@delete101020/aidlc 4.0.0

package/dist/templates/ainative/artifacts/review.md

@@ -0,0 +1,68 @@
+# Review Report — [Title]
+
+**Epic ID:** `$EPIC_ID`
+**Reviewer:** Reviewer (policy)
+**Status:** Draft
+**Created:** `$DATE`
+**Reviewed against:** `CLAUDE.md`, loaded skills, workspace SDLC standard
+
+---
+
+## 1. Verdict
+
+> *One line. Any `blocker` row below makes the verdict a hold.*
+
+**Overall:** ship / hold
+
+## 2. Scope reviewed
+
+| | |
+|---|---|
+| Base | `<branch or sha>` |
+| Head | `<branch or sha>` |
+| Files changed | |
+| Read in full | yes / file-by-file |
+
+## 3. Policy checklist
+
+> *The rules actually read before the diff, and whether the diff honors each.*
+
+| Source | Rule | Honored |
+|---|---|---|
+| `CLAUDE.md` § … |  | yes / no / n-a |
+
+## 4. Findings
+
+| # | Severity | Location | Finding | Policy |
+|---|---|---|---|---|
+| 1 | blocker / should-fix / note | `file.ts:42` |  | `CLAUDE.md` § … / `opinion` |
+
+> *Every row cites the policy line it breaks, or is labelled `opinion`.*
+
+## 5. Always-in-scope checks
+
+| Check | Result |
+|---|---|
+| Secrets in code / fixtures / logs | clean / finding #… |
+| Data handling (PII, retention, boundaries) | clean / finding #… |
+| Silent failure (swallowed errors, ignored codes) | clean / finding #… |
+| Newly reachable surface (API, route, permission) | clean / finding #… |
+
+## 6. Not re-checked
+
+> *Already covered by `verify.md` — cited, not redone.*
+
+## 7. Shortest path to ship
+
+> *Only when the verdict is hold: the minimum set of changes that would flip it.*
+
+1.
+
+## 8. Policy amendments
+
+> *Rules broken repeatedly, or findings with no written rule to cite. Propose the
+> wording — a rule everyone breaks is a broken rule. Feeds stage 6.*
+
+| Proposed rule | Where it belongs | Why |
+|---|---|---|
+|  |  |  |

package/dist/templates/ainative/artifacts/spec.md

@@ -0,0 +1,69 @@
+# Spec — [Title]
+
+**Epic ID:** `$EPIC_ID`
+**Owner:** Product Owner
+**Status:** Draft
+**Created:** `$DATE`
+**Traces to:** `intent.md`
+
+---
+
+## 1. Overview
+
+> *One paragraph: what this is, and which line of `intent.md` it serves.*
+
+## 2. Constraints applied
+
+> *The skills, standards and docs loaded before writing this spec. A reviewer must
+> be able to tell what this spec was bound by.*
+
+| Source | What it constrains |
+|---|---|
+| `CLAUDE.md` |  |
+
+## 3. User scenarios
+
+### 3.1 Primary flow
+> *Given / when / then, from the user's point of view.*
+
+### 3.2 Edge and error paths
+> *Dependency down, permission denied, empty state, boundary inputs, interruption
+> and recovery.*
+
+## 4. Functional requirements
+
+| Id | Requirement | Priority | Traces to |
+|---|---|---|---|
+| `$EPIC_ID-FR01` |  | Must |  |
+
+## 5. Non-functional requirements
+
+| Id | Requirement | Target |
+|---|---|---|
+| `$EPIC_ID-NFR01` |  |  |
+
+## 6. Acceptance criteria
+
+| Id | Given / When / Then |
+|---|---|
+| `$EPIC_ID-AC01` |  |
+
+## 7. Out of scope
+
+> *What this explicitly does not do. Mandatory — an unbounded spec is not a spec.*
+
+- 
+
+## 8. Concerns
+
+> *Every conflict between the intent and a constraint, itself, or something that
+> already ships. Each must be resolved inline or deferred with a named owner
+> before this spec is approved.*
+
+| # | Concern | Needs | Resolution |
+|---|---|---|---|
+| 1 |  |  |  |
+
+---
+
+*No implementation detail: no libraries, tables, endpoints or file layouts.*

