@caddis/cli 0.4.51 → 0.4.53

package/bundles/antigravity-plugin/scripts/enforcement_inventory.py

@@ -139,7 +139,6 @@ def _enforcer_for(rel_path: str, text: str) -> str | None:
 GATE_SCRIPT = REPO / "scripts" / "caddis_gate.py"
 GATE_CONCERNS = {
     "lane-check": ("lane", "spawn", "launch command", "--print", "-p"),
-    "verdict-gate": ("verdict", "advisory-hub", "blocked-pending-hub", "accept-degraded"),
     "tracker-vs-git": ("tracker",),
 }
 

package/bundles/antigravity-plugin/scripts/oss_review.py

@@ -416,7 +416,7 @@ def current_branch(cwd: str) -> str:
 
 def build_review_prompt(diff_text: str, branch: str, rng: str | None,
                         all_paths: list[str] | None = None) -> str:
-    """Adversarial review prompt — ported from docket runner._review_prompt (kept in sync).
+    """Adversarial review prompt.
 
     Self-contained: the criteria are inline so a real review always happens, and it ends with
     a single machine-parseable verdict line the caller maps to an exit code.
@@ -570,7 +570,7 @@ def main(argv: list[str] | None = None, env: dict[str, str] | None = None) -> in
     args = parser.parse_args(argv)
 
     # --check-config is deliberately NON-INTERACTIVE. This script runs headless — from CI, from a
-    # docket runner, from a `claude -p` session — where a prompt on stdin does not ask a question,
+    # runner, from a `claude -p` session — where a prompt on stdin does not ask a question,
     # it hangs forever. The ASKING belongs in `/caddis:cross-review`, which is driven by an agent
     # that can actually talk to a human. This half just answers "is it configured?" cheaply enough
     # to call before you need it, instead of finding out mid-commit.

