@antoneeo/agentic-sdlc-skill 1.35.0 → 1.36.0

package/CHANGELOG.md

@@ -2,14 +2,37 @@
 
 Tutte le modifiche significative a questa skill saranno documentate in questo file.
 
-## [1.35.0] - 2026-09-19
-
-### Added
-- F-057: shared project memory in every lens, no sibling installation required.
-  `index` catalogs original documents; `recall QUERY` searches live metadata.
-  KB integrity is shared; domain ownership and marketing numerical checks remain.
-  Vendored validators now require entry point + sdlc_core.py + knowledge.py.
-
+## [1.36.0] - 2026-09-25
+
+### Changed
+- **F-026 revised: a real doubt is asked when it emerges.** The question discipline
+  no longer sends doubts to the deliverable ("Default non-blocking" is gone). A real
+  doubt (a fact the search leaves open, or a choice whose pros and cons do not
+  settle it) is asked before the first write that would embed its answer, grouped,
+  with the pros and cons of each option. A choice that clearly wins the weighing is
+  taken without asking, and the weighing is written next to it — each rejected option
+  stated at its strongest; options that serve different needs, none good enough at
+  both, that nothing the user wrote ranks are a real doubt, however clear the
+  agent's own ranking. Reserved approvals
+  are always asked. A real doubt becomes a declared assumption only in unattended
+  or delegated work. `review.md` makes an unasked doubt a design-review finding; `dispatch.md`
+  tells a subagent to return its real doubts instead of deciding them.
+
+### Fixed
+- **`stale` no longer counts the audit plan against the area that holds it.**
+  Committing a hash mark of `ai_docs/` changed `ai_docs/audit/audit_plan.md` after
+  the recorded commit, so the area went stale again and every re-mark repeated the
+  loop. The plan's own edits are now excluded; any other change in the area still
+  counts.
+
+## [1.35.0] - 2026-09-19
+
+### Added
+- F-057: shared project memory in every lens, no sibling installation required.
+  `index` catalogs original documents; `recall QUERY` searches live metadata.
+  KB integrity is shared; domain ownership and marketing numerical checks remain.
+  Vendored validators now require entry point + sdlc_core.py + knowledge.py.
+
 
 ### Fixed
 - **F-056: `stale` no longer reports an area fresh when it cannot evaluate it.** An

package/README.md

@@ -31,7 +31,7 @@ Vendoring requires all three files: the entry point, `sdlc_core.py`, `knowledge.
 - **Standalone complete**: works fully with local `ai_docs/` without requiring devPNT.
 - **devPNT symbiosis**: when devPNT is available, Master Plan, Action Plan, M-VISION, and governed artifacts become the authoritative planning layer, with independent fresh-context reviews of technical artifacts and diffs.
 - **Independent review, twice**: the design is reviewed before it is implemented and the diff before the work is declared done — by somebody other than its author. Three rungs of independence (fresh-context subagent > one-shot run > a declared self-pass, legal only when no higher rung is usable: absent, or permission-gated and declined — a gated rung is asked about, never silently skipped, and the log says which), capped at 3 rounds, one log line per review, and a PASS is invalid on "found nothing" — it must state where each constraint is satisfied.
-- **Question discipline**: a question to the user is legal only when the agent searched first and names the search with its result, and names the decision the answer unblocks. Otherwise it proceeds on a declared assumption — same evidence duty, batched, never a stream of "shall I proceed?".
+- **Question discipline**: a real doubt is asked when it emerges, before its answer is written into any document — grouped, with the pros and cons of each option. A choice whose pros clearly win is taken without asking, and the weighing is written next to it; a fact is settled by evidence or asked, never weighed. A question is legal only when the agent searched first, names the search with its result, and names the decision it unblocks — never a stream of "shall I proceed?".
 - **Installed support files**: Claude, Codex, Gemini, and Google Antigravity receive the full skill folder, including `templates.md`, `architect.md`, `guides.md`, `vision.md`, `tdd.md`, `debugging.md`, `elicitation.md`, `review.md`, `dispatch.md`, `routing.md`, `hybrid.md`, `ENFORCEMENT.md`, `memory.md`, and the validator's three files, `scripts/sdlc_check.py` + `scripts/sdlc_core.py` + `scripts/knowledge.py` — plus the `LICENSE` and `NOTICE` it ships under.
 - **Mechanical checks**: optional validator for document structure, generated feature history, stale audit areas, and protected-path gates — `check`, `validate`, `index`, `stale`, `mark`, `benefit`, `gate`, `plan`, `orient`, `migrate`. `benefit` reports what the review gates have already caught, beside what the doctrine costs to read — it always exits 0 and carries no verdict, because a measurement that can fail a build becomes a target.
 

