@cofoundr/init 1.5.0

package/content/commands/tasks.md

@@ -0,0 +1,91 @@
+---
+description: >
+  Break the active phase or feature into ordered, dependency-aware, copy-paste-
+  ready tasks. SDD-canonical alias for /cofoundr:next phase [N]. Produces a
+  tasks.md file inside the phase or feature folder; never modifies code.
+---
+
+# /cofoundr:tasks — Task Breakdown
+
+You take a target (a phase, a feature, or "next") and produce a build-ready task list. You do not write code. You do not modify `phases.md` or `prd.md`. Your output is a `tasks.md` file scoped to the target.
+
+## Argument parsing
+
+- `/cofoundr:tasks` — operate on the **next unbuilt phase** (read `docs/phases.md`, find the first phase with unchecked tasks).
+- `/cofoundr:tasks phase <N>` — operate on a specific phase.
+- `/cofoundr:tasks feature <name>` — operate on a feature in `docs/features/`.
+
+If the target cannot be resolved (phase doesn't exist, feature doesn't exist), echo back the available targets and stop.
+
+## Step 1 — Read
+
+Read in this order. Do not re-read.
+
+1. `.cofoundr/constitution.md` (or `docs/rules.md`).
+2. `docs/tech.md` — for stack and conventions.
+3. `docs/phases.md` — for the target phase entry, its goal, its Boundary Map, its HALT conditions.
+4. The phase or feature spec pack (`docs/phases/<slug>/spec.md`, `tests.md`, `decisions.md`) if it exists.
+5. The current code state — run `git status` and `git log --oneline -10` so the task list does not duplicate work that's already done.
+
+## Step 2 — Generate the task list
+
+Write `docs/phases/<slug>/tasks.md` (or `docs/features/<slug>/tasks.md`). Use the structure below.
+
+```md
+# Tasks — <phase or feature name>
+
+## Preconditions
+- [ ] Constitution v<version> is in effect.
+- [ ] Spec pack at <path> is reviewed.
+- [ ] All Boundary Map "Consumes" artifacts exist (list each one and how to verify).
+
+## Ordered Tasks
+
+### T1 — <short imperative>
+- **File(s):** `path/to/file.ts`
+- **Produces:** <function, type, route, or schema this introduces>
+- **Depends on:** T0 (or "none")
+- **Steps:**
+  1. <copy-paste-ready instruction>
+  2. <copy-paste-ready instruction>
+- **<verify>** <one-line observable check the founder or AI can run>
+
+### T2 — <short imperative>
+...
+
+## HALT conditions
+Carry forward from `phases.md`. If a HALT condition fires, stop and write a note to `.cofoundr/memory/decisions.md`.
+
+## Done when
+- [ ] All `<verify>` checks pass.
+- [ ] `git status` clean on the phase branch.
+- [ ] Session Notes appended to the active feature doc (if feature work).
+- [ ] Phase task in `phases.md` checked off.
+```
+
+## Step 3 — Task quality rules
+
+- **Imperative, not aspirational.** "Add `getUserById` to `lib/users.ts`" not "Consider adding a user lookup helper".
+- **Files-first.** Every task names at least one file path. If a task does not touch a file, it is not a task — it is a check.
+- **One verify per task.** A task without a `<verify>` line is incomplete.
+- **Atomic.** A task that touches more than 3 files probably needs to split. Split it.
+- **Boundary-aware.** A task may not consume an artifact that no prior task produced. If it must, mark it as a Precondition and stop.
+- **Constitution-aware.** If a task would violate a Never rule, do not write it. Surface the conflict.
+
+## Step 4 — Update `AGENTS.md`
+
+Append the new tasks file path under the **Specs** section of `AGENTS.md` so all tools can find it:
+
+```
+- Tasks: <path>
+```
+
+## Step 5 — Confirm
+
+Show the founder the task count and the first three tasks. Ask: *"Want me to dispatch `/cofoundr:implement` on T1, or are we still iterating?"* Wait.
+
+## What you must not do
+
+- Do not write code. Tasks are instructions, not implementations.
+- Do not modify `phases.md` or `prd.md`. If the phase definition is wrong, surface it as a blocker and stop.
+- Do not invent tasks for work the codebase already has. Cross-check `git log` and a quick `Grep` first.

