@akinet/akidevrule 3.0.0 → 3.1.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [3.1.0] - 2026-09-15
+
+### Changed
+- **`/akiship` activation is now an explicit release order, not a literal `/akiship` token — and `release.B8`'s owner-worded-criteria licence now decides and reports instead of escalating by default.** Evidence: the owner's explicit "release trọn vẹn" order was refused for lacking the exact token, and a separate run re-asked whether to run an additive migration `stack.C8` had already answered. Root cause: the aug22 incident phrase ("tóm lại cần làm gì để trọn vẹn") already fails the release-object and imperative checks independently, so the literal-token requirement added on top of `akiship-literal-activation-aug22.md`'s fix caught no additional failure and only produced false negatives on plainly-worded orders; separately, B8's self-answer bullet read any owner-worded intensity phrase as ambiguous owner intent worth an interrupt, rather than a repo-answered fact. Mechanism: `skills/akiship/SKILL.md`'s activation gate now accepts the literal token **or** an equally explicit imperative naming the ritual ("release trọn vẹn đi", "chạy full release"); a completion word with no release object activates nothing. `release.B8`'s self-answer licence now derives an owner-worded criterion from the anchor plus the repo's own records, decides, and reports it in a `Decided: X · because Y · rejected Z (why) · reopen if W` block, escalating mid-run only when competing readings would produce different irreversible artifacts. Rejected: keeping the literal token — the aug22 incident it defends against is already blocked by the two independent conditions, so the token buys nothing but friction. `docs/research/akiship-literal-activation-aug22.md` gains a `Status: superseded in part` line for the literal-token point only; its residency-of-guard and imperative-vs-interrogative findings stand. Evidence and full trace: `docs/research/autonomy-escalation-ship-verification-sep15.md`; execution: `docs/plan/done/autonomy-escalation-ship-verification.md`.
+- **`agent.A3` gains mandatory, resident deep-think triggers and an escalate-only-when list; `METHOD-deep-think.md`/`akithink` gain a non-interactive triggered self-run mode.** Evidence: the owner kept manually typing "/akithink 4-6 rounds" on hard cases because neither of deep-think's two modes fires deterministically without him naming it — passive is deliberately shallow, active needs an explicit invocation. Root cause: no resident trigger existed to fire the method on its own, and no non-interactive mode existed for an autonomous run to use once triggered. Mechanism: `agent.A3` now lists six mandatory trigger conditions (about to ask/escalate, a one-way-door action, a repeated fix failure per `pattern.B2`, conflicting rules, owner wording admitting divergent-artifact readings, a documented-design touch), a converged→act outcome reported as a decision block, and an escalate-only-when list (irreversible outward action, documented-design contradiction, the `coding.C4` floor, or non-convergence) that narrows the ask surface instead of widening the guard. `METHOD-deep-think.md` A2 gains a third mode, triggered self-run, depth scaled to difficulty rather than a fixed round count; `skills/akithink/SKILL.md` gains a Self-run mode section, and `skills/akihelp/SKILL.md`'s introduction of the method now names three modes instead of two; `skills/akirule/SKILL.md`'s deep-think routing gains extra sensitivity for escalation-adjacent Vietnamese/English signals, explicitly additional to `agent.A3`'s mechanical floor. Rejected: promoting `METHOD-deep-think.md` itself to a core `@` import (token cost on every trivial task — the fix is resident triggers, not a resident file) and a fixed "4-6 rounds" depth (should scale to the difficulty of the specific case). Evidence and full trace: `docs/research/autonomy-escalation-ship-verification-sep15.md`.
+- **`agent.B3` defines "hard-to-reverse" so a two-way-door action with a backup path no longer defaults to the ask-before list.** Evidence: `agent.B3`'s ask-before list is a core `@` import, resident every session, while the counterweight that actually resolves most of those cases (`stack.C8`'s execution-ownership clause, `coding.B5`'s ladder) loads only on a contextual signal match — the same residency asymmetry as `akiship-literal-activation-aug22.md`, but inverted (under-acting instead of over-acting). Mechanism: `B3`'s destructive-or-hard-to-reverse bullet now states that hard-to-reverse means no backup/restore or fix-forward path exists; an action that has one climbs `coding.B5`'s ladder instead of asking. Evidence and full trace: `docs/research/autonomy-escalation-ship-verification-sep15.md`.
+- **`coding.B3` reclassifies a full build and test suite as self-authorized, gated by moment, instead of lumping them in with dev servers and live network calls as always user-triggered; `release.B7` gains a mandatory build-and-test step mirroring CI.** Evidence: nothing built locally before a push even at ship time, because `coding.B3` treated "running the app" as one undifferentiated user-triggered category and `release.B7`'s checklist had no build/test step at all. Mechanism: `coding.B3` now scales the tier by moment — after edits: typecheck/lint/related unit tests; committing a large batch (spans several modules, or touches build config/dependencies): add the build; ship/release/deploy: full build plus full test suite, mandatory and self-authorized. `release.B7` gains step 6, Build & test, between doc sync and verification honesty: commands are derived from `.github/workflows/*` first, else the manifest's own scripts; a failure blocks the gate and is fixed in place; a CI-only leg (other-OS matrix, secrets) is named and left to the new B10. Dev servers and live network calls stay user-triggered — cost and side effects are still the user's call there. Rejected: building after every edit (RAM/time/token cost on a 16GB-class machine — typecheck is the correct edit-time tier). Evidence and full trace: `docs/research/autonomy-escalation-ship-verification-sep15.md`.
+- **`payload/index.md` manifest rows for `release`, `think`, and the "Interrupting the owner" cross-cutting lens updated** to reflect the above; address-map comment `release.B1-9` → `release.B1-10`.
+
+### Added
+- **`release.B10` — post-push CI watch, in any flow, not only `/akiship`.** Evidence: CI failures on GitHub went unnoticed after a push. Root cause: the ritual only ever verified stack deploys (`release.C5`, ⟨Aki⟩-web-specific) — a CLI, library, or npm-package repo had no post-push check of any kind, so a red GitHub Actions run could sit unnoticed indefinitely. Mechanism: after any push or tag push, watch every triggered workflow to green (`gh run list --commit <sha>`, `gh run watch <id> --exit-status`); red is fixed forward with a new commit and re-pushed, never a history rewrite; a GitHub-created Release is confirmed with `gh release view`; a repo with no workflows says so. `skills/akiship/SKILL.md` Phase 3/Report now watch CI after any push regardless of stack, before stack deploy verification; `skills/akigitcommit/SKILL.md`'s push boundary gains a one-line pointer. Rejected: relying only on post-push CI and skipping the local build/test step above — wastes a full push cycle and leaves public red CI history visible before the failure is caught; local build/test mirroring CI catches most failures before they are ever pushed, and B10 exists specifically for the residue a local run cannot reproduce. Evidence and full trace: `docs/research/autonomy-escalation-ship-verification-sep15.md`.
+
+### Notes
+- Repo `CLAUDE.md` gains a new authoring principle, **"Release records carry their reasoning"**: every CHANGELOG entry and release note for this repo states why (observed failure/evidence, root cause, mechanism, tradeoff/rejected alternative), not only what — a bare list of changes is an incomplete entry. Owner-ordered 2026-09-15 after this same round of feedback; applied to every entry above and below.
+- `docs/research/autonomy-escalation-ship-verification-sep15.md` and `docs/plan/done/autonomy-escalation-ship-verification.md` record the full root-cause trace and execution list. Behavior change from this round (does a future session actually converge on the new triggers, does the escalate-only-when list reduce interrupts, does B10 get run inside a live `/akiship` execution) is **unverified — needs observation across real sessions**; there is no static or automated tier that settles a model-behavior claim.
+
 ## [3.0.0] - 2026-09-13
 