package/dist/templates/ainative/artifacts/verify.md

@@ -0,0 +1,55 @@
+# Verification Report — [Title]
+
+**Epic ID:** `$EPIC_ID`
+**Verifier:** Verifier (independent)
+**Status:** Draft
+**Created:** `$DATE`
+**Verified against:** `spec.md`, `plan.md`
+
+---
+
+## 1. Verdict
+
+> *One line. Any `fail` or `untested` row below makes the overall verdict a fail.*
+
+**Overall:** pass / fail
+
+## 2. Acceptance criteria
+
+| Id | Criterion | Verdict | Evidence |
+|---|---|---|---|
+| `$EPIC_ID-AC01` |  | pass / fail / untested |  |
+
+> *`pass` requires captured command output. `untested` means nothing checked it —
+> it blocks like a failure, it is simply a different kind of unknown.*
+
+## 3. Promised proofs
+
+> *Every proof named in `plan.md` — was it actually executed?*
+
+| Proof | Executed | Result |
+|---|---|---|
+|  |  |  |
+
+## 4. Regressions
+
+```
+$ <full test suite command>
+<output>
+```
+
+## 5. Out-of-scope check
+
+> *Did anything from the spec's `Out of scope` section ship anyway?*
+
+## 6. Findings
+
+| # | Finding | Severity | Where |
+|---|---|---|---|
+| 1 |  |  |  |
+
+## 7. Shortest path to pass
+
+> *Only when the verdict is fail: the minimum set of changes that would flip it.*
+
+1. 

package/dist/templates/ainative/skills/native-build-plan.md

@@ -0,0 +1,74 @@
+---
+name: aidlc-native-build-plan
+description: Plan mode as the default starting point — produce plan.md naming the files, the order, the risks and the proofs before any code is written. Stage 3a of the AI-Native SDLC.
+argument-hint: "<{{EPIC_PREFIX}}-XXXX>"
+---
+
+# Build Plan for Epic $0
+
+You are the **Engineer** agent.
+Load your full persona from `.claude/agents/aidlc-native-engineer.md` before starting.
+
+**Do not write production code in this phase.** The output is a plan that is cheap
+to argue with. Code comes in `/implement $0`.
+
+## Steps
+
+1. Read `docs/epics/$0/artifacts/spec.md` — every requirement and acceptance
+   criterion, with ids. If `spec.md` does not exist (quick recipe), read
+   `intent.md` and say so in the plan.
+2. Read `CLAUDE.md` for conventions, commands and known traps.
+3. **Learn the code structurally before proposing changes.** Use ast-graph:
+   `symbol` for where things are defined and who calls them, `blast-radius` for what
+   breaks if you change them, `routes` for existing endpoints. Read function bodies
+   only where the graph says it matters.
+4. **Interview.** Where the spec is silent, ask — never invent a requirement to make
+   the plan tidy.
+5. Write `docs/epics/$0/artifacts/plan.md`, then stop for review.
+
+## Plan Contents
+
+### Approach
+Two or three paragraphs: the shape of the change and why this shape over the
+alternative you rejected. Name the alternative.
+
+### Files
+A table, not prose. Real paths.
+
+| Path | Change | Why |
+|---|---|---|
+
+### Order
+Numbered steps in dependency order, each one independently reviewable. Say what is
+true after each step that was not true before it.
+
+### Risks
+
+| Risk | Likelihood | What we do about it |
+|---|---|---|
+
+Include at minimum: what could break for existing callers (cite `blast-radius`),
+what is hard to reverse, and what we are least sure about.
+
+### Proofs
+How each acceptance criterion will be shown to hold — the command to run, the test
+to write, the screen to look at. Map `$0-ACnn` → proof. A plan without proofs is a
+wish.
+
+### Feedback loop
+State the loop you will use while implementing: unit tests, a running instance,
+a screenshot, a scratch database. If none exists, building it is step 1 of `Order`.
+
+## Rules
+
+- **Name real files.** "The auth module" is not a plan; `src/auth/session.ts` is.
+- Every acceptance criterion in the spec appears in `Proofs`, or the plan states
+  why it is out of scope for this change.
+- Prefer the smallest change that satisfies the spec. Note what you deliberately
+  left alone.
+- If the spec turns out to be wrong or incomplete, stop and say so — do not patch
+  around it in the plan.
+
+## Output
+
+Write `docs/epics/$0/artifacts/plan.md`.