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-sdlc-skill",
-  "version": "1.35.0",
+  "version": "1.36.0",
   "description": "Documentation-First SDLC protocol with triage, Vision governance and optional devPNT integration.",
   "author": "Antonio Pinto (https://github.com/Antoneeo)"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antoneeo/agentic-sdlc-skill",
-  "version": "1.35.0",
+  "version": "1.36.0",
   "description": "Documentation-First SDLC protocol for Claude Code, Gemini CLI, Google Antigravity and Codex with risk triage, Vision governance, installed support files and optional devPNT integration.",
   "keywords": [
     "claude-code",
@@ -39,9 +39,9 @@
     "skills/agentic-sdlc-skill/routing.md",
     "skills/agentic-sdlc-skill/ENFORCEMENT.md",
     "skills/agentic-sdlc-skill/scripts/sdlc_check.py",
-    "skills/agentic-sdlc-skill/scripts/sdlc_core.py",
-    "skills/agentic-sdlc-skill/scripts/knowledge.py",
-    "skills/agentic-sdlc-skill/memory.md",
+    "skills/agentic-sdlc-skill/scripts/sdlc_core.py",
+    "skills/agentic-sdlc-skill/scripts/knowledge.py",
+    "skills/agentic-sdlc-skill/memory.md",
     "skills/agentic-sdlc-skill/LICENSE",
     "skills/agentic-sdlc-skill/NOTICE",
     "gemini-extension.json",

package/skills/agentic-sdlc-skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: agentic-sdlc
-version: 1.35.0
+version: 1.36.0
 description: Documentation-First SDLC protocol with risk-proportional triage, Vision as a guide, a complete Standalone mode and optional symbiosis with devPNT. Use for features, significant bugs, refactors, audits and documented maintenance.
 author: Antonio Pinto (https://github.com/Antoneeo)
 copyright: (c) 2026 Antonio Pinto
@@ -20,7 +20,7 @@ Support files in the skill directory:
 - `vision.md`: how to write a Vision a cold reviewer can actually apply — the properties that make a rule hold, the minimum operable sections, and the blind check run before promoting one to APPROVED.
 - `hybrid.md`: the devPNT seam — the authoritative hierarchy, the ownership matrix (who owns what when both authorities are live), the triage equivalence, the feature-state mapping and the shadow discipline. Read it when the `devpnt_*` tools point at this project; a Standalone session never needs it.
 - `routing.md`: which lens owns this unit of work. Read ONLY when a sibling lens skill is installed alongside this one; a single-lens install never reads it.
-- `scripts/sdlc_check.py` + `scripts/sdlc_core.py`: the mechanical validator for the docs root (`check`, `validate`, `index`, `stale`, `mark`, `benefit`, `gate`, `plan`, `orient`, `migrate`).  Keep the entry point, `scripts/sdlc_core.py` and `scripts/knowledge.py` together; the last supplies common memory and KB integrity.
+- `scripts/sdlc_check.py` + `scripts/sdlc_core.py`: the mechanical validator for the docs root (`check`, `validate`, `index`, `stale`, `mark`, `benefit`, `gate`, `plan`, `orient`, `migrate`).  Keep the entry point, `scripts/sdlc_core.py` and `scripts/knowledge.py` together; the last supplies common memory and KB integrity.
 - `ENFORCEMENT.md`: optional setup for CI and hooks.
 
 Read these files only when needed. `SKILL.md` is the operating contract; the support files are progressive resources.
@@ -37,15 +37,15 @@ Read these files only when needed. `SKILL.md` is the operating contract; the sup
 
 If a patch looks easy but you do not understand why the current code is shaped the way it is, investigate first.
 
