@brainervirus/workit-cli 4.0.0 → 5.0.0

package/assets/templates/plan-template.md

@@ -1,27 +1,26 @@
-# <Feature> Implementation Plan
+# <Feature> plan
 
-> **For agentic workers:** Load `workit-implement` when policy selects implementation. Use bounded `workit_worker` delegation when the host supports it; otherwise execute inline within writer scope. Steps use checkbox (`- [ ]`) syntax for tracking.
+Spec: `docs/<slug>/spec.md` · Goal: <one sentence>
 
-**Spec:** `docs/<slug>/spec.md`
-**Branch:** `feature/<slug>`
+A plan records decisions, not code: per slice the branch, what it touches, its
+acceptance, how it is verified, and what it depends on (workit-shape
+`references/slicing.md`). Independent slices fan out (workit-fanout);
+dependent ones stack (`workit stack plan <bottom> … <top>`).
 
-**Goal:** <one sentence>
+## Global constraints
 
-## Global Constraints
-
-- Each task lands exactly one contiguous non-empty commit range (`base..head`): fix rounds append commits to that range and never rewrite/amend an active review range; record the real base..head shas in task progress.
-- The final task closes the lead Workit task with `workit_task` `action: "close"` (CLI: `workit task close --payload … [--confirm]`) once requirements are satisfied and repository verification passes — never finish while the task is still `active` or `paused`.
-- <project-wide requirements, one line each>
+- <project-wide requirement, one line each>
 
 ---
 
-### Task N: <Component>
-
-- [ ] **Step 1: <action>**
+### S1 <type>/<slug>  (base: main)
 
-<!-- per-task criteria: how this task is verified -->
-**Criteria:** <verifiable check>
+Touches: <areas, not line numbers>
+Acceptance:
+- Given <state>, When <action>, Then <observable result>
+Verify: `workit check test`; verify-<app> "<feature>"
+Decisions: <ledger refs or one-line rulings>
 
-| Status | Task |
-| --- | --- |
-| pending | N: <Component> |
+| Slice | Branch | Depends on | Status |
+| --- | --- | --- | --- |
+| S1 | <type>/<slug> | — | pending |

package/assets/templates/spec-template.md

@@ -19,14 +19,15 @@ no durable agreement: `Spec: none (<reason>)`, no file.)
 
 ## Architecture
 
-<!-- May be `N/A (<reason>)` when the change has no flows or architecture. -->
-<!-- Otherwise REQUIRED: render a mermaid diagram (workit-diagram skill). -->
+<!-- Optional: only when a diagram argues a decision (workit-shape
+     references/diagrams.md); otherwise delete this section. -->
 ```mermaid
 flowchart TD
   A[Start] --> B[Step]
 ```
 
