@dzhechkov/skills-feature-adr 1.3.13 → 1.3.16

package/CHANGELOG.md

@@ -0,0 +1,119 @@
+# Changelog
+
+All notable changes to `@dzhechkov/skills-feature-adr` are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.3.13] - 2026-07-03
+
+### Added
+
+- **Durable half of the pattern-memory loop** via `dz teach` / `dz recall` — patterns produced by the QE steps now persist across sessions through the harness memory layer (complements the session-local aqe loop from 1.3.12).
+
+## [1.3.12] - 2026-07-03
+
+### Added
+
+- **aqe pattern-memory loop in Steps 0/8/9** (Direct modes, non-blocking): query stored patterns at Step 0, store QE outcomes at Steps 8/9 — panel-recommended integration.
+- Consolidation maintenance docs for the pattern memory.
+
+## [1.3.11] - 2026-07-03
+
+### Added
+
+- README Troubleshooting section: running `npx` inside a monorepo with npm workspaces.
+
+## [1.3.10] - 2026-07-03
+
+### Fixed
+
+- **All confirmed P1/P2 findings from the package audit** (adversarially verified):
+  - Installer safety: per-file overwrite guard, path-traversal containment, keysarium-preserve behavior, `.bak` backups on `update`, `isFile` checks.
+  - Metadata: removed stale `main` entry; live `bugs` / `homepage` URLs.
+  - Docs: Step 3.5/9 step-count accounting corrected.
+
+## [1.3.9] - 2026-07-03
+
+### Changed
+
+- Onboarding pointers now lead to the public rendered GitHub page.
+
+## [1.3.8] - 2026-07-03
+
+### Added
+
+- Team Onboarding playbook now ships inside the package (`docs/`), publicly viewable via unpkg.
+
+## [1.3.7] - 2026-07-03
+
+### Added
+
+- README pointer to the Team Onboarding playbook.
+
+## [1.3.6] - 2026-07-03
+
+### Added
+
+- "Self-Learning Layers" section in the README.
+
+## [1.3.5] - 2026-07-03
+
+### Added
+
+- "Fable?" column and model-routing guidance in the Pipeline Steps table.
+
+## [1.3.4] - 2026-07-03
+
+### Added
+
+- Detailed Spec-Driven Development (SDD) section published in the npm README.
+
+## [1.3.3] - 2026-06-16
+
+### Fixed
+
+- CLI rejects unknown options — a typo can no longer fall through to a destructive operation (#302).
+- Template-source manifest added; `update` keeps optional components that were installed via `init` flags (#305).
+- Reconciled template drift with sibling toolkits (governance pass, #310).
+
+## [1.3.2] - 2026-06-11
+
+### Fixed
+
+- Defused destructive `prepublishOnly` template-sync hook (#280).
+- Metadata + provenance corrections: registry category, `sources.json`, LICENSE (#286).
+- Shipped as part of the P0–P5 audit publish wave (#288).
+
+## [1.3.1] - 2026-05-06
+
+### Fixed
+
+- **`--with-learning` and `--knowledge-extractor` flags now actually install their components.** In 1.3.0 the flags were advertised by the CLI but the `prepublishOnly` step (`scripts/sync-templates.js`) did not bundle the corresponding template files, so `init` emitted `Template source not found` warnings and silently skipped them. The published tarball now includes:
+  - `lib/memory-protocol.md`
+  - `lib/reward-tracker.md`
+  - `.claude/rules/reward-learning.md`
+  - `.claude/skills/knowledge-extractor/` (full directory: `SKILL.md` + `modules/` + `references/` + `templates/`)
+  - `.claude/commands/harvest.md`
+- **`update` no longer reports `Unknown component` for skipped optional components.** When a template source was missing, `init` still recorded its key in the manifest's `components` array. On a later `update` pass, those orphan keys triggered noisy warnings. `init` now only writes optional component keys whose templates were actually present and whose installation produced files.
+- The `[optional]` lines printed in the success summary now reflect what was actually installed (no longer claims `✓` for components whose templates were missing).
+
+### Changed
+
+- `scripts/sync-templates.js`:
+  - `FEATURE_ADR_FILTERS.commands` extended to also match `harvest*.md` (alongside `feature-adr*.md`), so `templates/.claude/commands/` ships both `feature-adr.md` and `harvest.md`.
+  - New step `2d` copies the three optional learning files (`lib/memory-protocol.md`, `lib/reward-tracker.md`, `.claude/rules/reward-learning.md`) when they exist in the project root.
+  - New step `2e` copies the entire `.claude/skills/knowledge-extractor/` directory.
+  - Each optional source is reported individually with `[OK]` / `[WARN]` lines.
+
+### Migration notes
+
+- **No action required for existing installs** that ran with `--with-learning` or `--knowledge-extractor` against 1.3.0 — the manifest there records the keys but the files are missing on disk. Re-run with `--force` after upgrading to refill the missing templates:
+  ```bash
+  npx @dzhechkov/skills-feature-adr@1.3.1 init --with-learning --knowledge-extractor --force
+  ```
+- Installs that used neither optional flag are unaffected.
+
+## [1.3.0]
+
+Initial published baseline (April 2026). 11-step pipeline with Complexity Router (S/M/L/XL), 15 agentic-qe skills, three install modes (`--full-qe`, `--full-qe-extended`, `--with-learning`, `--knowledge-extractor`).