package/bundles/antigravity-plugin/scripts/roadmap-recheck.ps1

@@ -0,0 +1,89 @@
+# roadmap-recheck - the scheduled task for one roadmap (caddis-next Phase 9). It starts
+# `roadmap-run.ps1 -Roadmap <slug>` detached only when ALL of these hold, checked in this order:
+#   1. `--last-stop` exits 0: the runner's last recorded stop is `BLOCKED nothing ready`, there is none, or one of
+#      these, each with its own line prefix: `merged:` (the waiting PR merged), `freed:` (the runners that held our
+#      batches are gone), `rollup-ready:` (a milestone waits only for its rollup); any FAILED stop
+#      (the snapshot guard, a crash), `running` (a killed run), a cap or a STOP file needs the owner, so it prints
+#      why and starts nothing;
+#   2. the roadmap runner lock is absent or stale (`--lock-state`); a live lock starts and writes nothing;
+#   3. `caddis_roadmap.py recheck` cleared a blocker (exit 0); in a `merged:`, `freed:` or `rollup-ready:` tick
+#      recheck is NOT run (the
+#      merge is the change, and a cleared blocker would change the roadmap the restart checks against its hash);
+#   4. agy engine only (the recorded launch options): `caddis_spend.py check` exits 0.
+# It restarts with the launch options the last run recorded (`--restart-args`: engine, model, caps), never the
+# defaults. A run that holds the lock records the last stop `running`, so a run killed without a stop (a crash, a
+# reboot) is never restarted here: it needs the owner.
+# The owner registers it every 2 hours with the command that `roadmap-run.ps1 -Roadmap <slug> -PrintRecheckTask`
+# prints. Every Python call here runs with CADDIS_HEADLESS=1, so no owner-only roadmap change can pass.
+# Test seams: CADDIS_RECHECK_PYTHON (the interpreter) and CADDIS_RECHECK_SCRIPTS (the folder that holds
+# caddis_roadmap.py, caddis_roadmap_run.py, caddis_spend.py and roadmap-run.ps1).
+# Usage: roadmap-recheck.ps1 -Roadmap <slug> [-Repo <path>] [-GhAccount <gh login>]
+# Exit: 0 started the runner, 1 nothing to start, 3 cannot run, 4 bad input.
+param(
+    [string]$Roadmap = '',
+    [string]$Repo = (Get-Location).Path,
+    [string]$GhAccount = ''
+)
+$SlugRule = '^[a-z0-9][a-z0-9-]{0,62}$'  # = caddis_roadmap.SLUG_RE_TEXT (a test keeps the three equal)
+if ($Roadmap -cnotmatch $SlugRule) { Write-Error "roadmap-recheck: -Roadmap must match $SlugRule"; exit 4 }
+$py = if ($env:CADDIS_RECHECK_PYTHON) { $env:CADDIS_RECHECK_PYTHON } else { (Get-Command python -ErrorAction SilentlyContinue).Source }
+if (-not $py) { Write-Error "roadmap-recheck: python not found on PATH"; exit 3 }
+$dirs = if ($env:CADDIS_RECHECK_SCRIPTS) { @($env:CADDIS_RECHECK_SCRIPTS) } else { @($PSScriptRoot, (Join-Path $PSScriptRoot '../../scripts')) }
+function Find-Script([string]$name) {
+    foreach ($dir in $dirs) {
+        $p = Join-Path $dir $name
+        if (Test-Path $p) { return (Resolve-Path $p).Path }
+    }
+    return $null
+}
+$roadmapPy = Find-Script 'caddis_roadmap.py'
+$runnerPy = Find-Script 'caddis_roadmap_run.py'