 ### Added

package/README.md

@@ -65,14 +65,14 @@ Interpreter convention (documented once): the installer and hooks run on `node`
 |---|---|---|
 | `akirule` | automatic, every conversation | Smart rule router — contextual rules on signal match, everything on `nạp full` / `load all rules`. Core rules do not pass through it: the harness `@`-imports them, so they hold even when this skill never runs. Also owns the **`[RULES]` receipt** — one mandatory line reporting the whole rule context (`core` + `router` + a `missing:` field), so that "the rule never arrived" stops sharing a signature with "the rule arrived and was ignored". Hidden from the `/` menu by design. |
 | `akiflow` | `/akiflow` | Lead-coordinated **agent council** for work needing more than one kind of judgment. The lead's job is two laws: **ANCHOR** — the owner's verbatim message is pinned as the run's immutable first block (`council_open.py` refuses to open a room without it) and every numbered requirement must quote a fragment of it; and **JUSTIFICATION** — every seat, check and script is OFF by default and turns on only when this run produces a reason, so there are no standing seats and no roster derived from a tier. It decomposes the request into owned work items, checks a three-condition activation gate, and convenes seats from the five definitions in `~/.claude/agents/` — one batch, each seat traced to a requirement, never picked from a menu. **Two shapes, discriminated by whether anything is actually being arbitrated.** A *council* is items with adversaries, for work where two competent seats could reach different defensible answers. A *dispatch* is lanes with exclusive file ownership, for a fan-out whose answer is already knowable and whose only real hazard is two workers writing the same file — `--convene` refuses an overlapping `writes:` before a token is spent. Dispatch drops the challenger, the debate and the three-condition gate; it keeps the anchor, the quoted requirements, the `[RULES]` receipts, the durable record and the whole closure gate. It exists because 19 of 70 live rooms posted no debate turn at all and 11 of those still did substantive fan-out work, paying council overhead for machinery they never used. Orthogonally, three modes discriminated by one question, *what changes outside the room*: `discuss`, `audit` (read-only by construction), `execute` (only `aki-maker` may write). The lead does no menial work and settles what doctrine answers, escalating only a one-way door, a contradiction with documented design, or scope expansion — then writes the owner's answer back into doctrine the same turn, so a question never escalates twice. `council_verify.py` refuses closure on a missing anchor, a requirement quoting nothing the owner wrote, a declared seat that left no trace anywhere in the session, a seat with no `[RULES]` receipt, or an unanswered reminder — reading each seat's own `<seat>.md` as well as its turns, and printing `SKIP` rather than `PASS` where there was nothing to check — and deliberately requires no named seat, since an earlier version that did forced a seat to exist in a run with nothing to enforce and was gamed rather than questioned. **A read is a subscription, not a purchase** — the cost model that shapes how the room is used: every turn re-sends the whole history, so a read of size `S` at turn `t` of a `T`-turn run is charged about `S × (T − t)`, and pulling a 50k-token room at turn 50 of 200 costs ~7.5M cache-read tokens from one call. Measured on a real run with three `aki-maker` seats doing every file edit, the lead still held 70% of cache-read and 66% of output: delegation moves the work but not the money, because what a run pays for is the lead's own accumulated context. Hence `council_read.py --grep` to locate for a few hundred bytes and `--turn` to pull only what the grep pointed at. Close-out reconciles declared model tiers against actual spend, cross-CLI calls added by hand since they never appear in the transcript. Design record: [`docs/arch/akiflow.md`](docs/arch/akiflow.md). |
-| `akithink` | `/akithink` | Structured deep-thinking session for big, hard-to-reverse, or goal-ambiguous decisions: restate → goal excavation → first principles → mandatory critique → convergence into a `docs/` decision record. Recommends a top-tier model (Opus/Fable). |
+| `akithink` | `/akithink` | Structured deep-thinking session for big, hard-to-reverse, or goal-ambiguous decisions: restate → goal excavation → first principles → mandatory critique → convergence into a `docs/` decision record. Interactive by default; a non-interactive self-run mode fires when the owner authorizes it or an `agent.A3` deep-think trigger holds, ending in decide-and-report or escalation. Recommends a top-tier model (Opus/Fable). |
 | `akihtmlreport` | `/akihtmlreport` | Distills a dense analysis already in the conversation into one self-contained, ultra-wide `REPORT.html` at the project root — no new analysis, no dropped detail — then opens it locally. Exactly one per project; asks before overwriting. |
 | `akihelp` | `/akihelp` | Live introduction to the whole installed Aki system, rendered by reading `index.md` and skill frontmatters at runtime — it can never go stale. Includes a **painpoint → what to say** table (sprawling CSS, docs that no longer match code, a half-finished tree, a pre-ship check, a hard-to-reverse decision, padded or hard-wrapped output, over-guarded flows, UX friction, pricing calls) built from that live state, with any row whose target is not installed dropped rather than shown. Closes on the caveat that governs everything else: `akirule` is a skill and therefore best-effort, so name the rule file in the prompt whenever the load must be deterministic. |
 | `akigitcommit` | `/akigitcommit` | Turns a messy working tree into a few clean, logically grouped Conventional Commits. Triages a half-finished tree first — finished vs mid-edit vs abandoned vs accidental, asking rather than guessing — then stages by explicit path, never `git add -A`, never pushes unasked. |
 | `aki-article-writer` | `/aki-article-writer` or natural language | Per-project article writing pipeline: research & fact-verification, SEO metadata, JSON-LD schema, UX-psychology-aware content, and a dedicated Image Scout subagent (Gemini Flash / Haiku) for search → download → visual inspection → ffmpeg processing → slug-named WebP output. One subagent per article; image work is always isolated to a separate lightweight subagent. |
 | `akidevsync-notes` | natural language | Reads/edits a project's `.akidevsync/notes.json` — the per-project task list the Aki-Dev-Sync app itself writes (list/add/pin/mark-done/edit/delete tasks) via a bundled script that preserves the app's own JSON formatting, plus a workflow for cross-checking pinned notes against a shipped release (CHANGELOG + code) before marking them done. |
 | `akilint` | `/akilint` or a penalty card | Mechanical format lint for the penalty-card classes of `RULE-agent-behavior.md` §0: hard-wrapped code comments and markdown prose (`[WRAP]`) and oversize comments (`[YAP]`, always labeled *review* — a flag for judgment against `coding.B4`, never an auto-delete verdict). Thin wrapper over the shared `scythe.py` detector (deterministic line matching, exit-code aware, cannot fabricate evidence) — the same script akiflow's `aki-conduct` seat uses, so a card name means the same thing everywhere. `[FLUFF]` (density) is content judgment and explicitly out of a script's reach. |
-| `akiship` | `/akiship` | One-command full release: front-loads every check (release state, tree triage), then runs `RULE-release.md` B7's checklist unattended — diff-scoped hygiene (scythe, dead code, comment doc-refs on the accumulation only), external-action completeness, record truthfulness, doc sync across every record surface (plans, `arch`/`feat`, README, task notes, bound standards docs), version mint or defer, registry publish for npm/crates/PyPI packages (`RULE-release.md` B9 — an OTP-gated publish is the single hand-off) — committing via `akigitcommit` with confirmation pre-answered. **Activation is literal**: only a turn containing the exact token `/akiship` and asking for the run to be *performed* starts it — `/akiship` inside a question is a consult (answer in chat, change nothing), and words like "trọn vẹn" or "release trọn gói" on their own are vocabulary, not a trigger. Governed by the B8 contract: that invocation is the authorization, blockers are reported once as a batch or the run completes with zero mid-run questions, and it stops only for public-history ambiguity, unclassifiable work, or a design contradiction. Push/deploy stay opt-in — named explicitly, or via completion-intensity phrasing (canonical list in `RULE-release.md` B8, e.g. "trọn vẹn"). |
+| `akiship` | `/akiship` | One-command full release: front-loads every check (release state, tree triage), then runs `RULE-release.md` B7's checklist unattended — diff-scoped hygiene (scythe, dead code, comment doc-refs on the accumulation only), external-action completeness, record truthfulness, build & test mirroring CI (B7 step 6), doc sync across every record surface (plans, `arch`/`feat`, README, task notes, bound standards docs), version mint or defer, registry publish for npm/crates/PyPI packages (`RULE-release.md` B9 — an OTP-gated publish is the single hand-off) — committing via `akigitcommit` with confirmation pre-answered. **Activation is an explicit release order**: the literal token `/akiship`, or an equally explicit imperative naming the ritual for this repo ("release trọn vẹn đi") — a completion word with no release object ("làm cho trọn vẹn"), or `/akiship` inside a question, activates nothing and gets a consult (answer in chat, change nothing). Governed by the B8 contract: that order is the authorization, blockers are reported once as a batch or the run completes with zero mid-run questions, and it stops only for public-history ambiguity, unclassifiable work, or a design contradiction — an owner-worded completion criterion is derived from the anchor plus the repo's own records and decided/reported (`Decided: X · because Y · rejected Z (why) · reopen if W`), escalated only when competing readings would produce different irreversible artifacts. Push/deploy stay opt-in — named explicitly, or via completion-intensity phrasing (canonical list in `RULE-release.md` B8, e.g. "trọn vẹn") — and after any push, CI is watched to green (`RULE-release.md` B10) regardless of whether the stack deploys. |
 
 ### Five agent definitions
 
@@ -121,14 +121,15 @@ Each project keeps a root `CLAUDE.md` that references the `akirule` skill as the
 
 Aki-RULE changes affect many projects. Before changing rule files, clarify the intended rule, scope, and tradeoff unless the user explicitly requests the exact change.
 
-### One brain, two modes
+### One brain, three modes
 
-`METHOD-deep-think.md` is a single analytical brain — goal excavation, first principles, mandatory critique, conditional techbiz lens — consumed two ways:
+`METHOD-deep-think.md` is a single analytical brain — goal excavation, first principles, mandatory critique, conditional techbiz lens — consumed three ways:
 
-- **Passive:** `akirule` auto-loads it inline when a normal task hits a signal ("should we…", "is it worth…", tradeoff talk). Applied briefly inside the current answer, at most one clarifying question. Carries a radar rule: if the decision turns out to be one-way-door, large-scope, or goal-ambiguous, it must say "this deserves a `/akithink` session" instead of settling for a shallow pass.
-- **Active:** the user runs `/akithink`, which drives the same METHOD through a full 5-phase interactive protocol at maximum depth and ends with a proposed decision record under `docs/` (plus `/akihtmlreport` when the material is complex).
+- **Passive:** `akirule` auto-loads it inline when a normal task hits a signal ("should we…", "is it worth…", tradeoff talk). Applied briefly inside the current answer, at most one clarifying question.
+- **Triggered self-run:** fired by `agent.A3`'s mandatory deep-think triggers (about to ask/escalate, a one-way-door action, a repeated fix failure, conflicting rules, ambiguous owner wording, a documented-design touch) or by owner authorization. Non-interactive — depth scales to difficulty instead of a fixed round count, and it ends in decide-and-act (reported as `Decided: X · because Y · rejected Z (why) · reopen if W`) or escalates per `agent.A3`'s outcomes, never in a question left hanging or an offer to open `/akithink`.
+- **Active:** the user runs `/akithink`, which drives the same METHOD through a full 5-phase interactive protocol at maximum depth and ends with a proposed decision record under `docs/` (plus `/akihtmlreport` when the material is complex). `/akithink` also has its own non-interactive self-run mode, which collapses to the triggered mode above.
 