package/LICENSE

@@ -19,3 +19,16 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+---
+
+Third-party licenses
+
+This package bundles the frontend-design skill template, which is licensed
+under the Apache License, Version 2.0 (not MIT). The full Apache-2.0 license
+text ships alongside the skill at:
+
+  templates/.claude/skills/frontend-design/LICENSE.txt
+
+All other contents of this package are covered by the MIT license above.
+The package's SPDX license expression is: MIT AND Apache-2.0

package/README.md

@@ -263,6 +263,7 @@ features/<feature-slug>/
 ├── 02_research.md                  ← L/XL only
 ├── 03_adr/
 │   └── 001-<decision-slug>.md      ← M+ only
+├── 03.5_ideation_report.md         ← M+ only
 ├── 04_domain_model.md              ← L/XL only
 ├── 05_architecture.md              ← M+ only
 ├── 06_implementation_plan.md       ← Always
@@ -421,9 +422,15 @@ Hooks and events only **collect** raw data — distilling it into reusable patte
   `aqe learning consolidate` periodically (e.g. weekly, or after a heavy QE run);
   `aqe learning stats` shows the experience backlog.
 - **C (dz harness)** — run `dz consolidate` to harvest session learnings into the lexical store
-  (mirrored to the agentdb vector store if present); inspect the result with `dz recall`. The
-  SessionEnd hook automates this **only on clean session ends** — crashed or killed sessions are
-  missed.
+  (mirrored to the agentdb vector store if present); inspect the result with `dz recall`.
+  Consolidation now runs automatically on **PreCompact** — Claude Code fires this before every
+  context compaction (both auto-compaction and manual `/compact`), so long or heavily-compacted
+  sessions consolidate at each compaction boundary rather than only at a clean end. It is
+  **throttled** (a `.dz/.last-consolidate` marker enforces a minimum of ~15 min between auto-runs)
+  so rapid compactions don't reload the embedding model repeatedly. **SessionEnd** remains as a
+  secondary trigger for clean exits, and you can still run `dz consolidate` manually anytime.
+  PreCompact is the primary reliable trigger — earlier the SessionEnd-only hook missed long,
+  compacted, or crashed sessions, which left consolidation effectively manual.
 
 **Degradation symptom:** patterns stop improving while raw logs keep growing. If recall/injection
 quality plateaus, you're collecting but not distilling — consolidate.

package/docs/team-onboarding.md

@@ -8,7 +8,7 @@ self-learning options, and the team conventions.
 
 - 📦 npm: <https://www.npmjs.com/package/@dzhechkov/skills-feature-adr>
 - 📄 Full reference README: same npm page (this doc is the *team playbook*, not a reference dump)
-- 🧭 Deep design: `packages/@dzhechkov/skills-meta/feature-adr/SKILL.md` + its `references/`
+- 🧭 Deep design: `node_modules/@dzhechkov/skills-feature-adr/templates/.claude/skills/feature-adr/SKILL.md` + its `references/` (or browse on unpkg: <https://unpkg.com/@dzhechkov/skills-feature-adr/templates/.claude/skills/feature-adr/SKILL.md>)
 
 ---
 
@@ -216,7 +216,13 @@ reusable patterns is a separate consolidation step:
   returns zero useful patterns. Run `aqe learning consolidate` periodically (weekly, or after a
   heavy QE run); `aqe learning stats` shows the backlog.
 - **C** — run `dz consolidate` (harvests session learnings into the lexical store, mirrored to the
-  vector store if present); inspect with `dz recall`. The SessionEnd hook covers **clean exits only**.
+  vector store if present); inspect with `dz recall`. Consolidation now runs automatically on
+  **PreCompact** (Claude Code fires this before every context compaction — auto and manual
+  `/compact`), so long/compacted sessions consolidate at each compaction boundary, not only at a
+  clean end. It's **throttled** via a `.dz/.last-consolidate` marker (~15 min min between auto-runs).
+  SessionEnd remains a secondary trigger for clean exits; manual `dz consolidate` works anytime.
+  PreCompact is the primary reliable trigger (SessionEnd alone missed long/compacted/crashed
+  sessions).
 
