@garygentry/feature-forge 0.1.0

package/adapters/codex/references/shared-conventions.md

@@ -0,0 +1,144 @@
+# Shared Pipeline Conventions
+
+These conventions apply to every forge pipeline skill. Skills reference this file to avoid duplicating shared logic.
+
+## Feature Name Requirement
+
+Every pipeline skill requires a feature name as the first argument (e.g., `/feature-forge:forge-1-prd auth`).
+
+If no feature name is provided:
+1. STOP IMMEDIATELY
+2. Do NOT attempt to guess or infer a feature name
+3. Ask the user to provide one
+4. Do NOT proceed until a feature name is explicitly given
+5. The feature name must be a single kebab-case token. If the user provides multiple words (e.g., "user auth flow"), convert to kebab-case: `user-auth-flow`.
+
+## User Input Protocol
+
+### CRITICAL GUARDRAIL: Use AskUserQuestion for All Questions
+
+You MUST use the `AskUserQuestion` tool whenever you need the user's input before proceeding. This includes yes/no confirmations, choices between options, interview questions, and feedback on artifacts. NEVER output questions as inline prose text — the user may not be prompted and the session will stall.
+
+**Required turn structure:** Output your analysis, findings, or context as regular text. Then call `AskUserQuestion` with your questions. Do NOT mix questions into your text output.
+
+**WRONG — questions as inline prose (causes stalling):**
+```
+I found that the codebase uses React and TanStack Router. Here are my questions:
+1. Where should this component live?
+2. Should we use server-side rendering?
+```
+
+**RIGHT — context as text, questions via tool:**
+```
+I found that the codebase uses React and TanStack Router.
+[then call AskUserQuestion with: "1. Where should this component live? 2. Should we use server-side rendering?"]
+```
+
+**Recommendations:** Only recommend a specific option when codebase evidence, established conventions, or strong technical rationale clearly favors it. If options are equally valid, present them neutrally — let the user decide without bias.
+
+## Configuration Reading
+
+Read `forge.config.json` from the project root. If it doesn't exist, use defaults.
+
+If `forge.config.json` does not exist and no `.pipeline-state.json` files exist anywhere in `{specsDir}/`, suggest: "No forge.config.json found. Run `/feature-forge:forge-init` to create one with defaults, or I'll use built-in defaults. Want me to continue with defaults?"
+
+Extract these config values (use defaults if not present):
+- `specsDir` (default: `./specs`)
+- `docsDir` (default: `./docs/architecture`)
+- `backlogDir` (default: null — backlog lives at `{specsDir}/{feature}/backlog.json`; when `backlogDir` is configured, forge-4 composes `{backlogDir}/{feature}/`)
+- `gitCommitAfterStage` (default: true)
+- `commitPrefix` (default: `forge`)
+- `loopIterationMultiplier` (default: `1.5`)
+- `loopRunner` (optional object — the loop runner to drive; **defaults to rauf** when absent, with every command templated. See `references/forge-config-schema.json` and `references/ralph-loop-contract.md`.)
+
+## Feature Directory Resolution
+
+Before any file I/O against a feature's artifacts, resolve its directory through the deterministic helper rather than hardcoding `{specsDir}/{feature}/`. This makes flat (`{specsDir}/{feature}/`) and nested (`{specsDir}/{epic}/{feature}/`) layouts both resolve from a bare feature name (REQ-DIR-03), with standalone features behaving exactly as today.
+
+```bash
+R="$(for d in "$HOME"/.claude/skills/feature-forge "$HOME"/.claude/plugins/*/feature-forge; do [ -x "$d/scripts/forge-root.sh" ] && exec "$d/scripts/forge-root.sh"; done)"
+[ -n "$R" ] || { echo "feature-forge: cannot locate plugin root" >&2; exit 1; }
+resolvedFeatureDir=$(python3 "$R/scripts/epic-manifest.py" \
+  resolve "<feature>" --specs-dir "<specsDir>")
+```
+
+- **Exit 0:** stdout is the absolute feature directory. Use it everywhere this skill previously wrote `{specsDir}/{feature}/`.
+- **Exit 1:** the helper reports a structured finding (`not-found`, `ambiguous` — see `00-core-definitions.md §4`). Because this `resolve` call passes **no `--json`** (the subcommand has no such flag), the finding is a plain `not-found:`/`ambiguous:` line on **stderr** with empty stdout — there is no findings JSON to parse. **STOP** and surface that stderr line verbatim. (The `{valid, findings[]}`-on-stdout envelope is the `--json` shape used by `render-status`/`validate`, not by `resolve`.)
+- **Exit 2:** a usage / safety error (`unsafe-name`, a path-containment escape, missing file). The message is a plain `Error: …` line on **stderr** with empty stdout — there is no findings JSON to parse. **STOP** and surface that stderr line verbatim.
+
+In both failure cases, do not fall back to a guessed path.
+
+**Resolution algorithm (summary; full spec in `02-manifest-helper-cli.md §4`):**
+1. Reject the name if unsafe (path separator, `..`, absolute, or failing `SAFE_NAME_RE`) — before any filesystem access.
+2. If `{specsDir}/{name}/.pipeline-state.json` exists → return that flat path.
+3. Else if exactly one `{specsDir}/*/{name}/.pipeline-state.json` exists → return that nested path.
+4. More than one match anywhere → `ambiguous` error listing all matching paths (uniqueness violation, REQ-DIR-04).
+5. Zero matches → `not-found` error.
+
+A directory counts as a **feature** only if it directly contains a `.pipeline-state.json` (the *feature-shaped-dir bound*, `00-core-definitions.md §6`). Non-feature subtrees (`.verification/`, `tests/`, fixture dirs, and the epic root itself — which holds `epic-manifest.json` but no `.pipeline-state.json`) are therefore never matched as features.
+
+**Compatibility:** for a standalone feature the resolver returns its flat path with no epic logic engaged (REQ-COMPAT-01/02) — standalone-feature behavior is unchanged. A pre-existing latent name collision is reported for manual cleanup by the navigator / forge-verify epic mode (CHECK-E08), not by aborting an unrelated command whose name resolves to exactly one dir (tech-spec §3.4).