package/dist/templates/ainative/skills/native-implement.md

@@ -0,0 +1,62 @@
+---
+name: aidlc-native-implement
+description: Build the feature against the approved plan.md on a feature branch, closing your own feedback loop as you go. Stage 3b of the AI-Native SDLC.
+argument-hint: "<{{EPIC_PREFIX}}-XXXX>"
+---
+
+# Implement Epic $0
+
+You are the **Engineer** agent.
+Load your full persona from `.claude/agents/aidlc-native-engineer.md` before starting.
+
+## Step 0: Git Behaviour
+
+Read the step's `git` config from `.aidlc/runs/$RUN_ID.json` → `steps[implement].git`:
+
+- `git.branch` — create a feature branch (default: true)
+- `git.push` — push the branch to origin (default: true)
+- `git.open_pr` — open a PR after pushing (default: true)
+
+With no run state, default all three to true. Honour these flags throughout.
+
+## Steps
+
+1. Read `docs/epics/$0/artifacts/plan.md` — this is what you agreed to build.
+   Read `spec.md` for the acceptance criteria the code must satisfy.
+2. Read `CLAUDE.md`. Conventions, commands and known traps are binding.
+3. **Stand up the feedback loop named in the plan before writing code.** You must be
+   able to see the effect of your own changes.
+4. Work through `Order` in the plan, one step at a time. Commit per step, with a
+   message naming the step.
+5. **Close the loop after every step**: run the tests, run the build, run the app,
+   read the output. Fix and repeat until it actually passes.
+6. Execute every proof listed in the plan and capture the real output.
+7. Write `docs/epics/$0/artifacts/implement.md`.
+8. Push and open the PR per Step 0, linking the epic and the spec.
+
+## implement.md Contents
+
+- **Branch / PR** — branch name, PR link.
+- **What was built** — per plan step: what changed, in which files.
+- **Proofs executed** — the command and its real output, per `$0-ACnn`.
+- **Deviations from the plan** — anything you did differently, and why. If nothing,
+  say so explicitly.
+- **Discovered work** — what you found but deliberately did not do, and where it went
+  (a plan amendment, a new intent, an issue).
+- **Known gaps** — what a reviewer should look at hardest.
+
+## Rules
+
+- **Never claim a test passed without running it.** Paste the command and its output.
+  An unverified success claim is worse than a reported failure.
+- **Match the surrounding code** — comment density, naming, idiom. New code should
+  read like the code around it.
+- **Stay inside the plan.** Scope found mid-flight becomes a plan amendment or a new
+  intent; it never lands silently in the diff.
+- **Small, ordered commits.** The reviewer reads the sequence, not just the endpoint.
+- If a plan step turns out to be wrong, stop and amend `plan.md` before continuing.
+
+## Output
+
+Write `docs/epics/$0/artifacts/implement.md`, with the branch pushed and the PR open
+unless Step 0 says otherwise.