 **Degradation symptom:** patterns stop improving while raw logs keep growing → you're collecting,
 not distilling. Consolidate.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dzhechkov/skills-feature-adr",
-  "version": "1.3.13",
+  "version": "1.3.16",
   "description": "Adaptive Feature Development skill pack for Claude Code — 11-step pipeline with Complexity Router (S/M/L/XL), ADR-driven architecture, 15 agentic-qe skills, multi-agent fleet QE. Supports --full-qe, --full-qe-extended, --with-learning, and --knowledge-extractor modes.",
   "bin": {
     "skills-feature-adr": "./bin/cli.js"
@@ -10,6 +10,7 @@
     "src/",
     "templates/",
     "LICENSE",
+    "CHANGELOG.md",
     "docs/"
   ],
   "keywords": [
@@ -33,7 +34,7 @@
     "harvest"
   ],
   "author": "dzhechko",
-  "license": "MIT",
+  "license": "MIT AND Apache-2.0",
   "engines": {
     "node": ">=16.0.0"
   },
@@ -56,5 +57,6 @@
   },
   "publishConfig": {
     "access": "public"
-  }
-}
+  },
+  "scripts": {}
+}

package/src/cli.js

@@ -8,10 +8,10 @@ const { bold, cyan, dim, green, yellow, red, info, error } = require('./utils');
 // ---------------------------------------------------------------------------
 function showBanner() {
   console.log('');
-  console.log(cyan('\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557'));
+  console.log(cyan('\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557'));
   console.log(cyan('\u2551') + bold('   FEATURE-ADR \u2014 Adaptive Feature Development          ') + cyan('\u2551'));
   console.log(cyan('\u2551') + '   11-step pipeline with Complexity Router (S/M/L/XL)  ' + cyan('\u2551'));
-  console.log(cyan('\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D'));
+  console.log(cyan('\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D'));
   console.log('');
 }
 

package/src/commands/doctor.js

@@ -6,7 +6,7 @@ const {
   green, red, yellow, cyan, bold, dim,
   info, success, warn, error: logError,
   fileExists, readJSON, readManifest,
-  MANIFEST_FILE, getComponentFilter, COMPONENTS,
+  MANIFEST_FILE, fromManifestPath, getComponentFilter, COMPONENTS,
 } = require('../utils');
 
 // ---------------------------------------------------------------------------
@@ -40,7 +40,9 @@ function checkFilesExist(manifest, targetDir) {
     const suspicious = [];
 
     for (const relPath of files) {
-      const absPath = path.resolve(resolvedTarget, relPath);
+      // Normalize both separator kinds — old manifests may carry native
+      // (backslash) separators written on another OS.
+      const absPath = path.resolve(resolvedTarget, fromManifestPath(relPath));
 
       // Manifest entries must stay inside the project — anything that
       // resolves outside is suspicious (possible tampering), not checked.
@@ -276,7 +278,7 @@ function checkKeysariumIntegration(targetDir) {
     if (!keysariumManifest) {
       return {
         passed: true,
-        detail: 'Detected but manifest unreadable',
+        detail: '⚠ .keysarium.json exists but is unreadable (corrupted?) — treating as not installed',
       };
     }
 

package/src/commands/init.js

@@ -7,7 +7,8 @@ const {
   info, success, warn, error: logError, step,
   fileExists, readJSON,
   ensureDir, getRelativePaths, getRelativePathsFiltered,
-  createManifest, writeManifest, getTemplatesDir,
+  createManifest, readManifest, writeManifest, getTemplatesDir,
+  toManifestPath, fromManifestPath,
   COMPONENTS, OPTIONAL_COMPONENTS, MANIFEST_FILE, getComponentFilter,
 } = require('../utils');
 