package/content/commands/translate.md

@@ -0,0 +1,197 @@
+---
+description: >
+  Generate a plain-English companion to the six spec files. Reads product.md,
+  prd.md, tech.md, rules.md, phases.md, agents.md and writes
+  docs/plan-for-humans.md — no jargon, no P0/P1, no RLS, no boundary maps.
+  Just what you're building, in what order, and what can go wrong. Run this
+  after /cofoundr:new-project if you want a version you can share with
+  someone non-technical (or re-read yourself at 11pm without needing a
+  glossary).
+---
+
+# Translate — Plain-English Companion
+
+Generate a plain-English version of the spec that a non-technical founder, advisor, spouse, or first hire can read end-to-end without looking anything up.
+
+This does not replace the six canonical spec files — those are for your AI coder. This produces a **second** document alongside them, at `docs/plan-for-humans.md`, that says the same things in human language.
+
+## Step 1 — Read the Spec
+
+Read every file that exists, in this order:
+
+1. `docs/product.md` (or `product.md` in root)
+2. `docs/prd.md`
+3. `docs/tech.md`
+4. `docs/rules.md`
+5. `docs/phases.md`
+6. `docs/agents.md`
+
+If any are missing, continue with what you have and note the gap in the output.
+
+## Step 2 — Translate
+
+Produce `docs/plan-for-humans.md` using the structure below. Every section is written for someone who has never heard the acronyms. Translate every technical term the first time it appears. Then use the plain term afterward.
+
+### Translation rules
+
+- **Replace jargon on first use, then drop the jargon.**
+  - `P0 / P1 / P2` → "must-have at launch / would like / nice to have"
+  - `RLS` → "database row-level security (only the right people can see the right rows)"
+  - `CSRF` → "a kind of attack where a malicious site tricks a user's browser into taking an action on your site"
+  - `HALT conditions` → "stop-and-ask moments — situations where the AI must pause and check with you"
+  - `Boundary Map` → "what this phase produces and what it depends on from earlier phases"
+  - `YAML frontmatter` → "a short settings block at the top of the file"
+  - `exec / eval / raw SQL` → "running text the user typed as if it were code (a common way apps get hacked)"
+  - `magic bytes` → "the actual file contents (not what the filename or upload form claims)"
+  - Version numbers (e.g. "Next.js 15 App Router") → keep the version, but add a one-line what-it-is ("a framework for building websites")
+
+- **No acronym without its expansion on first use** — even common ones like API, URL, DB.
+- **Prefer verbs over nouns.** "The app checks the user's login" beats "Authentication validation is performed."
+- **One idea per sentence.** If a rules.md entry is a compound sentence, split it.
+
+### Structure for `plan-for-humans.md`
+
+```markdown
+# [Project Name] — The Plan, In Plain English
+
+*This is a human-readable companion to the spec in `/docs`. The files in
+`/docs` are for the AI coder. This file is for you (and anyone you show
+the project to).*
+
+**Last generated:** [today's date]
+
+---
+
+## What We're Building
+
+[2–3 paragraphs drawn from product.md. The TL;DR, the user, the problem,
+why now. No jargon.]
+
+## Who It's For
+
+[From product.md Target User. Named role + situation.]
+
+## What We're Deliberately NOT Building
+
+[From product.md "What This Is NOT" and prd.md P2. Explicit non-goals,
+each as one sentence starting with "Not".]
+
+---
+
+## What It Will Do (Must-Haves at Launch)
+
+[From prd.md P0. Each feature as:
+
+### [Feature name]
+**What it does:** [one sentence]
+**What you'll see when it works:** [the observable behaviours, translated
