@antoneeo/mkt-agentic-sdlc-skill 0.15.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.16.0] - 2026-10-08
+
+### Changed
+- F-065: every agent review request opens with a fixed REVIEW MANDATE block copied verbatim, which carries `review.md` itself to the reviewer in Standalone and Hybrid alike; §Requesting now lists every input its clauses check (Functional Spec, Interface Contract, Component Map, audit plan, probe harness, closure test evidence). devPNT performs no review: in Hybrid an agent review with verdict PASS precedes every proposal to devPNT, where the human reviews; after the round cap only the user's explicit decision sends an artifact on, with open findings attached.
+
+### Fixed
+- Shared memory catalog hashes normalize CRLF/LF, avoiding checkout-dependent index mismatches.
+- The validator prints its final check verdict after memory, topic and corpus checks, so their errors count in the summary.
+
 ## [0.15.0] - 2026-10-02
 
 ### Changed

package/README.md

@@ -83,7 +83,7 @@ The workstream registry (`audit/handoff.md`) is **generated** from one file per
 ## Modes
 
 - **Standalone** — everything on the filesystem under `mkt_docs/`.
-- **Hybrid with devPNT** — plans and strategy artifacts governed as versioned devPNT documents (MKT-VISION, ICP/Personas, Threat Map, Strategy, Tactical Plan, Measurement Plan), with proposal/approval workflow and independent review gates.
+- **Hybrid with devPNT** — plans and strategy artifacts governed as versioned devPNT documents (MKT-VISION, ICP/Personas, Threat Map, Strategy, Tactical Plan, Measurement Plan), with proposal/approval workflow; every artifact passes an independent agent review before it is proposed, and devPNT is where you review and approve it.
 
 On a shared `ai_docs/` tree, run `mkt_check.py index --docs-dir ai_docs` to
 generate the common index. An existing marketing-format `ai_docs/INDEX.md`

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "mkt-agentic-sdlc",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Evidence-First marketing planning protocol with engagement triage, SOSTAC workflow, evidence ledger and optional devPNT integration.",
   "author": "Antonio Pinto (https://github.com/Antoneeo)"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antoneeo/mkt-agentic-sdlc-skill",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Evidence-First marketing planning protocol for Claude Code, Gemini CLI, Google Antigravity and Codex: engagement triage, SOSTAC workflow, evidence ledger, mechanical validator and optional devPNT integration.",
   "keywords": [
     "claude-code",

package/skills/mkt-agentic-sdlc/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: mkt-agentic-sdlc
-version: 0.15.0
+version: 0.16.0
 description: Evidence-First marketing planning protocol with engagement triage, SOSTAC workflow, evidence ledger, adversarial CMO review, a complete Standalone mode and optional symbiosis with devPNT. Use for marketing plans, go-to-market strategy, campaign planning and market research.
 author: Antonio Pinto (https://github.com/Antoneeo)
 copyright: (c) 2026 Antonio Pinto

package/skills/mkt-agentic-sdlc/dispatch.md

@@ -99,8 +99,8 @@ Exactly three review touches per task, never a loop:
 
 1. Inline self-review by the implementer subagent before it reports done
    (the standard critical-review pass, not a separate call).
-2. One reviewer pass per task (Hybrid: reuse the devPNT code-review gate;
-   Standalone: the `review.md` discipline).
+2. One reviewer pass per task, under the `review.md` discipline in both modes
+   (Hybrid: against the accepted E-TDD).
 3. One broad final pass over the whole plan at closure, after all tasks are
    DONE — catches cross-task drift a per-task review cannot see.
 
@@ -135,6 +135,6 @@ have added.
 ## Hybrid note
 
 The plan's `derived-from` points at the accepted E-TDD document key. Per-task
-review reuses the devPNT independent reviewers (§4.6 code review gate) rather
-than restating review doctrine — see `review.md` for the single definition
-both modes share.
+review is the closure review of `review.md` against that E-TDD, run by the
+client's agent (devPNT doctrine §4.6 invokes the same review) — `review.md` is
+the single definition both modes share.

package/skills/mkt-agentic-sdlc/hybrid.md

@@ -8,9 +8,9 @@ phases, the gates and the evidence discipline are `SKILL.md`'s, identical in bot
 modes.
 
