@brainervirus/workit-core 0.11.0 → 1.0.0

package/README.md

@@ -1,5 +1,9 @@
 # @brainervirus/workit-core
 
+[![CI](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml/badge.svg)](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/@brainervirus/workit-core.svg)](https://www.npmjs.com/package/@brainervirus/workit-core)
+[![license: MIT](https://img.shields.io/badge/license-MIT-green.svg)](../../LICENSE)
+
 Shared core for the workit plugins — the single source of workflow logic that the OpenCode, Cursor, and CLI packages adapt to their native surfaces.
 
 ## When you need it directly
@@ -17,11 +21,9 @@ You consume `@brainervirus/workit-core` directly only when:
 | --- | --- |
 | `src/core/` | Shared TS logic (setup, registration, doctor, logger, branch, PR, changelog, YouTrack, presentation, docs, SDD, support matrix). |
 | `src/core.ts` | Package entry; adapters import `@brainervirus/workit-core/src/*`. |
-| `skills/` | 12 OpenCode-native `wk-*` skills. |
-| `commands/` | 12 OpenCode `wk-*` command prompts. |
+| `skills/` | 14 `workit-*` method skills (single source; adapters ship byte-identical copies). |
 | `scripts/` | Shared shell installers/launchers and the release-time workspace-dep rewrite. |
 | `templates/` | Execution and Superpowers contract templates. |
-| `vendor/superpowers/skills/` | 14 vendored Superpowers skills. |
 
 Adapters map host-native surfaces to `src/core/`; they never re-implement core logic. Keep shared behavior here and host-specific presentation in each adapter.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-core",
-  "version": "0.11.0",
+  "version": "1.0.0",
   "private": false,
   "description": "Workit — workflow rails for agentic coding: specs, plans, YouTrack, CI-gated commits (shared core)",
   "keywords": [
@@ -23,8 +23,6 @@
     "src/",
     "scripts/",
     "skills/",
-    "commands/",
-    "vendor/superpowers/skills/",
     "templates/",
     "README.md",
     "LICENSE",
@@ -42,5 +40,12 @@
   },
   "scripts": {
     "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@openclaw/fs-safe": "0.8.1",
+    "zod": "4.5.4"
+  },
+  "engines": {
+    "node": ">=24"
   }
 }

package/scripts/analyze-release-scope.ts

@@ -7,9 +7,12 @@ import { resolve } from "node:path";
 
 export const RELEASE_PACKAGES = [
   "workit-core",
+  "workit-mcp",
+  "workit-cli",
   "workit-opencode",
   "workit-cursor",
-  "workit-cli",
+  "workit-codex",
+  "workit-pi",
 ] as const;
 
 const g = (root: string, args: string[]): string =>

package/scripts/doctor-check.ts

@@ -10,7 +10,9 @@
 // failures are left to the post-install gate.
 import { runDoctor } from "../src/core/doctor";
 
-const host = process.argv[2] === "cursor" ? "cursor" : "opencode";
+const hostArg = process.argv[2];
+const host =
+  hostArg === "cursor" ? "cursor" : hostArg === "cli" ? "cli" : "opencode";
 const staleOnly = process.argv.includes("--stale");
 const report = runDoctor({ host, installer: true });
 

package/scripts/install-codex-plugin.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Install / refresh the Codex workit plugin from the local checkout or share clone.
+set -euo pipefail
+
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+ROOT="$(CDPATH= cd -- "$SCRIPT_DIR/../../.." && pwd)"
+SHARE="${HOME}/.local/share/workit"
+DEV="${WORKFLOW_TOOLKIT_DEV:-$ROOT}"
+PLUGIN_DIR="${HOME}/.codex/plugins/workit"
+
+chmod +x "$ROOT/packages/workit-core/scripts/sync-runtime.sh"
+WORKFLOW_TOOLKIT_DEV="$ROOT" "$ROOT/packages/workit-core/scripts/sync-runtime.sh"
+
+SOURCE="$DEV"
+if [ ! -d "$SOURCE/packages/workit-codex/.codex-plugin" ] && [ -d "$SHARE/packages/workit-codex/.codex-plugin" ]; then
+  SOURCE="$SHARE"
+fi
+
+mkdir -p "$PLUGIN_DIR"
+rsync -a --delete "$SOURCE/packages/workit-codex/" "$PLUGIN_DIR/"
+
+if ! bun "$ROOT/packages/workit-core/scripts/doctor-check.ts" cli; then
+  echo "FATAL: post-install doctor found problems after Codex plugin sync" >&2
+  exit 1
+fi
+
+echo "Codex plugin installed at $PLUGIN_DIR"
+echo "Complete an explicit v1 cutover before treating this as a generation switch."