+from the acceptance criteria]
+]
+
+## What Comes After Launch
+
+[From prd.md P1. Briefer — one line per item.]
+
+---
+
+## The Build Order
+
+[From phases.md. For each phase:
+
+### Phase [N] — [Name]
+**Goal:** [one sentence]
+**What gets built:** [plain-English list of tasks, no file paths]
+**Stop-and-ask moments:** [the HALT conditions, translated — situations
+where the AI must pause and ask you before continuing]
+**How you'll know the phase is done:** [success criteria, translated]
+]
+
+*Phase 0 always comes first — that's the groundwork: version control,
+database setup, login, environment secrets. No visible product yet,
+but everything after this depends on it.*
+
+---
+
+## What We're Using To Build It
+
+[From tech.md. As a simple bulleted list, not a table.
+Each item: "[What it is] — [one-line description]. Version [X]."]
+
+**Example:**
+- Next.js 15 (App Router) — a framework for building websites with React.
+- Supabase — the database and user-login system (so we don't have to
+  build our own).
+- Tailwind CSS 4 — a styling system that lets you design right in the code.
+
+## What We're Integrating With
+
+[From tech.md Third-Party Integrations. For each: name, what it's for,
+what it costs (if known), any secret keys that need to be set up.]
+
+---
+
+## The Rules The AI Must Follow
+
+[From rules.md. Grouped as:]
+
+### Always
+[Each Always rule in plain English, as a single sentence.]
+
+### Pause and Check With You First
+[Each "Ask first" rule in plain English.]
+
+### Never — No Matter What
+[Each Never rule in plain English, with its "because" reason translated.
+Example: "Never put secret passwords into the website code — because
+anyone viewing the page in their browser can read them."]
+
+### Why These Rules Exist
+
+[One paragraph: most of these rules exist because an AI coder, left
+un-constrained, will do exactly the thing the rule forbids. The rules.md
+file is what stops that.]
+
+---
+
+## How This Gets Handed Off Between Sessions
+
+[From agents.md Session Management + CLAUDE.md Session Start Protocol,
+in plain English.]
+
+Every time you start a new AI coding session, the AI will:
+
+1. Read the plan files automatically (you don't paste them in).
+2. Check if there's a feature in progress.
+3. Show you a recap of where things stand.
+4. Wait for you to confirm before writing any code.
+
+If the AI starts hallucinating or gets confused mid-session, the right
+move is to start a new chat — not to argue with the confused one.
+
+---
+
+## Open Gaps
+
+[Any rubric items that weren't answered during /cofoundr:plan and were
+deferred to Clarifications Log in prd.md. List them as one-liners
+with a note on why they matter.]
+
+---
+
+*The canonical spec — the one the AI actually reads — is in `/docs`.
+If anything here contradicts those files, the files win. Re-run
+`/cofoundr:translate` any time the spec changes to regenerate this
+document.*
+```
+
+## Step 3 — Confirm
+
+Show the file path and say:
+
+> Generated `docs/plan-for-humans.md`. This is the share-able version — send it to a co-founder, an advisor, a spouse, or anyone who wants to know what you're building without reading the technical spec. Re-run `/cofoundr:translate` whenever the spec changes.
+
+## Notes
+
+- **This command does not modify the six spec files.** Only writes/overwrites `docs/plan-for-humans.md`.
+- **Do not include this file in `CLAUDE.md` imports.** It is for humans, not the AI.
+- If the spec is incomplete (e.g. `/cofoundr:quick-brief` was run but not `/cofoundr:new-project`), generate a partial plain-English version and clearly label the gaps.

