@caddis/cli 0.4.52 → 0.4.53

package/bundles/antigravity-plugin/scripts/enforcement_inventory.py

@@ -139,7 +139,6 @@ def _enforcer_for(rel_path: str, text: str) -> str | None:
 GATE_SCRIPT = REPO / "scripts" / "caddis_gate.py"
 GATE_CONCERNS = {
     "lane-check": ("lane", "spawn", "launch command", "--print", "-p"),
-    "verdict-gate": ("verdict", "advisory-hub", "blocked-pending-hub", "accept-degraded"),
     "tracker-vs-git": ("tracker",),
 }
 

package/bundles/antigravity-plugin/scripts/oss_review.py

@@ -416,7 +416,7 @@ def current_branch(cwd: str) -> str:
 
 def build_review_prompt(diff_text: str, branch: str, rng: str | None,
                         all_paths: list[str] | None = None) -> str:
-    """Adversarial review prompt — ported from docket runner._review_prompt (kept in sync).
+    """Adversarial review prompt.
 
     Self-contained: the criteria are inline so a real review always happens, and it ends with
     a single machine-parseable verdict line the caller maps to an exit code.
@@ -570,7 +570,7 @@ def main(argv: list[str] | None = None, env: dict[str, str] | None = None) -> in
     args = parser.parse_args(argv)
 
     # --check-config is deliberately NON-INTERACTIVE. This script runs headless — from CI, from a
-    # docket runner, from a `claude -p` session — where a prompt on stdin does not ask a question,
+    # runner, from a `claude -p` session — where a prompt on stdin does not ask a question,
     # it hangs forever. The ASKING belongs in `/caddis:cross-review`, which is driven by an agent
     # that can actually talk to a human. This half just answers "is it configured?" cheaply enough
     # to call before you need it, instead of finding out mid-commit.

package/bundles/antigravity-plugin/scripts/roadmap-recheck.ps1

@@ -0,0 +1,89 @@
+# roadmap-recheck - the scheduled task for one roadmap (caddis-next Phase 9). It starts
+# `roadmap-run.ps1 -Roadmap <slug>` detached only when ALL of these hold, checked in this order:
+#   1. `--last-stop` exits 0: the runner's last recorded stop is `BLOCKED nothing ready`, there is none, or one of
+#      these, each with its own line prefix: `merged:` (the waiting PR merged), `freed:` (the runners that held our
+#      batches are gone), `rollup-ready:` (a milestone waits only for its rollup); any FAILED stop
+#      (the snapshot guard, a crash), `running` (a killed run), a cap or a STOP file needs the owner, so it prints
+#      why and starts nothing;
+#   2. the roadmap runner lock is absent or stale (`--lock-state`); a live lock starts and writes nothing;
+#   3. `caddis_roadmap.py recheck` cleared a blocker (exit 0); in a `merged:`, `freed:` or `rollup-ready:` tick
+#      recheck is NOT run (the
+#      merge is the change, and a cleared blocker would change the roadmap the restart checks against its hash);
+#   4. agy engine only (the recorded launch options): `caddis_spend.py check` exits 0.
+# It restarts with the launch options the last run recorded (`--restart-args`: engine, model, caps), never the
+# defaults. A run that holds the lock records the last stop `running`, so a run killed without a stop (a crash, a
+# reboot) is never restarted here: it needs the owner.
+# The owner registers it every 2 hours with the command that `roadmap-run.ps1 -Roadmap <slug> -PrintRecheckTask`
+# prints. Every Python call here runs with CADDIS_HEADLESS=1, so no owner-only roadmap change can pass.
+# Test seams: CADDIS_RECHECK_PYTHON (the interpreter) and CADDIS_RECHECK_SCRIPTS (the folder that holds
+# caddis_roadmap.py, caddis_roadmap_run.py, caddis_spend.py and roadmap-run.ps1).
+# Usage: roadmap-recheck.ps1 -Roadmap <slug> [-Repo <path>] [-GhAccount <gh login>]
+# Exit: 0 started the runner, 1 nothing to start, 3 cannot run, 4 bad input.
+param(
+    [string]$Roadmap = '',
+    [string]$Repo = (Get-Location).Path,
+    [string]$GhAccount = ''
+)