-## Shared project memory
-
-Project memory is available by default, independently of installed sibling lenses.
-Read `memory.md` for the common consult/capture contract during orientation and
-closure. Use `recall` for cross-domain discovery; `index` registers original guides,
-plans and decisions without copying them. One owner still governs each unit.
-The validator now ships as three files: entry point, `sdlc_core.py`, `knowledge.py`.
-
-## Rule Zero: Triage
+## Shared project memory
+
+Project memory is available by default, independently of installed sibling lenses.
+Read `memory.md` for the common consult/capture contract during orientation and
+closure. Use `recall` for cross-domain discovery; `index` registers original guides,
+plans and decisions without copying them. One owner still governs each unit.
+The validator now ships as three files: entry point, `sdlc_core.py`, `knowledge.py`.
+
+## Rule Zero: Triage
 
 Always classify the request before choosing the process. Declare the chosen level to the user when you start operational work.
 
@@ -63,7 +63,7 @@ Cross-cutting rules:
 - Parsing of external input, authN/authZ, cryptography, networking, personal data and filesystem access are security-sensitive: never L1.
 - If a bigger impact emerges during L1/L2 work, stop, reclassify and declare it.
 - When in doubt, pick the higher level.
-- **Before asking the user anything — any phase, any level — the question must pass the legality test: search first and name the search with its result; name the decision or fact blocked without the answer.** Blocking the work is the exception, not the default. `elicitation.md` §The question discipline owns the rule and is the only place it is stated — read it before you ask, and do not work from a summary of it.
+- **A real doubt is asked when it emerges, before its answer is written — any phase, any level; a question is legal only after naming the search with its result and the decision it blocks.** `elicitation.md` §The question discipline owns the rule — what is a real doubt, the pros-and-cons weighing, the form — and is the only place it is stated: read it before you ask or assume, and do not work from a summary of it.
 - The full audit does not start for L1/L2 unless explicitly requested.
 
 Triage rationalizations — the thought on the left is the signal to STOP and re-triage:

package/skills/agentic-sdlc-skill/dispatch.md

@@ -26,7 +26,11 @@ without an E-ISP.
    - `sdlc_check.py plan brief PLAN_[feature].md --task <id>` — prints the
      task block, the `produces` of prior-order tasks (interfaces), and
      `guides` pointers (paths, never pasted content) to stdout.
-   - Spawn the subagent with that brief as its entire context window.
+   - Spawn the subagent with that brief plus the return-doubts line as its
+     entire context window. The line: "An open point whose answer changes the
+     work is not yours to decide: return it in your final output with what you
+     searched." The orchestrator treats them as its own candidate doubts
+     (`elicitation.md` §When a doubt emerges).
    - Run `task.verify` out of band (the orchestrator executes it — the
      validator only ever prints it, never runs it) plus the one-shot review
      below.