-Content-wise, active is a superset of passive; mechanically, only `/akithink` runs the interactive protocol.
+Content-wise, the triggered and active modes are supersets of the passive one; mechanically, only `/akithink`'s default invocation runs the interactive protocol.
 
 ### Update notifications — notify-only
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akinet/akidevrule",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "Aki's shared rule corpus + Agent Skills for Claude Code, Gemini/Antigravity, Codex, Kiro and Grok — install and update with one command.",
   "keywords": [
     "claude-code",

package/payload/METHOD-deep-think.md

@@ -18,14 +18,15 @@ Not every decision deserves the same depth. Before applying any module, size the
 - **Two-way-door (reversible, cheap to undo):** a config flag, a copy change, a small refactor behind a feature branch. Decide fast; do not over-apply this METHOD.
 - **One-way-door (hard/expensive to reverse):** a schema choice, a public API shape, a pricing model, deleting data, an architecture that many things will depend on. Depth of analysis should scale with irreversibility — go through every module deliberately, and prefer `/akithink` over a shallow inline pass.
 
-### A2. One brain, two modes
+### A2. One brain, three modes
 
-This METHOD is consumed two ways:
+This METHOD is consumed three ways:
 
 - **Passive (this file, via akirule):** akirule auto-loads it when a normal task hits a matching signal. Apply the lenses inline, briefly, inside the current answer. Ask at most ONE clarifying question. Never turn a routine task into an interrogation session.
+- **Triggered self-run:** fired by `agent.A3`'s deep-think triggers, or by owner-authorized self-run (`skills/akithink/SKILL.md` § Self-run mode). Non-interactive — run Modules 1–3 and 5 (add 4 when there is business context), depth scaled to difficulty. Ends in decide-and-report or escalate per `agent.A3`'s outcomes, never in a question left hanging.
 - **Active (`/akithink` skill):** the user explicitly opens a full structured thinking session. That skill runs a 5-phase interactive protocol and uses this METHOD as its toolbox at maximum depth.
 
-Content-wise the active mode is a superset of the passive one; mechanically, only `/akithink` runs the interactive protocol.
+Content-wise the triggered and active modes are supersets of the passive one; mechanically, only `/akithink`'s default invocation runs the interactive protocol — its self-run mode collapses to the triggered mode above.
 
 ---
 
@@ -156,7 +157,7 @@ This module decides **when** something is promoted; it does not decide how much
 
 In one line: **the MVP gets the focus, but severity — not ordering — decides when an SFX/EC is promoted, up to and including reopening the MVP.**
 
-**Decide vs ask (once promoted):** first try to resolve it yourself with first-principles and critical thinking — then decide and report. Escalate to the owner only when it is genuinely their call per RULE-agent-behavior Decision boundaries (irreversible, cross-boundary, or unverifiable); do not ask about what basic reasoning already settles.
+**Decide vs ask (once promoted):** first try to resolve it yourself with first-principles and critical thinking — then decide and report. Escalate to the owner only through `agent.A3`'s escalation outcomes; do not ask about what basic reasoning already settles.
 
 ---
 
@@ -166,6 +167,8 @@ In one line: **the MVP gets the focus, but severity — not ordering — decides
 
 When applying this METHOD passively and the decision turns out to be one-way-door (hard to reverse), large in scope, or the goal itself is unclear, do NOT settle for a shallow inline analysis. Say explicitly: "this deserves a dedicated `/akithink` session" and offer to start one.
 
+In a triggered self-run or any autonomous run, do not stop to offer `/akithink` — run the depth yourself per A2 and decide. Offer an interactive `/akithink` session only when `agent.A3`'s escalation criteria hold and owner interaction is genuinely needed.
+
 ---
 
 ## One-line reminder

package/payload/RULE-agent-behavior.md

@@ -37,7 +37,9 @@ Classify every turn before acting: is it **communication** (a question, discussi
 - **Task → execute, do not stall.** Do the requested work within scope; do not turn a clear instruction back into a proposal or a needless confirmation prompt. Report when done, then stop.
 - **Calibrate autonomy by reversibility, not by asking-always.** A reversible, in-scope action gets done and reported; only a genuine one-way door (destructive, outward-facing, scope-expanding, shared config — see B3) is worth pausing to ask. Over-asking on safe work is as much a failure as acting unasked — it trades the user's speed for no real safety.
 - **Three kill-tests before any question reaches the user — failing one means answer it yourself and record the answer.** Reversibility (above) is the fourth. **Impact:** if the user answers against your default, does any artifact change? "The conclusion holds either way" is a default to write down, never a question to ask. **Already authorized:** the request may have settled it — asking the user to re-confirm a course they just ordered charges them twice for one decision. **Silence is not contradiction:** a doc that does not mention X does not conflict with X; that is a one-line gap to close, i.e. a work item, not a question. A question dressed as a "decision with a recommendation" still costs a read and an answer — the shape does not exempt it from these tests.
-- **Analyze first; a surviving question is asked in plain language.** Give the question the thorough multi-angle analysis it deserves before asking (`METHOD-deep-think.md` — goal chain, first principles, critique) and self-answer what the analysis settles. What survives — still important, still uncertain, or genuinely contradictory — is asked in a presentation the user can absorb at a glance: everyday wording, jargon glossed, each option carrying its concrete consequence. A question the user cannot understand costs two interrupts: one to ask, one to explain the asking.
+- **Deep-think trigger (mandatory, self-driven, non-interactive).** When any holds, Read `METHOD-deep-think.md` and run it before acting or asking: (a) about to ask or escalate to the owner; (b) about to take a one-way-door action; (c) the same fix failed a second time, or a third patch lands on one transition (`pattern.B2`); (d) two rules or instructions conflict; (e) the owner's wording admits readings that produce different artifacts; (f) the change touches documented design or goals. Depth scales with difficulty — repeat goal chain → first principles → critique → pre-mortem until the answer converges, never a fixed round count. Trivial reversible work triggers nothing.
+- **Outcome — converged: act, report the decision.** Self-answer what the analysis settles and act; for important or hard calls report one block — `Decided: X · because Y · rejected Z (why) · reopen if W` — so the owner can overrule after the fact instead of being asked before.
+- **Outcome — escalate only when:** a one-way door with outward effect (publish, tag, destructive data change); contradiction with documented design (`B3`); the `coding.C4` security/money/auth floor; the owner's own wording is ambiguous AND the readings lead to different irreversible artifacts; or deep-think does not converge (name exactly where it is stuck). What survives is asked in a presentation the user can absorb at a glance: everyday wording, jargon glossed, each option carrying its concrete consequence, plus the analysis and one recommendation. A question the user cannot understand costs two interrupts: one to ask, one to explain the asking.
 - Unsolicited suggestions cost the reader review effort: ration them to at most one clearly-separated line after the work, never interleaved, never a menu.
 
 ### A4. Report for fast, correct re-orientation
@@ -82,7 +84,7 @@ A worker is a subagent, or the same or another CLI called headlessly (`claude -p
 