 Moved out of `SKILL.md` by F-052 so a Standalone session stops paying for a seam
-it cannot reach. **The content below is unchanged**: a relocation, not a rewrite.
+it cannot reach. **The content below is the relocated text, unchanged except for one declared amendment**: F-065 rewrote the review wording (devPNT performs no review; the agent review precedes the proposal — `ADR_2026-10-07_agent_review_precedes_human` in the code lens). The digest certifies the amended block, re-stamped only after the pre-edit block matched the previous digest and the diff showed only those lines changed.
 
-<!-- moved-block-sha256: b9b19d58a104e858f38460065160a61e64a6cd6f64f92c1bbf47fbf534d25ef6 -->
+<!-- moved-block-sha256: 1627068db8c34b2bbbbb151812b12a3d09d663f4bace41d2d5b490239eb2efb6 -->
 ### Hybrid in symbiosis with devPNT
 
 Use this mode when the `devpnt_*` tools are available and point at the current project.
@@ -24,7 +24,7 @@ Authoritative hierarchy:
 
 ### Ownership matrix (the Hybrid seam)
 
-The skill owns the **process** (triage, phases, gates, lifecycle); devPNT owns the **machinery** (governed storage, versioned proposals, review wiring). The marketing artifacts occupy the same governance slots the software artifacts occupy in the sibling skill:
+The skill owns the **process** (triage, phases, gates, lifecycle); devPNT owns the **machinery** (governed storage, versioned proposals, the human's review and approval surface; devPNT performs no review — the agent review is the client's, under `review.md`, and its PASS precedes the proposal). The marketing artifacts occupy the same governance slots the software artifacts occupy in the sibling skill:
 
 | Artifact | Standalone master | Hybrid master (devPNT slot) | Mirror rule |
 |---|---|---|---|
@@ -44,4 +44,4 @@ Hybrid rules:
 - The skill stays autonomous: if devPNT is not there, switch to Standalone without losing capability.
 - If the user request, the local vision and the M-VISION diverge, stop and make the conflict explicit.
 - Never auto-accept devPNT proposals: present the preview and wait for explicit confirmation.
-- Where the local devPNT protocol imposes stricter gates (vision creation/amendment gates, independent review gates), follow them: they are the same discipline this skill encodes.
+- Where the local devPNT protocol imposes stricter gates (vision creation/amendment gates, the order agent review → proposal → human review), follow them: they are the same discipline this skill encodes.

package/skills/mkt-agentic-sdlc/review.md

@@ -1,8 +1,11 @@
 # Review Discipline
 
-The single definition of how to request, receive, and perform a review. Other
-places that need review behavior point here instead of restating it (DRY) —
-including devPNT's §4.5/§4.6 gates and any future review step.
+The single definition of how to request, receive, and perform an agent review,
+in Standalone and in Hybrid alike. Other places that need review behavior point
+here instead of restating it (DRY) — including devPNT doctrine §4.5/§4.6, which
+invoke this same review, and any future review step. **devPNT performs no
+review**: it hosts the governed artifacts and is where the human reviews and
+approves them — after the agent review this file defines, never instead of it.
 
 ## When a review is due
 
@@ -14,6 +17,20 @@ Two moments, and they review different things:
 | **1b. Late arrival** | Work that became L3 *after* code existed — an L1/L2 reclassified mid-flight, or a design increment on a feature already implemented — runs moment 1 **now**, before any further implementation, logged `design (late)` | same | L3 |
 | **2. Closure review** | Phase 5, before DONE | the actual diff, against that approved design | L2 / L3 — the L2 closure review is optional; every review that runs logs its row |
 