+$spendPy = Find-Script 'caddis_spend.py'
+$runPs1 = Find-Script 'roadmap-run.ps1'
+if (-not ($roadmapPy -and $runnerPy -and $spendPy -and $runPs1)) {
+    Write-Error "roadmap-recheck: caddis_roadmap.py, caddis_roadmap_run.py, caddis_spend.py or roadmap-run.ps1 not found"
+    exit 4
+}
+$env:CADDIS_HEADLESS = '1'  # inherited by every child below
+# No trailing separator (a trailing `\` before a closing quote escapes it); a drive root keeps `X:\`.
+$Repo = $Repo.TrimEnd('\', '/')
+if ($Repo -match '^[A-Za-z]:$') { $Repo += '\' }
+$repoArg = if ($Repo -match '\\$') { "$Repo\" } else { $Repo }  # doubled in front of the closing quote
+
+$ghArgs = if ($GhAccount) { @('--gh-account', $GhAccount) } else { @() }
+$why = (& $py $runnerPy --roadmap $Roadmap --repo $Repo --last-stop @ghArgs) -join ' '
+if ($LASTEXITCODE -ne 0) { Write-Output "roadmap-recheck: $why; runner not started"; exit 1 }
+
+# A live lock: a runner is starting or running. Start nothing and WRITE nothing (no recheck either: a cleared
+# blocker would change the roadmap under that runner's guard). `--last-stop` above only reads.
+$state = & $py $runnerPy --roadmap $Roadmap --repo $Repo --lock-state
+if ($LASTEXITCODE -ne 0) { Write-Output "roadmap-recheck: runner lock is $state; runner not started"; exit 1 }
+
+$merged = $why -match '^(merged|freed|rollup-ready):'  # merged PR, holder gone, or a milestone waits for its rollup
+if (-not $merged) {
+    # Only after `BLOCKED nothing ready` (or no stop). Never in a `merged:` tick: clearing a blocker now would change
+    # the origin roadmap the restarted runner checks against the hash it recorded at publish time.
+    & $py $roadmapPy recheck --roadmap $Roadmap --root $Repo
+    $rc = $LASTEXITCODE
+    if ($rc -ne 0) { Write-Output "roadmap-recheck: no blocker cleared (recheck exit $rc); runner not started"; exit 1 }
+}
+
+$options = @(& $py $runnerPy --roadmap $Roadmap --repo $Repo --restart-args | Where-Object { $_ -ne '' })
+if ($LASTEXITCODE -ne 0) { Write-Output "roadmap-recheck: launch options not readable; runner not started"; exit 1 }
+if ($GhAccount -and $options -notcontains '-GhAccount') { $options += @('-GhAccount', $GhAccount) }
+
+# The global agy spend cap applies to the agy engine only (a claude run needs no spend-cap file).
+$engineAt = [array]::IndexOf($options, '-Engine')
+$engine = if ($engineAt -ge 0 -and $engineAt + 1 -lt $options.Count) { $options[$engineAt + 1] } else { 'claude' }
+if ($engine -eq 'agy') {
+    & $py $spendPy check
+    if ($LASTEXITCODE -ne 0) { Write-Output "roadmap-recheck: spend check exit $LASTEXITCODE; runner not started"; exit 1 }
+}
+
+$shell = (Get-Process -Id $PID).Path
+$argv = @('-NoProfile', '-File', "`"$runPs1`"", '-Roadmap', $Roadmap, '-Repo', "`"$repoArg`"") + $options
+$start = @{ FilePath = $shell; ArgumentList = $argv }
+if ($IsWindows -or $env:OS -eq 'Windows_NT') { $start['WindowStyle'] = 'Hidden' }
+Start-Process @start
+Write-Output "roadmap-recheck: started roadmap-run.ps1 -Roadmap $Roadmap $($options -join ' ') (lock was $state)"
+exit 0

