@amsterdamdatalabs/enact-extensions 0.1.51 → 0.1.55

package/extensions/enact-repo/skills/to-feature/SKILL.md

@@ -8,7 +8,7 @@ disable-model-invocation: true
 
 Open a **Feature** on the board and give it a plan folder to live in.
 
-**A plan is a Feature, and a Feature is a directory** — `features/az<id>-<slug>/spec.md`, named for the work item it is. This skill creates that Feature and that directory; `to-workitems` later fills its `items/` with PBIs and Bugs parented under it. Where the repo carries a `plans/AGENTS.md`, it governs; otherwise follow the global `## Plans and work items` contract in your host's agent instructions.
+**A plan is a Feature, and a Feature is a directory** — `plans/features/az<id>-<slug>/spec.md`, named for the work item it is. This skill creates that Feature and that directory; `to-workitems` later fills its `items/` with PBIs and Bugs parented under it. Where the repo carries a `plans/AGENTS.md`, it governs; otherwise follow the global `## Plans and work items` contract in your host's agent instructions.
 
 Do NOT interview the user — synthesize what you already know from the conversation and the codebase.
 
@@ -72,7 +72,7 @@ workitem_create_or_update({
 
 ### 6. Record the id, then verify the link landed
 
-Create `features/az<id>-<slug>/` — named with the id the create call just returned, which is the only name it ever has — and write the drafted spec into its `spec.md` with `work_item:` set to that id and `epic:` carried through. Do this **immediately**, before anything else: a crash then leaves a folder that says what exists on the board, rather than a Feature nobody can trace back to a plan.
+Create `plans/features/az<id>-<slug>/` — named with the id the create call just returned, which is the only name it ever has — and write the drafted spec into its `spec.md` with `work_item:` set to that id and `epic:` carried through. Do this **immediately**, before anything else: a crash then leaves a folder that says what exists on the board, rather than a Feature nobody can trace back to a plan.
 
 Leave `items/` uncreated. A Feature whose items do not exist yet is the normal resting state of a fresh plan, not an unfinished one.
 

package/extensions/enact-repo/skills/to-feature/references/FEATURE-SPEC-TEMPLATE.md

@@ -1,6 +1,6 @@
 # The plan document
 
-`features/az<id>-<slug>/spec.md`. **This file IS the Feature** — the long form of its work
+`plans/features/az<id>-<slug>/spec.md`. **This file IS the Feature** — the long form of its work
 item, not a parallel copy. `## Problem` and `## Solution` are its Description; `## Acceptance
 criteria` is its Acceptance Criteria field. If the two ever differ, the board is lying.
 
@@ -52,11 +52,12 @@ Non-goals: [what a reader would wrongly assume is included]
 
 ## Items
 
-Order and dependencies. What each delivers lives in its own file under `items/`.
+Order and dependencies. Each row is the complete source for an item that does not have a file
+until `to-workitems` allocates its id.
 
-| # | Item | Work item | Predecessor |
-| --- | --- | --- | --- |
-| 1 | `az<id>-<slug>.md` | <id> | — |
+| # | Title | Item type | Delivers | Verification | Work item | Predecessor |
+| --- | --- | --- | --- | --- | --- | --- |
+| 1 | [the outcome this slice delivers] | pbi | [the complete vertical slice] | [a falsifiable check] |  | — |
 
 ## Verification
 

package/extensions/enact-repo/skills/to-workitems/SKILL.md

@@ -17,13 +17,13 @@ Put a plan's **backlog items** on the board.
 ## Do Not Use When
 
 - The plan has open decisions under `## Decisions` — resolve them first, or chart the effort with `wayfinder` if the destination itself is still unclear.
-- `epic:` or `feature:` is unset. **Stop and ask.** Never create an Epic or Feature to fill the gap: a typo must fail here, not silently spawn a duplicate. The server refuses a stray Epic outright, and refuses a wrong-*typed* parent for any creatable type — but a right-typed id can still be the **wrong** one, and nothing on the board catches that. Identity is on you.
+- `epic:` or `work_item:` is unset. **Stop and ask.** Those are the plan's Epic id and Feature id respectively. Never create an Epic or Feature to fill the gap: a typo must fail here, not silently spawn a duplicate. The server refuses a stray Epic outright, and refuses a wrong-*typed* parent for any creatable type — but a right-typed id can still be the **wrong** one, and nothing on the board catches that. Identity is on you.
 