@@ -20,18 +21,29 @@ const KEYSARIUM_MANIFEST = '.keysarium.json';
 function detectKeysarium(targetDir) {
   const manifestPath = path.join(targetDir, KEYSARIUM_MANIFEST);
   if (!fileExists(manifestPath)) return null;
-  return readJSON(manifestPath);
+  const manifest = readJSON(manifestPath);
+  if (manifest === null) {
+    // File exists but did not parse — say so distinctly instead of silently
+    // pretending keysarium is absent.
+    console.log(yellow('⚠') + ' .keysarium.json exists but is unreadable (corrupted?) — treating as not installed');
+    return null;
+  }
+  return manifest;
 }
 
 function showKeysariumIntegration(keysariumManifest) {
   console.log('');
   console.log(cyan('  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510'));
-  console.log(cyan('  \u2502') + bold(' @dzhechkov/keysarium detected!') + '                    ' + cyan('\u2502'));
+  // Interior width is 50 columns (the borders above/below have 50 dashes) \u2014
+  // every content line must render exactly 50 visible chars wide.
+  console.log(cyan('  \u2502') + bold(' @dzhechkov/keysarium detected!') + '                   ' + cyan('\u2502'));
   const v = keysariumManifest.version;
   const kv = typeof v === 'string' && v.length ? v : 'unknown';
-  console.log(cyan('  \u2502') + ` Version: ${dim(kv)}` + ' '.repeat(Math.max(0, 39 - kv.length)) + cyan('\u2502'));
-  console.log(cyan('  \u2502') + ' Feature ADR integrates with existing Keysarium.   ' + cyan('\u2502'));
-  console.log(cyan('  \u2502') + ' Shared: .claude/commands, rules, skills            ' + cyan('\u2502'));
+  // ' Version: ' is 10 chars, so padding = 50 - 10 - kv.length; the Math.max
+  // clamp keeps over-long version strings from producing a negative repeat.
+  console.log(cyan('  \u2502') + ` Version: ${dim(kv)}` + ' '.repeat(Math.max(0, 40 - kv.length)) + cyan('\u2502'));
+  console.log(cyan('  \u2502') + ' Feature ADR integrates with existing Keysarium.  ' + cyan('\u2502'));
+  console.log(cyan('  \u2502') + ' Shared: .claude/commands, rules, skills          ' + cyan('\u2502'));
   console.log(cyan('  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518'));
   console.log('');
 }
@@ -61,16 +73,18 @@ function installComponent(key, comp, templatesDir, targetDir, opts) {
   // Build the file list from the TEMPLATE source, never a scan of the destination — otherwise
   // user-created files inside a component dir get adopted into the manifest and a later
   // `remove` deletes them (finding #8).
+  // Manifest `rel` entries are stored POSIX-normalized (toManifestPath) so a
+  // manifest written on Windows keeps working on posix and vice versa.
   let entries;
   if (comp.isFile) {
-    entries = [{ srcFile: src, destFile: destRoot, rel: comp.src }];
+    entries = [{ srcFile: src, destFile: destRoot, rel: toManifestPath(comp.src) }];
   } else {
     const filterFn = getComponentFilter(comp);
     const rels = filterFn ? getRelativePathsFiltered(src, filterFn) : getRelativePaths(src);
     entries = rels.map((rel) => ({
       srcFile: path.join(src, rel),
       destFile: path.join(destRoot, rel),
-      rel: path.join(comp.src, rel),
+      rel: toManifestPath(path.join(comp.src, rel)),
     }));
   }
 
@@ -103,6 +117,25 @@ function printPreservedBlock(preserved, dryRun) {
   }
 }
 
+// Files tracked by the PREVIOUS install's manifest that the current template
+// set no longer provides. They were ours (the old manifest says so), so a
+// --force reinstall must clean them up or they stay on disk untracked forever.
+// Contained-path check (path.resolve + prefix) before every candidate — same
+// discipline remove.js uses; anything resolving outside the project is skipped.
+function findOrphans(oldManifest, newFileSet, resolvedTarget) {
+  if (!oldManifest || !Array.isArray(oldManifest.files)) return [];
+  const orphans = [];
+  for (const oldRel of oldManifest.files) {
+    const posixRel = toManifestPath(oldRel);
+    if (newFileSet.has(posixRel)) continue;
+    const absPath = path.resolve(resolvedTarget, fromManifestPath(oldRel));
+    if (absPath === resolvedTarget || !absPath.startsWith(resolvedTarget + path.sep)) continue;
+    if (!fileExists(absPath)) continue;
+    orphans.push({ rel: posixRel, absPath });
+  }
+  return orphans;
+}
+
 // Resolve which optional component keys to install based on flags
 function getOptionalKeys(flags, keysariumDetected) {
   if (keysariumDetected) return []; // keysarium already provides these
@@ -133,6 +166,7 @@ async function run(options) {
   const manifestPath = path.join(targetDir, MANIFEST_FILE);
 