 ### B3. Decision boundaries
 Ask before:
-- destructive or hard-to-reverse actions
+- destructive or hard-to-reverse actions — hard-to-reverse means no backup/restore or fix-forward path exists; an action that has one (e.g. an additive migration with a backup, `stack.C8`) climbs `coding.B5`'s ladder instead of asking
 - changing deployment, infrastructure, auth, billing, or shared config assumptions
 - modifying shared rule files, templates, or project-wide conventions
 - large rewrites or broad renames

package/payload/RULE-coding.md

@@ -41,7 +41,7 @@ A principle with the procedure that guarantees it — apply to any edit of code
 - Verify by the **narrowest tool that actually settles the doubt**: static reading and type/lint/unit checks first. Never spin up a full build or dev server just to catch a typo a typecheck would catch.
 - **Static reading IS verification** when the property is fully determined by visible code flow — state what was read as the evidence and close the checklist item on that evidence. Escalate a tier (typecheck → unit → runtime) only when you can name the specific doubt that tier settles.
 - **Never gate a done-transition on human manual testing for a check that static reading or an automated tier settles.** A plan's verify checklist stays fully detailed — the violation is not the checklist, it is parking finished work as "waiting for manual test" on items whose truth the code flow already proves. Hand the human only what genuinely needs human runtime judgment: UX feel, visual rendering, live external integration.
-- **Running the app is not a default verification step — but not running it does not let you claim "Done".** Starting a dev server, making live network calls, or driving a full build/headless screenshot is **user-triggered**, not self-authorized (cost and side effects are the user's call). When a change's real risk lives **only at runtime** — hydration, layout/z-index, route/auth flow, a dynamically-built class a build step may purge — and you cannot settle it statically, you may **not** report "Done": halt and report the state as **"unverified — needs a runtime check"**, propose the exact command, and hand it to the user (see [[RULE-agent-behavior]] A3). "Done" for logic you only compiled is not done.
+- **Running the app is not a default verification step — but not running it does not let you claim "Done".** Starting a dev server or making live network calls stays **user-triggered**, not self-authorized (cost and side effects are the user's call). A full build and the test suite are **not** in that category — they are self-authorized, gated by the moment instead: **after edits** → typecheck/lint/related unit tests, never a full build per edit; **committing a large batch** (spans several modules, or touches build config/dependencies) → add the build; **ship/release/deploy** → full build plus full test suite is mandatory and self-authorized, commands derived per `release.B7` step 6. When a change's real risk lives **only at runtime** — hydration, layout/z-index, route/auth flow, a dynamically-built class a build step may purge — and you cannot settle it statically, you may **not** report "Done": halt and report the state as **"unverified — needs a runtime check"**, propose the exact command, and hand it to the user (see [[RULE-agent-behavior]] A3). "Done" for logic you only compiled is not done.
 - **When a runtime check genuinely needs a human, hand over one ledger, not one per phase.** Collect every human-run check into a single batch at the end of the run, deduped by flow: the same flow is run once, at its final state. Re-running one flow at several milestones is legitimate only when an earlier run is the baseline that makes a later regression attributable — and that reason is written beside it. Three requests to run one launch-and-navigate flow is not three times the verification, it is three interruptions.
 - **A change that requires a separate action against an external system to take effect is not done when the file describing that action is written.** Migrations, remote config, env vars, cache purges, cron/schedule registration — writing the script/config is not the same event as the target system actually reflecting it. Git diff and a green build both stay silent about this gap: neither touches the external system, so both can look complete while the real target (a remote database, a dashboard toggle, a deployed cron) is still on the old state. Verify the action was actually executed **against the real target**, not just that the instructions to perform it exist locally, before reporting "Done" on that change. Domain instantiation: [[RULE-release]] (a release/CHANGELOG entry is not truthful until this holds) and stack-specific execution commands (e.g. `RULE-stack-akiNuxtCf.md` §C8 for D1 migrations).
 

package/payload/RULE-release.md

@@ -1,6 +1,6 @@
 # Release & Versioning Rule
 
-<!-- Address map: release.A1-5 · release.B1-9 · release.C1-4 (⟨Aki⟩) -->
+<!-- Address map: release.A1-5 · release.B1-10 · release.C1-4 (⟨Aki⟩) -->
 
 ## A. Versioning core
 
@@ -142,21 +142,22 @@ Run in order; each step names the rule that owns it.
 3. **External-action completeness** — every change whose "done" depends on something outside the repo actually happened: migrations ran against the real target and their postconditions were checked, remote config/env vars/cron registrations are live, and each script sits in its completion location (B5, [[RULE-coding]] B3). A green build proves nothing about the database.
 4. **Record truthfulness** — every closed problem has its `CHANGELOG.md` entry, and no entry claims something step 3 has not cleared (B2). Web stacks additionally need `releases.json` parity (C3).
 5. **Doc sync — every record surface the accumulation touched, not only `docs/`.** Enumerate, then check each against the diff: plans whose work shipped moved to `docs/plan/done/`; `arch`/`feat` docs match what is about to ship ([[RULE-docs]] B1, B3); `README.md` wherever the accumulation changed setup, commands, layout, or a documented behavior; the project's task-note file when one exists (`.akidevsync/notes.json`, edited only through the `akidevsync-notes` skill — a note whose fix is in this accumulation is marked done with the matching CHANGELOG line, an unmatched or unverified one stays open and is named in the report); and any external standards doc the project `CLAUDE.md` binds the project to, updated in place when the accumulation changed a convention that doc owns. A surface skipped because it was not in `docs/` is the same drift finding as a stale doc.
-6. **Verification honesty** — anything only checkable at runtime is reported as unverified rather than assumed ([[RULE-coding]] B3). "Untested but I expect it works" is a valid gate output; a silent "Done" is not.
-7. **Version decision** — mint or defer per A4/A5's materiality test. Do not mint a version to mark that a session ended.
+6. **Build & test — mirror CI.** Commands are derived, never invented: the jobs `.github/workflows/*` run on push/tag take priority; a repo with no such workflow falls back to the manifest's own scripts (`npm run typecheck`/`build`/`test`, `cargo build`/`cargo test`, equivalent). Run every one of them locally, self-authorized ([[RULE-coding]] B3 — ship/release is the moment full build+test is mandatory, not optional). A failure blocks the gate and is fixed in place, same as step 2. A CI step that cannot be reproduced locally (an other-OS matrix leg, a job needing secrets) is named explicitly and left to B10 to catch post-push. A repo with no build/test command at all says so plainly — that is a finding, not a silent pass. This step sits after 2–5 because those fix code and docs first, and the build must cover what is actually about to ship.
+7. **Verification honesty** — anything only checkable at runtime is reported as unverified rather than assumed ([[RULE-coding]] B3). "Untested but I expect it works" is a valid gate output; a silent "Done" is not.
+8. **Version decision** — mint or defer per A4/A5's materiality test. Do not mint a version to mark that a session ended.
 
-Deploy verification is deliberately **not** in this gate — it happens after the push, against the live target, and is owned by the stack rule.
+Post-push CI is B10; stack deploy verification (C5, `stack.C8`) follows a green CI.
 
-### B8. Autonomous full-release run — only an explicit `/akiship` invocation is the authorization
+### B8. Autonomous full-release run — an explicit release order is the authorization
 
-The B7 gate plus its surrounding ritual (fix findings → sync docs → CHANGELOG/`releases.json` → grouped commits → mint → artifacts) is routinely run as one unattended pass. **Activation is owned by the `/akiship` skill and is literal — this section is not a trigger.** The contract below has force only inside a user turn carrying the exact token `/akiship` that asks for the run to be performed; that skill's activation gate is the single source of truth for what counts (`pattern.A1`). Reading this section grants nothing — not its completion-intensity list, and not the fact that a keyword routed this file into context. Outside a valid invocation those words are ordinary vocabulary, and a turn without the token is answered, never executed (`agent.A3`: a question is not a request). This rule predates the skill and stays for the release-domain signals and narrow release context the skill does not carry; on *whether the run may start*, the skill's gate wins. Nothing here weakens [[RULE-agent-behavior]] B3 elsewhere; it exercises B3's "durably authorized" clause, scoped to the enumerated steps of one explicit invocation.
+The B7 gate plus its surrounding ritual (fix findings → sync docs → CHANGELOG/`releases.json` → grouped commits → mint → artifacts) is routinely run as one unattended pass. **Activation is owned by the `/akiship` skill's gate — this section is not a trigger.** The contract below has force only inside a user turn that gate accepts as a release order — the literal token `/akiship`, or an equally explicit imperative naming the ritual for this repo; that skill's activation gate is the single source of truth for what counts (`pattern.A1`). Reading this section grants nothing — not its completion-intensity list, and not the fact that a keyword routed this file into context. Outside a valid invocation those words are ordinary vocabulary, and a turn that is a question rather than an order is answered, never executed (`agent.A3`: a question is not a request). This rule predates the skill and stays for the release-domain signals and narrow release context the skill does not carry; on *whether the run may start*, the skill's gate wins. Nothing here weakens [[RULE-agent-behavior]] B3 elsewhere; it exercises B3's "durably authorized" clause, scoped to the enumerated steps of one valid invocation.
 
