

@@ -0,0 +1,30 @@
+---
+okf_version: "0.2"
+---
+
+# Second Brain
+
+A personal knowledge bundle. Three zones: what I know, what I am doing, what
+time is doing to both.
+
+The rules that govern writing into it live in the okf-pro skill
+(`.claude/skills/okf-pro/SKILL.md`), outside this bundle, because the agent
+loads it from there and because instructions are not knowledge. `CLAUDE.md`
+sits outside for the same reason.
+
+# KNOW
+
+* [reference/](/reference/) - what other people produced, summarised and attributed.
+* [learnings/](/learnings/) - conclusions of mine that outlive the work that produced them.
+* [glossary/](/glossary/) - terms that need one fixed meaning.
+
+# ACT
+
+* [projects/](/projects/) - work with a definition of done.
+* [areas/](/areas/) - standards held indefinitely, with no done.
+
+# TIME
+
+* [board.md](/board.md) - the single page of forward state.
+* [journal/](/journal/) - the backward record, one entry per day.
+* [roadmap.md](/roadmap.md) - the quarterly wavelength.

data/lib/okf/pro/template/seed/.okf/journal/index.md

@@ -0,0 +1,11 @@
+# Journal
+
+One entry per day, named `YYYY-MM-DD.md`. The backward record: what happened,
+what it meant, what was decided.
+
+Entries are append-only — a past day is a record, not a draft — and the commit
+door asks git directly whether a past day changed. Corrections go in today's
+entry, pointing back at the day they correct.
+
+Nothing recorded yet. The first entry is the first day this bundle is used,
+dated by you, not by the template.

data/lib/okf/pro/template/seed/.okf/learnings/index.md

@@ -0,0 +1,13 @@
+# Learnings
+
+Conclusions of mine that are true beyond the work that produced them.
+
+The test for filing here rather than in a project: *does it outlive the piece
+of work that produced it?* A finding that only makes sense inside one project
+belongs under `projects/`; a lesson that would still be worth knowing after
+that project is forgotten belongs here.
+
+This is also where closing a piece of work sends its durable part — extracted
+at closure, or archived with the work and relearned later at full price.
+
+Nothing concluded yet.

data/lib/okf/pro/template/seed/.okf/log.md

@@ -0,0 +1,10 @@
+# Update Log
+
+What changed in this bundle, newest day first. One `## YYYY-MM-DD` heading per
+day, and under it the day's lines — including the mechanical `**Snapshot**`
+line the end-of-day sitting appends.
+
+Nothing logged yet. The first heading is written on the first day this bundle
+is used, dated by you: a template that shipped with a date would hand you
+somebody else's calendar, and the dormancy window measures this bundle's age
+by its oldest journal entry.

data/lib/okf/pro/template/seed/.okf/projects/index.md

@@ -0,0 +1,23 @@
+# Projects
+
+Work with a definition of done. Each project is a directory with its own
+`index.md`; concepts scoped to that work live beside it.
+
+A project is closed by marking its own `index.md` on the first line — the word
+`closed`, then the date, separated only by spaces, a colon, a dash, asterisks
+or an opening parenthesis. These forms count:
+
+* `# Title — closed 2026-08-12`
+* `Closed: 2026-05-01`
+* `**Closed** 2026-08-12`
+* `closed (2026-08-12)`
+
+A sentence that merely mentions the word is not a marker, and neither is
+`_closed_` in underscores — the okf-pro skill's closing ritual enumerates
+what does and does not count, and it is the only place that list lives.
+
+The directory then stays exactly where it is —
+concepts elsewhere cite into it, and a move breaks every citation to buy a
+tidiness nobody asked for. Lifecycle is metadata; location is filing.
+
+Nothing started yet.

data/lib/okf/pro/template/seed/.okf/reference/index.md

@@ -0,0 +1,16 @@
+# Reference
+
+What other people produced: their document, their claim, your summary of it,
+with the source recorded.
+
+Everything here carries `sources:` — what it was derived from — and attributes
+individual claims with footnotes keyed to a `sources[].id`. That is the whole
+argument of this directory: a claim in here can be traced back to whatever it
+came from.
+
+A concept an agent wrote carries `generated:` from creation, and stays
+**unverified** until you have actually read it. That is the truth about it,
+not a defect in it, and the To-read line on [board.md](/board.md) stays until
+the reading happens.
+
+Nothing filed yet.

data/lib/okf/pro/template/seed/.okf/roadmap.md

@@ -0,0 +1,33 @@
+---
+type: Overview
+title: Roadmap
+description: The quarterly wavelength — intent stated sparsely, linking out to the work that carries it.
+---
+
+# What belongs here
+
+The quarter's intent, in a handful of lines. Not a plan, not a backlog, not a
+second board — those exist and they are elsewhere. This file answers one
+question: *if the next three months went well, what would be different?*
+Write it sparsely and link out; a roadmap that restates [board.md](/board.md)
+has become the second copy, and the second copy rots. The rule that keeps the
+two apart is the routing question in the okf-pro skill: the board holds
+commitments, this file holds intent, and intent that has become a commitment
+belongs on the board.
+
+# This quarter
+
+* No intent stated yet. Write one line when a quarter's shape is actually
+  known — a blank quarter is more honest than an invented one.
+
+# The standing accusation
+
+This file is the least field-proven element of the design. The board and the
+journal earn their keep every day; the roadmap claims a wavelength nobody has
+yet proved a personal system needs. If a month of use never touches it, it
+stands accused — delete it, remove its line from [index.md](/index.md), and
+note the deletion in [log.md](/log.md). All three, or the index links at
+nothing and lint says so.
+
+It is the one file in the core the design lets you remove. Everything else
+here the gates require, because without it they disengage in silence.