   // ── a) Check for existing installation ─────────────────────────────────
+  let oldManifest = null; // previous install's manifest (for orphan cleanup)
   if (fileExists(manifestPath)) {
     if (!force) {
       warn('Feature ADR skill pack is already installed in this directory.');
@@ -140,6 +174,7 @@ async function run(options) {
       process.exit(1);
     }
     warn('Existing Feature ADR installation found \u2014 overwriting (--force).');
+    oldManifest = readManifest(targetDir);
   }
 
   // ── b) Detect keysarium integration ────────────────────────────────────
@@ -253,6 +288,20 @@ async function run(options) {
     if (preservedFiles.length > 0) {
       printPreservedBlock(preservedFiles, true);
     }
+    if (force && oldManifest) {
+      const dryOrphans = findOrphans(
+        oldManifest,
+        new Set([...installedFiles, ...preservedFiles]),
+        path.resolve(targetDir)
+      );
+      if (dryOrphans.length > 0) {
+        console.log('');
+        info(`${dryOrphans.length} orphaned file(s) from the previous install would be removed:`);
+        for (const o of dryOrphans) {
+          console.log(`  ${yellow('⚠')} ${o.rel}`);
+        }
+      }
+    }
     console.log('');
     warn('Dry run — no files were written.');
     process.exit(0);
@@ -281,6 +330,34 @@ async function run(options) {
   writeManifest(targetDir, manifest);
   info(`Created ${MANIFEST_FILE} manifest`);
 
+  // ── f2) Orphan cleanup (--force reinstall) ─────────────────────────────
+  // Files the OLD manifest tracked that the new install no longer provides
+  // would otherwise stay on disk untracked forever. They were ours — the old
+  // manifest says so — so delete them now that the new install is complete.
+  if (force && oldManifest) {
+    const orphans = findOrphans(
+      oldManifest,
+      new Set([...installedFiles, ...preservedFiles]),
+      path.resolve(targetDir)
+    );
+    const removedOrphans = [];
+    for (const o of orphans) {
+      try {
+        fs.unlinkSync(o.absPath);
+        removedOrphans.push(o.rel);
+      } catch (err) {
+        warn(`Could not remove orphaned file ${o.rel}: ${err.message}`);
+      }
+    }
+    if (removedOrphans.length > 0) {
+      console.log('');
+      console.log(`${green('✓')} removed ${removedOrphans.length} orphaned file(s) from the previous install:`);
+      for (const rel of removedOrphans) {
+        console.log(`  ${dim(rel)}`);
+      }
+    }
+  }
+
   // ── g) Success summary ─────────────────────────────────────────────────
   console.log('');
   success(bold('Feature ADR skill pack installed!'));

package/src/commands/remove.js

@@ -7,7 +7,7 @@ const {
   green, red, yellow, cyan, bold, dim,
   info, success, warn, error: logError, step,
   fileExists, readManifest,
-  MANIFEST_FILE,
+  MANIFEST_FILE, fromManifestPath,
 } = require('../utils');
 
 // ---------------------------------------------------------------------------
@@ -88,7 +88,9 @@ function isKeysariumShared(relParts) {
 //   'shared'  — lives in a keysarium-shared directory (preserve)
 //   'ok'      — safe to remove
 function classifyManifestEntry(relPath, resolvedTarget, keysariumDetected) {
-  const absPath = path.resolve(resolvedTarget, relPath);
+  // Manifest entries may carry either separator kind (a manifest written on
+  // Windows has backslashes) — normalize to native before resolving.
+  const absPath = path.resolve(resolvedTarget, fromManifestPath(relPath));
 
   if (absPath !== resolvedTarget && !absPath.startsWith(resolvedTarget + path.sep)) {
     return { absPath, kind: 'outside' };
@@ -188,6 +190,13 @@ async function run(options) {
 