package/bundles/antigravity-plugin/scripts/roadmap-run.ps1

@@ -0,0 +1,88 @@
+# roadmap-run - start one fresh headless session per batch, until a stop. A thin shim over caddis_roadmap_run.py
+# (design: .caddis/plans/programme-method-design.md sections 8.2 and 8.5; caddis-next Phase 9).
+# -Plan runs a plain plan (plan mode). -Roadmap runs the next batches of a roadmap on origin (roadmap mode). Give one.
+# -PrintRecheckTask prints a PowerShell block (Register-ScheduledTask) that registers roadmap-recheck.ps1 every 2 hours;
+# it registers nothing.
+# Usage: roadmap-run.ps1 (-Plan <slug> | -Roadmap <slug>) [-Repo <path>] [-MaxHours 10] [-MaxSessions 12]
+#          [-SessionTimeoutMin 120] [-MaxUsdPerSession 25] [-MaxUsdTotal 150]
+#          [-Engine claude] [-Model opus] [-GhAccount <gh login>] [-DryRun]
+#        roadmap-run.ps1 -Roadmap <slug> [-Repo <path>] -PrintRecheckTask
+#        roadmap-run.ps1 -Roadmap <slug> [-Repo <path>] -AcceptRoadmap [-DryRun] [-Yes]   (owner only: accept an owner
+#          edit made during
+#          a merge wait as the new baseline)
+param(
+    [string]$Plan = '',
+    [string]$Roadmap = '',
+    [string]$Repo = (Get-Location).Path,
+    [double]$MaxHours = 10,
+    [int]$MaxSessions = 12,
+    [double]$SessionTimeoutMin = 120,
+    [double]$MaxUsdPerSession = 25,
+    [double]$MaxUsdTotal = 150,
+    [ValidateSet('claude', 'agy', 'codex')][string]$Engine = 'claude',
+    [string]$Model = '',
+    [switch]$DryRun,
+    [string]$GhAccount = '',
+    [switch]$PrintRecheckTask,
+    [switch]$AcceptRoadmap,
+    [switch]$Yes
+)
+if ([bool]$Plan -eq [bool]$Roadmap) { Write-Error "roadmap-run: give exactly one of -Plan <slug> and -Roadmap <slug>"; exit 4 }
+$SlugRule = '^[a-z0-9][a-z0-9-]{0,62}$'  # = caddis_roadmap.SLUG_RE_TEXT (a test keeps the three equal)
+if ($GhAccount -and $GhAccount -notmatch '^[A-Za-z0-9._-]+$') {
+    Write-Error "roadmap-run: -GhAccount must be a gh login name (got '$GhAccount')"; exit 4
+}
+if ($Roadmap -and $Roadmap -cnotmatch $SlugRule) {
+    Write-Error "roadmap-run: -Roadmap must match $SlugRule (got '$Roadmap')"; exit 4
+}
+if ($PrintRecheckTask) {
+    if (-not $Roadmap) { Write-Error "roadmap-run: -PrintRecheckTask needs -Roadmap <slug>"; exit 4 }
+    # A PowerShell block for the owner to paste: every value is a single-quoted literal (a ' is doubled), and the
+    # task's whole argument line is ONE string, so no shell splits it.
+    if (-not (Test-Path -LiteralPath $Repo -PathType Container)) {
+        Write-Error "roadmap-run: -Repo '$Repo' is not a folder; nothing printed"; exit 4
+    }
+    $recheck = (Resolve-Path (Join-Path $PSScriptRoot 'roadmap-recheck.ps1')).Path
+    # A full path with no trailing separator: in a quoted command-line argument a trailing `\` would escape the quote. A
+    # drive root keeps one `\`, doubled so it stays a backslash in front of the closing quote.
+    $repoFull = (Resolve-Path -LiteralPath $Repo).Path.TrimEnd('\', '/')
+    if ($repoFull -match '^[A-Za-z]:$') { $repoFull += '\\' }
+    $shellExe = (Get-Process -Id $PID).Path
+    function Sq([string]$s) { "'" + $s.Replace("'", "''") + "'" }
+    $argLine = "-NoProfile -NonInteractive -File `"$recheck`" -Roadmap $Roadmap -Repo `"$repoFull`""
+    if ($GhAccount) { $argLine += " -GhAccount $GhAccount" }
+    Write-Output "`$action = New-ScheduledTaskAction -Execute $(Sq $shellExe) -Argument $(Sq $argLine)"
+    Write-Output "`$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 2)"
+    Write-Output ("Register-ScheduledTask -TaskName $(Sq "caddis-roadmap-recheck-$Roadmap") -Action `$action " +
+        "-Trigger `$trigger -Description $(Sq "caddis roadmap $Roadmap recheck, every 2 hours")")
+    Write-Output ("# Note: this task runs only while you are logged on. To run it whether you are logged on or not, " +
+        "add -User <DOMAIN\user> -Password <password> to Register-ScheduledTask, or set that option in Task Scheduler.")
+    exit 0
+}
+$py = (Get-Command python -ErrorAction SilentlyContinue).Source
+if (-not $py) { Write-Error "roadmap-run: python not found on PATH"; exit 3 }
+# Installed plugin: both files sit in scripts/. Source repo: the Python file is in <repo>/scripts.
+$runner = Join-Path $PSScriptRoot 'caddis_roadmap_run.py'
+if (-not (Test-Path $runner)) { $runner = Join-Path $PSScriptRoot '..\..\scripts\caddis_roadmap_run.py' }
+if (-not (Test-Path $runner)) { Write-Error "roadmap-run: caddis_roadmap_run.py not found"; exit 4 }
+$inv = [Globalization.CultureInfo]::InvariantCulture
+$argv = @($runner)
+if ($Plan) { $argv += @('--plan', $Plan) } else { $argv += @('--roadmap', $Roadmap) }
+$argv += @('--repo', $Repo,
+    '--max-hours', $MaxHours.ToString($inv), '--max-sessions', $MaxSessions.ToString($inv),
+    '--session-timeout-min', $SessionTimeoutMin.ToString($inv),
+    '--max-usd-per-session', $MaxUsdPerSession.ToString($inv), '--max-usd-total', $MaxUsdTotal.ToString($inv),
+    '--engine', $Engine)
+if ($Model) { $argv += @('--model', $Model) }
+if ($DryRun) { $argv += '--dry-run' }
+if ($AcceptRoadmap) {  # owner only: the Python side refuses it headless
+    if (-not $Roadmap) { Write-Error "roadmap-run: -AcceptRoadmap needs -Roadmap <slug>"; exit 4 }
+    $acceptArgs = @('--roadmap', $Roadmap, '--repo', $Repo, '--accept-roadmap')
+    if ($DryRun) { $acceptArgs += '--dry-run' }  # print the diff, write nothing
+    if ($Yes) { $acceptArgs += '--yes' }  # no console confirmation
+    & $py $runner @acceptArgs
+    exit $LASTEXITCODE
+}
+if ($GhAccount) { $argv += @('--gh-account', $GhAccount) }
+& $py @argv
+exit $LASTEXITCODE