 ## Process
 
 ### 1. Read the plan and check the board
 
-`workitem_list_or_get({ id: <feature>, raw: true })` and assert:
+`workitem_list_or_get({ id: <work_item>, raw: true })` and assert:
 
 - `fields['System.WorkItemType']` is `Feature`
 - `links.parent` is `epic`
@@ -65,14 +65,15 @@ In `## Items` order, predecessors first — that is what makes `predecessors` ex
 workitem_create_or_update({
   type: <item_type: pbi -> 'Product Backlog Item', bug -> 'Bug'>,
   title: <the item's title>,
-  description: <the body, per references/TICKET-TEMPLATES.md>,
-  parentId: <the plan's feature>,
+  description: <the row's Delivers plus its source plan and row, per references/TICKET-TEMPLATES.md>,
+  acceptanceCriteria: <the row's Verification, verbatim>,
+  parentId: <the plan's work_item>,
   predecessors: [<ids of the rows this one lists under Predecessor>],
   related: [<for a Bug: the id of the PBI it was found in>],
 })
 ```
 
-The body is the row's own what-it-delivers and verification, shaped by [references/TICKET-TEMPLATES.md](references/TICKET-TEMPLATES.md). It goes in on the create call — `description` is an advertised argument that becomes a `System.Description` field op, so there is no follow-up write and nothing to confirm afterwards.
+The row's delivery and source become `description`, shaped by [references/TICKET-TEMPLATES.md](references/TICKET-TEMPLATES.md). Its falsifiable verification becomes `acceptanceCriteria` verbatim. Both are advertised arguments and go on the create call, so the board receives the same fields as the row without a follow-up write.
 
 A Bug parents to the **Feature**, exactly as a PBI does, so `related` is the only way to record which item it was found while building.
 

package/extensions/enact-repo/skills/to-workitems/references/TICKET-TEMPLATES.md

@@ -2,22 +2,24 @@
 
 ## The work item's `description`
 
-Sent on the create call for every PBI and Bug. It is the item's own two sections — no more:
+Sent on the create call for every PBI and Bug. It carries what the row delivers and where that
+row came from:
 
 ```markdown
 ## What it delivers
 
 The end-to-end behaviour this makes work. Not a layer-by-layer list.
 
-## Verification
-
-The falsifiable check. A command and its expected result, not "tested".
-
 ## Source
 
