@antoneeo/agentic-sdlc-skill 1.50.0 → 1.51.0

package/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 Tutte le modifiche significative a questa skill saranno documentate in questo file.
 
+## [1.51.0] - 2026-10-31
+
+### What's new
+
+**Several sessions can work on one repository, one of them coordinating.** When you run several agent sessions on the same project at once and tell one of them that it coordinates the others, they follow shared rules. Each request record has a single writer, so its entries are never numbered twice. A resource only one session can use at a time, such as the development container or the test database, is taken and released through the coordinator, so one session no longer restarts what another is running against. An authorization you gave one session is not passed to another by message. A session that stops reports what it did, and the coordinator checks it before telling you the work is done. Before a commit that carries several sessions' work, the coordinator checks that every changed file is assigned to the right unit. If you name no coordinator, nothing changes.
+
+**Decisions taken on your behalf are labelled.** In the request record, a decision a session took under a delegation you gave it, and words you gave one session for work another session records, now carry their own heading. They are never read later as something you said yourself, and a delegated decision never overrides one of yours: a choice that would change it comes back to you as a question.
+
+**The reminder of what must not break also covers files written from the shell.** From 1.49.0 the agent is reminded of a unit's constraints before it edits a file; a file it writes through a shell command never triggered that reminder, so the agent now looks the constraints up itself.
+
+#### What to do
+
+**1. Update (everyone).** The changes arrive only with the update.
+1. Run `npm install -g @antoneeo/agentic-sdlc-skill@latest`, then `agentic-sdlc-install-skill`.
+2. Close and reopen your agent sessions: the new version loads only at startup.
+
+To check: `npm ls -g @antoneeo/agentic-sdlc-skill` shows 1.51.0.
+
+**2. Coordinating several sessions (only if you run them in parallel).**
+- **This concerns you if** you run more than one agent session on the same repository at the same time.
+- **Why:** without a coordinator, sessions can write the same record at once, restart a container another session is using, or leave one commit nobody can split by unit.
+- **Steps:** tell the session you want as coordinator, in your own words, that it coordinates the others; it records your words, and the rules apply from then on. Each other session asks it before using a shared resource. Before committing several sessions' work together, it writes the commit map and runs `sdlc_check.py commit-map <map file>`.
+- **To check:** when a session takes a shared resource, `ai_docs/audit/leases.md` gains a `take` line naming it.
+
+| New file | Skill | Who reads it |
+|---|---|---|
+| `coordination.md` | agentic-sdlc | the agent, only while several sessions share a repository |
+
+### Added
+- `coordination.md` (F-088): rules for several peer sessions on one repository once the owner names a coordinating session in a request-record entry — one writer per record (a part's owner words for the shared unit go through its own record and the coordinator), leases on exclusive resources in `audit/leases.md` (`take`/`release` lines, written by the coordinator only; a permission given before the naming exempts no session; the code-writer lease passes only once the holder's code is committed or set aside with the owner's yes), decisions under delegation recorded as labelled entries that never reach an earlier owner decision, authorizations valid only in the session they were given to, a fixed closure message per part (and, for a part that stopped without one, the coordinator reads its HANDOFF and working tree and tells the owner what it can and cannot tell), and the commit map. Rulings r40, r41.
+- `sdlc_check.py commit-map MAP`: checks a commit map against the working tree against HEAD. Errors: a generated file under a unit, a changed authored file under Regenerated, a changed HANDOFF or request record in no section, a file under two units outside Shared, a file both under a unit and in Left out. Warnings: a change in no section, a listed file with no change. Exit 1 on any error.
+
+### Changed
+- Request record (`templates.md`): labelled entries `decided under delegation R<m>` and `received for <unit>`; `review.md` and `elicitation.md` treat them as the deciding session's choice or relayed words, never an owner statement (all four lenses).
+- `SKILL.md` Phase 4: constraint recall asks the agent to run `constraints --file` itself for a file written from the shell, which the recall hook never sees; `ENFORCEMENT.md` §3 names the residual. Phase 4 also names the code-writer lease as the one exception to "own worktree" under coordination.
+
 ## [1.50.0] - 2026-10-31
 
 ### What's new

package/README.md

@@ -4,17 +4,13 @@
 
 <!-- whats-new:begin -->
 <!-- generated by scripts/whats_new.js from CHANGELOG.md: edit the CHANGELOG, then run node scripts/whats_new.js --write -->
-## What's new in 1.50.0
+## What's new in 1.51.0
 
-**You approve the design before any code is written.** On significant work, once the independent design review passes, the agent stops and shows you a short summary of the design: what the change does, for whom and through which surfaces, which files it touches, the risks and how they are handled, and what the review found. The work starts only after your yes, which the agent records in the unit's request record. A "go ahead" given before you saw the design does not count, and in a session with nobody to answer the unit waits for you. A design that is right but not what you meant is cheapest to fix before the code exists. If you work with devPNT, your acceptance of the design proposal there is this approval, and nothing else is asked.
+**Several sessions can work on one repository, one of them coordinating.** When you run several agent sessions on the same project at once and tell one of them that it coordinates the others, they follow shared rules. Each request record has a single writer, so its entries are never numbered twice. A resource only one session can use at a time, such as the development container or the test database, is taken and released through the coordinator, so one session no longer restarts what another is running against. An authorization you gave one session is not passed to another by message. A session that stops reports what it did, and the coordinator checks it before telling you the work is done. Before a commit that carries several sessions' work, the coordinator checks that every changed file is assigned to the right unit. If you name no coordinator, nothing changes.
 
