@ai-outfitter/outfitter 0.3.0 → 0.6.1

package/requirements/OFTR-009-release-publishing.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-Outfitter release publishing prepares package metadata from a GitHub release tag and publishes the `@ai-outfitter/outfitter` npm package through GitHub Actions.
+Outfitter release publishing prepares package metadata from Conventional Commit release PRs and GitHub release tags, then publishes the `@ai-outfitter/outfitter` npm package through GitHub Actions using npm trusted publishing / OIDC.
 
 ## Requirements
 
@@ -13,7 +13,8 @@ Outfitter release publishing prepares package metadata from a GitHub release tag
 3. The release metadata synchronization script MUST reject invalid Semantic Versioning values before mutating package metadata.
 4. The release metadata synchronization script MUST update the root `package.json` version, root `package-lock.json` version, and `package-lock.json` root package entry version to the same normalized release version.
 5. The release metadata synchronization script MUST verify that the root package metadata it prepares belongs to the `@ai-outfitter/outfitter` npm package.
-6. The release metadata synchronization script MUST fail with an actionable error when required package-lock root package metadata is missing.
+6. The release metadata synchronization script MUST verify that `package.json` and the package-lock root metadata declare `repository.url` as `https://github.com/ai-outfitter/outfitter.git` so npm provenance validation can match the publishing repository.
+7. The release metadata synchronization script MUST fail with an actionable error when required package-lock root package metadata is missing.
 
 ### OFTR-009.2: Npm Release Workflow
 
@@ -22,4 +23,13 @@ Outfitter release publishing prepares package metadata from a GitHub release tag
 3. The npm release workflow MUST synchronize package metadata from the GitHub release tag before publishing.
 4. The npm release workflow MUST run CI checks before publishing.
 5. The npm release workflow MUST build the package before publishing.
-6. The npm release workflow MUST publish the public `@ai-outfitter/outfitter` package to the npm registry using an npm token secret.
+6. The npm release workflow MUST request `id-token: write`, use the `npm-publish` GitHub environment, and publish the public `@ai-outfitter/outfitter` package to the npm registry with provenance through npm trusted publishing / OIDC rather than `NPM_TOKEN` or `NODE_AUTH_TOKEN`.
+
+### OFTR-009.3: Conventional Commit Release Automation
+
+1. The Release Please workflow MUST run on pushes to `main`.
+2. The Release Please workflow MUST use `googleapis/release-please-action@v4` with the upstream example-style token input from `secrets.RELEASE_PLEASE_TOKEN`.
+3. The Release Please workflow MUST use `release-type: node` for the root `@ai-outfitter/outfitter` npm package.
+4. The Release Please workflow MUST derive version bumps from Conventional Commits.
+5. The Release Please workflow MUST update npm package metadata and changelog through a release PR before publishing.
+6. The Release Please workflow MUST use GitHub repository write auth capable of triggering release PR CI and the release-published npm workflow, not the default `GITHUB_TOKEN`.

package/requirements/OFTR-010-onboarding-welcome.md

@@ -2,33 +2,38 @@
 
 ## Overview
 
-Outfitter welcome onboarding guides a new user through the minimum choices needed to start productive Pi sessions, including an initial role and a recommended loadout of extensions and skills.
+Outfitter welcome onboarding gets a new user to a productive Pi session in one question. The
+recommended path installs the founder profile automatically; declining opens `/outfitter` inside Pi
+so the user can configure a profile interactively.
 
 ## Requirements
 
 ### OFTR-010.1: Welcome Text
 
-1. Welcome text MUST be shown to the user explaining what Outfitter and Pi are.
+1. Welcome text MUST be shown to the user explaining what Outfitter and Pi are and what the founder profile provides.
+2. Welcome text MUST use Outfitter-branded ASCII/text.
+3. Welcome text MUST reference `/outfitter` as the way to customize the profile after installation.
 
-> Pi is a heavily customizable coding harness.
-> The next few questions will configure Outfitter to best suit your workflow.
+> Pi is a fully extensible agentic coding harness.
+> The founder profile brings Pi to feature parity with dedicated agentic coding tools.
+> Press Y to install it now. Run /outfitter inside Pi at any time to customize your profile.
 