package/content/manifest.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "https://cofoundr.ai/schemas/manifest.schema.json",
+  "name": "cofoundr",
+  "version": "1.4.0",
+  "description": "Spec-driven development workflow for non-technical founders. Tool-agnostic — runs in Claude Code, Cursor, Windsurf, Cline, Codex, Aider, Copilot, Gemini, and any agent that reads AGENTS.md.",
+  "homepage": "https://cofoundr.ai",
+  "commands": [
+    { "id": "resume",       "file": "commands/resume.md",       "category": "session",   "summary": "Start of every session. Reads active feature docs and phases.md, presents a recap, asks for confirmation before code is written." },
+    { "id": "quick-brief",  "file": "commands/quick-brief.md",  "category": "planning",  "summary": "Fast 4-question pass that produces product.md only. First-time try-out path." },
+    { "id": "new-project",  "file": "commands/new-project.md",  "category": "planning",  "summary": "Full pipeline: planning conversation, research, six-file spec generation, agent context setup." },
+    { "id": "plan",         "file": "commands/plan.md",         "category": "planning",  "summary": "Standalone planning conversation with a 15-item sufficiency rubric." },
+    { "id": "next",         "file": "commands/next.md",         "category": "planning",  "summary": "Planning driver. Reads filesystem and dispatches to the right next step." },
+    { "id": "new-feature",  "file": "commands/new-feature.md",  "category": "planning",  "summary": "Add a feature to an existing project. Scope-check + 4-question planning + living feature doc." },
+    { "id": "scope-guard",  "file": "commands/scope-guard.md",  "category": "guardrails","summary": "Check a proposed change against product.md non-goals and prd.md scope." },
+    { "id": "rules-check",  "file": "commands/rules-check.md",  "category": "guardrails","summary": "Audit current work against the rules.md Always/Ask First/Never tiers." },
+    { "id": "review",       "file": "commands/review.md",       "category": "guardrails","summary": "22-check quality audit of the spec bundle." },
+    { "id": "translate",    "file": "commands/translate.md",    "category": "comms",     "summary": "Generate docs/plan-for-humans.md — a plain-English companion to the six files." },
+    { "id": "setup-skills", "file": "commands/setup-skills.md", "category": "setup",     "summary": "Install the recommended skill packs based on the project's stack." },
+
+    { "id": "constitution", "file": "commands/constitution.md", "category": "sdd",       "summary": "Establish the project's governing principles and non-negotiables. SDD-canonical alias to /cofoundr:plan's rules pass.", "aliases": ["principles"] },
+    { "id": "specify",      "file": "commands/specify.md",      "category": "sdd",       "summary": "Produce or refresh the formal spec for a project or feature. SDD-canonical alias to /cofoundr:new-project + spec-phase.", "aliases": ["spec"] },
+    { "id": "tasks",        "file": "commands/tasks.md",        "category": "sdd",       "summary": "Break the active phase or feature into ordered, dependency-aware tasks. SDD-canonical alias to /cofoundr:next phase.", "aliases": [] },
+    { "id": "implement",    "file": "commands/implement.md",    "category": "sdd",       "summary": "Execute the next unchecked task with HALT enforcement, verify-each-step, and a session-notes write at the end.", "aliases": ["build", "ship"] },
+
+    { "id": "onboard",      "file": "commands/onboard.md",      "category": "brownfield","summary": "Map an existing codebase. Produces .cofoundr/memory/codebase.md, drafts a back-filled spec, and surfaces gaps." },
+    { "id": "document",     "file": "commands/document.md",     "category": "brownfield","summary": "Generate or refresh living documentation from the code itself. Architecture, modules, data model, surfaces." },
+    { "id": "audit",        "file": "commands/audit.md",        "category": "brownfield","summary": "Codebase + spec consistency audit. Drift detection, dead surfaces, undocumented behavior, security smells." }
+  ],
+  "agents": [
+    { "id": "launch-kit-detect", "file": "agents/launch-kit-detect.md", "summary": "Detect whether the project is built on the CoFoundr Launch Kit." },
+    { "id": "spec-phase",        "file": "agents/spec-phase.md",        "summary": "Produce the 6-file spec pack for a named phase." },
+    { "id": "brand-intake",      "file": "agents/brand-intake.md",      "summary": "Run a 6-question brand intake and produce docs/brand.md." },
+    { "id": "consolidate",       "file": "agents/consolidate.md",       "summary": "Produce roadmap-level consolidation artifacts (data model, API contracts, fixtures)." }
+  ],
+  "templates": [
+    { "id": "product",  "file": "templates/product.md",  "summary": "Plain-English product definition." },
+    { "id": "prd",      "file": "templates/prd.md",      "summary": "P0/P1/P2 with acceptance criteria." },
+    { "id": "tech",     "file": "templates/tech.md",     "summary": "Stack, data model, endpoints, integrations." },
+    { "id": "rules",    "file": "templates/rules.md",    "summary": "Always/Ask first/Never constitution." },
+    { "id": "phases",   "file": "templates/phases.md",   "summary": "Milestones and phases with HALT conditions." },
+    { "id": "agents",   "file": "templates/agents.md",   "summary": "AI agent context. Imports the other five." },
+    { "id": "feature",  "file": "templates/feature.md",  "summary": "Living feature doc scaffold." },
+    { "id": "brand",    "file": "templates/brand.md",    "summary": "Visual and voice spec." }
+  ],
+  "scaffold": {
+    "agentsFile": "scaffold/AGENTS.md.tmpl",
+    "cofoundrDir": "scaffold/.cofoundr"
+  },
+  "targets": [
+    { "id": "claude-code", "name": "Claude Code",    "kind": "ide-cli",  "native": true,  "config": [".claude/commands/", ".claude/agents/", "CLAUDE.md"] },
+    { "id": "cursor",      "name": "Cursor",         "kind": "ide",      "native": false, "config": [".cursor/rules/cofoundr.mdc"] },
+    { "id": "windsurf",    "name": "Windsurf",       "kind": "ide",      "native": false, "config": [".windsurfrules", ".windsurf/rules/cofoundr.md"] },
+    { "id": "cline",       "name": "Cline / Roo Code","kind": "ide",     "native": false, "config": [".clinerules/cofoundr.md"] },
+    { "id": "codex",       "name": "OpenAI Codex CLI","kind": "cli",     "native": false, "config": ["AGENTS.md"] },
+    { "id": "aider",       "name": "Aider",          "kind": "cli",      "native": false, "config": ["AGENTS.md", ".aider.conf.yml"] },
+    { "id": "copilot",     "name": "GitHub Copilot", "kind": "ide",      "native": false, "config": [".github/copilot-instructions.md"] },
+    { "id": "gemini",      "name": "Gemini CLI",     "kind": "cli",      "native": false, "config": ["GEMINI.md"] }
+  ]
+}