+$SlugRule = '^[a-z0-9][a-z0-9-]{0,62}$'  # = caddis_roadmap.SLUG_RE_TEXT (a test keeps the three equal)
+if ($Roadmap -cnotmatch $SlugRule) { Write-Error "roadmap-recheck: -Roadmap must match $SlugRule"; exit 4 }
+$py = if ($env:CADDIS_RECHECK_PYTHON) { $env:CADDIS_RECHECK_PYTHON } else { (Get-Command python -ErrorAction SilentlyContinue).Source }
+if (-not $py) { Write-Error "roadmap-recheck: python not found on PATH"; exit 3 }
+$dirs = if ($env:CADDIS_RECHECK_SCRIPTS) { @($env:CADDIS_RECHECK_SCRIPTS) } else { @($PSScriptRoot, (Join-Path $PSScriptRoot '../../scripts')) }
+function Find-Script([string]$name) {
+    foreach ($dir in $dirs) {
+        $p = Join-Path $dir $name
+        if (Test-Path $p) { return (Resolve-Path $p).Path }
+    }
+    return $null
+}
+$roadmapPy = Find-Script 'caddis_roadmap.py'
+$runnerPy = Find-Script 'caddis_roadmap_run.py'
+$spendPy = Find-Script 'caddis_spend.py'
+$runPs1 = Find-Script 'roadmap-run.ps1'
+if (-not ($roadmapPy -and $runnerPy -and $spendPy -and $runPs1)) {
+    Write-Error "roadmap-recheck: caddis_roadmap.py, caddis_roadmap_run.py, caddis_spend.py or roadmap-run.ps1 not found"
+    exit 4
+}
+$env:CADDIS_HEADLESS = '1'  # inherited by every child below
+# No trailing separator (a trailing `\` before a closing quote escapes it); a drive root keeps `X:\`.
+$Repo = $Repo.TrimEnd('\', '/')
+if ($Repo -match '^[A-Za-z]:$') { $Repo += '\' }
+$repoArg = if ($Repo -match '\\$') { "$Repo\" } else { $Repo }  # doubled in front of the closing quote
+
+$ghArgs = if ($GhAccount) { @('--gh-account', $GhAccount) } else { @() }
+$why = (& $py $runnerPy --roadmap $Roadmap --repo $Repo --last-stop @ghArgs) -join ' '
+if ($LASTEXITCODE -ne 0) { Write-Output "roadmap-recheck: $why; runner not started"; exit 1 }
+
+# A live lock: a runner is starting or running. Start nothing and WRITE nothing (no recheck either: a cleared
+# blocker would change the roadmap under that runner's guard). `--last-stop` above only reads.
+$state = & $py $runnerPy --roadmap $Roadmap --repo $Repo --lock-state
+if ($LASTEXITCODE -ne 0) { Write-Output "roadmap-recheck: runner lock is $state; runner not started"; exit 1 }
+
+$merged = $why -match '^(merged|freed|rollup-ready):'  # merged PR, holder gone, or a milestone waits for its rollup
+if (-not $merged) {
+    # Only after `BLOCKED nothing ready` (or no stop). Never in a `merged:` tick: clearing a blocker now would change
+    # the origin roadmap the restarted runner checks against the hash it recorded at publish time.
+    & $py $roadmapPy recheck --roadmap $Roadmap --root $Repo
+    $rc = $LASTEXITCODE
+    if ($rc -ne 0) { Write-Output "roadmap-recheck: no blocker cleared (recheck exit $rc); runner not started"; exit 1 }
+}
+
+$options = @(& $py $runnerPy --roadmap $Roadmap --repo $Repo --restart-args | Where-Object { $_ -ne '' })
+if ($LASTEXITCODE -ne 0) { Write-Output "roadmap-recheck: launch options not readable; runner not started"; exit 1 }
+if ($GhAccount -and $options -notcontains '-GhAccount') { $options += @('-GhAccount', $GhAccount) }
+
+# The global agy spend cap applies to the agy engine only (a claude run needs no spend-cap file).
+$engineAt = [array]::IndexOf($options, '-Engine')
+$engine = if ($engineAt -ge 0 -and $engineAt + 1 -lt $options.Count) { $options[$engineAt + 1] } else { 'claude' }
+if ($engine -eq 'agy') {
+    & $py $spendPy check
+    if ($LASTEXITCODE -ne 0) { Write-Output "roadmap-recheck: spend check exit $LASTEXITCODE; runner not started"; exit 1 }
+}
+
+$shell = (Get-Process -Id $PID).Path
+$argv = @('-NoProfile', '-File', "`"$runPs1`"", '-Roadmap', $Roadmap, '-Repo', "`"$repoArg`"") + $options
+$start = @{ FilePath = $shell; ArgumentList = $argv }
+if ($IsWindows -or $env:OS -eq 'Windows_NT') { $start['WindowStyle'] = 'Hidden' }
+Start-Process @start
+Write-Output "roadmap-recheck: started roadmap-run.ps1 -Roadmap $Roadmap $($options -join ' ') (lock was $state)"
+exit 0