 - **A valid `/akiship` invocation = standing authorization for every enumerated step.** Explicitly invoking the full run authorizes: fixing gate findings, CHANGELOG/`releases.json` edits, grouped commits (the akigitcommit confirm step is pre-answered — "commit luôn" semantics), the version mint per A4/A5, and tag/GitHub Release strictly per the repo's existing convention (A3, B4). Push and deploy are included only when the invocation names them **or carries a completion-intensity signal** (the same trigger set as the next bullet) — a plain `/akiship` with no intensity marker stays local-only; deploy still additionally requires the stack to auto-deploy on push (owned by the stack rule, not this contract).
 - **Front-load the asks.** Derive B1 state and run B7 step 0 first; every escalation found is reported once, as one batch, and the run stops there. A clean front check means the run completes with zero mid-run questions — an automation that stalls on a question halfway through has failed this rule.
 - **Escalation floor (canonical — `/akiship` references this list, never restates it, `pattern.A1`) — stop only for:** (1) public-history ambiguity — cannot determine whether a version actually shipped, or a `Mismatch`/`Drifted` state whose recovery would rewrite published versions (A5, B1); (2) work the tree cannot classify — mid-edit vs abandoned (B7 step 0); (3) contradiction with documented design, or scope beyond what the invocation named ([[RULE-agent-behavior]] B3).
-- **Completion-intensity phrasing collapses condition (2) and unlocks push/deploy/GitHub-Release, never conditions (1) or (3).** The canonical phrase list — every other file (the `/akiship` skill, `README.md`) points here (`pattern.A1`): "trọn vẹn", "hoàn thành"/"hoàn thiện", "làm/xong hết", "tất cả"/"toàn bộ", or equivalent sentiment insisting the run finish everything, end to end — read **only inside a valid invocation**, where it modifies a run already authorized to start and never creates that authorization, does two things: resolves B7 step 0's mid-edit-vs-abandoned ambiguity toward **mid-edit by default** (finish and integrate the leftover instead of stopping to ask), and satisfies the previous bullet's push/deploy naming requirement, so the run pushes commits and tags, creates the GitHub Release, and runs post-push deploy verification (C5) without a separate mid-run confirmation. Conditions (1) and (3) gate on irreversibility (a published-version rewrite) and correctness (a documented-design contradiction), not on effort, so no phrasing intensity waives them — a "nghiêm trọng"/major-contradiction hit still stops the run.
+- **Completion-intensity phrasing collapses condition (2) and unlocks push/deploy/GitHub-Release, never conditions (1) or (3).** The canonical phrase list — every other file (the `/akiship` skill, `README.md`) points here (`pattern.A1`): "trọn vẹn", "hoàn thành"/"hoàn thiện", "làm/xong hết", "tất cả"/"toàn bộ", or equivalent sentiment insisting the run finish everything, end to end — read **only inside a valid invocation**, where it modifies a run already authorized to start and never creates that authorization, does two things: resolves B7 step 0's mid-edit-vs-abandoned ambiguity toward **mid-edit by default** (finish and integrate the leftover instead of stopping to ask), and satisfies the previous bullet's push/deploy naming requirement, so the run pushes commits and tags, creates the GitHub Release, and runs post-push CI watch (B10) and deploy verification (C5) without a separate mid-run confirmation. Conditions (1) and (3) gate on irreversibility (a published-version rewrite) and correctness (a documented-design contradiction), not on effort, so no phrasing intensity waives them — a "nghiêm trọng"/major-contradiction hit still stops the run.
 - **A question the repo already answers is a violation.** Anything determined by the repo, its docs, these rules, or the invocation itself — bump level (A4), tag or no tag (existing convention), changelog channel and tone (C1) — is self-answered, never asked — and every remaining candidate question runs through `agent.A3`'s kill-tests first. Over-asking inside an authorized run is the same failure as acting unasked (`agent.A3`, `think.B5`).
-- **This licence covers facts the repo determines, never what the owner meant.** A criterion stated in the owner's own words — what "trọn vẹn" must include, which leftovers count as debt and which are future plan — is his to define, and deciding it for him is not self-answering but overwriting the anchor. Report the open items and let him rule on them; when it is the owner's own wording that is ambiguous, that is the one question worth the interrupt.
+- **A criterion stated in the owner's own words — what "trọn vẹn" must include, which leftovers count as debt versus future plan — is resolved, not escalated by default.** Derive the default from the anchor wording plus the repo's own records (plans, task notes, CHANGELOG), decide, and list each such call in the report's `agent.A3` decision block (`Decided: X · because Y · rejected Z (why) · reopen if W`) so the owner can overrule after the fact. Ask mid-run only when the competing readings would produce different irreversible artifacts (a published tag, a minted version, a registry publish) — `agent.A3`'s escalation, not a default reflex on ambiguous wording.
 
 ### B9. Registry-published package (npm, crates.io, PyPI, …) — the registry version is the release
 
@@ -166,6 +167,15 @@ A package installed from a registry is a distributed artifact (A5): users get wh
 - **2FA `auth-and-writes` makes `npm publish` the run's single hand-off** (rung 6: the OTP is human-held). Everything else is agent work — push, tag, GitHub Release, tarball verification — so the owner receives one command and the `npm view` check that proves it landed, never a list of prerequisites.
 - **A published version number is burned forever** (`npm unpublish` is time-limited and a number is never reusable), so verify the tarball before publishing: `npm pack --dry-run` against the `files` allowlist, manifest version == CHANGELOG top == tag (A3), and the `bin` executed from the packed tarball installed in the scratchpad. A `bin` that writes to `$HOME` takes the override on its own command — `printf y | HOME="$SANDBOX" bin`, never `HOME="$SANDBOX" printf y | bin`, which scopes the variable to `printf` and runs against the real home.
 
+### B10. Post-push CI — pushed is not passed
+
+After any push or tag push, in any flow (not only `/akiship`): `gh run list --commit <sha>` (plus the tag's own runs), then `gh run watch <id> --exit-status` for each triggered run. The change is not Done until every triggered workflow is green.
+- **Red** → `gh run view <id> --log-failed`, fix forward with a new commit, re-push, re-watch — never rewrite published history.
+- A GitHub Release that CI creates (B4) is confirmed with `gh release view <tag>`.
+- No workflows exist in the repo → say so; there is nothing to watch.
+
+**Evidence.** CI failures went unnoticed because the ritual only verified stack deploys (C5): a non-deploying repo (CLI, library, npm package) had no post-push check at all, so a red workflow could sit unnoticed indefinitely.
+
 ## C. ⟨Aki⟩ Web release artifacts
 