package/scripts/install-cursor-plugin.sh

@@ -140,5 +140,6 @@ if [ -d "$LEGACY_PLUGIN_DIR" ] && [ "$LEGACY_PLUGIN_DIR" != "$PLUGIN_DIR" ]; the
 fi
 
 echo "Cursor plugin installed + auto-sync enabled (sessionStart)."
+echo "Generation switches require an explicit cutover preview/apply — install alone is not a cutover."
 echo "Share: $SHARE"
 ls "$HOME/.cursor/plugins/local/workit/skills" | grep '^wk-' || true

package/scripts/install-opencode-plugin.sh

@@ -77,3 +77,4 @@ if ! bun "$ROOT/packages/workit-core/scripts/doctor-check.ts" opencode; then
 fi
 
 echo "OpenCode install done. Fully quit all opencode processes, then restart."
+echo "Generation switches require an explicit cutover preview/apply — install alone is not a cutover."

package/scripts/install-pi-package.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# Register the Pi workit extension and skills from the local checkout or share clone.
+set -euo pipefail
+
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+ROOT="$(CDPATH= cd -- "$SCRIPT_DIR/../../.." && pwd)"
+SHARE="${HOME}/.local/share/workit"
+DEV="${WORKFLOW_TOOLKIT_DEV:-$ROOT}"
+PI_CONFIG="${HOME}/.pi/config.json"
+
+chmod +x "$ROOT/packages/workit-core/scripts/sync-runtime.sh"
+WORKFLOW_TOOLKIT_DEV="$ROOT" "$ROOT/packages/workit-core/scripts/sync-runtime.sh"
+
+SOURCE="$DEV"
+if [ ! -f "$SOURCE/packages/workit-pi/dist/workit.js" ] && [ -f "$SHARE/packages/workit-pi/dist/workit.js" ]; then
+  SOURCE="$SHARE"
+fi
+
+# pi 0.85.1 loads extensions from the settings `packages` list, not from
+# ~/.pi/config.json below. Register the absolute package dir there (honoring
+# PI_CODING_AGENT_DIR) so `pi list` picks it up; the config.json write stays
+# because uninstall/cutover/detection still key pi state off it — migrating
+# those three off config.json is a separate contract change.
+AGENT_DIR="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
+SETTINGS="$AGENT_DIR/settings.json"
+mkdir -p "$AGENT_DIR"
+PI_SETTINGS="$SETTINGS" EXT="$SOURCE/packages/workit-pi" bun -e '
+import fs from "node:fs";
+const path = process.env.PI_SETTINGS!;
+const ext = process.env.EXT!;
+const current = fs.existsSync(path) ? JSON.parse(fs.readFileSync(path, "utf8")) : {};
+const packages = Array.isArray(current.packages) ? [...current.packages] : [];
+const next = {
+  ...current,
+  packages: [...packages.filter((p) => !String(p).includes("workit")), ext],
+};
+fs.writeFileSync(path, JSON.stringify(next, null, 2) + "\n");
+console.log("Registered Pi package:", ext);
+'
+
+mkdir -p "$(dirname "$PI_CONFIG")"
+PI_CONFIG="$PI_CONFIG" EXT="$SOURCE/packages/workit-pi/dist/workit.js" SKILLS="$SOURCE/packages/workit-pi/skills" bun -e '
+import fs from "node:fs";
+const path = process.env.PI_CONFIG!;
+const current = fs.existsSync(path) ? JSON.parse(fs.readFileSync(path, "utf8")) : {};
+const next = {
+  ...current,
+  extensions: [process.env.EXT!],
+  skills: [process.env.SKILLS!],
+};
+fs.writeFileSync(path, JSON.stringify(next, null, 2) + "\n");
+console.log("Registered Pi extension:", process.env.EXT);
+'
+
+echo "Pi package registered in $SETTINGS (and legacy $PI_CONFIG)"
+echo "Complete an explicit v1 cutover before treating this as a generation switch."