package/bundles/antigravity-plugin/scripts/roadmap-run.ps1

@@ -0,0 +1,88 @@
+# roadmap-run - start one fresh headless session per batch, until a stop. A thin shim over caddis_roadmap_run.py
+# (design: .caddis/plans/programme-method-design.md sections 8.2 and 8.5; caddis-next Phase 9).
+# -Plan runs a plain plan (plan mode). -Roadmap runs the next batches of a roadmap on origin (roadmap mode). Give one.
+# -PrintRecheckTask prints a PowerShell block (Register-ScheduledTask) that registers roadmap-recheck.ps1 every 2 hours;
+# it registers nothing.
+# Usage: roadmap-run.ps1 (-Plan <slug> | -Roadmap <slug>) [-Repo <path>] [-MaxHours 10] [-MaxSessions 12]
+#          [-SessionTimeoutMin 120] [-MaxUsdPerSession 25] [-MaxUsdTotal 150]
+#          [-Engine claude] [-Model opus] [-GhAccount <gh login>] [-DryRun]
+#        roadmap-run.ps1 -Roadmap <slug> [-Repo <path>] -PrintRecheckTask
+#        roadmap-run.ps1 -Roadmap <slug> [-Repo <path>] -AcceptRoadmap [-DryRun] [-Yes]   (owner only: accept an owner
+#          edit made during
+#          a merge wait as the new baseline)
+param(
+    [string]$Plan = '',
+    [string]$Roadmap = '',
+    [string]$Repo = (Get-Location).Path,
+    [double]$MaxHours = 10,
+    [int]$MaxSessions = 12,
+    [double]$SessionTimeoutMin = 120,
+    [double]$MaxUsdPerSession = 25,
+    [double]$MaxUsdTotal = 150,
+    [ValidateSet('claude', 'agy', 'codex')][string]$Engine = 'claude',
+    [string]$Model = '',
+    [switch]$DryRun,
+    [string]$GhAccount = '',
+    [switch]$PrintRecheckTask,
+    [switch]$AcceptRoadmap,
+    [switch]$Yes
+)
+if ([bool]$Plan -eq [bool]$Roadmap) { Write-Error "roadmap-run: give exactly one of -Plan <slug> and -Roadmap <slug>"; exit 4 }
+$SlugRule = '^[a-z0-9][a-z0-9-]{0,62}$'  # = caddis_roadmap.SLUG_RE_TEXT (a test keeps the three equal)
+if ($GhAccount -and $GhAccount -notmatch '^[A-Za-z0-9._-]+$') {
+    Write-Error "roadmap-run: -GhAccount must be a gh login name (got '$GhAccount')"; exit 4
+}
+if ($Roadmap -and $Roadmap -cnotmatch $SlugRule) {
+    Write-Error "roadmap-run: -Roadmap must match $SlugRule (got '$Roadmap')"; exit 4
+}
+if ($PrintRecheckTask) {
+    if (-not $Roadmap) { Write-Error "roadmap-run: -PrintRecheckTask needs -Roadmap <slug>"; exit 4 }
+    # A PowerShell block for the owner to paste: every value is a single-quoted literal (a ' is doubled), and the
+    # task's whole argument line is ONE string, so no shell splits it.
+    if (-not (Test-Path -LiteralPath $Repo -PathType Container)) {
+        Write-Error "roadmap-run: -Repo '$Repo' is not a folder; nothing printed"; exit 4
+    }
+    $recheck = (Resolve-Path (Join-Path $PSScriptRoot 'roadmap-recheck.ps1')).Path
+    # A full path with no trailing separator: in a quoted command-line argument a trailing `\` would escape the quote. A
+    # drive root keeps one `\`, doubled so it stays a backslash in front of the closing quote.
+    $repoFull = (Resolve-Path -LiteralPath $Repo).Path.TrimEnd('\', '/')
+    if ($repoFull -match '^[A-Za-z]:$') { $repoFull += '\\' }
+    $shellExe = (Get-Process -Id $PID).Path
+    function Sq([string]$s) { "'" + $s.Replace("'", "''") + "'" }
+    $argLine = "-NoProfile -NonInteractive -File `"$recheck`" -Roadmap $Roadmap -Repo `"$repoFull`""
+    if ($GhAccount) { $argLine += " -GhAccount $GhAccount" }
+    Write-Output "`$action = New-ScheduledTaskAction -Execute $(Sq $shellExe) -Argument $(Sq $argLine)"
+    Write-Output "`$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 2)"
+    Write-Output ("Register-ScheduledTask -TaskName $(Sq "caddis-roadmap-recheck-$Roadmap") -Action `$action " +
+        "-Trigger `$trigger -Description $(Sq "caddis roadmap $Roadmap recheck, every 2 hours")")
+    Write-Output ("# Note: this task runs only while you are logged on. To run it whether you are logged on or not, " +
+        "add -User <DOMAIN\user> -Password <password> to Register-ScheduledTask, or set that option in Task Scheduler.")
+    exit 0
+}
+$py = (Get-Command python -ErrorAction SilentlyContinue).Source
+if (-not $py) { Write-Error "roadmap-run: python not found on PATH"; exit 3 }
+# Installed plugin: both files sit in scripts/. Source repo: the Python file is in <repo>/scripts.
+$runner = Join-Path $PSScriptRoot 'caddis_roadmap_run.py'
+if (-not (Test-Path $runner)) { $runner = Join-Path $PSScriptRoot '..\..\scripts\caddis_roadmap_run.py' }
+if (-not (Test-Path $runner)) { Write-Error "roadmap-run: caddis_roadmap_run.py not found"; exit 4 }
+$inv = [Globalization.CultureInfo]::InvariantCulture
+$argv = @($runner)
+if ($Plan) { $argv += @('--plan', $Plan) } else { $argv += @('--roadmap', $Roadmap) }
+$argv += @('--repo', $Repo,
+    '--max-hours', $MaxHours.ToString($inv), '--max-sessions', $MaxSessions.ToString($inv),
+    '--session-timeout-min', $SessionTimeoutMin.ToString($inv),
+    '--max-usd-per-session', $MaxUsdPerSession.ToString($inv), '--max-usd-total', $MaxUsdTotal.ToString($inv),
+    '--engine', $Engine)
+if ($Model) { $argv += @('--model', $Model) }
+if ($DryRun) { $argv += '--dry-run' }
+if ($AcceptRoadmap) {  # owner only: the Python side refuses it headless
+    if (-not $Roadmap) { Write-Error "roadmap-run: -AcceptRoadmap needs -Roadmap <slug>"; exit 4 }
+    $acceptArgs = @('--roadmap', $Roadmap, '--repo', $Repo, '--accept-roadmap')
+    if ($DryRun) { $acceptArgs += '--dry-run' }  # print the diff, write nothing
+    if ($Yes) { $acceptArgs += '--yes' }  # no console confirmation
+    & $py $runner @acceptArgs
+    exit $LASTEXITCODE
+}
+if ($GhAccount) { $argv += @('--gh-account', $GhAccount) }
+& $py @argv
+exit $LASTEXITCODE

package/bundles/antigravity-plugin/scripts/setup_project_ai.py

@@ -1096,7 +1096,6 @@ items?" has no answer when one state has three spellings.
 | Work in flight right now | `.caddis/plans/<feature>.md` | A plan is being executed. A parking-lot item is not. |
 | A task interrupted mid-session | `/caddis:digress` stack | That is a pause, not a backlog item. `/caddis:catchup` pops it. |
 | An ask only an outsider can resolve | `.caddis/comms/register.md` | Blocked on a human, not on us. |
-| Board cards | `.caddis/backlog/` | **docket writes that directory.** It is a projection of the board, not a hand-written register. Never edit it by hand. |
 