 ### C1. Two separate channels — do not merge them

package/payload/index.md

@@ -18,11 +18,11 @@ Provides reusable rules for agent behavior, coding, content, docs, and stack-spe
 | `RULE-stack-tauri.md` | `tauri` | Contextual | public | Tauri v2 + Rust: absolute never-block-the-UI rule for any command running a subprocess/network call (`spawn_blocking`), titlebar boundary, version SSOT, IPC capability silent-fail, serde default for persisted JSON, cfg(target_os) scoping, subprocess PATH-resolution cold-start race, salient target context (ship platform) surfaced in the project CLAUDE.md, macOS TCC/Gatekeeper boundary for spawned sidecars (responsible-process attribution, FDA vs Files & Folders vs Developer Tools, sticky denials, ad-hoc signing losing grants on every rebuild, and the read-only scope limit of the whole chain) |
 | `RULE-ui-pattern.md` | `ui` | Contextual | public | Frontend enforcement of pattern-core: subtraction pass before any tier (delete/inherit/hoist — the ladder packages repetition, only this removes it), 4-tier class taxonomy with the second copy as the STOP (the ≥3 threshold is repo-wide and unobservable inside one file), inline `style=` as a runtime-only escape hatch, `<style>`-block budget measured in aggregate against the shared layer, design tokens in whichever mechanism the installed framework version uses with one theme source per project, arbitrary-value policy, atomic structure, variant API, two-way lookup-then-record pattern duty, UI audit/refactor playbook led by the inversion check |
 | `RULE-seo.md` | `seo` | Contextual | **mixed** — group C is ⟨Aki⟩ | Meta limits, schema.org matrix, robots, sitemap, OG, AI visibility, entity linking |
-| `RULE-release.md` | `release` | Contextual | **mixed** — group C is ⟨Aki⟩ | CHANGELOG.md mandatory in every project, release notes vs changelog split, GitHub Release compare-link footer, releases.json (web-only), release vs deploy boundary, cold-start version reconstruction, severity-driven bump, version minted only at the release event (`[Unreleased]` buffer, no local drift ahead of production), audit mode, pre-ship gate expanded into the full-release checklist (B7: leftover triage, diff-scoped hygiene — scythe/dead-code/comment-refs on the accumulation only, never repo-wide), autonomous-run contract (B8: only an explicit `/akiship` invocation is the authorization — activation owned by that skill's literal-token gate, this rule is never itself a trigger; asks front-loaded into one batch, three-case escalation floor and completion-intensity phrase list owned solely by B8 (the `/akiship` skill references, never restates them), redundant questions forbidden; entry point `/akiship`), registry-published packages (B9: the registry version is the release, publish mechanism derived from existing convention and sibling packages, account/scope/2FA probed, OTP publish as the single hand-off, tarball verified before the irreversible publish) |
+| `RULE-release.md` | `release` | Contextual | **mixed** — group C is ⟨Aki⟩ | CHANGELOG.md mandatory in every project, release notes vs changelog split, GitHub Release compare-link footer, releases.json (web-only), release vs deploy boundary, cold-start version reconstruction, severity-driven bump, version minted only at the release event (`[Unreleased]` buffer, no local drift ahead of production), audit mode, pre-ship gate expanded into the full-release checklist (B7: leftover triage, diff-scoped hygiene, build & test mirroring CI as a mandatory step before verification honesty and the version decision), autonomous-run contract (B8: an explicit release order is the authorization — activation owned by akiship's own gate, this rule is never itself a trigger; asks front-loaded into one batch, three-case escalation floor and completion-intensity phrase list owned solely by B8, owner-worded criteria decided and reported rather than escalated by default; entry point `/akiship`), registry-published packages (B9: the registry version is the release, publish mechanism derived from existing convention and sibling packages, account/scope/2FA probed, OTP publish as the single hand-off, tarball verified before the irreversible publish), post-push CI watch (B10: a push or tag push is not Done until every triggered workflow is green, red fixed forward with a new commit never a history rewrite) |
 | `RULE-db-design.md` | `db` | Contextual | public | Immutability & Event Sourcing, 1NF, Bounded Context (DDD), flat-query discipline — load when designing schema/migration/DB refactor |
 | `RULE-biz.md` | `biz` | Contextual | public | Positioning & audience (one primary audience, falsifiable USP, `docs/biz/` as SSoT, niche-first), offer & pricing (value-based, few tiers, validate before building), messaging & customer psychology (benefit-first, anxiety at decision points, no dark patterns) — load on any market-facing decision |
 | `METHOD-audit-flow.md` | `flow` | Analytical | public | Flow integrity audit method |
-| `METHOD-deep-think.md` | `think` | Analytical | public | Deep-think brain: goal excavation, first principles, critique, conditional techbiz lens; passive via akirule, active via /akithink |
+| `METHOD-deep-think.md` | `think` | Analytical | public | Deep-think brain: goal excavation, first principles, critique, conditional techbiz lens; passive via akirule, active via /akithink, triggered self-run via `agent.A3` |
 | `METHOD-ux-psych.md` | `ux` | Analytical | public | UX psychology audit: cognitive-load/recognition/feedback/defaults/motor-cost/mental-model lenses, persona walkthrough protocol (first-run, friction ledger, failure paths, state completeness), severity-weighted output routed through the design system |
 | `METHOD-audit-zero-trust.md` | `zero-trust` | Analytical | public | Strict mechanical-first audit: scope locked by command (project-wide or change-plus-callers), detectors run before any opinion, findings split into CERTAIN (exact machine match — a verdict) vs SUGGESTED (pattern/naming — a candidate judgment must settle), signature propagation across the locked scope, short findings-only report. Read-only like every audit |
 | `METHOD-proportionality.md` | `proportion` | Analytical | public | Sizing a defense against its real threat: four measures before any verdict (reach against the `docs/biz/` audience, capability ladder, motive, blast radius by recoverability), every number labeled measured or estimated; asymmetry law (irreversibility outranks frequency), the `coding.C4`/`biz.C3` floor that is never sizeable, the cheapest-sufficient-control ladder (impossible by shape → one trust boundary → detect → accept-and-record) with client-side limits classified as UX and never enforcement; verdict record carries a reopen trigger. Seated in akiflow as `risk-sizing` |
@@ -68,12 +68,12 @@ Some subjects legitimately live in several files: one **root rule** stating the
 | Subject | Root | Domain applications |
 |---|---|---|
 | **Naming** | `pattern.A7` — name by role, never by concrete value | `agent.C1` file names · `ui.A` design tokens · `stack.C1` ⟨Aki⟩ canonical component names · `release.A3` version/tag format · `content.A3` semantic stability (renaming an existing concept) |
-| **External-action completeness** ("done" needs the outside world to move, not just the file) | `coding.B3` — a change requiring a separate action against an external system isn't done when the file describing it is written | `release.B5` ⟨Aki⟩ CHANGELOG/release entry not truthful until a migration/infra step actually ran · `stack.C8` ⟨Aki⟩ D1 migration must run `--remote` and move to `scripts/done/`, a green build alone proves nothing about the database |
+| **External-action completeness** ("done" needs the outside world to move, not just the file) | `coding.B3` — a change requiring a separate action against an external system isn't done when the file describing it is written | `release.B5` ⟨Aki⟩ CHANGELOG/release entry not truthful until a migration/infra step actually ran · `stack.C8` ⟨Aki⟩ D1 migration must run `--remote` and move to `scripts/done/`, a green build alone proves nothing about the database · `release.B10` a push or tag push is not Done until every triggered CI workflow is confirmed green |
 | **Audit reports, never fixes** (and the output depends on whether the baseline is stable) | `agent.B5` — an audit writes only its report; never mutates git state, never auto-classifies ambiguous work | `docs.C` docs-vs-reality, research+plan doc pair on a published baseline · `content.C2` canonical-term drift, density deletion test, i18n coverage sweeps · `release.B7` pre-ship pass/fail gate, no doc · `ui.C` class/token audit playbook · `flow` flow and state drift · `zero-trust` mechanical-first strict sweep, evidence weighted by the mechanism that produced it · `subtract` repo-wide does-this-need-to-exist sweep, terminating on two dry rounds |
 | **Sizing a control against its real threat** (severity is impact **and** who can actually reach it) | `proportion.A` — reach, capability, motive, blast radius, each labeled measured or estimated, before any guard is added, kept, or removed | `coding.C1` no defensive guards for impossible internal states · `coding.C4` the security floor this sizing never argues below · `pattern.A2` risk-weighted extraction at the 2nd occurrence for auth/money/permissions · `think.A1` one-way vs two-way door depth · `think.B5` when an edge-case is promoted above the MVP · `ux.C1` findings ranked by severity, never padded flat |
 | **Density — the deletion test** (a line exists only if deleting it loses information the reader needs) | `agent.A4` — report density: conclusion-first, no padding, no trimming of load-bearing detail | `coding.B4` code comments (naming first; comment only what code cannot say) · `docs.B3` doc prose · `content.B2` product copy · akiflow Step 4 output-hygiene floor (the enforcement tier for subagents, which inherit no router) · mechanical detection: `skills/akiflow/scripts/scythe.py` (`[WRAP]`/`[YAP]` only — `[FLUFF]` stays judgment, `agent` §0) |
 | **Subtraction before abstraction** (packaging repetition is second-best; not needing it is first) | `think.B4` — what can be deleted, skipped, merged, delayed, or made manual | `pattern.B3` first bullet of the critique gate · `ui.A1` delete/inherit/hoist pass ahead of the tier ladder · `subtract` the repo-wide audit form of the same question, read-only and detector-driven · akiflow's `aki-challenger`, which closes every solution-shaped item on "what can be cut?" |
-| **Interrupting the owner** (a question must survive the kill-tests before it costs a read and an answer) | `agent.A3` — impact, already-authorized, silence≠contradiction, with reversibility as the fourth | `coding.B3` one human hand-off ledger per run, deduped by flow · `coding.B5` the six-rung ladder a check must fail before it may be handed to the owner at all, and the one-line reason each survivor carries · `release.B8` a question the repo already answers is a violation · akiflow Step 4 seat-raised `CONFLICT` filtered through the lead's kill-test pass |
+| **Interrupting the owner** (a question must survive the kill-tests before it costs a read and an answer) | `agent.A3` — impact, already-authorized, silence≠contradiction, reversibility as the fourth, plus escalation outcomes and a `Decided: X · because Y · rejected Z (why) · reopen if W` decision block for what does get self-answered | `coding.B3` one human hand-off ledger per run, deduped by flow · `coding.B5` the six-rung ladder a check must fail before it may be handed to the owner at all, and the one-line reason each survivor carries · `release.B8` a question the repo already answers is a violation; owner-worded criteria decided and reported, escalated only when readings diverge on an irreversible artifact · akiflow Step 4 seat-raised `CONFLICT` filtered through the lead's kill-test pass |
 
 Add a lens row only when a subject has actually caused a miss — `pattern.A2` (Rule of Three) applies to this rule corpus too, and so did a real production incident where a migration script shipped in CHANGELOG but was never executed against remote D1 (2026-07-23).
 

package/skills/akigitcommit/SKILL.md

@@ -80,6 +80,6 @@ These exist because a later `git add` can swallow files meant for an earlier com
 
 ## Boundaries
 
-- **Never push.** Only commit. Push only when the user explicitly asks.
+- **Never push.** Only commit. Push only when the user explicitly asks — and once pushed, watch CI per `release.B10`.
 - Do not amend, rebase, reset, or rewrite existing commits unless explicitly told.
 - If the tree is clean (nothing to commit), say so and stop.

package/skills/akihelp/SKILL.md

@@ -19,7 +19,7 @@ Invoke with `/akihelp`, or when the user asks what's available in this setup ("w
    - **Skills (active, user-invoked)** — one row per aki-skill: its `/name`, its one-line description (from frontmatter), and when to reach for it.
    - **Agent definitions (who the work gets handed to)** — one row per installed `aki-` agent from step 3: what it is for, and the property that is mechanical rather than promised (its `tools:` list, which is what makes a read-only agent actually read-only, and its `model:`, so a tier is never improvised). Say the thing people get wrong: this is a catalog, not a roster — an agent is spawned because a specific requirement needs it, never because it exists.
    - **Passive system (akirule)** — explain the 3 tiers: Core rules always loaded every turn; Contextual/Analytical rules auto-loaded on signal match; full load via an explicit phrase ("nạp full", "load all rules"). Note that `akirule` itself is hidden from the `/` menu by design (`user-invocable: false`) — it runs passively, not as a command.
-   - **One brain, two modes** — `METHOD-deep-think.md` is read passively by akirule inside normal tasks (brief, inline, at most one clarifying question) and actively by `/akithink` (full 5-phase interactive session for big/hard-to-reverse/goal-ambiguous decisions). Short version of the comparison, not the full METHOD text.
+   - **One brain, three modes** — `METHOD-deep-think.md` is read passively by akirule inside normal tasks (brief, inline, at most one clarifying question), as a triggered self-run when an `agent.A3` deep-think trigger holds (non-interactive, depth scaled to difficulty, ends in decide-and-report or escalation), and actively by `/akithink` (full 5-phase interactive session for big/hard-to-reverse/goal-ambiguous decisions). Short version of the comparison, not the full METHOD text.
    - **Editing rules** — this whole system is generated from a source repo (akidevrule); the installed copies under `~/.aki/akidevrule` and `~/.claude` are deployed output, never edited directly. Changes go through the source repo + `install.sh`. Note for context: the same skill corpus (not the rule corpus) is also synced by `install.sh` to Antigravity/Gemini and to Codex, Kiro, and Grok CLIs on this machine if present — this skill itself only introduces the Claude Code side.
 