-<!-- REQUIRED if this spec touches UI: render an ASCII wireframe (workit-mockup skill). -->
+<!-- Optional: a UI choice still open gets an ASCII sketch (workit-shape
+     references/mockups.md). -->
 ```text
 ┌──────────────┐
 │ Header       │

package/dist/index.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "3.0.0",
+    version: "4.0.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -15598,13 +15598,13 @@ var METHODS, methodMatches = (definition, requirement) => definition.dimensions?
 };
 var init_methods = __esm(() => {
   METHODS = {
-    "workit-challenge": { dimensions: ["challenge", "decisions"] },
-    "workit-behavioral-tdd": { dimensions: ["testing"], ruleIds: ["mechanical-existing-checks"] },
+    "workit-shape": { dimensions: ["challenge", "decisions", "artifacts", "continuity"] },
+    "workit-bdd": { dimensions: ["testing"] },
     "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review", "self-review"] },
-    "workit-plan": { dimensions: ["artifacts", "continuity"] },
-    "workit-implement": { dimensions: ["delegation"] },
+    "workit-implement": { ruleIds: ["mechanical-existing-checks"] },
+    "workit-fanout": { dimensions: ["delegation"] },
     "workit-debug": {},
-    "workit-handoff": {},
+    "workit-continue": {},
     "workit-deslop": { ruleIds: ["pre-pr-cleanup"] }
   };
 });
@@ -21627,10 +21627,15 @@ function recordVerdict(context, input) {
   if (key.dirty === true)
     return err("blocked", `dirty_worktree: ${branch} has uncommitted changes, so its head is not what was judged`, "commit or stash the changes, re-check, then record the verdict");
   const session = context.actor.session;
-  const selfReason = input.self === true ? "flag" : session ? null : "no_session";
+  const selfReason = input.self === true ? "flag" : session && input.derivedFrom !== null ? null : "no_session";
   const self2 = selfReason !== null;
-  if (!self2 && session && authorSessions(context.cwd, ledger.value.rows, branch, { base: key.base, head: key.head }).has(session))
-    return err("blocked", `author_verdict: session ${session} authored ${branch}; a verdict must come from a different session`, 'have a non-author session record the verdict, or pass --self (a self verdict is never accepted by merge:"verified")');
+  const authors = authorSessions(context.cwd, ledger.value.rows, branch, {
+    base: key.base,
+    head: key.head
+  });
+  const authoring = [session, input.derivedFrom].find((candidate) => typeof candidate === "string" && authors.has(candidate));
+  if (!self2 && authoring)
+    return err("blocked", `author_verdict: session ${authoring} authored ${branch}; a verdict must come from a different session`, input.derivedFrom === undefined ? 'have a non-author session record the verdict, or pass --self (a self verdict is never accepted by merge:"verified")' : "run the verifier as a separate session: the lead spawns it with its own WORKIT_SESSION_ID (Claude Code: subagents get one from the SubagentStart hook)");
   const link = checkSupersede(context, "verdict", self2);
   if (!link.ok)
     return link;
@@ -23602,7 +23607,7 @@ var run3 = (root, args) => {
       cwd: target.data
     }
   });
-}, prBabysitNext = (output) => `PR ready: ${output}. Babysitting was explicitly requested. Follow workit-babysit to resolve conflicts, review threads, and get checks green. Stop at PR-ready; a PR or babysit request does not authorize merge or release.`, executeConcreteExternalAction = async (request, root, marker, dateMs, step, workText, caller, approvedBeforeDigest, approvedBeforeExists, coordinationRoot = root, approvedTip, approvedRemote, approvedAccount, approvedApiHost, approvedSourceCommit, approvedCommit, approvedRemoteBase, approvedLocalBase, writerActionLease, approvedSourceBranch, approvedMergeBaseCommit, expectedWorkspaceRevision) => {
+}, prBabysitNext = (output) => `PR ready: ${output}. Babysitting was explicitly requested. Follow workit-ship to resolve conflicts, review threads, and get checks green. Stop at PR-ready; a PR or babysit request does not authorize merge or release.`, executeConcreteExternalAction = async (request, root, marker, dateMs, step, workText, caller, approvedBeforeDigest, approvedBeforeExists, coordinationRoot = root, approvedTip, approvedRemote, approvedAccount, approvedApiHost, approvedSourceCommit, approvedCommit, approvedRemoteBase, approvedLocalBase, writerActionLease, approvedSourceBranch, approvedMergeBaseCommit, expectedWorkspaceRevision) => {