 ## Commands
 
@@ -1474,6 +1473,48 @@ def ensure_user_env(dry: bool, home: Path | None = None) -> list[str]:
             + ("" if not raw else " (previous version saved as settings.json.caddis-bak)")]
 
 
+CLEANUP_PERIOD_KEY = "cleanupPeriodDays"
+CLEANUP_PERIOD_DAYS = 120
+
+
+def ensure_cleanup_period(dry: bool, home: Path | None = None, days: int = CLEANUP_PERIOD_DAYS) -> str:
+    """Keep Claude Code transcripts `days` days (Claude Code's own default is 30) by adding `cleanupPeriodDays`.
+
+    WHY: caddis measures which skills and commands are used from those transcripts; on 11 Oct 2026 only
+    35 days were left, too few to decide what to cut (caddis-next checks, section 4.6). Same rules as
+    ensure_user_env: an existing value is ALWAYS left alone, a file that does not parse is never rewritten,
+    a backup is kept and the write is atomic. `CADDIS_NO_SETTINGS_ENV` skips it. Its backup has its own name
+    (`settings.json.caddis-retention-bak`): main() runs ensure_user_env first, and sharing `.caddis-bak` would
+    overwrite the user's original file with that function's output. Known limit, as for ensure_user_env: a
+    write by Claude Code between this read and the replace is lost."""
+    if os.environ.get("CADDIS_NO_SETTINGS_ENV"):
+        return "transcript retention: skipped (CADDIS_NO_SETTINGS_ENV set)"
+    path = _user_settings_path(home)
+    if path.is_file():
+        raw = path.read_text(encoding="utf-8", errors="ignore")
+        try:
+            data = json.loads(raw)
+        except json.JSONDecodeError as exc:
+            return (f"transcript retention: {path} is NOT VALID JSON ({exc.msg}, line {exc.lineno}) — "
+                    "left untouched; fix it by hand.")
+        if not isinstance(data, dict):
+            return f"transcript retention: {path} is not a JSON object — left untouched"
+    else:
+        raw, data = "", {}
+    if CLEANUP_PERIOD_KEY in data:
+        return f"transcript retention: {CLEANUP_PERIOD_KEY} already set to {data[CLEANUP_PERIOD_KEY]!r} — left alone"
+    data[CLEANUP_PERIOD_KEY] = days
+    if not dry:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        if raw:
+            path.with_suffix(".json.caddis-retention-bak").write_text(raw, encoding="utf-8")
+        tmp = path.with_suffix(".json.caddis-tmp")
+        tmp.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
+        os.replace(tmp, path)
+    verb = "would set" if dry else "set"
+    return f"transcript retention: {verb} {CLEANUP_PERIOD_KEY}={days} in {path}"
+
+
 def scaffold_artifact_dir(target: Path, dry: bool) -> list[str]:
     """Create the harness-owned .caddis/ artifact tree + a default .gitignore + a config example.
 
@@ -1775,6 +1816,7 @@ def main() -> int:
     print("-- user settings (additive only, never overwrites a value you set)")
     for line in ensure_user_env(args.dry_run):
         print(f"   {line}")
+    print(f"   {ensure_cleanup_period(args.dry_run)}")
 
     print("-- doc-coverage discipline (DOC-MAP + page guide + checker)")
     for line in emit_doc_discipline(target, ident, args.force, args.dry_run):

package/bundles/antigravity-plugin/session_end_agy.py

@@ -9,7 +9,7 @@ stdout as a `{"decision":…}` object — a stray string trips its "unsupported
 does a pure side effect and prints NOTHING: empty stdout is agy's "no decision", while
 `{"decision": "continue"}` would stop the session from ending.
 
-Headless runs (CADDIS_HEADLESS, DOCKET_PLAN or DOCKET_BRANCH set and non-empty) are skipped, as in
+Headless runs (CADDIS_HEADLESS set and non-empty) are skipped, as in
 the Claude Stop hook, so review and lane runs leave no files. The record is one append with no
 transcript read, so it stays here rather than moving to /handoff (Phase 13).
 
@@ -90,11 +90,11 @@ def _workspace_roots(data):
         return []
     return [str(r) for r in roots if isinstance(r, (str, bytes)) and str(r).strip()]
 
-_HEADLESS_MARKERS = ("CADDIS_HEADLESS", "DOCKET_PLAN", "DOCKET_BRANCH")
+_HEADLESS_MARKERS = ("CADDIS_HEADLESS",)
 
 
 def _headless() -> bool:
-    """True when any marker is set to a non-empty value. `CADDIS_HEADLESS=` is not headless."""
+    """True when CADDIS_HEADLESS is set to a non-empty value. `CADDIS_HEADLESS=` is not headless."""
     return any(str(os.environ.get(name, "")).strip() for name in _HEADLESS_MARKERS)
 
 