package/bundles/antigravity-plugin/scripts/setup_project_ai.py

@@ -689,7 +689,49 @@ if [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then
     echo "[gate] interpreter: $PY"
     py_gate ruff check .
     if py_sources_exist; then py_gate mypy .; else echo "[skip] mypy: no Python sources"; fi
-    py_gate pytest -q
+    # pytest is OPT-IN here (CADDIS_GATE_PYTEST=1). Found 2026-10-10: the full suite took 25-31 min in this
+    # hook on a box whose system disk was slow, while CI ran the same suite in 5 min - and a merge needs green
+    # CI anyway. A local gate five times slower than the check it stands in for trains people to --no-verify it.
+    # When it does run: CADDIS_GATE_TMP moves TMPDIR/TEMP/TMP (tests write to tmp_path; Python reads TMPDIR
+    # first, so set all three), CADDIS_GATE_PYTEST_ARGS adds arguments (for example "-n 4" with pytest-xdist;
+    # use a number, not "auto"), and a machine-wide lock (CADDIS_GATE_LOCK, mkdir-based, waits up to
+    # CADDIS_GATE_LOCK_WAIT seconds, a stale one is taken over after 60 min) lets only ONE pytest gate run at a time, so several repos pushing together cannot
+    # pile their suites on the same disk and CI runners.
+    if [ "${CADDIS_GATE_PYTEST:-0}" = "1" ]; then
+      if [ -n "${CADDIS_GATE_TMP:-}" ]; then
+        mkdir -p "$CADDIS_GATE_TMP" 2>/dev/null || true
+        export TMPDIR="$CADDIS_GATE_TMP" TEMP="$CADDIS_GATE_TMP" TMP="$CADDIS_GATE_TMP"
+      fi
+      LOCK="${CADDIS_GATE_LOCK:-${TMPDIR:-${TEMP:-/tmp}}/caddis-pytest-gate.lock}"
+      mkdir -p "$(dirname "$LOCK")" 2>/dev/null || true
+      lock_wait="${CADDIS_GATE_LOCK_WAIT:-1800}"
+      waited=0
+      got_lock=0
+      while :; do
+        if mkdir "$LOCK" 2>/dev/null; then got_lock=1; break; fi
+        # A stale lock is removed, then this round still sleeps and counts: if the removal fails (a lock owned
+        # by another user), the loop ends at lock_wait instead of spinning forever.
+        if [ -n "$(find "$LOCK" -maxdepth 0 -mmin +60 2>/dev/null)" ]; then
+          rmdir "$LOCK" 2>/dev/null || true
+        fi
+        if [ "$waited" -ge "$lock_wait" ]; then break; fi
+        if [ "$waited" -eq 0 ]; then echo "[gate] pytest: waiting for another repo's pytest gate ($LOCK)"; fi
+        sleep 1
+        waited=$((waited + 1))
+      done
+      if [ "$got_lock" -eq 1 ]; then
+        trap 'rmdir "$LOCK" 2>/dev/null || true' EXIT INT TERM
+        # shellcheck disable=SC2086  # CADDIS_GATE_PYTEST_ARGS is meant to word-split
+        py_gate pytest -q ${CADDIS_GATE_PYTEST_ARGS:-}
+        rmdir "$LOCK" 2>/dev/null || true
+        trap - EXIT INT TERM
+      else
+        echo "[gate] pytest: another pytest gate holds $LOCK for over ${lock_wait}s - cannot run, so the gate fails" >&2
+        fail=1
+      fi
+    else
+      echo "[skip] pytest: runs in CI (set CADDIS_GATE_PYTEST=1 to run it here)"
+    fi
   fi
 fi
 if [ -f "package.json" ] && command -v npm >/dev/null 2>&1; then
@@ -1054,7 +1096,6 @@ items?" has no answer when one state has three spellings.
 | Work in flight right now | `.caddis/plans/<feature>.md` | A plan is being executed. A parking-lot item is not. |
 | A task interrupted mid-session | `/caddis:digress` stack | That is a pause, not a backlog item. `/caddis:catchup` pops it. |
 | An ask only an outsider can resolve | `.caddis/comms/register.md` | Blocked on a human, not on us. |
-| Board cards | `.caddis/backlog/` | **docket writes that directory.** It is a projection of the board, not a hand-written register. Never edit it by hand. |
 
 ## Commands
 
@@ -1432,6 +1473,48 @@ def ensure_user_env(dry: bool, home: Path | None = None) -> list[str]:
             + ("" if not raw else " (previous version saved as settings.json.caddis-bak)")]
 