+
+## Epic Context Injection
+
+After resolving the feature directory, check the feature's `.pipeline-state.json` for an `epic` back-pointer. **If absent, skip this block entirely** (standalone feature — REQ-COMPAT-01; standalone-feature behavior is unchanged). **If present**, load exactly the following context, and nothing transitive (REQ-CTX-01):
+
+1. **`{specsDir}/{epic}/EPIC.md`** — the epic narrative, including the per-feature Contracts sections.
+2. **This feature's `charter`** — read from `{specsDir}/{epic}/epic-manifest.json` (the `features[]` entry whose `name` matches), together with its `exposes` and `consumes` arrays. These are the feature's **contract obligations** (REQ-CTX-02): what it must expose to dependents and what it consumes from dependencies.
+3. **Direct completed dependencies only** — for each `name` in this feature's `dependsOn`, resolve that sibling's directory and, **only if it is complete-for-orchestration** (`00-core-definitions.md §7`), load its `PRD.md` and `tech-spec.md`.
+
+**Do NOT load** transitive (indirect) dependencies' specs. Indirect contracts reach this feature only through the *direct* deps' Contracts sections in `EPIC.md`. This bounds context size and keeps the injected set deterministic (REQ-CTX-01).
+
+To obtain the manifest contracts and the live completion status of each dependency in one deterministic call, run `render-status` and read the per-feature `status` and the `consumes`/`exposes` arrays rather than re-deriving them:
+
+```bash
+R="$(for d in "$HOME"/.claude/skills/feature-forge "$HOME"/.claude/plugins/*/feature-forge; do [ -x "$d/scripts/forge-root.sh" ] && exec "$d/scripts/forge-root.sh"; done)"
+[ -n "$R" ] || { echo "feature-forge: cannot locate plugin root" >&2; exit 1; }
+python3 "$R/scripts/epic-manifest.py" \
+  render-status "<epic>" --specs-dir "<specsDir>" --json
+```
+
+If `render-status` fails, proceed with **only** EPIC.md + charter (a corrupt manifest must not silently inject stale dep specs — REQ-ROBUST-02): on **exit 1**, parse the `{findings[]}` JSON from stdout and surface each; on **exit 2**, surface the plain `Error:` line from stderr verbatim. Do not attempt to parse findings JSON on an exit-2 failure (stdout is empty).
+
+## Pipeline State Protocol
+
+Write pipeline state conforming to `references/pipeline-state-schema.json`. Always update `updatedAt` when modifying pipeline state.
+
+### Staleness Detection (Read-Time)
+
+When loading upstream artifacts as prerequisites, check `basedOnVersions` in the pipeline state for this stage. If any upstream stage's current version is newer than the version recorded in `basedOnVersions`, warn the user before proceeding:
+
+> "This stage was built against {upstream} v{old}, but {upstream} is now at v{new}. The current artifacts may be outdated. Consider re-running this stage, or use --force to proceed with potentially stale inputs."
+
+## Git Commit Protocol
+
+When `gitCommitAfterStage` is true, follow this exact order to avoid state inconsistency:
+
+1. **Stage specific files only:** `git add {specsDir}/{feature}/` — never use `git add -A` or `git add .`
+2. **Attempt commit:** `git commit -m "{commitPrefix}({feature}): <action>"`
+3. **If commit succeeds:** capture the commit hash, then update pipeline state with `status: "complete"` and the `commitHash`
+4. **If commit fails:** do NOT update pipeline state to complete. Report the error to the user and leave state as `in-progress` so the stage can be resumed. Common failure causes:
+   - **Pre-commit hook failure:** Report the hook output. Never use `--no-verify` to bypass. Help the user fix the underlying issue.
+   - **Merge conflicts:** Report conflicting files. Suggest resolution steps appropriate to the conflict.
+   - **Nothing to commit:** If all artifacts were already committed, this is fine — proceed with state update but note the absence of a new commit hash.
+5. **Never** use `git add -A`, `--no-verify`, or `--force` flags
+
+## Crash Recovery
+
+When a skill detects that `currentStage` matches itself and the stage status is `in-progress`, a previous run was interrupted. Follow this recovery protocol:
+
+1. **Inventory existing artifacts:** List all files on disk in `{specsDir}/{feature}/` that this stage would produce
+2. **Compare against state:** Check the `artifacts` array in the pipeline state for this stage — it tracks files written incrementally during the previous run
+3. **Present options to user:** "This stage was interrupted. Found {N} artifacts from the previous run: {list}. Would you like to resume from where it left off, or restart the stage from scratch?"
+4. **If resume:** Skip artifact generation for files that already exist and appear complete (non-empty, properly structured). Continue from the next unwritten artifact.
+5. **If restart:** Proceed normally. The version number will increment.
+
+**Incremental artifact tracking:** When a stage writes multiple files (e.g., forge-3-specs writing a suite of spec documents), update the `artifacts` array in `.pipeline-state.json` after writing each file — not just at stage completion. This ensures crash recovery knows exactly which files were successfully written.
+
+## Force Mode
+
+If the user passes `--force` as an argument, skip prerequisite validation with a warning:
+
+> Force mode: skipping prerequisite checks. Pipeline state tracking may be incomplete. Recommend running `/feature-forge:forge {feature}` after to verify status.
+
+Continue with the stage even if prior stages are not marked complete. Still read any existing artifacts (PRD.md, tech-spec.md, etc.) if they exist on disk — force mode skips the pipeline state check, not the artifact loading.