-**The npm page tells you what is new.** This section, at the top of the package page, now summarizes each version for the people who install it.
+**Decisions taken on your behalf are labelled.** In the request record, a decision a session took under a delegation you gave it, and words you gave one session for work another session records, now carry their own heading. They are never read later as something you said yourself, and a delegated decision never overrides one of yours: a choice that would change it comes back to you as a question.
 
-**From 1.49.0, published without notes:**
-- **Fewer regressions on significant changes.** When an analysis states what must not break, the agent is reminded of it just before it edits that file, not only at the start of the work, and the reviewer has the list to check. It is a reminder and never blocks the work; for now it works on Claude Code.
-- **The process checks can no longer be bypassed by accident.** Quoting a work level inside a sentence no longer counts as declaring it, and protected parts of the project stay protected when the agent changes folder.
-- **You know what the project memory has not read yet.** The agent can tell how much of the project it has never examined (automatically in projects with a corpus, on request otherwise).
-- **Defects found after the merge can be recorded** without distorting the review statistics.
+**The reminder of what must not break also covers files written from the shell.** From 1.49.0 the agent is reminded of a unit's constraints before it edits a file; a file it writes through a shell command never triggered that reminder, so the agent now looks the constraints up itself.
 
 #### What to do
 
@@ -22,20 +18,17 @@
 1. Run `npm install -g @antoneeo/agentic-sdlc-skill@latest`, then `agentic-sdlc-install-skill`.
 2. Close and reopen your agent sessions: the new version loads only at startup.
 
-To check: `npm ls -g @antoneeo/agentic-sdlc-skill` shows 1.50.0.
+To check: `npm ls -g @antoneeo/agentic-sdlc-skill` shows 1.51.0.
 
-If you do not want the constraint reminder (Claude Code only, from 1.49.0): remove the entry that contains `constraints --hook` from `~/.claude/settings.json`. Later updates will not put it back.
+**2. Coordinating several sessions (only if you run them in parallel).**
+- **This concerns you if** you run more than one agent session on the same repository at the same time.
+- **Why:** without a coordinator, sessions can write the same record at once, restart a container another session is using, or leave one commit nobody can split by unit.
+- **Steps:** tell the session you want as coordinator, in your own words, that it coordinates the others; it records your words, and the rules apply from then on. Each other session asks it before using a shared resource. Before committing several sessions' work together, it writes the commit map and runs `sdlc_check.py commit-map <map file>`.
+- **To check:** when a session takes a shared resource, `ai_docs/audit/leases.md` gains a `take` line naming it.
 
-**2. Approving the design (significant units).**
-- **This concerns you if** you use the skill for significant (L3) work. Nothing to configure: after the design review passes, the agent asks whether to proceed. Answer yes to start the code, or say what to change; the design is then revised and, where the change touches what the review judged, reviewed again before you are asked again.
-- **A unit already in progress.** Units started before 2026-10-31 are not affected. If a unit started on or after 2026-10-31 with an earlier version is already in progress or finished, `sdlc_check.py validate` shows a `[note]` saying it has `no design approval in its request record`. Why: the earlier version never asked you. To clear it, tell the agent that you approve the design as it was implemented; it records your words under a label that begins `design approved` (for example `design approved after implementation`). The note never fails a check, so you can also leave it.
-- **To check:** on your next significant unit, the agent stops after the design review and asks you before any code starts.
-
-**3. Protected folders in a repository with several `ai_docs/` (only if you use them; from 1.49.0).**
-- **This concerns you if** your agent settings contain `gate --hook --protected` and the repository has more than one `ai_docs/` folder, for example a package with its own.
-- **Why:** protected paths are now read from the `ai_docs/` nearest to the edited file. A path written from the repository root, such as `packages/api/src/auth`, no longer matches the files inside `packages/api`, so the agent could change them without an analysis.
-- **Steps:** rewrite those paths from the package: `packages/api/src/auth` becomes `src/auth`. Note that `src/auth` then protects the folder with that name in every project that has its own `ai_docs/`.
-- **To check:** in a session with no open analysis, ask the agent for a small change to a protected file. It must be refused.
+| New file | Skill | Who reads it |
+|---|---|---|
+| `coordination.md` | agentic-sdlc | the agent, only while several sessions share a repository |
 