package/scripts/rewrite-workspace-deps.ts

@@ -9,12 +9,23 @@
 import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 
-const root = process.argv[2] ? resolve(process.argv[2]) : resolve(import.meta.dir, "..", "..", "..");
+const root = process.argv[2]
+  ? resolve(process.argv[2])
+  : resolve(import.meta.dir, "..", "..", "..");
 const core = JSON.parse(readFileSync(resolve(root, "packages/workit-core/package.json"), "utf8"));
 if (!core.version || typeof core.version !== "string") {
-  throw new Error(`workit-core version missing in ${resolve(root, "packages/workit-core/package.json")}`);
+  throw new Error(
+    `workit-core version missing in ${resolve(root, "packages/workit-core/package.json")}`,
+  );
 }
-for (const pkg of ["workit-opencode", "workit-cursor", "workit-cli"]) {
+for (const pkg of [
+  "workit-mcp",
+  "workit-cli",
+  "workit-opencode",
+  "workit-cursor",
+  "workit-codex",
+  "workit-pi",
+]) {
   const file = resolve(root, `packages/${pkg}/package.json`);
   const data = JSON.parse(readFileSync(file, "utf8"));
   const deps = data.dependencies;
@@ -28,10 +39,16 @@ for (const pkg of ["workit-opencode", "workit-cursor", "workit-cli"]) {
 // plugin manifest is versioned at release time.
 for (const file of [
   resolve(root, "packages/workit-cursor/.cursor-plugin/plugin.json"),
+  resolve(root, "packages/workit-codex/.codex-plugin/plugin.json"),
 ]) {
   const data = JSON.parse(readFileSync(file, "utf8"));
   data.version = core.version;
-  if (data.homepage) data.homepage = data.homepage.replace("BrainerVirus/workflow-toolkit", "BrainerVirus/workit");
-  if (data.repository) data.repository = data.repository.replace("BrainerVirus/workflow-toolkit", "BrainerVirus/workit");
+  if (data.homepage)
+    data.homepage = data.homepage.replace("BrainerVirus/workflow-toolkit", "BrainerVirus/workit");
+  if (data.repository)
+    data.repository = data.repository.replace(
+      "BrainerVirus/workflow-toolkit",
+      "BrainerVirus/workit",
+    );
   writeFileSync(file, `${JSON.stringify(data, null, 2)}\n`);
 }

package/scripts/sync-release-manifests.ts

@@ -9,14 +9,18 @@ import { execFileSync } from "node:child_process";
 import { readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 
-export const SYNC_MANIFEST_PATHS = [
+const SYNC_MANIFEST_PATHS = [
   "package.json",
   "packages/workit-core/package.json",
+  "packages/workit-mcp/package.json",
+  "packages/workit-cli/package.json",
   "packages/workit-opencode/package.json",
   "packages/workit-cursor/package.json",
-  "packages/workit-cli/package.json",
+  "packages/workit-codex/package.json",
+  "packages/workit-pi/package.json",
   // Kept in lockstep with packages/workit-core/package.json by contract test.
   "packages/workit-cursor/.cursor-plugin/plugin.json",
+  "packages/workit-codex/.codex-plugin/plugin.json",
 ];
 
 export type ManifestSyncResult = { version: string; changed: string[] };
@@ -27,8 +31,7 @@ export type ManifestSyncResult = { version: string; changed: string[] };
  * are left byte-untouched and omitted from `changed`. Throws on a value that
  * is not a plain release version (`latest`, branches, ranges).
  */
-export function syncManifests(root: string, tagOrVersion: string): ManifestSyncResult {
-  const match = /^v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/.exec(tagOrVersion.trim());
+export function syncManifests(root: string, tagOrVersion: string): ManifestSyncResult {  const match = /^v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/.exec(tagOrVersion.trim());
   if (!match) throw new Error(`invalid version tag: ${JSON.stringify(tagOrVersion)}`);
   const version = match[1];
   const changed: string[] = [];
@@ -44,7 +47,7 @@ export function syncManifests(root: string, tagOrVersion: string): ManifestSyncR
 }
 
 /** The newest `v*` tag by descending semver refname order (empty repo throws). */
-export function latestReleaseTag(cwd?: string): string {
+function latestReleaseTag(cwd?: string): string {
   const out = execFileSync("git", ["tag", "--list", "v*", "--sort=-v:refname"], {
     cwd,
     encoding: "utf8",

package/scripts/sync-runtime.sh

@@ -69,7 +69,7 @@ else
   exit 1
 fi
 
-for DEP in @brainervirus/workit-core @modelcontextprotocol/sdk zod; do
+for DEP in @brainervirus/workit-core @brainervirus/workit-mcp @modelcontextprotocol/sdk zod; do
   if [ ! -e "$SRC/node_modules/$DEP" ]; then
     if [ ! -f "$SRC/bun.lock" ]; then
       echo "FATAL: dependency install requires $SRC/bun.lock" >&2
@@ -83,11 +83,15 @@ for DEP in @brainervirus/workit-core @modelcontextprotocol/sdk zod; do
   fi
 done
 