package/content/scaffold/.cofoundr/README.md

@@ -0,0 +1,67 @@
+# `.cofoundr/` — Project Workspace
+
+This directory is the **source of truth** for everything an AI agent needs to work on this project. It is tool-agnostic by design — every modern coding agent reads from here.
+
+## Layout
+
+```
+.cofoundr/
+├── constitution.md       # The project's binding rules (Always / Ask first / Never)
+├── manifest.json         # Version stamp — what CoFoundr release this project is on
+├── memory/
+│   ├── project.md        # Project-level facts that don't change often
+│   ├── decisions.md      # Append-only decision log
+│   ├── knowledge.md      # Patterns, gotchas, things learned the hard way
+│   └── codebase.md       # Generated by /cofoundr:onboard — the architecture map
+├── specs/
+│   ├── README.md
+│   └── <feature-or-phase-id>/
+│       ├── spec.md
+│       ├── tasks.md
+│       └── decisions.md
+├── commands/             # Canonical workflow commands (read by every tool via AGENTS.md)
+├── agents/               # Canonical agent definitions
+├── templates/            # Project-local template overrides (optional)
+├── docs/                 # Generated documentation (from /cofoundr:document)
+└── reports/              # Generated audit reports (from /cofoundr:audit)
+```
+
+## Tool shims
+
+`AGENTS.md` at the repository root tells **every** AI tool how to use this directory.
+
+In addition, the following per-tool shims may exist:
+
+- `.claude/commands/`, `.claude/agents/`, `CLAUDE.md` — Claude Code
+- `.cursor/rules/cofoundr.mdc` — Cursor
+- `.windsurfrules`, `.windsurf/rules/cofoundr.md` — Windsurf
+- `.clinerules/cofoundr.md` — Cline / Roo
+- `GEMINI.md` — Gemini CLI
+- `.github/copilot-instructions.md` — GitHub Copilot
+
+Each shim points back to `.cofoundr/` — there is **one** source of truth.
+
+## How agents invoke a CoFoundr command
+
+When the user says `/cofoundr:<name>` or `cofoundr <name>`:
+
+1. Read `.cofoundr/commands/<name>.md`.
+2. Follow it step-by-step. Do not paraphrase. Do not skip.
+3. Honor the constitution at every step.
+
+## Refresh
+
+```bash
+# Pull the latest commands, agents, templates, and shims into this project:
+npx @cofoundr/init sync
+
+# Re-map the codebase after architectural changes:
+# (run inside your AI tool)
+/cofoundr:onboard --refresh
+```
+
+## Hand-edits
+
+Files inside `commands/`, `agents/`, and the bundled `templates/` are managed by `npx @cofoundr/init sync` — your edits will be overwritten on the next sync.
+
+To customize a command, agent, or template **for this project only**, copy it to `.cofoundr/templates/overrides/` (for templates) or to `.cofoundr/commands.local/` (for commands). Sync respects these.