+**The agent review comes first, the human's after — never instead (Hybrid).**
+No governed artifact that this file reviews — the design (`E-ISP`, `E-TDD`),
+and whatever else the client's devPNT doctrine §4.5/§4.6 sends to review — is
+proposed to devPNT before an agent review of it under this file has a final
+verdict of PASS; the proposal's notes cite that
+REVIEW_LOG row (date, doc_key, verdict), so the human sees which review it
+passed. When the round cap is reached with findings still standing, the artifact
+goes back to the user in chat with those findings, and it reaches devPNT only on
+the user's explicit decision — with the open findings attached to the proposal
+and the decision recorded. Where the client also follows devPNT doctrine
+§4.5/§4.6, that invocation IS this review: one review, one REVIEW_LOG row in the
+Hybrid realization below, and the doctrine's extra requirements add to this
+mandate, never replace it.
+
 **Why the design review is its own moment, and not a nicety.** The closure review
 can only tell you the code matches the design; it cannot tell you the design was
 wrong. An omission in the design — an impacted file nobody listed, a threat with no
@@ -165,7 +182,7 @@ policy pays — could not be drawn.
 **mode-specific** realization columns. The core is what both modes actually share: `date`, `doc_key`,
 `tier`, `model`, `findings_raised`, `findings_real`, `verdict`, `revise_rounds`.
 Around it, Standalone adds `reviewer` and Hybrid adds `instrument` and `notes` —
-a devPNT row carries no `reviewer` column at all, so "one identical column list"
+a Hybrid row carries no `reviewer` column at all, so "one identical column list"
 was never true of the two modes. This costs nothing for the reason `templates.md`
 §`ai_docs/audit/reviews/REVIEW_LOG.md` owns and states.
 The log is how the gate's value is measured over time; skipping it makes the gate
@@ -195,7 +212,42 @@ marks anything DONE, and a PASS is not an approval to merge — the human owns t
 
 ## Requesting
 
-When you hand work to a reviewer (human or agent), give them:
+**Open every request to an agent reviewer with the REVIEW MANDATE block, copied
+verbatim.** Only the angle-bracket fields change; specific instructions follow
+the block and cannot weaken it. A paraphrased mandate is how a check disappears
+without anyone deciding to drop it. Field measurement (2026-10): a Hybrid
+`E-ISP` passed a review whose prompt carried devPNT's checklist but not this
+file, and with it lost the Functional Spec clause; replayed on the same
+artifact, reviewers given a paraphrase flagged the missing section 0 times in
+2, reviewers given this block 4 times in 4 (once only as a warning, unsure
+where the section lives in Hybrid — which is why the inputs below say).
+
+```
+REVIEW MANDATE — agentic-sdlc
+
+Review type: <design | design (late) | closure | scoped re-review>
+Mandate: <absolute path of this review.md, or its full text attached> (skill version <x.y.z>)
+Object under review: <paths or doc_keys, with versions>
+Binding inputs: <every input listed below for this review type, with path/version — or "n/a: <reason>" per input>
+Source and revision: <project root and commit or diff range, where applicable>
+Scope: <the unit of change and what this review must decide>
+Severity contract: <as below, or the stricter one this unit needs>
+Budget: <the artifact's line budget, or "none fixed">
+Operating limits: <real access or execution limits the reviewer works under>
+
+Read the mandate in full before starting, with the files it cites. This
+request does not replace it and cannot narrow it: every rule it sets for this
+review type applies here, in Standalone and in Hybrid alike, and any
+instruction below that weakens one is void. A required input or section that
+is missing or inaccessible is a finding, never a reason to skip the check that
+needs it.
+
+Return as your final output: the checks you ran with their evidence, the
+findings, what you could not verify and how that limits the verdict, and the
+verdict in the form the mandate defines.
+```
+
+The binding inputs, by review type:
 