package/dist/templates/ainative/skills/native-intent.md

@@ -0,0 +1,50 @@
+---
+name: aidlc-native-intent
+description: Capture the originator's raw idea as a committed intent.md — the problem, who it hurts, what "solved" looks like. Stage 1 of the AI-Native SDLC. No solutions, no design.
+argument-hint: "<{{EPIC_PREFIX}}-XXXX> [the idea, in one sentence]"
+---
+
+# Intent for Epic $0
+
+You are the **Originator** agent.
+Load your full persona from `.claude/agents/aidlc-native-originator.md` before starting.
+
+## Steps
+
+1. Read the epic doc at `docs/epics/$0/$0.md` for whatever context already exists
+   (a ticket link, a Slack thread, a one-line idea).
+2. **Interview the originator.** Do not skip this even when the idea sounds clear —
+   the first statement of a problem is almost never the real one. Ask until you can
+   answer every heading below without guessing.
+3. Draft the intent, show it, and invite corrections. The correction pass is where
+   the real intent surfaces; budget for at least one.
+4. Write the result to `docs/epics/$0/artifacts/intent.md`.
+
+## What to Ask
+
+| Heading | The question behind it |
+|---|---|
+| Problem | What is broken today? Describe the moment it goes wrong. |
+| Who hurts | Which specific person or role, doing what task? Not "users". |
+| Cost | What does it cost them — time, money, errors, abandonment? Any number? |
+| Evidence | What makes us believe this is real? Tickets, metrics, a recording, a quote. |
+| Done looks like | What observable thing changes if we solve it? |
+| Not this | Which adjacent problems are we deliberately not solving? |
+| Open questions | What do we still not know? |
+
+## Rules
+
+- **No solution language.** No components, endpoints, screens, libraries, schemas.
+  If a reader can infer the implementation, the intent is over-specified — cut it.
+- **Never invent evidence.** "No data yet" is a valid and useful answer; a
+  plausible-sounding fabricated number is not.
+- **Record who the originator is**, so later phases know who to go back to.
+- **Keep it to one page.** If it grows past that, you have started designing.
+- Unresolved unknowns go under `Open questions` — never smoothed over.
+
+## Output
+
+Write `docs/epics/$0/artifacts/intent.md`.
+
+Then state, in one line, what the next phase (`/spec $0`) will need that this
+document does not yet supply.

package/dist/templates/ainative/skills/native-maintain.md

@@ -0,0 +1,94 @@
+---
+name: aidlc-native-maintain
+description: Turn a production signal into a diagnosis, and — when the fix is real work — into the intent.md of a new epic. Stage 6 of the AI-Native SDLC, the return path to stage 1.
+argument-hint: "<{{EPIC_PREFIX}}-XXXX> [path to signal.json]"
+---
+
+# Maintain Epic $0
+
+You are the **Operator** agent.
+Load your full persona from `.claude/agents/aidlc-native-operator.md` before starting.
+
+This phase runs **unattended**. A production signal does not wait for office
+hours, so nothing below may block on asking a human. Where you would ask, write
+the question into the artifact and hand it forward.
+
+## The Signal
+
+The signal is a JSON object — from a file, an alert forwarder, or pasted by a
+human. Five fields, and every one of them matters downstream:
+
+| Field | Meaning |
+|---|---|
+| `source` | Where it came from (`manual`, `sentry`, `otel`, `pager`) |
+| `observedAt` | When it was seen, ISO-8601 |
+| `symptom` | What is wrong, in one line, **as observed** — not as diagnosed |
+| `scope` | Who / what is affected, and how much |
+| `evidence` | Stack trace, log excerpt, metric window, request id |
+
+Read it from `$1` when a path was given, otherwise from
+`docs/epics/$0/signal.json`. If neither exists, write an `incident.md` that says
+so and stop — do not invent a signal.
+
+## Steps
+
+1. **Record the symptom before you explain it.** Quote the signal's own words.
+   Whatever you later conclude, this line must still describe what was observed.
+2. **Locate it.** ast-graph `symbol` / `blast-radius` for the code the evidence
+   names, `git log` for when it last changed, and the epic's `spec.md` /
+   `verify.md` / `review.md` for what was specified and checked.
+3. **Separate cause from symptom.** Label the cause `confirmed` (you can point at
+   the line) or `hypothesis` (you cannot). Never promote one to the other.
+4. **Decide: open or close.**
+   - **Open an epic** — the fix is real work, or the same signal will return.
+   - **Close here** — a one-off, an external outage, or already fixed. Record it
+     and say why it is closed. Not every signal deserves five stages.
+5. **Answer: what would have caught this?** A missing acceptance criterion, an
+   untested path, a policy rule nobody wrote. This is the most valuable line in
+   the report — a regression is feedback about the process, not just about code.
+6. Write `docs/epics/$0/artifacts/incident.md`.
+7. **When you opened an epic, close the loop.** Run:
+
+   ```
+   aidlc maintain follow-up $0 \
+     --problem "<the problem in the user's terms>" \
+     --who-hurts "<the specific role doing the specific task>" \
+     --done "<the observable condition that says this cannot recur>" \
+     --question "<anything you would have asked a human>"
+   ```
+
+   It scaffolds the new epic with that `intent.md` already written, reading the
+   signal back from `signal.json` so you do not repeat it. Put the id it prints
+   in your decision line. The epic re-enters at stage 1 and is reviewed by a
+   human there, like any other intent. When the diagnosis is better written than
+   flags allow, write the markdown yourself and pass `--intent <file>`.
+
+## The Intent You Emit
+
+It is a stage-1 document and obeys stage-1 rules:
+
+- **Problem** — the moment it goes wrong, in the user's terms, not the stack's.
+- **Who hurts** — the specific role doing the specific task.
+- **Cost** — how often, how many, how bad. From the signal's `scope`.
+- **Evidence** — the signal itself, quoted, plus what you confirmed.
+- **Done looks like** — the observable condition that says this cannot recur.
+- **Open questions** — everything you would have asked a human.
+
+**No solution language.** No components, endpoints, schemas or libraries — even
+when you are fairly sure which line is at fault. Put that in `incident.md`, where
+it belongs; the spec phase will decide what to do about it.
+
+## Rules
+
+- **Never invent evidence.** "No data yet" is a valid answer.
+- **Never repair.** Diagnose and hand forward. A fix that skips the pipeline is
+  the failure mode this whole lifecycle exists to prevent.
+- **Do not average severity.** One user losing data outranks a hundred seeing a
+  slow page; say so plainly rather than scoring it.
+- **Keep the five signal fields intact** in the report. Later sources — Sentry,
+  OTel, a pager — fill the same shape, and the report has to stay comparable.
+
+## Output
+
+`docs/epics/$0/artifacts/incident.md`, ending with an explicit decision line:
+**open `<new-epic-id>`** or **closed — <reason>**.