package/adapters/codex/references/skill-frontmatter.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/garygentry/feature-forge/references/skill-frontmatter.schema.json",
+  "title": "feature-forge canonical SKILL.md frontmatter",
+  "description": "Spec-pure frontmatter for canonical skills/*/SKILL.md. Source of truth for the allowed/required key sets loaded by scripts/check-spec-purity.py. NO version key (REQ-VER-03): versions live in manifests only.",
+  "type": "object",
+  "required": ["name", "description"],
+  "additionalProperties": false,
+  "properties": {
+    "name": { "type": "string" },
+    "description": { "type": "string" },
+    "license": { "type": "string" },
+    "compatibility": {},
+    "metadata": { "type": "object" },
+    "allowed-tools": {}
+  }
+}

package/adapters/codex/references/stack-resolution.md

@@ -0,0 +1,51 @@
+# Stack Resolution Protocol
+
+How feature-forge resolves stack-specific guidance for a project.
+
+## Resolution Order (highest priority first)
+
+1. **Project-level override**: `.claude/references/stack-decisions.md` in the project root. If this file exists, it takes absolute precedence — it contains the team's explicit technology decisions.
+
+2. **Detected stack profile**: `references/stacks/{stack}.md` in this plugin, where `{stack}` matches the `stack` field in `forge.config.json`. Provides language-specific conventions for spec writing, verification, and examples.
+
+3. **Generic fallback**: `references/stacks/_generic.md` in this plugin. Language-neutral guidance that works for any stack. Used when no stack is detected or no matching profile exists.
+
+## How Stack Detection Works
+
+Stack detection happens during **forge-2-tech** (the technical specification stage), which is the natural point where technology decisions are made.
+
+1. The agent examines the project's root manifest and build files
+2. Identifies the primary language, build tool, package manager, and framework
+3. Asks the user to confirm: "I detected this as a {stack} project. Correct?"
+4. Persists the stack identity in `forge.config.json` via the `stack`, `typeCheckCommand`, and `testCommand` fields
+5. All downstream stages (forge-3-specs, forge-4-backlog, forge-verify, forge-6-docs) read the `stack` field and load the matching profile
+
+## forge.config.json Fields
+
+```json
+{
+  "stack": "typescript",
+  "typeCheckCommand": "bun run typecheck",
+  "testCommand": "bun test"
+}
+```
+
+- `stack` — Identifier matching a profile filename in `references/stacks/` (e.g., "typescript", "python", "go")
+- `typeCheckCommand` — Used in acceptance criteria and verification checks. Null if the stack has no type checker.
+- `testCommand` — Used in acceptance criteria and verification checks.
+
+## Available Profiles
+
+| Profile | File | Covers |
+|---------|------|--------|
+| TypeScript | `references/stacks/typescript.md` | Node.js/Bun, npm/pnpm/bun, monorepo patterns, TS-specific spec conventions |
+| Python | `references/stacks/python.md` | Python 3.10+, pip/uv/poetry, pytest, type hints, Pydantic/dataclasses |
+| Generic | `references/stacks/_generic.md` | Any stack — language-neutral guidance using placeholders |
+
+## When No Stack Is Configured
+
+If `forge.config.json` has no `stack` field and forge-2-tech hasn't run yet (e.g., when using `--force`), skills should:
+
+1. Attempt basic detection from project files (look for manifest files)
+2. Use `_generic.md` as fallback
+3. Note in the pipeline state that stack detection was skipped

package/adapters/codex/references/stacks/_generic.md

@@ -0,0 +1,90 @@
+# Generic Stack Profile
+
+Language-neutral guidance for projects without a dedicated stack profile. Use this as a fallback when no matching `references/stacks/{stack}.md` exists.
+
+## Discovery Protocol
+
+Identify the project's stack by checking for these manifest and build files:
+
+| File | Stack |
+|------|-------|