package/skills/agentic-sdlc-skill/elicitation.md

@@ -1,173 +1,216 @@
-# Spec Elicitation
-
-`## The question discipline` below governs EVERY question to the user — any
-phase, any level, inside or outside the round. The rest of the file is the spec
-elicitation round: it applies when an L3 request enters phase 3 (Request
-Analysis), BEFORE drafting the ANALYSIS document (Standalone) or the D-UC/E-ISP
-(Hybrid).
-
-Skip path: if the spec is already complete — an approved Vision or explicit user
-requirements already answer goal, scope, and constraints, or the remainder is
-derivable from the repo, `ai_docs/` and the conversation — skip the round and add
-a one-line note in the analysis stating why it was skipped and naming the
-sources. Do not run the round as a formality when the answers are already on
-record.
-
-Unattended path: when the user is not reachable (a scheduled or autonomous run)
-and the skip path does not answer all six, do not stall and do not invent
-consensus. Write the missing answers as **declared assumptions** in
-`## Objective`, mark the ANALYSIS `BLOCKED on the user`, and stop before
-implementation. An assumption on the record is reviewable; a guess folded
-silently into a design is not.
-
-## The question discipline
-
-A question to the user spends their attention and stalls the work; the round
-below is the only place the process *plans* that cost. Everywhere, a question is
-legal only when BOTH hold:
-
-1. **Searched first, and the search is named — with its result.** The answer is
-   not on record and not derivable from the repo, `ai_docs/`, the Vision or the
-   conversation — and the question states the terms, tools and areas you searched
-   **and what they returned**. Same standard as a router verdict or an
-   architect-pass MISSING, and it carries their floors, not only their vocabulary
-   (`architect.md`, `guides.md`): a search whose scope does not cover the question
-   is not a search; a hit you did not open does not narrow anything; and **never
-   fake the search** — "I looked and found nothing" that names no terms and no
-   areas is a search not run. A question the repo can answer is a search
-   outsourced to the user.
-2. **It names what is blocked.** The question states the specific decision or
-   fact that cannot be resolved without the reply — what you will do differently
-   depending on the answer. If nothing downstream changes with the answer, there
-   is no question.
-
-Never legal:
-
-- **Generic confirmation** — "shall I proceed?", "is this OK?". The process
-  authorizes proceeding; if a real risk motivates the ask, name the risk and the
-  fork — that is a blocking question and carries the form below.
-- **Preference-fishing** — asking the user to pick among options that are
-  equivalent **in their effect on the benefit** and already decided by the
-  project's conventions. Cheapness to undo is NOT the test: nearly everything is
-  reversible under version control, and "it is reversible" as a licence to stop
-  asking is the silence-side evasion this clause must not fund.
-- **Re-asking the record** — goal, scope or constraints that an APPROVED Vision,
-  an earlier reply, or the request itself already states.
-
-What questions are FOR — what the user uniquely owns: the benefit, priorities
-between conflicting goods, non-goals, acceptance, and the approvals doctrine
-reserves to them (Vision promotion and amendment, scope changes, proposal
-acceptance, merge decisions). Facts about intent come from the user; facts about
-the system come from search. (The marketing sibling states the same rule as "ask
-only what the user uniquely owns"; this is its code-domain form.)
-
-**Precedence, because both halves can fire at once:** this paragraph wins over
-the "never legal" list above it. A choice the user uniquely owns is never
-preference-fishing, however cheap it is to undo; the list reaches choices that
-are *not* theirs.
-
-**Default non-blocking.** An unknown on which no fork of the work depends: write
-it as a **declared assumption** in the artifact it touches — the same mechanism
-the unattended path uses — proceed, and present the open points **batched**, with
-the round for spec questions or with the deliverable otherwise, answered by
-exception.
-
-This is the path most work takes, so it carries the SAME evidence duty as a
-question, not a lighter one — otherwise "assume it" becomes the way to skip the
-standard. Each declared assumption states **what it is taken from** ("I take X
-from Y" — the same shape the round uses) and **the alternative it excludes**, and
-**every declared assumption reaches the batch**: an assumption nobody is shown is
-not an open point, it is a silent decision. That pairing is what the kb family's
-escalation rule actually does — keep BOTH sides with their sources and surface
-them, never silently pick one — and this branch, not the blocking one, is where
-it structurally belongs. An assumption recorded with its source and its rejected
-alternative is reviewable; one recorded alone is a decision wearing an
-assumption's clothes, and a session stalled on a question that could have been
-an assumption is the waste this section exists to prevent.
-
-**Blocking is reserved** for three cases: proceeding under ANY assumption would
-waste the work (the forks diverge at once, and the wrong branch is rework of the
-whole unit); the doctrine reserves the decision to the user (the approvals
-above); or the doctrine itself mandates the stop — and a mandated stop is legal
-by mandate, never re-argued here.
-
-**Exactly two mandating files prescribe their own hand-over, and there the form