   if (localAction(request.operation)) {
     if (!caller)
       return failure2("capability_unavailable", "local external action writer authority is unavailable", { outcome: "not_started" });
@@ -23717,7 +23722,7 @@ var run3 = (root, args) => {
         ...result,
         ...request.payload.babysit !== undefined ? { babysit: request.payload.babysit } : {},
         ...babysit ? {
-          babysitSkill: "workit-babysit",
+          babysitSkill: "workit-ship",
           next: prBabysitNext(String(result.output ?? ""))
         } : {}
       });
@@ -68239,22 +68244,17 @@ var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync12(root) ? re
 };
 var init_skill_manifests = __esm(() => {
   WORKIT_METHOD_SKILLS = [
-    "workit-challenge",
-    "workit-behavioral-tdd",
-    "workit-review",
-    "workit-plan",
+    "workit-shape",
     "workit-implement",
+    "workit-review",
     "workit-debug",
-    "workit-handoff",
-    "workit-babysit",
-    "workit-blast-radius",
-    "workit-deslop",
-    "workit-diagram",
-    "workit-mockup",
-    "workit-green-run",
-    "workit-steer",
+    "workit-ship",
+    "workit-continue",
     "workit-bdd",
-    "workit-test-audit"
+    "workit-test-audit",
+    "workit-deslop",
+    "workit-fanout",
+    "workit-verify-app"
   ];
   if (false) {}
 });
@@ -68531,8 +68531,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, assetPathsFor = (host, dev) => {
   const pkg = path32.join(dev, "packages", `workit-${host}`);
   switch (host) {
-    case "opencode":
-      return WORKIT_METHOD_SKILLS.map((skill) => path32.join(pkg, "assets", "skills", skill, "SKILL.md"));
+    case "opencode": {
+      const packaged = path32.join(pkg, "assets", "skills");
+      const root = existsSync13(packaged) ? packaged : path32.join(dev, "packages", "workit-core", "skills");
+      return WORKIT_METHOD_SKILLS.map((skill) => path32.join(root, skill, "SKILL.md"));
+    }
     case "cursor":
       return [
         path32.join(pkg, "assets", "templates", "workit-contract.md"),
@@ -79819,6 +79822,7 @@ var exports_ledger = {};
 __export(exports_ledger, {
   run: () => run18
 });
+import { randomBytes as randomBytes4 } from "node:crypto";
 import { parseArgs } from "node:util";
 function targetBranch(io, rows, branch, pr) {
   if (pr !== undefined) {
@@ -79901,9 +79905,13 @@ async function run18(argv, io) {
   const target = targetBranch(io, rows, values.branch, pr);
   if (!target.ok)
     return failed(io, target);
+  const acting = actorFor(io, values);
+  if (acting instanceof Error)
+    return usage3(io, acting.message);
+  const { actor } = acting;
   const context = {
     cwd: io.cwd,
-    actor: actorFromEnv(io.env),
+    actor,
     branch: target.value,
     base: values.base ?? null,
     ...pr === undefined ? {} : { pr },
@@ -79931,10 +79939,30 @@ async function run18(argv, io) {
     how: values.how,
     surface: values.surface ?? null,
     self: values.self === true,
-    evidenceRefs: values.evidence
-  })), (row) => `recorded verdict ${row.id}: ${row.result} [${row.kind}] for ${row.branch} @ ${(row.head ?? "").slice(0, 12)}${row.self ? ` (self${row.selfReason === "no_session" ? ": WORKIT_SESSION_ID unset" : ""}; never accepted)` : ""}`);
+    evidenceRefs: values.evidence,
+    ..."derivedFrom" in acting ? { derivedFrom: acting.derivedFrom } : {}
+  })), (row) => `recorded verdict ${row.id}: ${row.result} [${row.kind}] for ${row.branch} @ ${(row.head ?? "").slice(0, 12)} as ${actor.session ?? "no session"}${row.self ? ` (self${row.selfReason === "no_session" ? ": WORKIT_SESSION_ID unset" : ""}; never accepted)` : ""}`);
 }
-var USAGE7 = "workit ledger decision|ruling|verdict|list|check ... (workit help ledger for the grammar)", OPTIONS, positiveInt2 = (value, flag) => {
+var USAGE7 = "workit ledger decision|ruling|verdict|list|check ... (workit help ledger for the grammar)", OPTIONS, SESSION_SAFE2, ROLE_SAFE, actorFor = (io, values) => {
+  const actor = actorFromEnv(io.env);
+  if (values.session !== undefined && values.as !== undefined)
+    return new Error("pass --session or --as, not both");
+  if (values.session !== undefined) {
+    if (!SESSION_SAFE2.test(values.session))
+      return new Error("--session must be 1-128 characters of [A-Za-z0-9_.:@/+-]");
+    return { actor: { ...actor, session: values.session } };
+  }
+  if (values.as !== undefined) {
+    if (!ROLE_SAFE.test(values.as))
+      return new Error("--as takes a lowercase role, e.g. verifier");