package/bundles/antigravity-plugin/skills/_registry.md

@@ -55,6 +55,7 @@
 | Explainer Doc | `explainer-doc/` | Hand-off doc for a team that did NOT do the investigation (vendor, contractor, another team) — the "stranger must follow it alone" case. Use when the user says "write a spec for the X team", "document this for someone outside the team", "explainer doc", "implementation spec for a vendor", or "hand this off to Y". Not for readers with full context. |
 | Hld | `hld/` | Generate High-Level Design (HLD) Markdown documentation and Confluence XHTML with native PlantUML diagrams. |
 | Lld | `lld/` | Generate Lower-Level Design (LLD) Markdown documentation and Confluence XHTML with native PlantUML diagrams. |
+| Office Documents Official | `office-documents-official/` | Hint for Office and PDF file work. Use when the user asks to create, edit, read or convert a Word .docx, PDF, PowerPoint .pptx or Excel .xlsx file. caddis does not ship these skills; points to Anthropic's official document-skills plugin. |
 | Tech Explainer | `tech-explainer/` | >- |
 | Technical Writing | `technical-writing/` | Documentation best practices for READMEs, API docs, architecture docs, runbooks and developer guides. Use when writing or reviewing docs or setting documentation standards. |
 | Writing Plans | `writing-plans/` | Use when you have a spec or requirements for a multi-step task, before touching code |
@@ -97,20 +98,15 @@
 | Pr Merge | `pr-merge/` | End-to-end pull request and merge lane — push feature branch, open or update PR, monitor CI to green, merge to default branch, and clean up the feature branch. |
 | Prd | `prd/` | Capture requirements through structured discovery and write a PRD |
 | Rca | `rca/` | Record a root cause in one step — .caddis/rca/<date>-<slug>.md — or close one with the fixing commit |
-| Resume | `resume/` | Renamed to /caddis:catchup (alias, removed next release) |
-| Review | `review/` | Renamed to /caddis:review-pr (alias, removed next release) |
 | Review Pr | `review-pr/` | Review someone else's OPEN pull request end to end — what changed, what CI says, what is risky — then approve or request changes. Never approves on its own. |
 | Ship | `ship/` | Commit, push, and monitor the deploy pipeline (auto-detects Gitea, GitHub Actions, or local-only) |
 | Ship Merge | `ship-merge/` | Merge an already-green, already-reviewed PR behind an explicit deploy-confirm, monitor the deploy, validate prod, then clean up the branch — only on green. |
 | Ship Pr | `ship-pr/` | Open a reviewed PR for the current feature branch — rebase-safe push, PR create/update, monitor CI, STOP at green. Never merges, never deploys (that's /ship-merge). |
-| Spawn Hub | `spawn-hub/` | Hand the Advisory Hub role to a fresh session — run the mechanical audit, then generate the succession prompt with a context self-check the new Hub must pass |
 | Spawn Session | `spawn-session/` | Hand the WORK to a fresh session — generate the handover from the repo, then validate the successor by re-deriving its answers |
-| Statusline | `statusline/` | Renamed to /caddis:install-statusline (alias, removed next release) |
 | Tdd | `tdd/` | Run a strict red-green-refactor TDD cycle for a unit of behavior |
 | Ui Brief | `ui-brief/` | Design-first UI brief — lock the aesthetic before writing any code |
 | Usage Review | `usage-review/` | Review local caddis usage over a window, surface prioritised recommendations, and apply config changes in one step |
 | Use Model | `use-model/` | Explain (or apply) the model lanes — claude / claude-glm / cross-review — key resolution, and how to add a provider |
-| Validate Phase | `validate-phase/` | Advisory Hub phase validation — consume a phase report, RE-DERIVE its claims independently, and return ACCEPT / ACCEPT-WITH-CORRECTION / REJECT |
 | Version | `version/` | Report the installed caddis version |
 
 ### Media
@@ -134,10 +130,10 @@
 
 | Skill | Path | When to Use |
 |-------|------|-------------|
-| Advisory Hub | `advisory-hub/` | >- |
 | Best Practices | `best-practices/` | >- |
 | Brainstorming | `brainstorming/` | You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation. |
 | Context Curator | `context-curator/` | Compress and prioritize codebase context before handing work to reasoning agents, minimizing token waste while preserving the required decision inputs. |
 | Preflight | `preflight/` | Plan-vs-codebase validation — verifies API contracts, type names, field accuracy, dependencies, and paths before implementation begins |
+| Roadmap | `roadmap/` | Track milestones across plans in .caddis/roadmaps/<slug>/: next batch, typed blockers, rollup. Every change is a docs PR via caddis_roadmap.py. |
 | Setup Project Ai | `setup-project-ai/` | Install or refresh the agent-agnostic dev harness in this project (AGENTS.md-canonical rules hierarchy + CLAUDE.md @import shims, subagents, commands, settings) |
 | Skill Creator | `skill-creator/` | Create, edit and improve skills, run evals and benchmarks, and optimize a skill's description for triggering accuracy. |

package/bundles/antigravity-plugin/skills/best-practices/agents/best-practices-referencer.md

@@ -44,7 +44,7 @@ description: >-
   constraints pattern, and surfaces anti-patterns around breaking changes.
   </commentary>
   </example>
-model: inherit
+model: sonnet
 ---
 
 **Note: The current year is 2026.** Use this when searching for recent documentation and patterns.

package/bundles/antigravity-plugin/skills/best-practices/agents/codebase-context-builder.md

@@ -46,7 +46,7 @@ description: >-
   finds slow query examples, and identifies existing performance tests.
   </commentary>
   </example>
-model: inherit
+model: sonnet
 ---
 
 **Note: The current year is 2026.** Use this when referencing recent patterns or documentation.

package/bundles/antigravity-plugin/skills/best-practices/agents/task-intent-analyzer.md

@@ -48,7 +48,7 @@ description: >-
   considerations: caching, N+1 queries, database indexes, async processing.
   </commentary>
   </example>
-model: inherit
+model: sonnet
 ---
 
 **Note: The current year is 2026.** Use this when referencing recent patterns or documentation.

package/bundles/antigravity-plugin/skills/catchup/SKILL.md

@@ -68,6 +68,13 @@ on is worse than one sentence admitting there is nothing to recap.
 