 Full history: [CHANGELOG](https://github.com/Antoneeo/agentic-sdlc-skill/blob/main/CHANGELOG.md)
 <!-- whats-new:end -->
@@ -57,9 +50,9 @@ Full history: [CHANGELOG](https://github.com/Antoneeo/agentic-sdlc-skill/blob/ma
 - **devPNT symbiosis**: when devPNT is available, Master Plan, Action Plan, M-VISION, and governed artifacts become the authoritative planning layer, and every governed artifact passes an independent agent review before it is proposed; devPNT itself performs no review — it is where you review and approve.
 - **Independent review, twice**: the design is reviewed before it is implemented and the diff before the work is declared done — by somebody other than its author, who receives the whole review mandate in a fixed block copied verbatim, never a paraphrase of it. Three rungs of independence (fresh-context subagent > one-shot run > a declared self-pass, legal only when no higher rung is usable: absent, or permission-gated and declined — a gated rung is asked about, never silently skipped, and the log says which), capped at 3 rounds, one log line per review, and a PASS is invalid on "found nothing" — it must state where each constraint is satisfied. After the design review passes, the owner approves the design before any code is written.
 - **Question discipline**: a real doubt is asked when it emerges, before its answer is written into any document — grouped, with the pros and cons of each option. A choice whose pros clearly win is taken without asking, and the weighing is written next to it; a fact is settled by evidence or asked, never weighed. A question is legal only when the agent searched first, names the search with its result, and names the decision it unblocks — never a stream of "shall I proceed?".
-- **Installed support files**: Claude, Codex, Gemini, and Google Antigravity receive the full skill folder, including `templates.md`, `architect.md`, `guides.md`, `vision.md`, `tdd.md`, `debugging.md`, `elicitation.md`, `review.md`, `dispatch.md`, `routing.md`, `hybrid.md`, `ENFORCEMENT.md`, `memory.md`, and the validator's three files, `scripts/sdlc_check.py` + `scripts/sdlc_core.py` + `scripts/knowledge.py` — plus the docs site generator `scripts/docs_site.py` and its page `docs_site/`, and the `LICENSE` and `NOTICE` it ships under.
+- **Installed support files**: Claude, Codex, Gemini, and Google Antigravity receive the full skill folder, including `templates.md`, `architect.md`, `guides.md`, `vision.md`, `tdd.md`, `debugging.md`, `elicitation.md`, `review.md`, `dispatch.md`, `routing.md`, `coordination.md`, `hybrid.md`, `ENFORCEMENT.md`, `memory.md`, and the validator's three files, `scripts/sdlc_check.py` + `scripts/sdlc_core.py` + `scripts/knowledge.py` — plus the docs site generator `scripts/docs_site.py` and its page `docs_site/`, and the `LICENSE` and `NOTICE` it ships under.
 - **Docs site** (`scripts/docs_site.py --root <project> [--open] [--zip <file>]`): a static, offline, read-only website of what the agent reads in the project — reading guide, Vision, rules, documents, open work with each next step, analyses and, with a knowledge base, the topic map, each fact with its exact source passage, and the source documents. Written to `.docs-site/` (added to `.gitignore` on the first run), outside `ai_docs/`; nothing is ranked or recommended.
-- **Mechanical checks**: optional validator for document structure, generated feature history, stale audit areas, and protected-path gates — `check`, `validate`, `index`, `stale`, `mark`, `benefit`, `gate`, `plan`, `orient`, `migrate`, `review-map` (code lens: classes the files of a change for the merge review brief), `constraints` (code lens: a unit's constraints, or those binding a file). `benefit` reports what the review gates have already caught, beside what the doctrine costs to read — it always exits 0 and carries no verdict, because a measurement that can fail a build becomes a target.
+- **Mechanical checks**: optional validator for document structure, generated feature history, stale audit areas, and protected-path gates — `check`, `validate`, `index`, `stale`, `mark`, `benefit`, `gate`, `plan`, `orient`, `migrate`, `review-map` (code lens: classes the files of a change for the merge review brief), `commit-map` (code lens: checks the map of one commit carrying several parallel sessions' work), `constraints` (code lens: a unit's constraints, or those binding a file). `benefit` reports what the review gates have already caught, beside what the doctrine costs to read — it always exits 0 and carries no verdict, because a measurement that can fail a build becomes a target.
 
 ## Shared project memory
 
@@ -141,6 +134,7 @@ skills/agentic-sdlc-skill/
 ├── review.md
 ├── dispatch.md
 ├── routing.md
+├── coordination.md
 ├── hybrid.md
 ├── memory.md
 ├── ENFORCEMENT.md

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-sdlc-skill",
-  "version": "1.50.0",
+  "version": "1.51.0",
   "description": "Documentation-First SDLC protocol with triage, Vision governance and optional devPNT integration.",
   "author": "Antonio Pinto (https://github.com/Antoneeo)"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antoneeo/agentic-sdlc-skill",
-  "version": "1.50.0",
+  "version": "1.51.0",
   "description": "Documentation-First SDLC protocol for Claude Code, Gemini CLI, Google Antigravity and Codex with risk triage, Vision governance, installed support files and optional devPNT integration.",
   "keywords": [
     "claude-code",
@@ -37,6 +37,7 @@
     "skills/agentic-sdlc-skill/dispatch.md",
     "skills/agentic-sdlc-skill/hybrid.md",
     "skills/agentic-sdlc-skill/routing.md",
+    "skills/agentic-sdlc-skill/coordination.md",
     "skills/agentic-sdlc-skill/ENFORCEMENT.md",
     "skills/agentic-sdlc-skill/scripts/sdlc_check.py",
     "skills/agentic-sdlc-skill/scripts/sdlc_core.py",

package/scripts/init.js

@@ -203,16 +203,16 @@ in the skill's \`routing.md\`: it decides which lens's method and validation rul
 that unit. L1 never reaches it. Never refer to a document whose meaning differs by lens
 ("threat model", "vision", \`principles.md\`, \`handoff.md\`) by its bare name.
 