+if ! (cd "$SRC" && PATH="$(dirname "$BUN_BIN"):$PATH" "$BUN_BIN" "$SRC/packages/workit-mcp/scripts/build.ts"); then
+  echo "FATAL: shared MCP build failed in $SRC" >&2
+  exit 1
+fi
 if ! (cd "$SRC" && PATH="$(dirname "$BUN_BIN"):$PATH" "$BUN_BIN" "$CURSOR_SRC/scripts/build.ts"); then
   echo "FATAL: Cursor adapter build failed in $CURSOR_SRC" >&2
   exit 1
 fi
-for ENTRY in mcp-server.js cursor-session-start.js; do
+for ENTRY in mcp-server.js cursor-session-start.js workit-hook.js; do
   DIST_ENTRY="$CURSOR_SRC/dist/$ENTRY"
   if [ ! -f "$DIST_ENTRY" ] || [ ! -s "$DIST_ENTRY" ] || [ "$(IFS= read -r LINE <"$DIST_ENTRY"; printf '%s' "$LINE")" != '#!/usr/bin/env node' ]; then
     echo "FATAL: Cursor adapter invalid dist entry: $DIST_ENTRY" >&2
@@ -153,7 +157,7 @@ import fs from "node:fs";
 const path = process.env.PKG_PATH!;
 const data = JSON.parse(fs.readFileSync(path, "utf8"));
 data.dependencies = data.dependencies ?? {};
-data.dependencies["@opencode-ai/plugin"] = data.dependencies["@opencode-ai/plugin"] ?? "1.17.7";
+data.dependencies["@opencode-ai/plugin"] = data.dependencies["@opencode-ai/plugin"] ?? "1.18.30";
 fs.writeFileSync(path, JSON.stringify(data, null, 2) + "\n");
 ' || true
 fi

package/scripts/validate-cursor-marketplace.ts

@@ -20,20 +20,12 @@
 // `continual-learning` and `third_party/gmail` with no `../` prefix, even though
 // `.cursor-plugin/` is a sibling of those directories. Therefore
 // `source: "packages/workit-cursor"` is correct and kept verbatim.
-import {
-  existsSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-} from "node:fs";
-import os from "node:os";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import Ajv from "ajv";
 import addFormats from "ajv-formats";
-import { CANONICAL_SKILLS, validateSkillManifests } from "../src/core/skill-manifests";
-import { copySanitizedVendor } from "./vendor-assets";
+import { WORKIT_METHOD_SKILLS, validateSkillManifests } from "../src/core/skill-manifests";
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(scriptDir, "..", "..", "..");
@@ -54,30 +46,6 @@ const frontmatterKeys = (file: string): Set<string> => {
   return keys;
 };
 
-const treesEqual = (a: string, b: string): string[] => {
-  const diffs: string[] = [];
-  // Thread the tree root so each file is keyed by its ROOT-relative path —
-  // otherwise every `SKILL.md` collapses to one map entry and only the
-  // last-read (readdir-order-dependent) skill is actually compared.
-  const walk = (rootDir: string, dir: string, into: Map<string, string>): void => {
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      const p = path.join(dir, entry.name);
-      if (entry.isDirectory()) walk(rootDir, p, into);
-      else into.set(path.relative(rootDir, p).split(path.sep).join("/"), readFileSync(p, "utf8"));
-    }
-  };
-  const left = new Map<string, string>();
-  const right = new Map<string, string>();
-  walk(a, a, left);
-  walk(b, b, right);
-  for (const [rel, content] of left) {
-    if (!right.has(rel)) diffs.push(`missing in rebuilt: ${rel}`);
-    else if (right.get(rel) !== content) diffs.push(`content drift: ${rel}`);
-  }
-  for (const rel of right.keys()) if (!left.has(rel)) diffs.push(`extra in rebuilt: ${rel}`);
-  return diffs;
-};
-
 export const validateMarketplace = (rootArg: string): string[] => {
   const errors: string[] = [];
 