 5. Render a **painpoint → what to say** table. This is the section most people actually need: a capability list tells them what exists, this tells them which words to type when a specific problem is in front of them. Build every row from what steps 1–3 actually returned, and **drop any row whose skill or rule file did not appear there** — a row pointing at something uninstalled is worse than a missing row.

package/skills/akirule/SKILL.md

@@ -68,10 +68,11 @@ Load if message or file path contains any of:
 - **Keywords:** `release`, `release note`, `release notes`, `changelog`, `CHANGELOG`, `version`, `versioning`, `semver`, `bump`, `bump version`, `major.minor.patch`, `releases.json`, `phát hành`, `phiên bản`, `cập nhật phiên bản`, `nâng version`
 - **Paths:** `CHANGELOG.md`, `app/data/releases.json`, `pages/releases/**`
 - **Keywords (pre-ship gate):** `chưa push`, `trước khi push`, `trước khi deploy`, `sắp release`, `chuẩn bị ship`, `pre-release`, `ready to ship`, `xong chưa`, `đã xong hết chưa`
-- **Keywords (release-ritual context — these load this rule file, they never start a run; execution needs a literal `/akiship` per that skill's activation gate):** `akiship`, `full release`, `release trọn gói`, `chạy full release`, `ship đợt này`, `ship trọn gói`
+- **Keywords (release-ritual context — these load this rule file, they never start a run; activation is owned entirely by akiship's own gate, an imperative release order):** `akiship`, `full release`, `release trọn gói`, `chạy full release`, `ship đợt này`, `ship trọn gói`
 - **Keywords (commit/push/deploy — load even without an explicit "release" word):** `commit`, `git commit`, `push`, `git push`, `deploy`, `deployment`, `git tag`, `ship it`, `commit và push`, `push lên`, `đẩy lên`, `triển khai`
 - **Keywords (registry publish — `release.B9`):** `npm publish`, `publish`, `npm`, `npx`, `registry`, `crates.io`, `cargo publish`, `PyPI`, `twine`, `2FA`, `OTP`, `lên npm`
-- **Actions:** committing or pushing code, deploying, shipping a change that should be recorded for users or maintainers; bumping a version; checking whether finished-but-unpushed work is actually shippable (`release.B7`); running the full release ritual unattended (`release.B8`, `/akiship`)
+- **Keywords (post-push CI — `release.B10`):** `CI`, `GitHub Actions`, `workflow run`, `gh run`, `CI fail`, `CI đỏ`, `build fail`, `test fail`
+- **Actions:** committing or pushing code, deploying, shipping a change that should be recorded for users or maintainers; bumping a version; checking whether finished-but-unpushed work is actually shippable (`release.B7`); running the full release ritual unattended (`release.B8`, `/akiship`); verifying CI after a push (`release.B10`)
 
 ### RULE-stack-tauri.md
 **Default ON for any Tauri project context.** Skip only when the task is provably unrelated to the Tauri/Rust backend (pure frontend copy change with no `src-tauri` involvement, isolated doc edit). Load if message or file path contains any of:
@@ -108,8 +109,8 @@ Load if message contains any of:
 
 ### METHOD-deep-think.md
 Load if message contains any of:
-- **Keywords:** `new feature`, `tính năng mới`, `should we`, `có nên`, `simplest way`, `đơn giản nhất`, `is this worth`, `có đáng`, `tradeoff`, `scope creep`, `mở rộng scope`, `premature`, `complexity`, `abstraction`, `tooling`, `first principles`, `tư duy nguyên bản`, `phản biện`, `mục tiêu tối thượng`, `one-way door`, `quyết định lớn`, `decision record`, `pre-mortem`, `evaluate`, `assess`, `review the approach`, `worth refactoring`, `good idea`, `side effect`, `edge case`, `đánh giá`, `bàn luận`, `nên refactor`, `đánh giá ý tưởng`, `đánh giá chiến lược`, `tác dụng phụ`, `trường hợp biên`
-- **Context:** architectural or tooling decision, scope or effort/value discussion, a big or hard-to-reverse decision, a request for first-principles/critique-style thinking, or *discussing/evaluating* (rather than just executing) a refactor, a code review, a strategy/plan, or an idea — the four cases that trigger Module 5 (MVP focus, side-effects/edge-cases weighed by severity)
+- **Keywords:** `new feature`, `tính năng mới`, `should we`, `có nên`, `simplest way`, `đơn giản nhất`, `is this worth`, `có đáng`, `tradeoff`, `scope creep`, `mở rộng scope`, `premature`, `complexity`, `abstraction`, `tooling`, `first principles`, `tư duy nguyên bản`, `phản biện`, `mục tiêu tối thượng`, `one-way door`, `quyết định lớn`, `decision record`, `pre-mortem`, `evaluate`, `assess`, `review the approach`, `worth refactoring`, `good idea`, `side effect`, `edge case`, `đánh giá`, `bàn luận`, `nên refactor`, `đánh giá ý tưởng`, `đánh giá chiến lược`, `tác dụng phụ`, `trường hợp biên`, `leo thang`, `hỏi owner`, `mâu thuẫn`, `bế tắc`, `thử lại vẫn lỗi`, `tự chốt`
+- **Context:** architectural or tooling decision, scope or effort/value discussion, a big or hard-to-reverse decision, a request for first-principles/critique-style thinking, *discussing/evaluating* (rather than just executing) a refactor, a code review, a strategy/plan, or an idea — the four cases that trigger Module 5 (MVP focus, side-effects/edge-cases weighed by severity) — plus, at extra sensitivity: about to ask or escalate to the owner, a fix that failed twice, conflicting rules/instructions, owner wording with multiple readings. `agent.A3` is the mechanical floor for escalation; this line is additional routing sensitivity on top of it, not a replacement.
 
 ### METHOD-proportionality.md
 Load if message contains any of:

package/skills/akiship/SKILL.md

@@ -1,24 +1,26 @@
 ---
 name: akiship
-description: Full release ritual end-to-end — front-loaded checks, then an unattended pass. ACTIVATION IS LITERAL: this skill runs only on a user turn containing the exact token `/akiship` that asks for the run to be performed. Nothing else activates it — not the bare word "akiship", not a release-flavored paraphrase, and never a completion-intensity phrase on its own ("trọn vẹn" and its siblings — canonical list in RULE-release.md B8): outside a valid invocation those are ordinary vocabulary carrying zero authorization to fix, commit, push, tag, or release. `/akiship` inside a question means consult the checklist and answer in chat — read-only. Sequences RULE-release.md B7's checklist under the B8 autonomy contract; the escalation floor, completion-intensity semantics, and push/deploy authorization are owned by B8 and referenced, never restated, here.
+description: Full release ritual end-to-end — front-loaded checks, then an unattended pass. ACTIVATION = an imperative turn ordering the release for this repo — the literal token `/akiship`, or an explicit ship/release order ("release trọn vẹn đi", "chạy full release"). A question about it, or a completion word with no release object ("làm cho trọn vẹn"), activates nothing — consult the checklist and answer in chat, read-only. Sequences RULE-release.md B7's checklist under the B8 autonomy contract; the escalation floor, completion-intensity semantics, and push/deploy authorization are owned by B8 and referenced, never restated, here.
 ---
 
 # akiship — one-command full release
 
-Invoke with the literal `/akiship`, and only as described in § Activation gate below. Goal: replace the daily hand-typed ritual ("resolve leftovers, sync every doc, lint, fix drift, changelog, commit, release…") with one invocation that runs to completion or stops once, early, with every blocker in a single batch.
+Invoke with `/akiship` or an explicit release order, only as described in § Activation gate below. Goal: replace the daily hand-typed ritual ("resolve leftovers, sync every doc, lint, fix drift, changelog, commit, release…") with one invocation that runs to completion or stops once, early, with every blocker in a single batch.
 
 **This skill sequences; it does not own content.** The checklist is `RULE-release.md` B7 and the autonomy/escalation contract is B8 — read that file first (installed at `~/.aki/akidevrule/RULE-release.md`), plus `RULE-docs.md` for the doc-sync step. If a step here ever disagrees with the rule file, the rule file wins — except the activation gate below, which this skill owns outright (`pattern.A1`) and which no rule file, keyword list, or routing table may widen.
 