-### OFTR-010.2: Role Selection
+### OFTR-010.2: Profile Installation
 
-1. The welcome onboarding flow MUST ask the user to choose an initial role for the Outfitter-managed agent session.
-2. Role choices MUST align with Outfitter's built-in standard role catalog, not DeepWork review personas or a remote default profile source.
-3. The role selection prompt MUST include the currently available built-in standard profile roles, including `engineer` and `data_analyst` while those roles remain supported.
-4. The selected role MUST be captured as structured onboarding data so profile creation or profile selection can map it to the matching standard profile ID.
-5. If the selected role cannot be mapped to an available standard profile for the selected agent adapter, Outfitter MUST warn the user and choose a deterministic fallback role rather than silently ignoring the selection.
+1. The welcome onboarding flow MUST present a single accept/decline prompt for the founder profile.
+2. Accepting (default) MUST install the founder role and the full recommended loadout without further prompts.
+3. The founder role MUST be the default and fallback selection. Outfitter's built-in role catalog also includes `engineer` and `data_analyst`; these are accessible via `/outfitter` after first run.
+4. If the accepted role cannot be mapped to an available standard profile, Outfitter MUST warn the user and choose a deterministic fallback role rather than silently ignoring the selection.
 
-### OFTR-010.3: Loadout Selection
+### OFTR-010.3: Loadout
 
-1. The welcome onboarding flow MUST recommend at least one default loadout for the selected role.
-2. A loadout MUST be represented as a named set of Pi extensions, skills, or package resources that Outfitter can translate into profile controls or profile-managed Pi configuration.
-3. The welcome onboarding flow MUST allow the user to accept the recommended loadout, select individual loadout items, or skip loadout installation.
-4. The default recommended loadout MUST include `git:github.com/ai-outfitter/ulta-tasklist`, `git:github.com/ai-outfitter/deepwork`, `npm:pi-subagents`, and `npm:pi-mcp-adapter` while those packages remain available.
-5. Loadout installation MUST be captured as structured onboarding data so future profile creation can install the selected extensions, skills, or package resources deterministically.
-6. If a loadout item is unavailable or unsupported by the selected agent adapter, Outfitter MUST warn the user and continue with the remaining selected loadout items unless strict onboarding validation is enabled.
+1. On acceptance, the full recommended loadout MUST be installed automatically with no item-level selection prompt.
+2. The default recommended loadout MUST include `git:github.com/ai-outfitter/deepwork`, `npm:@juicesharp/rpiv-ask-user-question`, `git:github.com/applepi-ai/ulta-tasklist`, `npm:pi-nolo`, `npm:pi-browser-harness`, `npm:@mjakl/pi-subagent`, `npm:@narumitw/pi-btw`, `npm:pi-must-have-extension`, `npm:pi-interactive-shell`, and `npm:pi-mcp-adapter` while those packages remain available.
+3. Loadout installation MUST be captured as structured onboarding data so profile creation can install the selected extensions deterministically.
+4. On acceptance, Outfitter MUST display a message directing users to `/outfitter` inside Pi and `outfitter profile list` in the terminal for post-install management.
+5. If a loadout item is unavailable or unsupported by the selected agent adapter, Outfitter MUST warn the user and continue with the remaining loadout items unless strict onboarding validation is enabled.
+6. The Outfitter npm package MUST publish a default Pi skill named `outfitter` for profile setup guidance from inside Pi.
+7. The Pi adapter MUST load the default Outfitter skill for normal profile launches.
 
 ### OFTR-010.4: Pi Login Setup
 
@@ -36,3 +41,8 @@ Outfitter welcome onboarding guides a new user through the minimum choices neede
 2. If Pi is not logged in after the welcome flow, Outfitter MUST automatically invoke Pi's `/login` flow when Pi starts.
 3. When Outfitter launches Pi outside the welcome flow and Pi does not appear to be logged in, Outfitter MUST inform the user to run `/login` inside Pi.
 4. Pi login setup MUST NOT ask Outfitter to collect, echo, or persist provider API keys.
+
+### OFTR-010.5: Decline Path
+
+1. If the user declines the welcome profile, Outfitter MUST launch Pi with `/outfitter` prefilled and auto-submitted so the user can configure a profile interactively on first session start.
+2. The profile install target MUST always be the user home directory (`~/.outfitter`); no installation scope prompt MUST be shown.