-below does not apply** (two forms over one moment is the duplicate `review.md`
-§Reviewing forbids): `debugging.md`'s circuit breaker — the minimal reproduction,
-what was ruled out, the current best hypothesis; and `review.md`'s round cap —
-the artifact plus the open findings. That list is closed. **Every other mandated
-stop carries the form**, including one that names only its options and not its
-evidence (`SKILL.md`'s Vision-Gate conflict names the two choices — the evidence
-is still owed, and for a Vision conflict the quoted line IS the substance) and
-one that prescribes nothing (`guides.md`'s guide proposal and its ingestion
-bound). "The file mentions the moment" is not a prescription; only a stated
-hand-over is.
-
-A blocking question carries a mandatory form — surface both sides with their
-evidence, never silently pick one:
-
-- the fork: the concrete options and what each implies for the work;
-- the evidence: what you searched, read or tried, and what it leaves undecided;
-- why no assumption survives — what work is discarded if you assume and are
-  wrong. This is what makes case (a) falsifiable: without it, "this is a fork"
-  is an agent's assertion about its own convenience, and case (a) becomes the
-  licence for exactly the question this section forbids. Cases (b) and (c) answer
-  it by citing the approval or the mandate instead;
-- why it is the user's call — what makes the remainder intent, priority or
-  approval rather than a derivable fact;
-- what stays blocked until answered.
-
-## The round
-
-**Derive before asking.** Answer each of the six from the record first — the
-Vision, `ai_docs/`, the conversation, the code. Ask only the residue, and carry
-the derived answers into the round as declared assumptions corrected by
-exception ("I take X from Y; the questions below are what no source answers"),
-not re-confirmed one by one.
-
-Ask ONE structured set of questions, not a drip of follow-ups. Keep each
-question short and numbered; offer concrete options where a real choice
-exists (this narrows the reply and speeds up the round). Cover:
-
-1. **Goal / benefit** — what problem this closes and why now. The answer must
-   name what the actor *obtains*, not a mechanism: "a dashboard" is not an
-   answer to "never lose the thread" — ask again until it is a benefit
-   (`vision.md`: the Vision is the distilled benefit; solutions and preferences
-   are what gets filtered out).
-2. **Actors** — who interacts with this: their role, primary goal, what
-   "good UX" means to them, and the surfaces they use today for this job
-   (the screens, commands or endpoints they operate — the Interface
-   Contract's as-is starts here; skip the surface half when no actor-facing
-   surface is in scope) and, at responsibility level, what happens when they
-   act (which components respond) — the Interface Contract's flow starts here. These become the Vision's `## Actors`; each
-   use-case below attaches to one (actor = who they are, use-case = what
-   they do). Skip only when an approved Vision already names them.
-3. **Scope boundaries** — what is explicitly included in this unit of work.
-4. **Non-goals** — what is explicitly excluded, so scope does not silently
-   creep in later.
-5. **Constraints** — technical, compatibility, and security constraints that
-   bound the solution space.
-6. **Acceptance signals** — how you and the user will both recognize the
-   work is done and correct.
-
-## Reflect
-
-Fold the answers into the ANALYSIS `## Objective` / `## Vision-Alignment`
-sections (Standalone) or into the D-UC/E-ISP (Hybrid) — do not leave them
-sitting only in the chat transcript. The written document, not the
-conversation, is what the next session and the next reviewer will read.
-
-Run a second round only when an answer opens a real fork in the design (a
-genuinely new question the first round could not have anticipated). Do not
-run a second round to double-check answers that were already clear.
-
-## Anti-patterns
-
-- **Interrogation**: an endless list of questions, or drip-feeding one
-  question at a time across many turns instead of one structured round.
-- **Collecting answers without folding them in**: getting replies in chat
-  and proceeding to design without writing them into the analysis document —
-  the next reader has no record of why the scope is what it is.
-
-(The illegal question forms — generic confirmation, preference-fishing,
-re-asking the record — are defined once, in `## The question discipline`.)
+# Spec Elicitation
+
+`## The question discipline` below governs EVERY doubt and EVERY question to the
+user — any phase, any level, inside or outside the round. The rest of the file is
+the spec elicitation round: it applies when an L3 request enters phase 3 (Request
+Analysis), BEFORE drafting the ANALYSIS document (Standalone) or the D-UC/E-ISP
+(Hybrid).
+
+Skip path: if the spec is already complete — an approved Vision, explicit user
+requirements or an earlier reply already answer goal, scope, and constraints, and
+any remainder is settled as §When a doubt emerges allows — skip the round and add
+a one-line note in the analysis stating why it was skipped and naming the
+sources. Do not run the round as a formality when the answers are already on
+record.
+
+Unattended path: when the user is not reachable (a scheduled or autonomous run)
+and a real doubt remains, do not stall and do not invent consensus. Write it as a
+**declared assumption** (§Ask before the write) in the artifact it touches. At L3,
+mark the ANALYSIS `BLOCKED on the user` and stop before implementation; below L3,