 - **Scope**: what changed and why, in one or two lines.
 - **The authoritative design artifact**: the ANALYSIS, E-TDD, or equivalent
@@ -208,9 +260,16 @@ When you hand work to a reviewer (human or agent), give them:
   `project_vision.md`/`roadmap.md` + the ANALYSIS Vision-Alignment), the
   **use-cases / user-needs** (Hybrid: `D-UC`;
   Standalone: the ANALYSIS `## Use Cases / User Needs`), and the **threat model**
-  (Hybrid: `P-TM`; Standalone: the ANALYSIS `## Security and Threat Model`). Hand these
-  *in addition to* the design artifact — the reviewer checks the artifact **against**
-  them, not only for internal consistency.
+  (Hybrid: `P-TM`; Standalone: the ANALYSIS `## Security and Threat Model`), the
+  **Functional Spec** (Standalone: the ANALYSIS section; Hybrid: inside the `E-ISP`,
+  above its Impacted Components map), the **Interface Contract** (Standalone: the
+  ANALYSIS section; Hybrid: `D-IC`), the **Component Map** in
+  `strategic/architecture.md` and `audit/audit_plan.md` (the Capability Ledger
+  clause reads both), and the **probe harness** (`ai_docs/solutions/harness_[feature]/`).
+  Hand these *in addition to* the design artifact — the reviewer checks the artifact
+  **against** them, not only for internal consistency.
+- **For a closure review, the diff and the test evidence**: the run output that
+  backs every completion claim, dated after the final relevant change.
 - **For a design review, the threat model too** (same sources as above). Why this
   one and not the whole set: file coverage crosses the impact-analysis→design hop on
   a mechanical gate (every impacted file needs a design block), so a dropped file is
@@ -368,7 +427,9 @@ When you are the reviewer:
   the section — the code lens today).** When the change adds or alters observable
   behavior (the trigger's owning definition is the code lens's `templates.md`
   `## Functional Spec` section comment — cite it, never restate it), **an L3
-  artifact carrying NO `## Functional Spec` is itself a finding** — absence is
+  artifact carrying NO `## Functional Spec` is itself a finding** — in Hybrid the
+  section lives inside the `E-ISP`, above its Impacted Components map, so an
+  `E-ISP` without it is that finding. Absence is
   what a skipped spec looks like, not a reason to skip the check. When the spec
   is there, these findings live here: **a component, file or mechanism named
   inside it** — the spec is component-free by construction; that is

package/skills/mkt-agentic-sdlc/scripts/knowledge.py

@@ -1491,16 +1491,17 @@ def memory_records(docs):
                     paths.append(p)
     records = []
     for p in sorted(set(paths), key=lambda p: p.relative_to(docs).as_posix()):
-        raw = p.read_bytes()
-        text = raw.decode("utf-8", errors="replace")
+        text = p.read_bytes().decode("utf-8", errors="replace")
         meta = sdlc_core.load_frontmatter(text.splitlines())
         title = next((line[2:].strip() for line in text.splitlines()
                       if line.startswith("# ")), p.stem)
+        # LF-normalized like the guides' source_hash: an autocrlf checkout must
+        # regenerate the same catalog as an LF one.
         records.append((p.relative_to(docs).as_posix(),
                         kb_unquote(meta.get("domain")) or default,
                         ", ".join(_as_list(meta.get("topics", ""))),
                         kb_unquote(meta.get("description")) or title,
-                        hashlib.sha256(raw).hexdigest()))
+                        sdlc_core.sha256_file(p)))
     return records
 
 
@@ -1662,17 +1663,18 @@ def kb_cmd_validate(root, docs, strict=False, hybrid=False):
 
 def kb_cmd_check(root, docs, strict=False, hybrid=False):
     # The spine's check owns its banners and summary line: reuse it whole, so a
-    # tree with no kb surface gets byte-identical output. The kb checks run
-    # after, and only when the surface exists.
-    rc = sdlc_core.cmd_check(root, strict=strict, hybrid=hybrid)
-    rc = max(rc, _kb_extra_validate(docs), memory_validate(docs))
+    # tree with no kb surface gets byte-identical output. The kb checks ride its
+    # hooks -- index freshness in the validate stage, graph/corpus as sections
+    # only when the surface exists -- so the summary is printed after all of them.
+    sections = ()
     if (docs / "topics").is_dir() or (docs / "corpus").is_dir():
         cycle = kb_time_cycle(docs)
-        print("===== graph =====")
-        rc = max(rc, kb_cmd_graph(docs, cycle))
-        print("===== corpus =====")
-        rc = max(rc, kb_cmd_corpus(docs, cycle))
-    return rc
+        sections = (("graph", lambda: kb_cmd_graph(docs, cycle)),
+                    ("corpus", lambda: kb_cmd_corpus(docs, cycle)))
+    return sdlc_core.cmd_check(
+        root, strict=strict, hybrid=hybrid,
+        extra_validate=lambda: max(_kb_extra_validate(docs), memory_validate(docs)),
+        extra_sections=sections)
 