 **No argument:** this is the last step of the catchup procedure above, not a separate one.
 After the list, add the workstream index and the open work:
+0. The roadmap on origin is the order of work. List the roadmaps, then show each one's status line:
+   ```
+   python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_roadmap.py" list
+   python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_roadmap.py" status --roadmap <slug>
+   ```
+   Run `caddis_roadmap.py list`, then `caddis_roadmap.py status --roadmap <slug>` for each slug it prints, and
+   show the `line`. If `list` prints nothing (exit 1), the repo has no roadmap: go on to step 1.
 1. Refresh and show the index: `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_workstreams.py" render-index`,
    then display `.caddis/relay.md`. If it refuses a legacy `.caddis/relay.md`, display that file
    as it is and suggest `/handoff`, which migrates it.

package/bundles/antigravity-plugin/skills/cloud-phases/SKILL.md

@@ -152,7 +152,7 @@ For each PR from a `<prefix>/phase-<NN>` branch, one at a time:
 1. Read the whole diff (`gh pr diff <N>`). Check it against the phase's Design and Touches. A file
    outside Touches is a finding.
 2. Wait for CI: `gh pr checks <N> --watch` (or the ci-watch lane, if this caddis has it).
-3. Review under the three rules: one review, stop at the first CLEAN; after two blocking reviews,
+3. Review under the three rules (rule 3, review by tier): stop at the first CLEAN; after 3 rounds,
    ask the owner. A fix goes back to the same cloud session or is made locally on the PR branch.
 4. Just before merging, re-read `gh pr view <N> --json headRefOid,mergeStateStatus`. Merge only if
    the head SHA is the one you reviewed and CI passed on it:

package/bundles/antigravity-plugin/skills/cross-review/SKILL.md

@@ -96,14 +96,17 @@ as a diff that silently is not read. Name a provider explicitly only when you ha
 ## Interpret the exit code
 - **0 — REVIEW: CLEAN** → no blocking issues. Proceed.
 - **1 — REVIEW: BLOCKING** → read the printed findings, then **FIX each blocking item** (or explicitly
-  justify why one is a false positive). Re-run once. A second BLOCKING goes to the owner (rule 3).
+  justify why one is a false positive). Fix it, then re-review only the fix diff. After 3 rounds, ask the owner (rule 3).
 - **4 — error** → no verdict parsed, or a git/endpoint failure. Read stderr; do NOT treat as clean.
 - **3 — misconfigured** → `REVIEW_API_KEY` is unset. Set it (see Prerequisite) and re-run.
 
 ## Three rules: one attempt, one review
 1. **Think before you send.** Before a task goes to any coder, write its edge cases and check the facts it depends on (one query or one file read).
 2. **Run it before review.** The coder runs the same checks as CI (name the exact commands in the task). Then run the change once on real data.
-3. **Review once.** Use whatever reviewer is available. Stop at the first CLEAN. After two blocking reviews, ask the owner.
+3. **Review by tier.** Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <base>...HEAD` (add `--plan <plan> --phase <N>` inside a plan; no `TIER:` line means tier 2).
+   Tier 0: gates only. Tier 1-small: your self-check only. Tier 1: one review by another vendor; stop at
+   the first CLEAN. Tier 2: two reviewers of two other vendors, in one round. Fix blocking findings only;
+   park the rest. Re-review only the fix diff, and only when the fix changed logic. After 3 rounds, ask the owner.
 
 A diff over the batch ceiling is split into batches. Each batch prompt lists every file in the
 change, so a batch does not report the others as missing.

package/bundles/antigravity-plugin/skills/feature-plan/SKILL.md

@@ -13,9 +13,8 @@ The plan file is the **durable spine of the harness** — it must let any future
 agent, on any tool) resume with zero re-discovery. Optimize for that.
 