 Plan: the Feature's `spec.md`, `## Items` row <n>.
 ```
 
+## The work item's `acceptanceCriteria`
+
+The row's `Verification` cell, verbatim: a falsifiable check with its expected result, not
+"tested". Send it as `acceptanceCriteria` on the same create call as `description`.
+
 ## The item file
 
 Written after the create call returns, because the file is named `az<work item id>-<slug>.md`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/enact-extensions",
-  "version": "0.1.51",
+  "version": "0.1.55",
   "description": "Create and validate Enact multi-platform plugin manifests",
   "license": "UNLICENSED",
   "type": "module",

package/scripts/lib/run-repo-doctor.mjs

@@ -14,16 +14,17 @@
  *                                          match; every merged JSON entry /
  *                                          TOML block present; list drifted
  *                                          or missing)
- *   - per-host status: claude (marketplace + settings present; trust +
- *     "start a new session" note), codex (files present; read-only
+ *   - per-host status: direct native files recorded in the lock (never a
+ *     plugin root or marketplace), codex (files present; read-only
  *     ~/.codex/config.toml projects."<repo>".trust_level; hooks-review-
  *     pending note), cursor (files present; MCP approval note), kimi
- *     (.kimi-code/mcp.json present; global hooks are enact-vps-owned, so we
- *     only report whether ~/.kimi-code/config.toml has the
+ *     (native files present; global hooks are enact-vps-owned, so we only
+ *     report whether ~/.kimi-code/config.toml has the
  *     `# BEGIN ENACT KIMI HOOKS` block; PLUS a read-only Kimi Code
  *     workspace-trust check — Kimi only loads project MCP servers, including
  *     `.kimi-code/mcp.json`, once the workspace is trusted), opencode
- *     (plugin file present and generated from the current bundle)
+ *     (native agents/skills and root `opencode.json` MCP entries when the
+ *     selected bundle declares them; hooks are global enact-vps-owned)
  *   - required global binaries on PATH (enact-hook, lean-ctx,
  *     code-review-graph/crg, azure-devops-mcp) with versions
  *   - root `enact-config.toml` marker: present, parses as TOML, has our
@@ -332,14 +333,9 @@ function checkLockIntegrity(repo, name, lock) {
     const found = existsSync(path) ? findBlock(readFileSync(path, "utf8"), name) : null;
     if (!found || sha256(found.block) !== record.sha256) tomlIssues.push(rel);
   }
-  // Managed symlinks (today: the Claude plugin's skills -> ../../.agents/skills
-  // link). These carry no content hash, so `lock.files`-style verification does
-  // not reach them: a broken or retargeted link is invisible to every other
-  // check here. It is not a cosmetic gap -- a dangling link makes Claude Code
-  // report `Skills (0)` while the repo still looks installed, which is exactly
-  // the "presence is not armedness" failure AGENTS.md exists to catch. Verify
-  // by the link's own mechanism: it must BE a symlink, point where the lock
-  // says, and actually resolve.
+  // Managed symlinks carry no content hash, so `lock.files`-style verification
+  // does not reach them. Verify by the link's own mechanism: it must BE a
+  // symlink, point where the lock says, and actually resolve.
   //
   // lstatSync, never existsSync: existsSync follows the link and returns false
   // for a dangling one, so it cannot tell "absent" from "present but broken".
@@ -374,48 +370,76 @@ function checkLockIntegrity(repo, name, lock) {
 // ---------------------------------------------------------------------------
 // per-host status
 // ---------------------------------------------------------------------------
-function checkHosts(repo, lock, home, contentOutdated) {
+const NATIVE_HOST_PATHS = {
+  claude: { prefixes: [".claude/"], exact: [".mcp.json"] },
+  codex: { prefixes: [".codex/", ".agents/skills/"], exact: [] },
+  cursor: { prefixes: [".cursor/"], exact: [] },
+  kimi: { prefixes: [".kimi-code/"], exact: [] },
+  opencode: { prefixes: [".opencode/"], exact: ["opencode.json"] },
+};
+
+function isNativeHostPath(host, rel) {
+  const { prefixes, exact } = NATIVE_HOST_PATHS[host];
+  return exact.includes(rel) || prefixes.some((prefix) => rel.startsWith(prefix));
+}
+
+// The lock is the authoritative ownership record. A host is present only
+// when it owns at least one direct native path and every such path still
+// exists. This deliberately does not infer installation from a plugin root,
+// marketplace, or a host config file that another extension/user may own.
+function checkNativeHostPresence(repo, lock, host) {
+  const rels = [
+    ...Object.keys(lock.files ?? {}),
+    ...Object.keys(lock.merged ?? {}),
+    ...Object.keys(lock.toml ?? {}),
+    ...Object.keys(lock.symlinks ?? {}),
+  ].filter((rel) => isNativeHostPath(host, rel));
+  const nativePaths = [...new Set(rels)].sort();
+  return {
+    nativePaths,
+    present: nativePaths.length > 0 && nativePaths.every((rel) => existsSync(abs(repo, rel))),
+  };
+}
+
+function checkHosts(repo, lock, home) {
   const hosts = {};
   for (const host of REPO_HOSTS) {
     const targeted = lock.hosts.includes(host);
+    const native = targeted ? checkNativeHostPresence(repo, lock, host) : { nativePaths: [], present: true };
     if (host === "claude") {
-      const present =
-        !targeted ||
-        (existsSync(abs(repo, ".claude-plugin/marketplace.json")) && existsSync(abs(repo, ".claude/settings.json")));
       hosts.claude = {
         targeted,
-        present,
+        present: native.present,
+        nativePaths: native.nativePaths,
         note: targeted
-          ? "loads only after you TRUST this folder in Claude Code -- the marketplace registers on first launch; if hooks/skills are missing in that FIRST session, start a NEW session in this folder"
+          ? "direct native Claude files are installed; Claude Code loads them after you TRUST this folder"
           : "not targeted by this install",
       };
     } else if (host === "codex") {
-      const present =
-        !targeted || existsSync(abs(repo, ".codex/hooks.json")) || existsSync(abs(repo, ".codex/config.toml"));
       hosts.codex = {
         targeted,
-        present,
+        present: native.present,
+        nativePaths: native.nativePaths,
         trust: checkCodexTrust(repo, home),
         note: targeted
           ? "config/hooks load only after you trust this project; hooks review (/hooks) is pending until you review them in Codex"
           : "not targeted by this install",
       };
     } else if (host === "cursor") {
-      const present =
-        !targeted || existsSync(abs(repo, ".cursor/hooks.json")) || existsSync(abs(repo, ".cursor/mcp.json"));
       hosts.cursor = {
         targeted,
-        present,
+        present: native.present,
+        nativePaths: native.nativePaths,
         note: targeted
           ? "Cursor prompts for MCP server approval on first use -- approve code-review-graph/lean-ctx in Cursor's MCP settings"
           : "not targeted by this install",
       };
     } else if (host === "kimi") {
-      const present = !targeted || existsSync(abs(repo, ".kimi-code/mcp.json"));
       const globalHooks = checkKimiGlobalHooks(home);
       hosts.kimi = {
         targeted,
-        present,
+        present: native.present,
+        nativePaths: native.nativePaths,
         globalHooksInstalled: globalHooks.hooksBlockPresent,
         globalHooksNote: !globalHooks.configFound
           ? `${globalHooks.configPath} not found`
@@ -425,15 +449,12 @@ function checkHosts(repo, lock, home, contentOutdated) {
         workspaceTrust: checkKimiWorkspaceTrust(repo),
       };
     } else if (host === "opencode") {
-      const rel = `.opencode/plugins/${lock.plugin}.ts`;
-      const present = !targeted || existsSync(abs(repo, rel));
-      const generatedFromCurrentBundle = targeted && present ? !contentOutdated.includes(rel) : null;
       hosts.opencode = {
         targeted,
-        present,
-        generatedFromCurrentBundle,
+        present: native.present,
+        nativePaths: native.nativePaths,
         note: targeted
-          ? "one generated plugin file; re-run install after a bundle update to regenerate it"
+          ? "direct native OpenCode files are installed; repo-local hooks are global enact-vps-owned"
           : "not targeted by this install",
       };
     }
@@ -567,7 +588,7 @@ export function runRepoDoctor(pluginRoot, options = {}) {
     );
   }
 
-  const hosts = checkHosts(repo, lock, home, contentOutdated);
+  const hosts = checkHosts(repo, lock, home);
 
   const binaries = {};
   for (const bin of REQUIRED_BINARIES) binaries[bin] = checkBinary(bin);