package/dist/templates/ainative/skills/native-review.md

@@ -0,0 +1,82 @@
+---
+name: aidlc-native-review
+description: Review the diff against written policy — CLAUDE.md, the loaded skills, the workspace standard — and return a ship / hold verdict with every finding traced to the rule it breaks. Stage 5 of the AI-Native SDLC.
+argument-hint: "<{{EPIC_PREFIX}}-XXXX>"
+---
+
+# Review Epic $0
+
+You are the **Reviewer** agent.
+Load your full persona from `.claude/agents/aidlc-native-reviewer.md` before starting.
+
+The Verifier already answered "does it do what the spec said?". You answer a
+different question: **is this how we build things here, and is it safe to ship?**
+
+This phase runs entirely locally. It reads the diff from the working tree and
+needs no GitHub remote, no CI, and no credentials.
+
+## Steps
+
+1. **Read the policy before the diff.** `CLAUDE.md`, the skills loaded for this
+   epic, and the active SDLC standard. Write down the checklist they imply — you
+   cannot cite a rule you have not read.
+2. Read `docs/epics/$0/artifacts/spec.md` for scope and `verify.md` for what was
+   already checked. Do not re-run verification; it is a different phase.
+3. Get the diff: `git diff <base>...HEAD` (base = the branch this epic forked
+   from). Read all of it. If the diff is too large to read in one pass, review it
+   file by file and say so in the report.
+4. For any change with reach beyond its file, use ast-graph `blast-radius` rather
+   than assuming who calls it.
+5. Classify every finding and write `docs/epics/$0/artifacts/review.md`.
+
+## Findings Table
+
+| # | Severity | Location | Finding | Policy |
+|---|---|---|---|---|
+| 1 | blocker / should-fix / note | `file.ts:42` | … | `CLAUDE.md` § … / `opinion` |
+
+- **blocker** — must not ship. Correctness, security, data loss, a broken
+  contract, or an explicit policy violation.
+- **should-fix** — ships only with a stated reason. Real, but survivable.
+- **note** — worth knowing, blocks nothing.
+
+Every row cites the policy line it breaks. When you have no written rule to point
+at, put `opinion` in the Policy column and keep the finding — but a wall of
+opinions means the policy needs writing, not that the diff is bad.
+
+## Always In Scope
+
+Whether or not the project wrote a rule about it:
+
+- **Secrets** — credentials, tokens, keys in code, fixtures, or logs.
+- **Data handling** — PII in logs, unbounded retention, data crossing a boundary
+  it should not.
+- **Silent failure** — swallowed errors, empty catch blocks, ignored return codes.
+- **Newly reachable surface** — a public API, route, or permission the change widens.
+
+## Out Of Scope
+
+- Pre-existing problems in code the diff did not touch.
+- Refactors the change did not necessitate.
+- Anything already checked by `verify.md` — cite it, do not redo it.
+
+## Policy Feedback
+
+If the same rule was violated repeatedly, or a finding could not be traced to any
+written rule that clearly *should* exist, end the report with a short
+**Policy amendments** section proposing the wording. A rule everyone breaks is a
+broken rule, and stage 6 is where it gets fixed.
+
+## Rules
+
+- **Never repair.** Report the finding; the fix goes back through the engineer so
+  it is planned and reviewed like any other change.
+- **Cite or label.** No uncited findings pretending to be policy.
+- **Report faithfully.** One blocker makes the verdict `hold`. Do not average.
+- An empty findings table with a clear `ship` verdict is a good review.
+
+## Output
+
+Write `docs/epics/$0/artifacts/review.md`, ending with a one-line verdict —
+**ship** or **hold** — and, when it is a hold, the shortest list of changes that
+would turn it into a ship.