 ## Headless mode
-When the invocation contains the marker **`HEADLESS RUN RULES`**, **or `CADDIS_HEADLESS` /
-`DOCKET_PLAN` / `DOCKET_BRANCH` is set in the environment** (the caddis OSS launchers export
-`CADDIS_HEADLESS` on claude's `-p`/`--print`; the docket runner sets the others) — a non-interactive
+When the invocation contains the marker **`HEADLESS RUN RULES`**, **or `CADDIS_HEADLESS` is set in
+the environment** (the caddis OSS launchers export it on claude's `-p`/`--print`) — a non-interactive
 caller spawned this session and no human is present, so the scope-check questions and any interview are
 **suspended and forbidden**. This mode exists for one-line ideas: the card may be a short title with **no
 description**, and there may be **no codebase, PROJECT-FACTS, or prior PRD** to read. That is expected —
@@ -39,13 +38,6 @@ Absolute rules in this mode (they override everything below):
   a bullet under `## Constraints & decisions` — never a question to the user.
 - **Honor the caller's output path and slug** (falling back to `.caddis/plans/<feature-slug>.md`);
   set `feature: <slug>` in the frontmatter to that slug.
-- **Also emit a visual companion** — a self-contained, scannable HTML page at `<artifact_dir>/<slug>.html`
-  presenting the plan visually (a goal card, phases as cards with their steps, an affected-files table,
-  and a risks/decisions section). **Use inline `<style>` ONLY** — the visual is rendered in a *sandboxed*
-  iframe with no script execution, so a `<script>`/CDN (e.g. the Tailwind browser CDN) would NOT run and
-  the page would appear unstyled. Keep it fully portable — no external `<script>`/`<link>`, no local
-  asset files, no `/`-rooted paths. This is the visual the human reviews in docket alongside the markdown.
-  Write it after the `.md`; the runner finds it by the matching `<slug>.html` name.
 - **Always write the plan file, then end with exactly one fenced `json` highlights block** — nothing
   after it:
   ```json
@@ -63,7 +55,7 @@ exists instead of assumed. If the work fits comfortably in one session, say so a
 instead of planning. Only produce a plan for genuinely multi-phase work.
 
 ### Evidence gate — do not write plan content while a BLOCKER is unresolved
-Absorbed from `golden-plan`, whose strongest idea this is, and the direct counter to the failure
+This is the direct counter to the failure
 mode that makes a plan dangerous: **you write the spec, so you cannot see its gaps.** A phase built
 on guessed field names or an imagined API is confidently wrong, passes every completeness check,
 and only fails at the exit gate — or worse, doesn't.
@@ -164,9 +156,11 @@ of that role and write its Lane line as follows:
 - `sonnet`: `claude — /model sonnet`
 - `claude`: `claude — this session`
 - `codex`: codex — `codex exec --ephemeral --sandbox workspace-write "HEADLESS RUN RULES. Read <plan path> and its Constraints. Implement Phase N only in the current checkout. Do not switch or create branches, commit, push, or edit files outside this phase. Run its exit gate and report the literal result."`
-- `agy`: agy — `agy --mode accept-edits --dangerously-skip-permissions --add-dir . --print-timeout 20m --output-format text -p "HEADLESS RUN RULES. Read <plan path> and its Constraints. Implement Phase N only in the current checkout. Do not switch or create branches, commit, push, or edit files outside this phase. Run its exit gate and report the literal result."`
+- `agy`: agy — `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_spend.py" run --caller lane-pN -- agy --mode accept-edits --dangerously-skip-permissions --add-dir . --print-timeout 20m --output-format json -p "HEADLESS RUN RULES. Read <plan path> and its Constraints. Implement Phase N only in the current checkout. Do not switch or create branches, commit, push, or edit files outside this phase. Run its exit gate and report the literal result."`
 
-Replace `<plan path>` and `N` with this plan's path and phase number. If the routing command fails
+Replace `<plan path>` and `N` (also in `lane-pN`) with this plan's path and phase number. The agy line
+always starts with `caddis_spend.py run`: it books the call against the global EUR spend cap, and
+`caddis_gate.py lane-check` refuses a bare `agy` Lane line. If the routing command fails
 or exits 3, use `claude — this session` and state the reason in that phase.
 
 #### A phase may take a no-escalation lane only if its exit gate would fail on a spec error
@@ -186,14 +180,9 @@ internal repo path into stakeholder-facing copy, and set a `live` status flag th
 framework's own "Soon" badge). `tsc` clean, 632/632 tests green, cross-review CLEAN, exit gate
 satisfied. A headless run following it literally would have committed both, entirely green.
 
-In an Advisory-Hub plan, treat your lane as **provisional**: the Hub writes each `phase-NN.prompt.md`
-before the phase runs, and that is the first time anyone but the spec's author reads it. Let that
-read confirm or downgrade the lane. It costs nothing — the prompt is being written anyway.
-
 ### Group phases into MILESTONES — only when the plan is big enough
 **Add milestones when the plan has ~8+ phases OR spans multiple sessions.** Below that, phases and a
-Tracker are enough; a three-phase feature gains nothing from ceremony. (Same sizing instinct as the
-Advisory-Hub test, deliberately — one threshold to remember, not two.)
+Tracker are enough; a three-phase feature gains nothing from ceremony.
 
 A milestone is **a group of phases that ship together**. It answers "what lands when this is done?",
 which is the question a long plan otherwise leaves the executor guessing at.
@@ -211,9 +200,10 @@ resuming session can see at a glance which group it is in and what remains befor
 ### Flag high-risk phases (`risk:` — a marker, not a mechanism)
 Each phase may carry **`risk: normal|high`** (default `normal` — omit the line unless the phase is
 `high`), meaning only "this is a phase where a wrong answer is expensive" — security/authz, a
-correctness-critical algorithm, an ambiguous spec, or an irreversible change. It is **inert**: it
-selects no model, spawns no agents, and implies no fan-out — it exists so the executor can decide **at
-runtime** whether an extra cross-check is worth it. Do not emit orchestration, lane fan-out, or
+correctness-critical algorithm, an ambiguous spec, or an irreversible change. It selects no model and
+implies no fan-out. It has one effect: the roadmap/plan runner reviews a finished `risk: high` phase
+twice (`caddis_review.py --plan --phase --runs 2`), gives it one fix session on blocking
+findings, and stops `BLOCKED review` when findings remain. Roadmap mode reviews before it publishes the PR. Do not emit orchestration, lane fan-out, or
 `Workflow` scripts from this command; the runtime decision rules and the intent→model map live in one
 place, the `agent-orchestration` skill's *Multi-model fan-out* section.
 
@@ -275,7 +265,10 @@ yourself (relay + Tracker) before stopping — do not hand back "run `/caddis:ha
 Three rules: one attempt, one review.
 1. **Think before you send.** Before a task goes to any coder, write its edge cases and check the facts it depends on (one query or one file read).