-Select the owning lens by the unit's purpose, then apply only its risk scale.
-The project's always-on pointer stays intact: consult the selected skill rather than
-merging multiple mandatory ladders. All lenses already carry shared project memory
-(\`memory.md\`); another installation is not needed for cross-domain recall.
+Select the owning lens by the unit's purpose, then apply only its risk scale.
+The project's always-on pointer stays intact: consult the selected skill rather than
+merging multiple mandatory ladders. All lenses already carry shared project memory
+(\`memory.md\`); another installation is not needed for cross-domain recall.
 This file is NOT auto-loaded by any client: it is a note for you, deliberately additive.
-Delete this note once the routing pointer is integrated.
+Delete this note once the routing pointer is integrated.
 `, 'multi-lens routing note');
   if (wrote && protocolPreexisting) {
     console.log('   ⚠️  A protocol pointer already existed and was NOT overwritten.');
-    console.log('       Integrate the routing pointer from AGENTIC_MULTI_LENS.md; keep one risk scale per unit.');
+    console.log('       Integrate the routing pointer from AGENTIC_MULTI_LENS.md; keep one risk scale per unit.');
   }
 }
 

package/skills/agentic-sdlc-skill/ENFORCEMENT.md

@@ -130,7 +130,8 @@ is the one holding the edited file, never the hook's working directory.
 It informs and never decides: its JSON carries `additionalContext` only, never a
 `permissionDecision`, so the user's permission flow is the one without it. It is silent
 everywhere else and whenever it cannot tell (subagent, oversized or unreadable
-transcript, any error), and always exits 0.
+transcript, any error), and always exits 0. A file written from the shell never reaches
+it: for that file the agent runs `constraints --file` itself (SKILL.md Phase 4).
 
 Cost: up to 15 lines of context on a bound edit at L3 (owner-accepted,
 `REQUEST_working_model.md` R12 (b)), zero tokens at any other level; and about 0.25 s

package/skills/agentic-sdlc-skill/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: agentic-sdlc
-version: 1.50.0
+version: 1.51.0
 description: Documentation-First SDLC protocol with risk-proportional triage, Vision as a guide, a complete Standalone mode and optional symbiosis with devPNT. Use for features, significant bugs, refactors, audits and documented maintenance.
 author: Antonio Pinto (https://github.com/Antoneeo)
 copyright: (c) 2026 Antonio Pinto
@@ -20,6 +20,7 @@ Support files in the skill directory:
 - `vision.md`: how to write a Vision a cold reviewer can actually apply — the properties that make a rule hold, the minimum operable sections, and the blind check run before promoting one to APPROVED.
 - `hybrid.md`: the devPNT seam — the authoritative hierarchy, the ownership matrix (who owns what when both authorities are live), the triage equivalence, the feature-state mapping and the shadow discipline. Read it when the `devpnt_*` tools point at this project; a Standalone session never needs it.
 - `routing.md`: which lens owns this unit of work. Read ONLY when a sibling lens skill is installed alongside this one; a single-lens install never reads it.
+- `coordination.md`: several sessions on one repository, one of them coordinating. Read ONLY when the owner has named a coordinating session; otherwise never.
 - `scripts/sdlc_check.py` + `scripts/sdlc_core.py`: the mechanical validator for the docs root (`check`, `validate`, `index`, `stale`, `mark`, `benefit`, `gate`, `plan`, `orient`, `migrate`).  Keep the entry point, `scripts/sdlc_core.py` and `scripts/knowledge.py` together; the last supplies common memory and KB integrity.
 - `scripts/docs_site.py --root <project> --open` (`--zip <file>` to share): opens in the user's browser a read-only site of what the agent reads; use it to show the project state.
   It is what users mean by "docs site", "minisito", "documentation site" or "project site": run it, never build a page by hand.
@@ -86,7 +87,7 @@ Triage decides IF documentation is due; this table decides WHICH document each e
 | Document | Write trigger | Phase |
 |---|---|---|
 | `solutions/ANALYSIS_[feature].md` | Every L3, after elicitation and before any code. On topic match with an existing analysis, update that one instead of a new file -- a revision re-reads the WHOLE document and rewrites it to current state (history in the Diary), never an appended delta section. A capability the architect pass splits out as its own unit of change (`architect.md` §4) gets its own ANALYSIS, and the two documents name each other. | 3 |
-| `audit/requests/REQUEST_[feature].md` | Every L3, the moment the level is declared — before the Vision Gate and the first question: R1 quotes the owner's opening words verbatim; every later owner statement that settles something for the unit (answer, approval, cost, ruling, merge) is appended before acting on it. Append-only, never deleted; artifacts cite its entries, a paraphrase never replacing the citation (`templates.md`). | 1 → 5 |
+| `audit/requests/REQUEST_[feature].md` | Every L3, the moment the level is declared — before the Vision Gate and the first question: R1 quotes the owner's opening words verbatim; every later owner statement that settles something for the unit (answer, approval, cost, ruling, merge) is appended before acting on it. Append-only, never deleted; artifacts cite its entries, a paraphrase never replacing the citation (`templates.md`). Under coordination, which record an entry goes to: `coordination.md` §1. | 1 → 5 |
 | `solutions/SPIKE_[topic].md` | Closing any Spike — including a failed one (a negative outcome is still an outcome). | — |
 | `solutions/E2E_TEST_[feature].md` | Every L3, before the closure review (it is part of the reviewed diff): the human tester's post-merge script — new-behavior scenarios when behavior changed, regression scenarios always (`templates.md`). | 5 |
 | `solutions/MERGE_REVIEW_[feature].md` | Every L3, after the closure review: the integrator's brief — what to review (`sdlc_check.py review-map`), what was verified by which gate, what only a human can judge (`templates.md`). The PR description links it. | 5 |
@@ -207,12 +208,12 @@ Hybrid L3:
 ### 4. Development and Testing
 