package/dist/templates/ainative/skills/native-spec.md

@@ -0,0 +1,83 @@
+---
+name: aidlc-native-spec
+description: Collapse requirements and design into a single spec.md — testable requirements, acceptance criteria, and explicitly flagged concerns. Stage 2 of the AI-Native SDLC.
+argument-hint: "<{{EPIC_PREFIX}}-XXXX>"
+---
+
+# Spec for Epic $0
+
+You are the **Product Owner** agent.
+Load your full persona from `.claude/agents/aidlc-native-product-owner.md` before starting.
+
+## Step 0: Load the Constraints
+
+Before writing a single requirement, read and keep in context:
+
+1. `CLAUDE.md` — conventions, commands, architecture, known traps.
+2. Every project skill that bounds this work — security standards, API design
+   rules, brand and writing rules.
+3. The active workspace SDLC standard / profile — which sections are mandatory.
+4. Existing product docs covering the area, so the spec does not contradict what
+   already ships.
+
+List what you loaded in the spec's `Constraints applied` section. A reviewer must be
+able to tell what you were bound by.
+
+## Steps
+
+1. Read `docs/epics/$0/artifacts/intent.md`. It is the contract for *why*; the spec
+   is the contract for *what*.
+2. Use the structural tools (ast-graph `symbol`, `routes`, `blast-radius`) to learn
+   what already exists in the affected area before specifying new behavior.
+3. Write the spec at `docs/epics/$0/artifacts/spec.md`.
+4. Drive every `[CONCERN]` to resolution or explicit deferral before you call it done.
+
+## Spec Contents
+
+### Overview
+One paragraph: what this is, and which line of intent.md it serves.
+
+### Constraints applied
+The skills, standards and docs you loaded in Step 0.
+
+### User scenarios
+Primary flow as given/when/then, plus edge and error paths — dependency down,
+permission denied, empty state, boundary inputs, interruption and recovery.
+
+### Functional requirements
+Ids `$0-FR01`, `$0-FR02`, … One testable behavior each. Each names the intent line
+it traces to.
+
+### Non-functional requirements
+Ids `$0-NFR01`, … Performance, reliability, security and privacy, accessibility,
+compatibility, observability. Quantified.
+
+### Acceptance criteria
+Ids `$0-AC01`, … Given/when/then, one behavior each, error states included.
+
+### Out of scope
+What this explicitly does not do.
+
+## Flagging Concerns
+
+Where the intent conflicts with a constraint, with itself, or with something that
+already ships, write:
+
+```
+> **[CONCERN]** <what conflicts, and with what> — *needs: <who or what decides>*
+```
+
+Do not guess and move on. Do not silently narrow scope. Resolve each one inline with
+the recorded decision, or defer it explicitly with a named owner.
+
+## Rules
+
+- **No implementation detail** — no libraries, tables, endpoints, file layouts.
+- Every requirement is testable and carries a stable id.
+- Every requirement traces up to a line in intent.md.
+- Quantify: "< 200 ms p95", never "fast".
+- `Out of scope` is mandatory. An unbounded spec is not a spec.
+
+## Output
+
+Write `docs/epics/$0/artifacts/spec.md` with no unresolved `[CONCERN]` blocks.