@@ -90,9 +58,7 @@ export const validateMarketplace = (rootArg: string): string[] => {
   const validate = new Ajv({ strict: true, allErrors: true });
   addFormats(validate);
   const schemaDir = path.join(rootArg, "test/fixtures/cursor-schemas");
-  const pluginSchema = JSON.parse(
-    readFileSync(path.join(schemaDir, "plugin.schema.json"), "utf8"),
-  );
+  const pluginSchema = JSON.parse(readFileSync(path.join(schemaDir, "plugin.schema.json"), "utf8"));
   const marketSchema = JSON.parse(
     readFileSync(path.join(schemaDir, "marketplace.schema.json"), "utf8"),
   );
@@ -106,12 +72,13 @@ export const validateMarketplace = (rootArg: string): string[] => {
   // 2. Resolve each plugin source relative to the repo root; name must match.
   for (const entry of (market.plugins ?? []) as { name: string; source: string }[]) {
     const pluginDir = path.join(rootArg, entry.source);
-    const manifestRel = path.join(entry.source, ".cursor-plugin/plugin.json");
     if (!existsSync(path.join(pluginDir, ".cursor-plugin/plugin.json"))) {
       errors.push(`plugin ${entry.name}: source ${entry.source} has no .cursor-plugin/plugin.json`);
       continue;
     }
-    const plugin = JSON.parse(readFileSync(path.join(pluginDir, ".cursor-plugin/plugin.json"), "utf8"));
+    const plugin = JSON.parse(
+      readFileSync(path.join(pluginDir, ".cursor-plugin/plugin.json"), "utf8"),
+    );
     if (!validate.validate(pluginSchema, plugin)) {
       errors.push(
         `plugin ${entry.name} plugin.json invalid: ${(validate.errors ?? []).map((e) => e.message).join("; ")}`,
@@ -155,23 +122,25 @@ export const validateMarketplace = (rootArg: string): string[] => {
 
     // 5. Skills and rules carry valid frontmatter.
     const skillRoots: [string, readonly string[]][] = [
-      [path.join(pluginDir, "skills"), CANONICAL_SKILLS.workit],
-      [path.join(pluginDir, "vendor/superpowers/skills"), CANONICAL_SKILLS.superpowers],
+      [path.join(pluginDir, "skills"), WORKIT_METHOD_SKILLS],
     ];
     for (const [dir, expected] of skillRoots) {
       const mismatch = validateSkillManifests(dir, expected, "skills");
       if (mismatch) errors.push(`plugin ${entry.name}: ${mismatch}`);
       for (const skill of expected) {
         const keys = frontmatterKeys(path.join(dir, skill, "SKILL.md"));
-        if (!keys.has("name")) errors.push(`plugin ${entry.name}: ${skill}/SKILL.md missing frontmatter name`);
-        if (!keys.has("description")) errors.push(`plugin ${entry.name}: ${skill}/SKILL.md missing frontmatter description`);
+        if (!keys.has("name"))
+          errors.push(`plugin ${entry.name}: ${skill}/SKILL.md missing frontmatter name`);
+        if (!keys.has("description"))
+          errors.push(`plugin ${entry.name}: ${skill}/SKILL.md missing frontmatter description`);
       }
     }
     const rulesDir = path.join(pluginDir, "rules");
     if (existsSync(rulesDir)) {
       for (const rule of readdirSync(rulesDir).filter((f) => f.endsWith(".mdc"))) {
         const keys = frontmatterKeys(path.join(rulesDir, rule));
-        if (!keys.has("description")) errors.push(`plugin ${entry.name}: ${rule} missing frontmatter description`);
+        if (!keys.has("description"))
+          errors.push(`plugin ${entry.name}: ${rule} missing frontmatter description`);
       }
     }
 