 - Implement only after the documentation gate required by the level; at L3 it ends with the owner's design approval (`review.md` §When a review is due). **Flip the ANALYSIS frontmatter `PLANNED` → `IN_PROGRESS` when implementation starts** — that flip is what `gate` and the handoff registry key on, and nothing else performs it.
-- Isolate the work: run an L3 change on its own branch. In Hybrid, prefer a git worktree from the start — a running devPNT server locks `.devpnt/*.db` and blocks in-place branch switches/merges in the primary worktree. A session that may run while another session uses the same checkout works in its **own git worktree**, and never switches branch, stashes, resets or runs `index` in a checkout another session may be using. Parallel work also shares ids: choose a new unit's id **after fetching**, as the first id free on every branch and tag the checkout can see (`check` names a collision while the unit is open).
+- Isolate the work: run an L3 change on its own branch. In Hybrid, prefer a git worktree from the start — a running devPNT server locks `.devpnt/*.db` and blocks in-place branch switches/merges in the primary worktree. A session that may run while another session uses the same checkout works in its **own git worktree**, and never switches branch, stashes, resets or runs `index` in a checkout another session may be using; under coordination, the code-writer lease is the one exception (`coordination.md` §2). Parallel work also shares ids: choose a new unit's id **after fetching**, as the first id free on every branch and tag the checkout can see (`check` names a collision while the unit is open).
 - Modify surgically, consistently with the plan.
 - Implementation work follows the TDD discipline in `tdd.md` (RED/GREEN/REFACTOR — the L2/L3 default; record the reason when it does not apply).
 - Before implementing (L2/L3; L1 exempt), **consult the guide router** — the verdict already declared with the triage level (`## Operative Guides`). Re-run the lookup here only if the work has moved to a topic the first one did not cover, and say so if the verdict changes.
 - If the environment does not allow automated tests, declare the alternative verification and the reason.
-- **Constraint recall (L3).** Where the recall hook is wired (`ENFORCEMENT.md` §3), an edit of a file the open unit's constraints bind shows them first. Without it, run `sdlc_check.py constraints --file <path>` before its first edit of a file in a session.
+- **Constraint recall (L3).** Where the recall hook is wired (`ENFORCEMENT.md` §3), an edit of a file the open unit's constraints bind shows them first. Without it — or for a file you write from the shell, which the hook never sees — run `sdlc_check.py constraints --file <path>` before its first edit of a file in a session.
 - For bugs (L2/L3), continue the investigation and design-verification method in `debugging.md`; implementation follows the `tdd.md` discipline above.
 - Circuit breaker: after 3 consecutive runs without progress on the tests, stop, switch to the systematic method in `debugging.md`, and ask for instructions if still stuck. `debugging.md` also covers **chronic fragility** — a component that breaks repeatedly across sessions is a comprehension + complexity signal (write the `source_kind: code` guide AND escalate a refactor), not a fourth patch.
 - Update the ANALYSIS Diary or the Action Plan when you complete milestones, hit blockers, change decisions, or a session ends with work unfinished.