+proceed and list the assumption in the reply. An assumption on the record is
+reviewable; a guess folded silently into a design is not.
+
+## The question discipline
+
+A doubt kept silent is decided by the agent alone and reaches the documents
+looking settled; a useless question wastes the user's attention. This section
+rules on both.
+
+### When a doubt emerges
+
+A **candidate doubt** is an open point whose answer changes what you build or
+write. The usual signals — they illustrate, they do not close the definition:
+
+| Thought | What it means |
+|---|---|
+| "They probably mean…", "I'll assume…" | you are choosing between readings of the request |
+| "The request doesn't say, so I'll fill it in" | a gap in scope, a non-goal, an acceptance criterion or a priority |
+| "Either would work, I'll pick one" | equivalent in effect: yours, pick and do not ask; different in effect: weigh them below |
+| "I'll note it as an assumption and move on" | with the user reachable, that note is where doubts go to be forgotten |
+| "It's reversible, it can be fixed later" | later is after the documents built on it exist |
+
+Settle it by kind:
+
+- **A fact, or information only the user holds** (a deadline, a price, a
+  constraint): settled only by evidence, cited — never settled by a weighing. Left
+  open by the search and changing the work, it is a real doubt.
+- **A choice** — a reading of intent, a design trade-off: cite the user's statement
+  that settles it (the request, an APPROVED Vision, an earlier reply); failing one,
+  weigh the pros and cons of each option, stating each rejected option
+  at its strongest — the need it serves best; a weighing won against a weak
+  version of the alternative is not a weighing. One clearly outweighs: take it and
+  write the weighing with the choice — "I take X over Z: pro …, contro …".
+  Balanced, or turning on a user priority not on record: a **real doubt** — and it
+  turns on one whenever the options serve different needs of the actor, each better
+  at one the actor would notice in using the result (reading in a spreadsheet
+  against processing by a program, a quick answer against a complete one) and
+  none good enough at both, and nothing the user wrote ranks those needs — however
+  clear your own ranking feels. "The more natural reading" with no pros and cons
+  written is not a weighing. Design is yours until it trades off something the
+  user owns. Reserved approvals never enter this test (§The form of a question).
+
+### Ask before the write
+
+A real doubt that passes the legality test below is **owed**, not merely allowed:
+the test separates a doubt from a search not yet run, it never licenses silence.
+Ask it before the first write that would embed its answer — in an analysis, plan,
+guide or code — grouped with every doubt open at that point, in one numbered set,
+with the client's structured-question facility where it has one. Never defer a
+doubt to the deliverable, where the user must find it inside the document; never
+drip one question per turn. The round below is this rule's planned occasion. Fold
+every answer into the artifact, citing the reply (§Reflect); an intent choice with
+neither a source nor a weighing is a finding (`review.md` §Reviewing).
+
+**Declared assumptions exist only where no question can be asked:**
+
+- **Unattended** — the user is not reachable (the Unattended path above).
+- **Delegated** — the user's own words handed you this choice ("your call"); quote
+  them. A general "go ahead" is not a delegation.
+
+Each states **what it is taken from** and **the alternative it excludes**, and is
+listed where the user will read it: an assumption recorded alone is a decision
+wearing an assumption's clothes, and one nobody is shown is a silent decision. A
+dispatched subagent returns its open points in its final output (`dispatch.md`);
+the orchestrator treats them as its own candidate doubts (§When a doubt emerges).
+
+### The legality test
+
+Everywhere, a question is legal only when BOTH hold:
+
+1. **Searched first, and the search is named — with its result.** The answer is
+   not on record and not derivable from the repo, `ai_docs/`, the Vision or the
+   conversation — and the question states the terms, tools and areas you searched
+   **and what they returned**. Same standard as a router verdict or an
+   architect-pass MISSING, and it carries their floors, not only their vocabulary
+   (`architect.md`, `guides.md`): a search whose scope does not cover the question
+   is not a search; a hit you did not open does not narrow anything; and **never
+   fake the search** — "I looked and found nothing" that names no terms and no
+   areas is a search not run. A question the repo can answer is a search
+   outsourced to the user.
+2. **It names what is blocked.** The question states the specific decision or
+   fact that cannot be resolved without the reply — what you will do differently
+   depending on the answer. If nothing downstream changes with the answer, there
+   is no question.
+
+Never legal:
+
+- **Generic confirmation** — "shall I proceed?", "is this OK?". The process
+  authorizes proceeding; if a real risk motivates the ask, name the risk and the
+  fork — that is a blocking question and carries the form below.
+- **Preference-fishing** — asking the user to pick among options that are
+  equivalent **in their effect on the benefit** and already decided by the
+  project's conventions. Cheapness to undo is NOT the test.
+- **Re-asking the record** — goal, scope or constraints that an APPROVED Vision,
+  an earlier reply, or the request itself already states.
+