@@ -184,23 +153,6 @@ export const validateMarketplace = (rootArg: string): string[] => {
         errors.push(`plugin ${entry.name}: ${rel} references ignored runtime output`);
       }
     }
-
-    // 7. Rebuilding the sanitized vendor tree yields no diff.
-    const sourceVendor = path.join(rootArg, "packages/workit-core/vendor/superpowers/skills");
-    const trackedVendor = path.join(pluginDir, "vendor/superpowers/skills");
-    if (existsSync(sourceVendor) && existsSync(trackedVendor)) {
-      const rebuilt = mkdtempSync(path.join(os.tmpdir(), "wk-vendor-rebuild-"));
-      try {
-        copySanitizedVendor(sourceVendor, rebuilt);
-        for (const diff of treesEqual(rebuilt, trackedVendor)) {
-          errors.push(`plugin ${entry.name}: vendor drift: ${diff}`);
-        }
-      } finally {
-        rmSync(rebuilt, { recursive: true, force: true });
-      }
-    } else {
-      errors.push(`plugin ${entry.name}: missing vendor source or tracked tree`);
-    }
   }
 
   return errors;
@@ -210,7 +162,9 @@ if (import.meta.main) {
   const errors = validateMarketplace(root);
   if (errors.length > 0) {
     for (const e of errors) process.stderr.write(`${e}\n`);
-    process.stderr.write(`marketplace validation FAILED (${errors.length} error${errors.length === 1 ? "" : "s"})\n`);
+    process.stderr.write(
+      `marketplace validation FAILED (${errors.length} error${errors.length === 1 ? "" : "s"})\n`,
+    );
     process.exit(1);
   }
   console.log(`marketplace validation passed (root: ${root})`);

package/skills/workit-babysit/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: workit-babysit
+description: Use when a PR needs driving to merge-ready, CI is red, or the user says babysit
+---
+
+# Babysit a PR to merge-ready
+
+Babysit starts automatically on PR creation unless declined (`--no-babysit`).
+One babysitter per PR; never mutate PR topology (no rebase strategy changes,
+no force-push).
+
+## Before method work
+
+If there is no active or paused task, run shared `task.start` then `policy.assess`
+before relying on selected policy rules or other product mutations. Assessment
+selects requirements; do not wait for a rule that can only exist after assess.
+
+## Method
+
+1. Declare mode: drive (fix + merge), watch (report only), or threads-only.
+2. Work the merge frontier in order: conflicts → review threads → CI.
+3. Classify CI before retry: flake (rerun once) vs stale base (verify with
+   `git merge-base --is-ancestor` before updating) vs real failure (fix).
+4. Triage bot findings skeptically: reproduce or quote code before acting;
+   invalid bots get a reasoned dismissal, never silent ignore.
+5. Batch fixes into one push wave; re-verify green after every push.
+6. Merge only when green and approved, honoring `pr` settings (squash +
+   delete branch). Stop at the human's line: never merge on explicit hold.
+
+## Completion
+
+PR merged per settings, or a status brief (frontier state, next action) when
+blocked on the human. Record evidence for fixes, findings for blockers.

package/skills/workit-behavioral-tdd/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: workit-behavioral-tdd
+description: Use when policy identifies behavior, side effects, permissions, or data handling that may change and a regression boundary is needed
+---
+
+# Behavioral TDD
+
+Test the observable behavior at a stable boundary, not the implementation shape.
+Use this method when assessment selects the `testing` dimension.
+
+## Before method work
+
+If there is no active or paused task, run shared `task.start` then `policy.assess`
+before relying on selected policy rules or other product mutations. Assessment
+selects requirements; do not wait for a rule that can only exist after assess.
+
+## Method
+
+1. Inspect the task requirement, current candidate, intended behavior, and real
+   verification entry point with shared `task`, `policy`, and `evidence` operations.
+2. State one behavior and its observable result. Choose the narrowest stable
+   boundary a caller or user depends on; avoid private helpers and incidental
+   representations.
+3. Write one vertical RED slice that fails for the missing behavior, run it, and
+   preserve the actual failure as evidence. Implement the smallest change, then
+   run the same slice GREEN and record its result. Close enforces the order: a
+   testing requirement with GREEN but no preceding RED evidence stays unsatisfied.
+4. Add only another slice for a distinct behavior or risk. Reconcile stale
+   evidence if the candidate changes.
+
+## Reject noisy tests
+
+- A dependency/version-pin assertion is not behavioral evidence.
+- A test that mirrors branches, private calls, or exact implementation structure
+  is coupled to internals; replace it with the public effect.
+- Duplicate assertions and tests that add no distinct failure signal are noise;
+  delete them.
+- Do not claim a passing test satisfies a different requirement.
+- Banned: tautologies (asserts what the code says, not what it must do),
+  ghost loops (assert inside a possibly-empty loop), smoke-only renders,
+  type-only or CSS-class coupling. If the test still passes when every
+  imported function returns undefined, rewrite the assertion or delete it.
+
+Use shared `evidence` operations for RED/GREEN results. Do not add a second
+lifecycle, approval chain, or test workflow outside the current task state.
+
+## Common mistakes
+
+| Mistake | Correction |
+| --- | --- |
+| "The pin changed, so assert the new string" | Exercise the affected consumer behavior. |
+| "The code is obvious" | A small vertical slice still proves the contract. |
+| Keeping a passing test after the boundary moved | Mark it stale and retest the current candidate. |