 ## Activation gate — two conditions, both required, checked before anything else
 
-**1. The literal token.** The current user turn contains the exact string `/akiship`. Nothing else activates this skill: not the bare word "akiship", not a release-flavored paraphrase ("release trọn gói", "chạy full release", "ship đợt này"), and above all not a completion-intensity phrase standing on its own (e.g. "trọn vẹn" — canonical list: `release.B8`). Those are how an owner talks while thinking about finishing something — reading one as an invocation turns a conversation into a push to a public remote. Seeing this file, or `release.B8`, in context is not an invocation either: being loaded is not being called.
+**1. Release order.** The current user turn carries either the exact token `/akiship`, or a turn explicitly ordering the release ritual for this repo — "release trọn vẹn đi", "ship đợt này luôn", "chạy full release". A completion-intensity phrase with no release object ("làm cho trọn vẹn") activates nothing: it names no ritual, so it is ordinary vocabulary about finishing something, not an order to run this skill. Seeing this file, or `release.B8`, in context is not an invocation either: being loaded is not being called.
 
-**2. Imperative, not interrogative** (`agent.A3`). The token alone authorizes nothing — the turn must ask for the run to be *performed*.
+**2. Imperative, not interrogative** (`agent.A3`). The order alone authorizes nothing — the turn must ask for the run to be *performed*. Where both readings are available, consult.
+
+**Why the token is not required.** The incident phrase ("tóm lại cần làm gì để trọn vẹn", `docs/research/akiship-literal-activation-aug22.md`) fails both conditions independently — no release object, and interrogative — and `agent.A3` alone was already resident when it misfired, which is why condition 1 stays a mechanical release-object check rather than judgment; the literal token on top adds only false negatives on a plainly-worded release order.
 
 | Turn | Mode |
 |---|---|
-| `/akiship` · "thực hiện /akiship trọn vẹn" · "chạy /akiship đi" | **execute** — run the phases below |
-| "nếu chạy /akiship thì cần gì để trọn vẹn?" · "/akiship sẽ làm những gì?" · "/akiship có push không?" | **consult** — read the checklist below and answer in chat what the run would do and what is still open on this tree; edit no file, no commit, no push, no tag, no release |
+| `/akiship` · "release trọn vẹn đi" · "chạy full release" · "ship đợt này luôn" | **execute** — run the phases below |
+| "nếu chạy /akiship thì cần gì để trọn vẹn?" · "/akiship sẽ làm những gì?" · "làm cho trọn vẹn" (no release object) | **consult / no activation** — read the checklist below and answer in chat what the run would do and what is still open on this tree; edit no file, no commit, no push, no tag, no release |
 
 Consult is the default whenever both readings are available. A withheld execution costs one extra turn; a wrongly performed one costs a published push that cannot be taken back (`agent.A3` — calibrate by reversibility).
 
@@ -31,21 +33,23 @@ Consult is the default whenever both readings are available. A withheld executio
 
 ## Phase 2 — gate, fixing in place
 
-Run B7 steps 2–6 in order, fixing findings as they surface (this is a gate, not an audit — no findings doc):
+Run B7 steps 2–7 in order, fixing findings as they surface (this is a gate, not an audit — no findings doc):
 
 - **Hygiene, diff scope only**: `python3 ~/.claude/skills/akiflow/scripts/scythe.py <files changed since boundary>` for `[WRAP]`/`[YAP]`; dead code / redundant guards / duplication the accumulation introduced (`pattern.A8`); doc refs in touched comments still resolve (`docs.B3`). Never widen to the whole repo.
-- External-action completeness — a pending migration qualifying under `stack.C8`'s execution-ownership clause (additive, idempotent, backup path available) is run here, not deferred; record truthfulness (CHANGELOG + `releases.json` parity where it exists), doc sync over every record surface B7 step 5 enumerates (plans → `done/`, `arch`/`feat` stamps per `docs.A4`, `README.md`, the task-note file via `akidevsync-notes`, any standards doc the project `CLAUDE.md` binds to), verification honesty — anything else runtime-only, or a migration that does not qualify, is carried to the final report as **unverified**, never silently assumed (`coding.B3`).
+- External-action completeness — a pending migration qualifying under `stack.C8`'s execution-ownership clause (additive, idempotent, backup path available) is run here, not deferred; record truthfulness (CHANGELOG + `releases.json` parity where it exists), doc sync over every record surface B7 step 5 enumerates (plans → `done/`, `arch`/`feat` stamps per `docs.A4`, `README.md`, the task-note file via `akidevsync-notes`, any standards doc the project `CLAUDE.md` binds to).
+- **Build & test — mirror CI (B7 step 6)**: derive commands from `.github/workflows/*` first, else the manifest's own scripts; run them all locally; a failure blocks and is fixed in place, same as the hygiene step above; a CI-only leg (other-OS matrix, secrets) is named and left to `release.B10`.
+- Verification honesty — anything else runtime-only, or a migration that does not qualify above, is carried to the final report as **unverified**, never silently assumed (`coding.B3`).
 
 ## Phase 3 — commit, mint, artifacts
 
 1. Commit in logical groups per `/akigitcommit` (domain-grouped mode; anti-stage-loss rules apply in full). B8 pre-answers its confirmation step — "commit luôn" semantics.
 2. Version decision per `release.A4`/`A5`: mint exactly once at the highest accumulated severity, or defer on the materiality test. Deferring is a normal outcome, not a failure.
 3. Artifacts per the repo's own convention: bare tag only if the repo already tags (`release.A3` B8 exception); GitHub Release per `release.B4`; `releases.json` sync check per `release.C4`; registry publish per `release.B9` — tarball verified first, and an OTP-gated publish is the report's single hand-off with its `npm view` check.
-4. **Push / deploy only if B8's push/deploy authorization holds for this invocation (named explicitly, or completion-intensity phrasing per `release.B8`).** Otherwise the run stays local-only. If pushed and the stack deploys, run live verification per `release.C5` afterward.
+4. **Push / deploy only if B8's push/deploy authorization holds for this invocation (named explicitly, or completion-intensity phrasing per `release.B8`).** Otherwise the run stays local-only. After any push, watch CI per `release.B10` — always, regardless of stack. If the stack additionally deploys on push, run live deploy verification per `release.C5` once CI is green.
 
 ## Report
 
-One dense summary (`agent.A4`): state derived → findings fixed (counts per gate step) → commits made → version minted or deferred with the reason → artifacts created → anything left **unverified**, each with the exact command that would settle it.
+One dense summary (`agent.A4`): state derived → findings fixed (counts per gate step) → commits made → version minted or deferred with the reason → artifacts created → CI results (`release.B10`) → any owner-worded criteria self-decided this run, as an `agent.A3` decision block (`Decided: X · because Y · rejected Z (why) · reopen if W`) → anything left **unverified**, each with the exact command that would settle it.
 
 ## Boundaries
 

package/skills/akithink/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: akithink
-description: Structured deep-thinking session between agent and human for important decisions — restate the problem, excavate the goal chain to the ultimate goal, first-principles decomposition (facts/constraints/assumptions), mandatory critique (steelman, inversion, pre-mortem), then converge into a decision record. For big / hard-to-reverse / goal-ambiguous problems — small inline questions are already covered passively by akirule + METHOD-deep-think. Recommends running on a top-tier model (Opus/Fable).
+description: Structured deep-thinking session between agent and human for important decisions — restate the problem, excavate the goal chain to the ultimate goal, first-principles decomposition (facts/constraints/assumptions), mandatory critique (steelman, inversion, pre-mortem), then converge into a decision record. For big / hard-to-reverse / goal-ambiguous problems — small inline questions are already covered passively by akirule + METHOD-deep-think. Also runnable self-run (non-interactive) when owner-authorized or fired by an `agent.A3` trigger. Recommends running on a top-tier model (Opus/Fable).
 ---
 
 # akithink — structured deep-thinking session
@@ -54,6 +54,14 @@ Then:
 - **Anti-sycophancy:** same rule as METHOD Module 3 — do not agree without critique, in any phase.
 - **Anti-overuse guard:** if the problem turns out to be small and reversible once restated in Phase 1, say so and offer to just decide it directly instead of running the full protocol.
 
+## Self-run mode
+
+Runs all phases without waiting, when the owner authorizes the agent to run it itself (e.g. "tự nạp /akithink", "tự chốt", "cho bạn tự quyết") or when fired by an `agent.A3` deep-think trigger:
+- Phase 1 restatement is written, not confirmed.
+- The Interaction rules pacing (1–2 questions per turn) does not apply — no questions are asked mid-session.
+- Questions reach the owner only via `agent.A3`'s escalation outcomes, never through this skill's own turn-by-turn interaction.
+- Phase 5 converges, acts, and reports the decision block (`agent.A3`'s converged outcome). A decision-record doc per `RULE-docs.md` still applies when the decision is durable.
+
 ## Invocation scope
 
-This skill is **explicit-invoke only** — akirule does not auto-trigger it. The signals that matter for auto-loading live on `METHOD-deep-think.md` (passive mode); this skill itself is reached only when the user asks for it by name or in equivalent words.
+Interactive mode is explicit-invoke only — akirule does not auto-trigger the interactive protocol; it is reached only when the user asks for it by name or in equivalent words. Self-run mode above is the exception: it fires from an `agent.A3` trigger or owner authorization, without an explicit `/akithink` invocation. The signals that matter for passive-mode auto-loading live on `METHOD-deep-think.md`.