   // ── c) Confirm unless --force ─────────────────────────────────────────
   if (!force) {
+    // Without a TTY, rl.question never resolves (CI / piped stdin) — the
+    // process would hang or silently exit. Reject with a copy-paste command.
+    if (!process.stdin.isTTY) {
+      logError('non-interactive session detected — re-run with --force to confirm removal');
+      info(`Run: ${cyan('npx @dzhechkov/skills-feature-adr remove --force')}`);
+      process.exit(1);
+    }
     const confirmed = await confirmPrompt(
       yellow('This will remove all Feature ADR skill pack files. Continue? (y/N) ')
     );

package/src/commands/update.js

@@ -8,6 +8,7 @@ const {
   copyDirRecursive, copyDirFiltered, fileExists, readJSON,
   ensureDir, getRelativePaths, getRelativePathsFiltered, diffFiles,
   readManifest, writeManifest, getTemplatesDir,
+  toManifestPath,
   COMPONENTS, OPTIONAL_COMPONENTS, MANIFEST_FILE, getComponentFilter,
 } = require('../utils');
 
@@ -201,10 +202,14 @@ async function run(options) {
     // them). If the template source is missing, keep the previous manifest
     // entries for this component verbatim.
     if (!fileExists(srcPath)) {
-      const kept = prevFiles.filter(
-        (rel) => rel === comp.src || rel.startsWith(comp.src + path.sep)
-      );
-      allFiles.push(...kept);
+      // Compare in POSIX form so old manifests with native (backslash)
+      // separators still match; re-store the kept entries POSIX-normalized.
+      const compPosix = toManifestPath(comp.src);
+      const kept = prevFiles.filter((rel) => {
+        const relPosix = toManifestPath(rel);
+        return relPosix === compPosix || relPosix.startsWith(compPosix + '/');
+      });
+      allFiles.push(...kept.map(toManifestPath));
       warn(`component '${key}' not found in current templates — manifest entries kept as-is`);
       continue;
     }
@@ -213,7 +218,7 @@ async function run(options) {
     // readdir it — without this branch the 3 learning files silently drop out of
     // the manifest on every rebuild, and a later `remove` strands them.
     if (comp.isFile) {
-      if (fileExists(destPath)) allFiles.push(comp.src);
+      if (fileExists(destPath)) allFiles.push(toManifestPath(comp.src));
       continue;
     }
 
@@ -221,7 +226,7 @@ async function run(options) {
       const paths = filterFn
         ? getRelativePathsFiltered(srcPath, filterFn)
         : getRelativePaths(srcPath);
-      allFiles.push(...paths.map((rel) => path.join(comp.src, rel)));
+      allFiles.push(...paths.map((rel) => toManifestPath(path.join(comp.src, rel))));
     }
   }
 

package/src/utils.js

@@ -208,6 +208,20 @@ function diffFiles(srcDir, destDir, filterFn) {
 
 const MANIFEST_FILE = '.skills-feature-adr.json';
 
+// Manifest entries are always stored with POSIX '/' separators so a manifest
+// written on Windows keeps working on posix and vice versa (portability).
+
+// WRITE side: normalize a path to POSIX form before storing it in a manifest.
+function toManifestPath(p) {
+  return String(p).replace(/\\/g, '/');
+}
+
+// READ side: accept BOTH separator kinds (old manifests may carry native
+// backslashes) and return a native-separator path safe for path.resolve/join.
+function fromManifestPath(p) {
+  return String(p).split(/[\\/]+/).join(path.sep);
+}
+
 function readManifest(targetDir) {
   return readJSON(path.join(targetDir, MANIFEST_FILE));
 }
@@ -369,6 +383,8 @@ module.exports = {
 
   // Manifest
   MANIFEST_FILE,
+  toManifestPath,
+  fromManifestPath,
   readManifest,
   writeManifest,
   createManifest,

package/templates/.claude/rules/feature-adr-conventions.md

@@ -34,11 +34,13 @@ All artifacts use numbered prefix matching their step:
 01_requirements.md
 02_research.md
 03_adr/001-{decision-slug}.md
+03.5_ideation_report.md
 04_domain_model.md
 05_architecture.md
 06_implementation_plan.md
 07_code_changes/change_manifest.md
 08_qe_report.md
+09_fleet_qe_assessment.md
 ```
 
 ## Complexity Tier Rules
@@ -73,6 +75,7 @@ It DOES share:
   → Step 6: plan
   → Step 7: code
   → Step 8: QE
+  → Step 9: Fleet QE (L/XL)
   → Done: README.md + code changes in repo
 ```