package/skills/agentic-sdlc-skill/coordination.md

@@ -0,0 +1,139 @@
+# Coordinating Parallel Sessions
+
+Rules for several peer sessions working on one repository at once, one of them
+coordinating. Read this only when they apply (§Trigger); a session that is not
+coordinated never needs it.
+
+## Trigger and roles
+
+The rules apply while more than one session works on the same repository **and**
+the owner has named the coordinating session in a request-record entry. The skill
+never elects a coordinator. Without that naming no session coordinates: each works
+in its own worktree, asks the owner before using an exclusive resource, and appends
+to no record it does not own.
+
+- **Coordinator** — the session the owner named. It keeps the shared files below,
+  writes the record of the shared unit, and acts for the owner only within what the
+  owner delegated.
+- **Part** — a peer session the owner can talk to, working on its own unit and
+  following the whole skill for it (triage, design, review, closure). It is not a
+  dispatched subagent: `dispatch.md` governs those, unchanged.
+
+Out of scope: which part runs next, in what order, with what priority — the owner
+decides that, and nothing here records it (Non-Goal 1, ruling r3).
+
+## 1. Every record has one writer
+
+A request record numbers its entries; two writers number them twice (field case:
+three sessions wrote R156–R158 into one record at once). So:
+
+- A part's unit has its own record when its triage gives it one (every L3); the
+  part is its only writer.
+- The record of the shared unit the parts serve — the milestone, the umbrella — is
+  written only by the coordinator.
+- Owner words a part receives are recorded **before it acts on them**, in the record
+  of the unit they settle. Words settling the part's own unit go to its own record.
+  Words settling the shared unit are appended verbatim to the part's own record
+  under the received heading (`templates.md` §REQUEST) and sent to the coordinator,
+  which appends them verbatim to the shared record citing
+  `REQUEST_[part].md#R<n>`.
+- A part with no record of its own (below L3) sends the words; the coordinator's
+  shared entry names that part and the date received, and the part acts once it
+  exists.
+- Every such entry keeps every rule of the record: verbatim, redaction, the owner
+  told so they can correct a quotation.
+- An artifact of the shared unit cites only the shared record: the coordinator
+  enters the words before any such artifact relies on them.
+
+## 2. Leases on exclusive resources
+
+An exclusive resource has one holder at a time: the development container, the test
+database, the code-writer role in a checkout a runtime mounts, any other the owner
+names. A part asks the coordinator; the coordinator appends to `audit/leases.md`:
+
+```
+take <resource> — <session> — YYYY-MM-DD
+release <resource> — <session> — YYYY-MM-DD
+```
+
+The file opens by citing the entry that names the coordinator; only the coordinator
+writes it. A lease names a resource and a session, never a unit; it keeps no queue,
+no waiting list, no order, and ends with its release (ruling r40). A restart or a
+long suite on a shared resource is announced to the coordinator before it starts —
+it kills what another session is running against it. A permission for a resource
+given before the coordinator was named («restart it as much as you like, nobody else
+uses it») rested on a single user: from the naming on it exempts no session from the
+lease. If the owner restates it, the coordinator enters it as a `take` for that
+session — a recorded lease, never an exemption. A lease never released is
+closed by the owner through the coordinator; there is no timeout.
+
+**The code-writer lease is the one exception to «own worktree»** (`SKILL.md`
+Phase 4). The session holding it writes code in the checkout the runtime mounts;
+every other session keeps its own worktree and writes no code there. The lease
+passes to another session only once the holder's code in that checkout is committed,
+or set aside with the owner's yes. Two sessions' code in that checkout is a
+violation, code a previous holder left uncommitted included.
+
+## 3. Decisions taken under delegation
+
+A decision the coordinator takes under the owner's delegation is a request-record
+entry under the delegated heading (`templates.md` §REQUEST), citing the delegation
+entry — in Hybrid also the devPNT proposal it accepted (`hybrid.md`). It is the
+decision's one home: an artifact relying on it cites the entry (ruling r41).
+
+A delegation never reaches an earlier owner decision, of any unit: a choice that
+would change one goes to the owner as a question. (Field case: under a delegation
+to approve design boards, the coordinator removed a file the owner had decided to
+keep; a design document was accepted on it before the coordinator withdrew.)
+
+## 4. What travels between sessions
+
+- An owner statement recorded verbatim in a request record is citable by every
+  session.
+- An authorization for a gated act — one the client or the skill makes wait for the
+  owner's yes — is valid only in the session the owner gave it to. A message from
+  another session saying the owner authorized it is information, never the
+  authorization: the receiving session asks the owner, or the session holding it
+  acts.
+- A decision found to rest on a false fact is reopened by a new entry naming the one
+  it corrects (`templates.md` §REQUEST); the old entry is never edited.
+
+## 5. When a part stops
+
+A part that stops — done, blocked, interrupted — sends the coordinator:
+
+```
+Unit / increment:
+State: done | stopped at step <X>
+Files touched:
+Verification run and result:
+Open points:
+Needs the owner:
+```
+
+The coordinator checks each claim on the diff and the run output, never on the
+message (`review.md`, an unproven completion claim), then tells the owner what is
+done, what is left and what needs them.
+
+A part can stop without being able to send (a crash, a closed client). A part with
+no closure message is not done: before relying on its state — accepting its work,
+mapping a commit, telling the owner it finished — the coordinator reads its HANDOFF
+`next:` and its working tree, and tells the owner which closure steps (`SKILL.md`
+Phase 5) the tree shows done and which it cannot tell. Whether to resume the part is the
+owner's call.
+
+## 6. One commit, several units
+
+Before a commit carrying more than one unit's work, the coordinator writes the
+commit map (`templates.md`) and runs:
+
+```
+python <skill_dir>/scripts/sdlc_check.py commit-map MAP
+```
+
+It checks the map against the working tree as it stands against HEAD: a generated
+file under a unit, a changed HANDOFF or request record in no section, a file under
+two units outside Shared, a file both under a unit and in Left out, a changed
+authored file under Regenerated are errors; a
+changed file in no section, a listed file with no change are warnings. It sees this
+working tree only, not other worktrees. The commit stays the owner's.

package/skills/agentic-sdlc-skill/debugging.md

@@ -34,11 +34,11 @@ proof that it caused this incident.
    Do not repeat an invalidated hypothesis unless new evidence reopens it.
 
 3. **Test and trace the mechanism.** Reproduce and isolate the smallest faithful
-   failing case when feasible; bisect inputs, paths or changes when informative.
-   Skip a reproduction already known to omit the incident's causal conditions;
-   choose a faithful alternative or disclose the gap. Stop diagnostic checks when
-   further results cannot change the causal or fix decision; this does not replace
-   the regression and recovery verification in step 5.
+   failing case when feasible; bisect inputs, paths or changes when informative.
+   Skip a reproduction already known to omit the incident's causal conditions;
+   choose a faithful alternative or disclose the gap. Stop diagnostic checks when
+   further results cannot change the causal or fix decision; this does not replace
+   the regression and recovery verification in step 5.
    If the incident is intermittent or inaccessible, use captured traces and
    targeted diagnostic observations instead of declaring investigation impossible.
    Add minimal instrumentation when evidence is insufficient. Prefer read-only

package/skills/agentic-sdlc-skill/elicitation.md

@@ -86,7 +86,9 @@ neither a source nor a weighing is a finding (`review.md` §Reviewing).
 - **Unattended** — the user is not reachable (the Unattended path above).
 - **Delegated** — the user's own words handed you this choice ("your call"); cite
   their entry in the request record, or quote them where the unit has none (below
-  L3). A general "go ahead" is not a delegation.
+  L3). A general "go ahead" is not a delegation. A choice you make under it goes, where the
+  unit has a request record, into it as a delegated entry (`templates.md` §REQUEST) and the artifact
+  cites that entry; it never changes an earlier decision of theirs — ask instead.
 