package/skills/outfitter/SKILL.md

@@ -0,0 +1,68 @@
+---
+name: outfitter
+description: Help users create, inspect, and maintain Outfitter profiles, settings, setup sources, and Pi launch loadouts. Use when a user invokes /outfitter or asks for help setting up Outfitter-managed profiles, profile.yml files, profile sources, default profiles, skills, extensions, prompts, or setup repositories.
+---
+
+# Outfitter
+
+Use this skill to guide profile setup for Outfitter-managed Pi sessions.
+
+## Default behavior
+
+If the user invokes `/outfitter` without a specific request:
+
+1. Run `outfitter profile list` to show available profiles.
+2. Summarize the profiles by name, scope/source when visible, and default status when visible.
+3. Ask whether the user wants to create a new profile.
+4. If they do, ask for the intended profile ID and scope before running `outfitter profile create`.
+
+## Workflow
+
+1. Inspect the current directory and home configuration before editing:
+   - `.outfitter/settings.yml`
+   - `.outfitter/local/settings.yml`
+   - `.outfitter/profiles/*/profile.yml`
+   - `~/.outfitter/settings.yml`
+2. Identify the intended scope:
+   - user profile: reusable across projects
+   - project profile: checked into the repository
+   - project-local profile: private machine-specific overrides
+3. Prefer existing commands before manual file edits:
+   - `outfitter setup <source>` to import setup sources
+   - `outfitter sync` to refresh remote profile sources
+   - `outfitter profile list` to inspect available profiles
+   - `outfitter profile create <id> --scope user|project|project-local` to scaffold profiles
+   - `outfitter run --profile <id>` to verify launch behavior
+4. Keep profile changes focused:
+   - put reusable resources under `skills/`, `prompts/`, `extensions/`, or `deepwork/jobs/`
+   - put Pi-only resources under `cli_specific/pi/`
+   - put Claude-only resources under `cli_specific/claude/`
+5. Validate profile YAML against the current schema and run a smoke test with `outfitter run --profile <id> -- --help` when possible.
+
+## Profile skeleton
+
+```yaml
+id: engineer
+label: Engineer
+
+controls:
+  provider: openai-codex
+  model: gpt-5.5
+  thinking: xhigh
+  append_system_prompt:
+    - ./prompts/engineering.md
+  skills:
+    - ./skills/review
+  pi:
+    extensions:
+      - git:github.com/ai-outfitter/ulta-tasklist
+      - git:github.com/ai-outfitter/deepwork
+    skills:
+      - ./cli_specific/pi/skills/outfitter
+```
+
+## Notes
+
+- Use profile IDs matching lowercase letters, digits, `.`, `_`, and `-`.
+- Use `template: true` only for inheritance-only profiles.
+- Do not store provider secrets in profile files; use Pi login, environment variables, or the user's private agent state.

package/src/schemas/profile.schema.json

@@ -9,6 +9,8 @@
       "pattern": "^[a-z0-9][a-z0-9._-]*[a-z0-9]$|^[a-z0-9]$"
     },
     "label": { "type": "string" },
+    "description": { "type": "string" },
+    "template": { "type": "boolean" },
     "inherits": {
       "type": "array",
       "items": {
@@ -43,7 +45,7 @@
         },
         "prompt_template": { "type": "string" },
         "system_prompt": { "type": "string" },
-        "append_system_prompt": { "type": "string" },
+        "append_system_prompt": { "$ref": "#/$defs/appendSystemPrompt" },
         "environment": {
           "type": "object",
           "additionalProperties": { "type": "string" }
@@ -69,7 +71,7 @@
             },
             "prompt_template": { "type": "string" },
             "system_prompt": { "type": "string" },
-            "append_system_prompt": { "type": "string" },
+            "append_system_prompt": { "$ref": "#/$defs/appendSystemPrompt" },
             "allow_external_deepwork_jobs": { "type": "boolean" },
             "environment": {
               "type": "object",
@@ -99,7 +101,7 @@
             },
             "prompt_template": { "type": "string" },
             "system_prompt": { "type": "string" },
-            "append_system_prompt": { "type": "string" },
+            "append_system_prompt": { "$ref": "#/$defs/appendSystemPrompt" },
             "environment": {
               "type": "object",
               "additionalProperties": { "type": "string" }
@@ -111,5 +113,16 @@
       "additionalProperties": true
     }
   },
-  "additionalProperties": true
+  "additionalProperties": true,
+  "$defs": {
+    "appendSystemPrompt": {
+      "oneOf": [
+        { "type": "string" },
+        {
+          "type": "array",
+          "items": { "type": "string" }
+        }
+      ]
+    }
+  }
 }