 
+CLEANUP_PERIOD_KEY = "cleanupPeriodDays"
+CLEANUP_PERIOD_DAYS = 120
+
+
+def ensure_cleanup_period(dry: bool, home: Path | None = None, days: int = CLEANUP_PERIOD_DAYS) -> str:
+    """Keep Claude Code transcripts `days` days (Claude Code's own default is 30) by adding `cleanupPeriodDays`.
+
+    WHY: caddis measures which skills and commands are used from those transcripts; on 11 Oct 2026 only
+    35 days were left, too few to decide what to cut (caddis-next checks, section 4.6). Same rules as
+    ensure_user_env: an existing value is ALWAYS left alone, a file that does not parse is never rewritten,
+    a backup is kept and the write is atomic. `CADDIS_NO_SETTINGS_ENV` skips it. Its backup has its own name
+    (`settings.json.caddis-retention-bak`): main() runs ensure_user_env first, and sharing `.caddis-bak` would
+    overwrite the user's original file with that function's output. Known limit, as for ensure_user_env: a
+    write by Claude Code between this read and the replace is lost."""
+    if os.environ.get("CADDIS_NO_SETTINGS_ENV"):
+        return "transcript retention: skipped (CADDIS_NO_SETTINGS_ENV set)"
+    path = _user_settings_path(home)
+    if path.is_file():
+        raw = path.read_text(encoding="utf-8", errors="ignore")
+        try:
+            data = json.loads(raw)
+        except json.JSONDecodeError as exc:
+            return (f"transcript retention: {path} is NOT VALID JSON ({exc.msg}, line {exc.lineno}) — "
+                    "left untouched; fix it by hand.")
+        if not isinstance(data, dict):
+            return f"transcript retention: {path} is not a JSON object — left untouched"
+    else:
+        raw, data = "", {}
+    if CLEANUP_PERIOD_KEY in data:
+        return f"transcript retention: {CLEANUP_PERIOD_KEY} already set to {data[CLEANUP_PERIOD_KEY]!r} — left alone"
+    data[CLEANUP_PERIOD_KEY] = days
+    if not dry:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        if raw:
+            path.with_suffix(".json.caddis-retention-bak").write_text(raw, encoding="utf-8")
+        tmp = path.with_suffix(".json.caddis-tmp")
+        tmp.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
+        os.replace(tmp, path)
+    verb = "would set" if dry else "set"
+    return f"transcript retention: {verb} {CLEANUP_PERIOD_KEY}={days} in {path}"
+
+
 def scaffold_artifact_dir(target: Path, dry: bool) -> list[str]:
     """Create the harness-owned .caddis/ artifact tree + a default .gitignore + a config example.
 
@@ -1733,6 +1816,7 @@ def main() -> int:
     print("-- user settings (additive only, never overwrites a value you set)")
     for line in ensure_user_env(args.dry_run):
         print(f"   {line}")
+    print(f"   {ensure_cleanup_period(args.dry_run)}")
 
     print("-- doc-coverage discipline (DOC-MAP + page guide + checker)")
     for line in emit_doc_discipline(target, ident, args.force, args.dry_run):

package/bundles/antigravity-plugin/session_end_agy.py

@@ -9,7 +9,7 @@ stdout as a `{"decision":…}` object — a stray string trips its "unsupported
 does a pure side effect and prints NOTHING: empty stdout is agy's "no decision", while
 `{"decision": "continue"}` would stop the session from ending.
 
-Headless runs (CADDIS_HEADLESS, DOCKET_PLAN or DOCKET_BRANCH set and non-empty) are skipped, as in
+Headless runs (CADDIS_HEADLESS set and non-empty) are skipped, as in
 the Claude Stop hook, so review and lane runs leave no files. The record is one append with no
 transcript read, so it stays here rather than moving to /handoff (Phase 13).
 
@@ -90,11 +90,11 @@ def _workspace_roots(data):
         return []
     return [str(r) for r in roots if isinstance(r, (str, bytes)) and str(r).strip()]
 
-_HEADLESS_MARKERS = ("CADDIS_HEADLESS", "DOCKET_PLAN", "DOCKET_BRANCH")
+_HEADLESS_MARKERS = ("CADDIS_HEADLESS",)
 
 
 def _headless() -> bool:
-    """True when any marker is set to a non-empty value. `CADDIS_HEADLESS=` is not headless."""
+    """True when CADDIS_HEADLESS is set to a non-empty value. `CADDIS_HEADLESS=` is not headless."""
     return any(str(os.environ.get(name, "")).strip() for name in _HEADLESS_MARKERS)
 
 