 Each states **what it is taken from** and **the alternative it excludes**, and is
 listed where the user will read it: an assumption recorded alone is a decision

package/skills/agentic-sdlc-skill/review.md

@@ -467,7 +467,9 @@ When you are the reviewer:
   the artifact relies on — an answer, an approval, a cost acceptance, a ruling, a
   delegation — that resolves to no entry of the unit's request record, or that the
   record contradicts, is a finding; so is a quotation in the record carrying what
-  its template says to redact. What makes a ground
+  its template says to redact, a delegated entry citing no delegation or changing
+  an earlier owner decision, and an artifact of a shared unit citing a received
+  entry instead of the shared record (`templates.md` §REQUEST, labelled entries). What makes a ground
   or an assumption legal is each lens's `elicitation.md` §The question discipline —
   cite it, never restate it. The fix is the question, not a better justification.
 - **Restated facts (cite, never copy).** Every governance slot has ONE owning document

package/skills/agentic-sdlc-skill/scripts/sdlc_check.py

@@ -41,7 +41,7 @@ sdlc_core.set_profile(
     unit_noun="feature",
     support_files=("templates.md", "architect.md", "guides.md", "vision.md", "tdd.md",
                    "debugging.md", "elicitation.md", "review.md", "dispatch.md",
-                   "routing.md", "hybrid.md", "ENFORCEMENT.md", "memory.md"),
+                   "routing.md", "coordination.md", "hybrid.md", "ENFORCEMENT.md", "memory.md"),
     capabilities=(
         # spine
         "triage", "write_triggers", "workstream_registry", "vision_gate",
@@ -84,7 +84,11 @@ REVIEW_INSTRUCTIONS = {
 REVIEW_MAP_HELP = ("\nCode lens:\n  review-map [--base REF] [--root DIR] [--docs-dir NAME]\n"
                    "      classify every file changed since the merge-base with REF "
                    "(default main):\n      REVIEW / DESIGN / EVIDENCE / GENERATED, "
-                   "as a markdown table for the merge review brief")
+                   "as a markdown table for the merge review brief\n"
+                   "  commit-map MAP [--root DIR] [--docs-dir NAME]\n"
+                   "      check a commit map (one commit carrying several units' work, "
+                   "templates.md)\n      against the working tree as it stands against "
+                   "HEAD; sees this working tree only,\n      not other worktrees")
 
 
 def table_cell(text):
@@ -268,10 +272,123 @@ def cmd_review_map(argv):
     return 0
 