+    const prefix = (actor.session ?? actor.host).slice(0, 96);
+    return {
+      actor: { ...actor, session: `${prefix}:${values.as}:${randomBytes4(4).toString("hex")}` },
+      derivedFrom: actor.session
+    };
+  }
+  return { actor };
+}, positiveInt2 = (value, flag) => {
   if (value === undefined)
     return;
   const parsed = Number(value);
@@ -79967,8 +79995,12 @@ var init_ledger2 = __esm(() => {
     type: { type: "string" },
     last: { type: "string" },
     supersedes: { type: "string" },
+    session: { type: "string" },
+    as: { type: "string" },
     json: { type: "boolean" }
   };
+  SESSION_SAFE2 = /^[A-Za-z0-9_.:@/+-]{1,128}$/;
+  ROLE_SAFE = /^[a-z][a-z0-9-]{0,31}$/;
 });
 
 // node_modules/@babel/parser/lib/index.js

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-cli",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "private": false,
   "description": "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
   "keywords": [
@@ -38,9 +38,9 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.9",
-    "@brainervirus/workit-core": "^4.0.0",
-    "@brainervirus/workit-cursor": "^4.0.0",
-    "@brainervirus/workit-opencode": "^4.0.0",
+    "@brainervirus/workit-core": "^5.0.0",
+    "@brainervirus/workit-cursor": "^5.0.0",
+    "@brainervirus/workit-opencode": "^5.0.0",
     "@inkjs/ui": "2.0.0",
     "ink": "7.1.1",
     "react": "19.2.8"

package/assets/templates/execution-contract.md

@@ -1,40 +0,0 @@
-Load resolved method skills through the host skill loader when policy selects them. Implement the existing plan; do not re-plan.
-
-**Spec:** <SPEC_PATH>
-**Plan:** <PLAN_PATH>
-**Branch:** <BRANCH>
-
-## Hard gates
-
-- Inspect task state before acting. On OpenCode, Cursor, Codex, and Pi use the eight shared `workit_*` families (`workit_task`, `workit_policy`, `workit_evidence`, `workit_finding`, `workit_decision`, `workit_worker`, `workit_writer`, `workit_state`). On the CLI host use `workit <family> <action>` with the same actions (hyphenated on the CLI).
-- Never use a worktree. Branch changes are in-place through the approved `git.branch_setup` external action (CLI: `workit action git.branch_setup --payload …`).
-- Task metadata lives under `.workit/`; never edit it directly. Record progress, evidence, findings, decisions, and worker state only through the shared operations.
-- Helpers cannot widen scope, record binding decisions, close or pause the task, assign further helpers, or resolve blockers for the lead.
-- On Cursor, pass the active workspace as `workspace_root` on every repository-scoped call.
-
-## Setup
-
-1. If there is no active or paused task, call `workit_task` with `action: "start"` then `workit_policy` with `action: "assess"` (CLI: `workit task start …` then `workit policy assess …`).
-2. Load `workit-plan`, list tasks with `workit_task` `action: "list"`, and mirror visible todo state to the host UI.
-3. When policy requires a feature branch, resolve it with read-only `context.read` and apply `git.branch_setup` only after native approval.
-
-## Remaining-task loop
-
-For each bounded plan task:
-
-1. Mark the item in progress in the host todo UI and record boundary progress with `workit_task` `action: "progress"`.
-2. Route by policy: assign bounded workers with `workit_worker` `action: "assign"` when delegation is available; otherwise implement inline. Acquire product-write ownership with `workit_writer` `action: "acquire"` before repository mutations; release it when done.
-3. Record checks and artifacts with `workit_evidence` `action: "record"`. Record review concerns with `workit_finding` `action: "record"`; resolve or defer them with `finding.resolve`. Blocking findings may trigger at most **two** fix+re-review rounds per task; advisory taste/YAGNI items still use `finding.record` and never pause the loop by direct file edit.
-4. Never advance while a foreign writer is active or blocking findings remain open for the current candidate.
-
-## Final gate
-
-Run repository verification (CLI: `workit doctor`; hosts: approved project verify when policy requires it). **Mandatory:** close the lead task with `workit_task` `action: "close"` (CLI: `workit task close --payload … [--confirm]`) once requirements are satisfied and verification passes — never finish while the task is still `active` or `paused`.
-
-## Task order
-
-<TASK_LIST>
-
-## Quality gate
-
-- Specs/plans follow `templates/spec-template.md` / `templates/plan-template.md`.