package/bundles/antigravity-plugin/skills/_registry.md

@@ -55,6 +55,7 @@
 | Explainer Doc | `explainer-doc/` | Hand-off doc for a team that did NOT do the investigation (vendor, contractor, another team) — the "stranger must follow it alone" case. Use when the user says "write a spec for the X team", "document this for someone outside the team", "explainer doc", "implementation spec for a vendor", or "hand this off to Y". Not for readers with full context. |
 | Hld | `hld/` | Generate High-Level Design (HLD) Markdown documentation and Confluence XHTML with native PlantUML diagrams. |
 | Lld | `lld/` | Generate Lower-Level Design (LLD) Markdown documentation and Confluence XHTML with native PlantUML diagrams. |
+| Office Documents Official | `office-documents-official/` | Hint for Office and PDF file work. Use when the user asks to create, edit, read or convert a Word .docx, PDF, PowerPoint .pptx or Excel .xlsx file. caddis does not ship these skills; points to Anthropic's official document-skills plugin. |
 | Tech Explainer | `tech-explainer/` | >- |
 | Technical Writing | `technical-writing/` | Documentation best practices for READMEs, API docs, architecture docs, runbooks and developer guides. Use when writing or reviewing docs or setting documentation standards. |
 | Writing Plans | `writing-plans/` | Use when you have a spec or requirements for a multi-step task, before touching code |
@@ -97,20 +98,15 @@
 | Pr Merge | `pr-merge/` | End-to-end pull request and merge lane — push feature branch, open or update PR, monitor CI to green, merge to default branch, and clean up the feature branch. |
 | Prd | `prd/` | Capture requirements through structured discovery and write a PRD |
 | Rca | `rca/` | Record a root cause in one step — .caddis/rca/<date>-<slug>.md — or close one with the fixing commit |
-| Resume | `resume/` | Renamed to /caddis:catchup (alias, removed next release) |
-| Review | `review/` | Renamed to /caddis:review-pr (alias, removed next release) |
 | Review Pr | `review-pr/` | Review someone else's OPEN pull request end to end — what changed, what CI says, what is risky — then approve or request changes. Never approves on its own. |
 | Ship | `ship/` | Commit, push, and monitor the deploy pipeline (auto-detects Gitea, GitHub Actions, or local-only) |
 | Ship Merge | `ship-merge/` | Merge an already-green, already-reviewed PR behind an explicit deploy-confirm, monitor the deploy, validate prod, then clean up the branch — only on green. |
 | Ship Pr | `ship-pr/` | Open a reviewed PR for the current feature branch — rebase-safe push, PR create/update, monitor CI, STOP at green. Never merges, never deploys (that's /ship-merge). |
-| Spawn Hub | `spawn-hub/` | Hand the Advisory Hub role to a fresh session — run the mechanical audit, then generate the succession prompt with a context self-check the new Hub must pass |
 | Spawn Session | `spawn-session/` | Hand the WORK to a fresh session — generate the handover from the repo, then validate the successor by re-deriving its answers |
-| Statusline | `statusline/` | Renamed to /caddis:install-statusline (alias, removed next release) |
 | Tdd | `tdd/` | Run a strict red-green-refactor TDD cycle for a unit of behavior |
 | Ui Brief | `ui-brief/` | Design-first UI brief — lock the aesthetic before writing any code |
 | Usage Review | `usage-review/` | Review local caddis usage over a window, surface prioritised recommendations, and apply config changes in one step |
 | Use Model | `use-model/` | Explain (or apply) the model lanes — claude / claude-glm / cross-review — key resolution, and how to add a provider |
-| Validate Phase | `validate-phase/` | Advisory Hub phase validation — consume a phase report, RE-DERIVE its claims independently, and return ACCEPT / ACCEPT-WITH-CORRECTION / REJECT |
 | Version | `version/` | Report the installed caddis version |
 
 ### Media
@@ -134,10 +130,10 @@
 
 | Skill | Path | When to Use |
 |-------|------|-------------|
-| Advisory Hub | `advisory-hub/` | >- |
 | Best Practices | `best-practices/` | >- |
 | Brainstorming | `brainstorming/` | You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation. |
 | Context Curator | `context-curator/` | Compress and prioritize codebase context before handing work to reasoning agents, minimizing token waste while preserving the required decision inputs. |
 | Preflight | `preflight/` | Plan-vs-codebase validation — verifies API contracts, type names, field accuracy, dependencies, and paths before implementation begins |
+| Roadmap | `roadmap/` | Track milestones across plans in .caddis/roadmaps/<slug>/: next batch, typed blockers, rollup. Every change is a docs PR via caddis_roadmap.py. |
 | Setup Project Ai | `setup-project-ai/` | Install or refresh the agent-agnostic dev harness in this project (AGENTS.md-canonical rules hierarchy + CLAUDE.md @import shims, subagents, commands, settings) |
 | Skill Creator | `skill-creator/` | Create, edit and improve skills, run evals and benchmarks, and optimize a skill's description for triggering accuracy. |

package/bundles/antigravity-plugin/skills/best-practices/agents/best-practices-referencer.md

@@ -44,7 +44,7 @@ description: >-
   constraints pattern, and surfaces anti-patterns around breaking changes.
   </commentary>
   </example>
-model: inherit
+model: sonnet
 ---
 