 2. **Run it before review.** The coder runs the same checks as CI (name the exact commands in the task). Then run the change once on real data.
-3. **Review once.** Use whatever reviewer is available. Stop at the first CLEAN. After two blocking reviews, ask the owner.
+3. **Review by tier.** Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <base>...HEAD` (add `--plan <plan> --phase <N>` inside a plan; no `TIER:` line means tier 2).
+   Tier 0: gates only. Tier 1-small: your self-check only. Tier 1: one review by another vendor; stop at
+   the first CLEAN. Tier 2: two reviewers of two other vendors, in one round. Fix blocking findings only;
+   park the rest. Re-review only the fix diff, and only when the fix changed logic. After 3 rounds, ask the owner.
 
 - One phase at a time: read this plan → run the phase on its **Lane** → RED→GREEN→VERIFY→CROSS-REVIEW→
   COMMIT → update the **Tracker** row. The Tracker is the resume signal for every future session.
@@ -293,6 +286,10 @@ Three rules: one attempt, one review.
      normally; the halt stops anything being **built on top of it** before a human has looked. Blast
      radius stays one reviewable, revertable commit. Halting *beforehand* buys nothing: the phase has
      to be executed either way, and a well-specced high-risk phase is as executable as any other.
+     One exception: when the session prompt says the runner reviews `risk: high` phases (the
+     runner's `plan-resume-prompt.md` says so), the runner's review gate replaces this halt: the
+     session ends `STATUS: CONTINUE`, and the runner reviews the phase twice before anything builds
+     on it. A headless marker (`CADDIS_HEADLESS=1`) alone does not lift the halt.
   4. **A failed or blocked phase** — tests red, exit gate unmet, or the plan turned out wrong. Stop;
      do not build on it.
 - **A lane change is NOT a halt.** `/caddis:implement` spawns the assigned lane itself and verifies
@@ -366,66 +363,15 @@ done:
 
 If any phase relies on the implementer *reasoning out* a gap, close the gap in the plan now.
 
-## Step 3b — Does this plan need an Advisory Hub? (ask once, here)
-
-The Advisory Hub is **opt-in per plan**, gated on a single file: `<plan-stem>-advisory-context.md`
-beside the plan. `/caddis:implement`, `/caddis:handoff` and `/caddis:validate-phase` all check for it;
-**no file → no behaviour change, ever.** But nothing has ever *asked* whether to create it, so the
-pattern only ever gets used by someone who already knows it exists. This step closes that gap.
-
-**Ask it here** — at the end of planning is the only moment the phase count, risk levels and session
-boundaries are all known.
-
-> **You MUST call `Skill(advisory-hub)` and read *"When it earns its keep"* before deciding.**
-> Do not decide from memory, and do not decide from any summary — including one in this file.
-> The test is stated in exactly one place on purpose: two copies of a rule drift on the first edit,
-> and the copy that used to live here had already drifted. It compressed the REQUIRED leg to the
-> phrase *"expensive-to-reverse"* and dropped the enumeration that defines it — which reads as
-> *"can I `git revert` this?"*, and under that reading a plan that publishes € figures to business
-> stakeholders scores "no stakes". That is the one leg that fires on reporting, analytics and
-> dashboard work, i.e. most of what this fleet builds. Load the skill.
-
-If the test passes, tell the user plainly what it costs and what it buys, and offer to scaffold the
-context doc from the `advisory-hub` skill's template. **Do not create it silently** — an opt-in
-pattern that switches itself on is no longer opt-in.
-
-**In headless mode, never offer and never create.** Headless forbids asking anything, so an "offer"
-is impossible there. Instead record the result as a line under `## Constraints & decisions` —
-*"Advisory Hub: test passed (N phases, <criteria>) — not scaffolded, headless run; create
-`<plan-stem>-advisory-context.md` to enable"* — so the decision reaches a human rather than being
-silently dropped or silently taken.
-
-If it does not pass, say nothing **to the user** — a three-phase feature should never hear about
-this. But **always record the determination in the plan, pass or fail**: one line under
-`## Constraints & decisions`, naming which REQUIRED trigger was or was not hit.
-
-> `Advisory Hub: not applicable — no REQUIRED trigger (not a migration / security change /
-> production data correctness / numbers published to stakeholders).`
-
-### If the test FAILS but this repo already runs a Hub for another plan
-
-Check for an existing `*-advisory-context.md` in `.caddis/plans/` belonging to a **different** plan.
-If one exists, add a second line under `## Constraints & decisions`:
-
-> `Hub conventions: this repo runs Advisory Hub for <other-plan>. This plan does NOT — if it borrows
-> the phase-NN.prompt.md / .report.md / CONTINUE GATE conventions, the lightweight rule applies: the
-> session that files a report must not write the next prompt without an independent re-check.`
-
-**Why this line exists.** A repo with one Hub plan has its artefacts sitting there as the most recent
-example of "how we structure a multi-session plan here", and the next plan copies them by analogy.
-It inherits the file names and none of the safety, because the safety was never in the names.
-Measured once already: an implementing session filed its own batch report and then wrote the next
-batch's prompt in the same session, with nobody having looked in between. Nothing was wrong that
-time — and nothing checked either.
-
-This is the cheapest possible place to catch it: when the second plan is created, before any
-artefact-mimicry has happened. See *"Failing this test correctly does not mean no discipline"* in the
-`advisory-hub` skill for the rule itself. Do not restate the rule here — one home, or the copies
-drift.
-
-Silent to the human, auditable in the artifact. "Say nothing" once meant *leave no trace anywhere*,
-and a wrong negative was then invisible — no line in the plan, no line in the chat, nothing for
-anyone to challenge. A rule whose failures leave no artifact cannot be reviewed.
+A `risk: high` phase gets two independent review runs: run by the roadmap/plan runner automatically (from caddis-next Phase 11), and by hand in an interactive `/caddis:implement` run (`caddis_review.py --plan <plan> --phase <n> --runs 2`, from Phase 10). Only a `blocking` finding fails that review (exit 1); `should-fix` and `nit` findings go on a follow-up list and do not stop the merge. A phase gets 3 completed review rounds (a run that did not complete uses none); the 4th ends with exit 5, "stop, the owner decides". The advisory hub is retired; do not plan a separate validation session.
+
+## Programme triggers
+
+Small work that does not meet a trigger skips its block.
+
+**Trigger: Always.** Add one open-work row for the plan in `.caddis/open-work.md`. Set its cells with `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_rows.py" set --file <open-work.md> --id <row id> --col Status=todo`, never with a regex edit.
+
+**Trigger: The plan records a decision.** Record it with `/caddis:decide`.
 
 ## Step 4 — Report
 Output the plan path (`.caddis/plans/<feature-slug>.md`), the phase list (one line each, with each