 
 def kb_cmd_stale(root, docs, hybrid=False):

package/skills/mkt-agentic-sdlc/scripts/sdlc_core.py

@@ -1354,10 +1354,10 @@ def cmd_validate(root, strict=False, hybrid=False):
                               "doing the work it triggers")
         # comment-stripped, anchored: a '<!-- TODO: the ## Capability Ledger -->'
         # must not read as the section being present
-        # Hybrid: the design lives in devPNT and its §4.5 gate owns this slot
-        # (the Hybrid ownership matrix: "run ONE of them, never both"), and its log
-        # rows are keyed on e_isp_/e_tdd_ doc_keys, not on this filename -- so
-        # firing here would be a permanent, unfixable false positive.
+        # Hybrid: the design lives in devPNT, and the agent review of it (the
+        # same review.md review, run before the proposal) logs a row keyed on
+        # its e_isp_/e_tdd_ doc_key, not on this filename -- so firing here
+        # would be a permanent, unfixable false positive.
         if not hybrid and design_review_due(meta) and not review_logged(root, p.name):
             advisories.append(f"{rel}: L3 in implementation with no design-review row in "
                               f"{review_log_rel()} -- the design was reviewed by nobody but its "
@@ -1869,15 +1869,26 @@ def print_orient_hook_note(root):
         pass  # detection must never break check
 
 
-def cmd_check(root, strict=False, hybrid=False):
+def cmd_check(root, strict=False, hybrid=False, extra_validate=None, extra_sections=()):
+    """An overlay adds its checks through the two hooks, never after the call:
+    the summary line is the verdict, so every check that can fail runs before
+    it. `extra_validate()` folds into the validate stage; each
+    (title, fn) in `extra_sections` gets its own banner and summary rc."""
     print("===== validate =====")
     rc_v = cmd_validate(root, strict=strict, hybrid=hybrid)
+    if extra_validate is not None:
+        rc_v = max(rc_v, extra_validate())
     print("\n===== stale =====")
     rc_s = cmd_stale(root, hybrid=hybrid)
-    print(f"\ncheck: {'CLEAN' if not (rc_v or rc_s) else 'NOT CLEAN'} "
-          f"(validate rc={rc_v}, stale rc={rc_s})")
+    rcs = [("validate", rc_v), ("stale", rc_s)]
+    for title, fn in extra_sections:
+        print(f"\n===== {title} =====")
+        rcs.append((title, fn()))
+    failed = any(rc for _, rc in rcs)
+    print(f"\ncheck: {'NOT CLEAN' if failed else 'CLEAN'} "
+          f"({', '.join(f'{title} rc={rc}' for title, rc in rcs)})")
     print_orient_hook_note(root)
-    return 1 if (rc_v or rc_s) else 0
+    return 1 if failed else 0
 
 
 # --------------------------------------------------------------------- gate

package/skills/mkt-agentic-sdlc/templates.md

@@ -498,7 +498,7 @@ One row per completed review (`review.md` §When a review is due). Append-only;
 is the record that the gate ran and what it was worth. **One schema for both
 modes** — one required CORE (`date`, `doc_key`, `tier`, `model`, `findings_raised`,
 `findings_real`, `verdict`, `revise_rounds`) plus each mode's own realization
-columns: Standalone adds `reviewer`, a Hybrid devPNT row adds `instrument` and
+columns: Standalone adds `reviewer`, a Hybrid row adds `instrument` and
 `notes` and carries no `reviewer` at all. Both modes write this same file.
 
 ```markdown