package/skills/workit-blast-radius/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: workit-blast-radius
+description: Use when a small-looking change could break something else, before close or merge
+---
+
+# Blast radius beyond the diff
+
+A small diff is not a small risk. Prove the one fact it is safe because of,
+with runnable proof — not assertion.
+
+## Before method work
+
+If there is no active or paused task, run shared `task.start` then `policy.assess`
+before relying on selected policy rules or other product mutations. Assessment
+selects requirements; do not wait for a rule that can only exist after assess.
+
+## Method
+
+1. List what the change touches: callers, shared state, contracts, config,
+   migrations. Grep every caller of each touched function.
+2. For each: state the one fact it is safe because of (type boundary,
+   existing test, unreachable path) plus how to run the proof.
+3. Run the proofs. Unproven claims stay labeled UNPROVEN in findings —
+   never silently treated as safe.
+4. Fix at the shared root (one guard where all callers route through),
+   not per caller.
+
+## Completion
+
+Blast-radius note in evidence or review: each risk with fact + proof
+command, or an UNPROVEN finding for what could not be proven.

package/skills/workit-challenge/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: workit-challenge
+description: Use when a proposal is ambiguous, consequential, disputed, or may hide assumptions, coupling, failure modes, or a simpler solution
+---
+
+# Challenge a proposal with a grounded grill
+
+Treat the proposal as a hypothesis. Facts are the agent's job; decisions are
+the user's. Use this method when assessment selects the `challenge` or
+`decisions` dimension.
+
+## Before method work
+
+If there is no active or paused task, run shared `task.start` then `policy.assess`
+before relying on selected policy rules or other product mutations. Assessment
+selects requirements; do not wait for a rule that can only exist after assess.
+
+## Method
+
+1. Ground first: inspect the task, policy, candidate, evidence, decisions, and
+   the repo docs that exist. Never ask what code or docs can answer.
+2. Diverge once, bounded: when the approach is unknown, offer 3-5 candidate
+   directions with evidence and tradeoffs in one advisory burst, without
+   critique. Record the burst as artifact evidence when it matters; the user
+   steers or mixes.
+3. Grill one question at a time: each question carries your recommended answer,
+   the facts behind it, and at least one rejected alternative. Resolve
+   dependency order and recompute after every answer — a wall of questions is
+   not an interview.
+4. Funnel every resolution: the moment a consequential choice settles, bind it
+   with a receipt-shaped question (header `Workit decision: <purpose>`, exactly
+   `approved`/`rejected`, the approved description carrying the exact content).
+   If the user already stated the choice in conversation and no receipt can be
+   minted, record it in task progress and reassess so the settled requirement
+   retires — never re-ask to mint a receipt, and never leave it for close to
+   demand.
+5. Durability: write or refresh the spec under `docs/<slug>/` only when the
+   `durable-spec` requirement fires. No glossary, no second lifecycle.
+6. Counter-case: each material recommendation carries one strongest
+   counter-case (hidden assumption, failure mode, coupling, simpler
+   alternative). Stop when a counter-case adds no new constraint.
+
+Stop at an empty frontier or three rounds; the cap is the bound. Say directly
+when the proposal is weak, overcomplicated, or solves the wrong problem.
+
+## Guardrails
+
+- Do not create a universal spec, plan, approval chain, or second lifecycle.
+- Unknowns that affect the dependent action remain unresolved until evidence or a
+  user decision closes them.
+- Use the shared operations for state and provenance; never write task metadata
+  directly.
+- An in-session counter-case is never fresh-context review; claim only what it is.
+
+## Common mistakes
+
+| Mistake | Correction |
+| --- | --- |
+| Asking what the code or docs already answer | Ground first; the user owns choices, not lookups. |
+| Listing every hypothetical objection | One strongest counter-case, then stop. |
+| Asking "what do you think?" without a recommendation | Recommend an option and explain the tradeoff. |
+| Leaving a settled choice for close to confirm | Funnel it when it resolves; progress plus reassessment if no receipt. |