+| `package.json` | Node.js / Bun (JavaScript/TypeScript) |
+| `pyproject.toml`, `setup.py`, `setup.cfg` | Python |
+| `go.mod` | Go |
+| `Cargo.toml` | Rust |
+| `pom.xml`, `build.gradle`, `build.gradle.kts` | Java / Kotlin |
+| `*.csproj`, `*.sln` | .NET (C#/F#) |
+| `mix.exs` | Elixir |
+| `Gemfile` | Ruby |
+| `Package.swift` | Swift |
+
+Also check for:
+- **Lock files**: Reveal the package manager (`bun.lockb`, `uv.lock`, `poetry.lock`, `go.sum`, `Cargo.lock`, etc.)
+- **Workspace/monorepo configs**: `turbo.json`, `nx.json`, `lerna.json`, `pants.toml`, `Cargo workspace`, Go workspace `go.work`
+- **CI configuration**: `.github/workflows/`, `Makefile`, `justfile` — often reveals build and test commands
+
+## Archetype Adaptations
+
+### 00-core-definitions.md
+
+The shared type/data contract document. Language-neutral name for what TypeScript calls "core types and interfaces." Contents should include:
+
+- **Data structures**: The primary types, classes, structs, records, or models that define the feature's domain. Use the project's idiomatic type system (dataclasses, structs, interfaces, schemas, etc.)
+- **Error/exception hierarchy**: Base error type and domain-specific subtypes with structured properties. Every language has a mechanism for this (exception classes, error types, Result enums, etc.)
+- **Constants and enumerations**: Shared values referenced across the feature
+- **Public contracts**: Function signatures, protocols, interfaces, or traits that define the feature's API surface
+
+**Documentation rule**: Every type/structure must have documentation comments in the project's convention (JSDoc, docstrings, godoc, rustdoc, etc.)
+
+**Export rule**: Everything must be accessible through the module's entry point following project conventions.
+
+### 01-architecture-layout.md
+
+How the feature is structured in the project:
+
+- **Directory tree**: Full layout (not abbreviated)
+- **Project manifest**: Dependencies, entry points, build scripts
+- **Build/compiler configuration**: Key options
+- **Module export structure**: What each entry point exposes
+- **Build and deployment considerations**
+
+### NN-testing-strategy.md
+
+- **Testing framework and tooling**: Match project conventions
+- **Unit test approach**: What to test, what to mock/stub
+- **Integration test approach**: Cross-module interaction testing
+- **Test fixtures and factories**
+- **Coverage targets**
+- **Test file location conventions**
+
+## Spec Conventions
+
+When writing implementation specs:
+- Include complete type definitions and function signatures in the project's language — not pseudocode
+- Include documentation comments on every public type and function
+- Include error handling for every operation
+- Include example usage where it aids clarity
+- Cross-reference other spec documents by filename
+
+## Verification Adaptations
+
+Replace stack-specific checks with these generic equivalents:
+
+| Stack-specific check | Generic equivalent |
+|---------------------|-------------------|
+| "Valid TypeScript syntax" | "Valid syntax in the project's language" |
+| "Barrel exports (index.ts)" | "Module exports/entry points follow project conventions" |
+| "bun run typecheck passes" | "`{typeCheckCommand}` passes" (from forge.config.json) |
+| "bun test passes" | "`{testCommand}` passes" (from forge.config.json) |
+| "JSDoc on every field" | "Documentation comments on every field" |
+| "tsconfig.json extends root" | "Build configuration follows project conventions" |
+
+## Acceptance Criteria Patterns
+
+Use these placeholder patterns in backlog items. Replace `{typeCheckCommand}`, `{testCommand}`, and `{module}` with values from `forge.config.json` and the project structure:
+
+- `{typeCheckCommand} passes for {module}`
+- `{testCommand} passes for {module}`
+- `{module}/[entry point] exports [expected symbols]`
+- `[dependency manifest] includes [new dependency]`
+- `[build command] succeeds`