 **Note: The current year is 2026.** Use this when searching for recent documentation and patterns.

package/bundles/antigravity-plugin/skills/best-practices/agents/codebase-context-builder.md

@@ -46,7 +46,7 @@ description: >-
   finds slow query examples, and identifies existing performance tests.
   </commentary>
   </example>
-model: inherit
+model: sonnet
 ---
 
 **Note: The current year is 2026.** Use this when referencing recent patterns or documentation.

package/bundles/antigravity-plugin/skills/best-practices/agents/task-intent-analyzer.md

@@ -48,7 +48,7 @@ description: >-
   considerations: caching, N+1 queries, database indexes, async processing.
   </commentary>
   </example>
-model: inherit
+model: sonnet
 ---
 
 **Note: The current year is 2026.** Use this when referencing recent patterns or documentation.

package/bundles/antigravity-plugin/skills/catchup/SKILL.md

@@ -68,6 +68,13 @@ on is worse than one sentence admitting there is nothing to recap.
 
 **No argument:** this is the last step of the catchup procedure above, not a separate one.
 After the list, add the workstream index and the open work:
+0. The roadmap on origin is the order of work. List the roadmaps, then show each one's status line:
+   ```
+   python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_roadmap.py" list
+   python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_roadmap.py" status --roadmap <slug>
+   ```
+   Run `caddis_roadmap.py list`, then `caddis_roadmap.py status --roadmap <slug>` for each slug it prints, and
+   show the `line`. If `list` prints nothing (exit 1), the repo has no roadmap: go on to step 1.
 1. Refresh and show the index: `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_workstreams.py" render-index`,
    then display `.caddis/relay.md`. If it refuses a legacy `.caddis/relay.md`, display that file
    as it is and suggest `/handoff`, which migrates it.

package/bundles/antigravity-plugin/skills/cloud-phases/SKILL.md

@@ -152,7 +152,7 @@ For each PR from a `<prefix>/phase-<NN>` branch, one at a time:
 1. Read the whole diff (`gh pr diff <N>`). Check it against the phase's Design and Touches. A file
    outside Touches is a finding.
 2. Wait for CI: `gh pr checks <N> --watch` (or the ci-watch lane, if this caddis has it).
-3. Review under the three rules: one review, stop at the first CLEAN; after two blocking reviews,
+3. Review under the three rules (rule 3, review by tier): stop at the first CLEAN; after 3 rounds,
    ask the owner. A fix goes back to the same cloud session or is made locally on the PR branch.
 4. Just before merging, re-read `gh pr view <N> --json headRefOid,mergeStateStatus`. Merge only if
    the head SHA is the one you reviewed and CI passed on it:

package/bundles/antigravity-plugin/skills/cross-review/SKILL.md

@@ -96,14 +96,17 @@ as a diff that silently is not read. Name a provider explicitly only when you ha
 ## Interpret the exit code
 - **0 — REVIEW: CLEAN** → no blocking issues. Proceed.
 - **1 — REVIEW: BLOCKING** → read the printed findings, then **FIX each blocking item** (or explicitly
-  justify why one is a false positive). Re-run once. A second BLOCKING goes to the owner (rule 3).
+  justify why one is a false positive). Fix it, then re-review only the fix diff. After 3 rounds, ask the owner (rule 3).
 - **4 — error** → no verdict parsed, or a git/endpoint failure. Read stderr; do NOT treat as clean.
 - **3 — misconfigured** → `REVIEW_API_KEY` is unset. Set it (see Prerequisite) and re-run.
 
 ## Three rules: one attempt, one review
 1. **Think before you send.** Before a task goes to any coder, write its edge cases and check the facts it depends on (one query or one file read).
 2. **Run it before review.** The coder runs the same checks as CI (name the exact commands in the task). Then run the change once on real data.
-3. **Review once.** Use whatever reviewer is available. Stop at the first CLEAN. After two blocking reviews, ask the owner.
+3. **Review by tier.** Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <base>...HEAD` (add `--plan <plan> --phase <N>` inside a plan; no `TIER:` line means tier 2).
+   Tier 0: gates only. Tier 1-small: your self-check only. Tier 1: one review by another vendor; stop at
+   the first CLEAN. Tier 2: two reviewers of two other vendors, in one round. Fix blocking findings only;
+   park the rest. Re-review only the fix diff, and only when the fix changed logic. After 3 rounds, ask the owner.
 
 A diff over the batch ceiling is split into batches. Each batch prompt lists every file in the
 change, so a batch does not report the others as missing.