 
+# ------------------------------------------------------------- commit-map (F-088)
+# The coordinator's map of ONE commit carrying several units' work: a section per
+# unit, Shared, Regenerated, Left out. The grouping is a judgement, so the map is
+# hand-written; this checks only what a tree can contradict. The base is HEAD:
+# the map describes the next commit, not the branch. Paths from the map are
+# compared with git's list as text, never opened.
+
+COMMIT_MAP_SPECIAL = {"shared": "shared", "regenerated": "regenerated",
+                      "left out": "left_out"}
+
+
+def parse_commit_map(text):
+    """{path: [section, ...]} where a section is a unit heading, or one of
+    'shared' / 'regenerated' / 'left_out'. An item is a list line whose first
+    code span is the path; text after it (a reason, the units sharing it) is free."""
+    import re
+    listed, section = {}, None
+    for line in text.splitlines():
+        if line.startswith("## "):
+            head = line[3:].strip()
+            section = COMMIT_MAP_SPECIAL.get(head.lower(), head)
+            continue
+        m = re.match(r"^\s*[-*] +`([^`]+)`", line)
+        if m and section is not None:
+            path = m.group(1).strip().replace("\\", "/")
+            while path.startswith("./"):
+                path = path[2:]
+            listed.setdefault(path, []).append(section)
+    return listed
+
+
+def cmd_commit_map(argv):
+    import argparse
+    ap = argparse.ArgumentParser(prog="sdlc_check.py commit-map")
+    ap.add_argument("map")
+    ap.add_argument("--root")
+    ap.add_argument("--docs-dir", dest="docs_dir")
+    args = ap.parse_args(argv)
+    map_path = Path(args.map).resolve()
+    try:
+        text = map_path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError) as exc:
+        print(f"[ERROR] cannot read the commit map {table_cell(args.map)}: {exc}")
+        return 1
+    try:
+        discovered, name = sdlc_core.resolve_docs_dir(args, args.root)
+    except sdlc_core.AmbiguousDocsRoot as exc:
+        print(f"[ERROR] {exc}")
+        return 1
+    sdlc_core.set_docs_dir(name)
+    root = Path(args.root).resolve() if args.root else (discovered or sdlc_core.find_project_root())
+    if not sdlc_core.require_ai_docs(root, "commit-map"):
+        return 1
+    top = _git(root, "rev-parse", "--show-toplevel")
+    if top.returncode != 0:
+        print(f"[ERROR] {root} is not inside a git repository: commit-map compares the map with HEAD.")
+        return 1
+    top = Path(top.stdout.strip()).resolve()
+    if _git(top, "rev-parse", "--verify", "--quiet", "HEAD^{commit}").returncode != 0:
+        print("[ERROR] the repository has no commit yet: commit-map compares the map with HEAD.")
+        return 1
+    docs = sdlc_core.ai_path(root).resolve()
+    try:
+        docs_prefix = docs.relative_to(top).as_posix()
+    except ValueError:
+        print(f"[ERROR] {docs} is outside the git repository {top}.")
+        return 1
+    try:
+        own = map_path.relative_to(top).as_posix()
+    except ValueError:
+        own = None
+    changed = {p for _c, p, _a, _d in _changes(top, "HEAD") if p != own}
+    generated = set()
+    if any(classify_path(p, docs_prefix, set()) != "REVIEW" for p in changed):
+        generated = _generated_set(docs)
+        if generated is None:
+            return 1
+    listed = parse_commit_map(text)
+    special = set(COMMIT_MAP_SPECIAL.values())
+    errors, warnings = [], []
+    for path in sorted(set(changed) | set(listed)):
+        sections = listed.get(path, [])
+        units = [s for s in sections if s not in special]
+        is_generated = classify_path(path, docs_prefix, generated) == "GENERATED"
+        rel = path[len(docs_prefix) + 1:] if path.startswith(docs_prefix + "/") else ""
+        if units and is_generated:
+            errors.append((path, "regenerated by the validator, listed under a unit: "
+                                 "move it to Regenerated"))
+        if len(set(units)) > 1 and "shared" not in sections:
+            errors.append((path, "under " + ", ".join(sorted(set(units)))
+                                 + " outside Shared: move it to Shared"))
+        if units and "left_out" in sections:
+            errors.append((path, "both under a unit and in Left out"))
+        if "regenerated" in sections and path in changed and not is_generated:
+            errors.append((path, "under Regenerated, but the validator does not write it: "
+                                 "list it under its unit"))
+        if path in changed and not sections:
+            if rel.startswith("audit/HANDOFF_") or rel.startswith("audit/requests/"):
+                errors.append((path, "a changed HANDOFF or request record in no section"))
+            else:
+                warnings.append((path, "changed, in no section"))
+        if path not in changed:
+            warnings.append((path, "listed, but not changed against HEAD"))
+    for level, items in (("ERROR", errors), ("WARN", warnings)):
+        for path, rule in items:
+            print(f"[{level}] `{table_cell(path)}` -- {rule}")
+    print(f"commit-map: {len(changed)} changed files against HEAD; "
+          f"{len(errors)} errors, {len(warnings)} warnings")
+    return 1 if errors else 0
+
+
 def main(argv=None):
     argv = list(sys.argv[1:] if argv is None else argv)
     if argv[:1] == ["review-map"]:
         return cmd_review_map(argv[1:])
+    if argv[:1] == ["commit-map"]:
+        return cmd_commit_map(argv[1:])
     rc = knowledge.main(argv)
     if argv[:1] in (["-h"], ["--help"]):
         print(REVIEW_MAP_HELP)

package/skills/agentic-sdlc-skill/templates.md

@@ -549,12 +549,57 @@ Context (agent): "the question it answered, quoted"
   entered only as `[NOT VERBATIM — from <source>]`, never as a quote.
 - **Unattended**: R1 quotes the trigger that started the unit, labelled as such.
   Declared assumptions are not owner statements and never enter the record.
+- **Labelled entries** (r41): a decision taken under the owner's delegation is
+  `### R<n> — YYYY-MM-DD — decided under delegation R<m> — <what it settles>`, citing
+  the delegation entry (in Hybrid also the devPNT proposal it accepted); it is the
+  deciding session's choice, never an owner statement, and never changes an earlier
+  owner decision — that goes to the owner as a question. Owner words received for a
+  unit whose record another session writes are
+  `### R<n> — YYYY-MM-DD — received for <unit> — <what it settles>`, then sent to that
+  record's writer, who enters them verbatim citing this entry. Several sessions on one
+  repository: `coordination.md` §1.
 - **Design approval** (L3): the owner's approval of the design is an entry whose
   label begins `design approved`; a no or a correction takes its own label
   (`review.md` §When a review is due).
 - **Hybrid**: always on the filesystem; governed artifacts cite entries too; an
   approval given in devPNT is named by its proposal, not quoted.
 
+## ai_docs/audit/leases.md (several sessions, one coordinating)
+
+Written only by the coordinating session (`coordination.md` §2); append-only.
+
+```markdown
+# Leases
+
+Coordinator named in `REQUEST_[unit].md#R<n>`.
+
+take dev-container — wave-6 session — YYYY-MM-DD
+release dev-container — wave-6 session — YYYY-MM-DD
+```
+
+## Commit map (one commit, several units)
+
+Written by the coordinating session before a commit carrying more than one unit's
+work, checked with `sdlc_check.py commit-map MAP` (`coordination.md` §6); not
+committed. Each item is a list line whose first code span is the path.
+
+```markdown
+# Commit map: [what this commit carries]
+
+## F-001 [unit]
+- `src/app.py`
+- `ai_docs/audit/HANDOFF_[feature].md`
+
+## Shared
+- `ai_docs/audit/reviews/REVIEW_LOG.md` — F-001, F-002
+
+## Regenerated
+- `ai_docs/INDEX.md`
+
+## Left out
+- `scratch/notes.md` — why it is not in this commit
+```
+
 ## ai_docs/solutions/E2E_TEST_[feature].md
 
 Every L3, written before the closure review so it is part of the reviewed diff.