package/content/scaffold/.cofoundr/constitution.md.tmpl

@@ -0,0 +1,54 @@
+---
+version: "1.0.0"
+last_amended: "{{TODAY}}"
+---
+
+# {{PROJECT_NAME}} — Constitution
+
+> The non-negotiable rules for any human or AI agent that touches this codebase.
+> Read in full before making any change. Run `/cofoundr:constitution` to amend.
+
+## Always
+
+- Validate input server-side. Client-side validation is a UX hint, never a security control.
+- Pin exact major versions in `package.json` (or equivalent). No `^` for security-sensitive dependencies.
+- Commit to git before any multi-file change.
+- Read `.cofoundr/memory/decisions.md` before making an architecture decision; append a new entry after.
+- Run `/cofoundr:rules-check` after a build session before declaring it done.
+
+## Ask first
+
+- Before adding any unlisted dependency.
+- Before any database migration or schema change.
+- Before deleting files or directories.
+- Before changing authentication or authorization logic.
+- Before running anything that touches production credentials.
+- Before modifying functions outside the current task's scope.
+
+## Never
+
+<never>
+
+- NEVER put secret keys in client bundles — because DevTools exposes them.
+- NEVER deploy database tables without row-level security or equivalent server-side authorization — because the anon key is public.
+- NEVER enforce authentication only client-side — because attackers bypass it.
+- NEVER run `DROP`, `TRUNCATE`, `rm -rf`, or `--force` flags without explicit user confirmation — because agents have destroyed production databases.
+- NEVER commit `.env`, key files, or secrets — because git history is permanent.
+- NEVER pass user input directly to `exec`, `eval`, or raw SQL — because remote code execution.
+- NEVER hardcode credentials — because scanners harvest them.
+- NEVER use `any` in TypeScript — because it disables the type system.
+- NEVER trust `Content-Type` headers for upload validation — because attackers spoof them.
+- NEVER skip pre-commit hooks (`--no-verify`) without explicit user authorization — because the hook exists for a reason.
+
+</never>
+
+## How to maintain this file
+
+- Every amendment bumps the version. Patch for new rules, minor for restructures, major for framework changes.
+- Every amendment appends a line to the Amendment Log below.
+- This file is **append-mostly**. Do not silently delete a rule. If a rule is being retired, mark it `[retired in vX.Y.Z]` and explain why in the Amendment Log.
+- The `Never` list is wrapped in `<never>` XML tags so AI tools can parse it as binding.
+
+## Amendment Log
+
+- 1.0.0 — {{TODAY}} — Initial constitution scaffolded by `/cofoundr:init`. Confirm or amend with `/cofoundr:constitution`.

package/content/scaffold/.cofoundr/manifest.json.tmpl

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://cofoundr.ai/schemas/project-manifest.schema.json",
+  "cofoundrVersion": "{{COFOUNDR_VERSION}}",
+  "initializedAt": "{{TODAY}}",
+  "tools": {{TOOLS_JSON}},
+  "layout": {
+    "constitution": ".cofoundr/constitution.md",
+    "memory": ".cofoundr/memory/",
+    "specs": ".cofoundr/specs/",
+    "commands": ".cofoundr/commands/",
+    "agents": ".cofoundr/agents/",
+    "docs": ".cofoundr/docs/",
+    "reports": ".cofoundr/reports/"
+  }
+}

package/content/scaffold/.cofoundr/memory/decisions.md.tmpl

@@ -0,0 +1,19 @@
+# Decisions Log
+
+> Append-only. Newest at the bottom. Every architecture decision, every HALT, every "we tried X, it broke Y, so we picked Z" goes here.
+>
+> Format:
+> ```
+> ## YYYY-MM-DD — <short title>
+> Context: <one paragraph — what were we deciding>
+> Decision: <one sentence>
+> Alternatives: <one sentence>
+> Consequences: <what changes because of this — links to specs that need updating>
+> ```
+
+## {{TODAY}} — Initialized CoFoundr workspace
+
+Context: Bootstrapping the project's AI workspace.
+Decision: Adopt CoFoundr as the spec-driven development framework. Constitution lives at `.cofoundr/constitution.md`. Workflow commands at `.cofoundr/commands/`. AGENTS.md at the repo root teaches every coding agent how to use them.
+Alternatives: Ad-hoc prompting; one-tool-only setup (e.g. Claude Code only).
+Consequences: Future sessions across any tool will read this directory. Non-CoFoundr-aware files in `docs/` are still respected, but new specs go under `.cofoundr/specs/`.