+What questions are FOR — what the user uniquely owns: the benefit, priorities
+between conflicting goods, non-goals, acceptance, and the approvals doctrine
+reserves to them (Vision promotion and amendment, scope changes, proposal
+acceptance, merge decisions). Facts about intent come from the user; facts about
+the system come from search.
+
+**Precedence, because both halves can fire at once:** this paragraph wins over
+the "never legal" list above it. A choice the user uniquely owns is never
+preference-fishing, however cheap it is to undo; the list reaches choices that
+are *not* theirs.
+
+### The form of a question
+
+The approvals reserved above and every stop the doctrine mandates are asked
+whatever you expect the answer: **legal by mandate**, never weighed, never
+re-argued here. Unattended, they are never assumed: the work holds, unless the
+mandating rule prescribes its own unattended handling (`review.md`'s gated rung
+does).
+
+**Exactly two mandating files prescribe their own hand-over, and there the form
+below does not apply** (two forms over one moment is the duplicate `review.md`
+§Reviewing forbids): `debugging.md`'s circuit breaker — the minimal reproduction,
+what was ruled out, the current best hypothesis; and `review.md`'s round cap —
+the artifact plus the open findings. That list is closed. **Every other mandated
+stop carries the form**, including one that names only its options and not its
+evidence (`SKILL.md`'s Vision-Gate conflict names the two choices — the evidence
+is still owed, and for a Vision conflict the quoted line IS the substance) and
+one that prescribes nothing (`guides.md`'s guide proposal and its ingestion
+bound). "The file mentions the moment" is not a prescription; only a stated
+hand-over is.
+
+A question outside the planned occasions carries the **blocking form**, one line
+per element — surface both sides with their evidence, never silently pick one:
+
+- the fork: the options, each with its pros and cons, and what each implies for
+  the work;
+- the evidence: what you searched, read or tried, and what it leaves undecided;
+- why no assumption survives — why the weighing does not settle it, and what a
+  wrong pick costs; a reserved approval or a mandated stop cites the approval or
+  the mandate instead;
+- why it is the user's call — what makes the remainder intent, priority or
+  approval rather than a derivable fact;
+- what stays blocked until answered.
+
+## The round
+
+**Derive before asking.** Answer each of the six from the record first — the
+Vision, `ai_docs/`, the conversation; the code answers facts and constraints,
+never the goal, scope or acceptance. Ask only the real doubts, and carry the
+derived answers into the round with their source or weighing ("I take X from Y;
+the questions below are what no source settles"), not re-confirmed one by one.
+
+Ask ONE structured set of questions, not a drip of follow-ups. Keep each
+question short and numbered; offer concrete options where a real choice
+exists, each with its pros and cons (this narrows the reply and speeds up the
+round). Cover:
+
+1. **Goal / benefit** — what problem this closes and why now. The answer must
+   name what the actor *obtains*, not a mechanism: "a dashboard" is not an
+   answer to "never lose the thread" — ask again until it is a benefit
+   (`vision.md`: the Vision is the distilled benefit; solutions and preferences
+   are what gets filtered out).
+2. **Actors** — who interacts with this: their role, primary goal, what
+   "good UX" means to them, and the surfaces they use today for this job
+   (the screens, commands or endpoints they operate — the Interface
+   Contract's as-is starts here; skip the surface half when no actor-facing
+   surface is in scope) and, at responsibility level, what happens when they
+   act (which components respond) — the Interface Contract's flow starts here. These become the Vision's `## Actors`; each
+   use-case below attaches to one (actor = who they are, use-case = what
+   they do). Skip only when an approved Vision already names them.
+3. **Scope boundaries** — what is explicitly included in this unit of work.
+4. **Non-goals** — what is explicitly excluded, so scope does not silently
+   creep in later.
+5. **Constraints** — technical, compatibility, and security constraints that
+   bound the solution space.
+6. **Acceptance signals** — how you and the user will both recognize the
+   work is done and correct.
+
+## Reflect
+
+Fold the answers into the ANALYSIS `## Objective` / `## Vision-Alignment`
+sections (Standalone) or into the D-UC/E-ISP (Hybrid) — do not leave them
+sitting only in the chat transcript. The written document, not the
+conversation, is what the next session and the next reviewer will read.
+
+Run a second round only when an answer opens a real fork in the design (a
+genuinely new question the first round could not have anticipated). Do not
+run a second round to double-check answers that were already clear.
+
+## Anti-patterns
+
+- **Interrogation**: an endless list of questions, or drip-feeding one
+  question at a time across many turns instead of one structured round.
+- **Deferring a doubt into the document**: writing a guess into the artifact
+  and leaving the user to find it there.
+- **Collecting answers without folding them in**: getting replies in chat
+  and proceeding to design without writing them into the analysis document —
+  the next reader has no record of why the scope is what it is.
+
+(The illegal question forms — generic confirmation, preference-fishing,
+re-asking the record — are defined once, in `## The question discipline`.)