package/content/scaffold/.cofoundr/memory/knowledge.md.tmpl

@@ -0,0 +1,23 @@
+# Knowledge — Patterns and Gotchas
+
+> Patterns we've adopted, mistakes we don't want to repeat, things an AI agent would otherwise have to learn the hard way.
+>
+> This is the file the founder pastes into when they say "remember this". Append-only by convention; entries can supersede earlier ones if marked.
+
+## Patterns
+<!-- What we do and why. Examples:
+- We use server actions for all mutations because we want progressive enhancement.
+- We use Zod schemas at every API boundary because the runtime types must match the static ones.
+-->
+
+## Gotchas
+<!-- Things that broke once and we don't want to repeat. Examples:
+- Stripe webhook signing fails locally if the body is parsed as JSON before verification — must use the raw body.
+- Supabase RLS policies require server-side `auth.uid()` to be set; client SDK does this automatically, server SDK does not.
+-->
+
+## Idioms specific to this codebase
+<!-- One-liners. e.g. "All async server functions return { data, error } never throw." -->
+
+---
+<sub>Append entries as you learn. Run `/cofoundr:document` periodically to refresh module docs from the same observations.</sub>

package/content/scaffold/.cofoundr/memory/project.md.tmpl

@@ -0,0 +1,27 @@
+# Project Memory
+
+> Project-level facts that don't change often. Read at the start of every session.
+
+## What this is
+{{PROJECT_DESCRIPTION}}
+
+## Who it's for
+<!-- Filled by /cofoundr:plan or /cofoundr:onboard. The first user, named, with their role and the situation they're in when they open the product. -->
+
+## Stage
+<!-- pre-launch | private beta | public beta | shipped | maintained -->
+
+## Stack at a glance
+<!-- One-liner. Detail lives in docs/tech.md. -->
+
+## Where things live
+- Source: `<directory>`
+- Tests: `<directory>`
+- Docs: `docs/`
+- AI workspace: `.cofoundr/`
+
+## Domain glossary
+<!-- Project-specific terms an AI agent must use correctly. Term — one-line definition. -->
+
+---
+<sub>Refresh with `/cofoundr:onboard --refresh` after a major change.</sub>

package/content/scaffold/.cofoundr/specs/README.md

@@ -0,0 +1,38 @@
+# `.cofoundr/specs/` — Feature and Phase Specs
+
+This directory holds the formal, machine-and-human-readable specifications for every feature and phase in the project.
+
+## Layout
+
+```
+specs/
+├── <feature-or-phase-id>/
+│   ├── spec.md          # What it is, what ships, who it's for
+│   ├── tasks.md         # Ordered, dependency-aware tasks (from /cofoundr:tasks)
+│   ├── decisions.md     # Append-only decision log scoped to this spec
+│   └── (optional) ui-spec.md, research.md, tests.md, data-model.md
+```
+
+The id is kebab-case. For phases, use the phase number: `phase-0-bootstrap`, `phase-1-meta-oauth`. For features, use the slug from `/cofoundr:new-feature`: `team-invitations`, `bulk-export`.
+
+## How to add a spec
+
+| Source         | Command                             |
+|----------------|--------------------------------------|
+| New project    | `/cofoundr:specify project`         |
+| New feature    | `/cofoundr:specify feature <slug>`  |
+| Specific phase | `/cofoundr:specify phase <N>`       |
+
+## How to break a spec into tasks
+
+```
+/cofoundr:tasks phase <N>
+/cofoundr:tasks feature <slug>
+```
+
+## How to build from a spec
+
+```
+/cofoundr:implement T<N>          # one task
+/cofoundr:implement phase <N>     # whole phase, pausing between tasks
+```