package/skills/agentic-sdlc-skill/review.md

@@ -55,7 +55,7 @@ above is already satisfiable and no stop fires (the row still carries
 rung 2 is not "usable" for this clause, it joins the question instead. When the best rung is gated and no
 ungated rung works, the gate STOPS and asks: descending to rung 3 on silence is
 illegal while a user is reachable. The stop is doctrine-mandated (legal by mandate,
-`elicitation.md` §Blocking is reserved) and carries that file's five-bullet
+`elicitation.md` §The form of a question) and carries that file's five-bullet
 blocking form — its closed-list exemption covers this file's round-cap hand-over
 only, not this stop. The question offers the gated rung(s) against the fallback, with what each
 buys; states each higher rung's status (tried / unusable / gated) with the
@@ -335,6 +335,13 @@ When you are the reviewer:
   statement is the proof the check ran; an unfalsifiable "I checked" is the review
   theater this discipline exists to prevent (the reviewer-side twin of §Receiving's
   silent-drop rule). Plain code reviews stay findings-only.
+- **An unasked doubt is a finding (impact/solution-analysis & design reviews).** An
+  intent choice written with no owner-authored source and no weighing, a weighing
+  that names no rejected option or turns on an owner priority not on record, and a
+  fact or owner-held datum settled by a weighing instead of evidence are findings;
+  so is a cited source that does not say what the line claims. What makes a ground
+  or an assumption legal is each lens's `elicitation.md` §The question discipline —
+  cite it, never restate it. The fix is the question, not a better justification.
 - **Restated facts (cite, never copy).** Every governance slot has ONE owning document
   per project. A fact restated in the artifact under review when another document owns
   it is a **finding**: the fix is a citation naming the owner, not a better copy. This

package/skills/agentic-sdlc-skill/scripts/sdlc_core.py

@@ -1574,6 +1574,13 @@ def cmd_stale(root, hybrid=False):
         return rc                                  # was: return 0 — MUST carry guide rc
     use_git = git_available(root)
     entry = entry_script()
+    # The audit plan records the marks: its own edits are not a change to the area
+    # that contains it. Counting them made a committed hash mark of that area
+    # stale again, and every re-mark repeated the loop.
+    try:
+        plan_rel = f.resolve().relative_to(Path(root).resolve()).as_posix()
+    except ValueError:
+        plan_rel = None
     # F-056: an ANALYZED row whose reference cannot be evaluated is UNVERIFIED,
     # never fresh. Each `continue` below that skips such a row records it here;
     # skipping silently is how a pruned reference printed `[ok]` over three areas.
@@ -1641,6 +1648,7 @@ def cmd_stale(root, hybrid=False):
                     except ValueError:   # symlink out of the tree: report absolute, never crash
                         name = str(fp)
                     changed.append(name)
+        changed = [c for c in changed if c != plan_rel]
         if changed:
             stale.append((rel, changed))