package/adapters/codex/references/stacks/go.md

@@ -0,0 +1,138 @@
+# Go Stack Profile
+
+Stack-specific guidance for Go projects (1.21+).
+
+## Stack Identity
+
+- **Language**: Go 1.21+ (required for `slog` stdlib logging, `slices`/`maps` packages, improved generics)
+- **Build system**: `go build`, `go install` (no external build tool required)
+- **Module system**: Go modules (`go.mod` / `go.sum`)
+- **Philosophy**: Simplicity-first — prefer the standard library, add dependencies only when justified
+
+## Discovery Checklist
+
+When examining a Go project, check for:
+
+- **Module definition**: `go.mod` (module path, Go version, dependencies)
+- **Dependency lock**: `go.sum` (checksums for reproducible builds)
+- **Entry points**: `cmd/` directory (for CLIs, services, or multiple binaries)
+- **Private packages**: `internal/` directory (compiler-enforced encapsulation)
+- **Public packages**: `pkg/` directory (if used — not all projects follow this convention)
+- **Build automation**: `Makefile`, `Taskfile.yml`, `mage` targets
+- **Configuration**: `.golangci.yml` or `.golangci.yaml` (linter config)
+- **Code generation**: `go generate` directives, `//go:generate` comments, `tools.go` for tool dependencies
+- **Framework**: Check imports for chi, gin, echo, fiber (routers), or stdlib `net/http`
+- **Database**: Check for sqlx, pgx, ent, gorm, or `database/sql`
+
+## Archetype Conventions
+
+### 00-core-definitions.md (Go)
+
+- **Structs**: Use `struct` types with json/db tags (e.g., `` `json:"name" db:"name"` ``). Document every exported field with a comment.
+- **Interfaces**: Keep small and behavior-focused (1–3 methods). Define at the consumer site, not the implementation site. Name with `-er` suffix where natural (e.g., `Reader`, `Validator`).
+- **Error types**: Custom types implementing the `error` interface. Use `errors.New` for sentinel errors, `fmt.Errorf` with `%w` for wrapping. Group domain errors in a dedicated `errors.go` file.
+- **Constants**: Use `iota` for sequential constants, typed constants for domain values, `const` blocks for related groups
+- **Type aliases and generics**: Use sparingly. Generic types when the abstraction genuinely applies across multiple concrete types.
+- **No barrel exports**: Go uses package-level visibility (`Exported` vs `unexported`); there is no index file pattern.
+
+### 01-architecture-layout.md (Go)
+
+- **Standard project layout**:
+  - `cmd/<binary-name>/main.go` — entry points (one per binary)
+  - `internal/` — private application code (compiler-enforced)
+  - `pkg/` — public library code (optional, some projects skip this)
+  - `api/` — OpenAPI specs, protobuf definitions, API contracts
+  - `configs/` — configuration file templates
+  - `scripts/` — build, install, analysis scripts
+- **go.mod**: Module path matching the repo URL (e.g., `github.com/user/repo`), minimum Go version, direct and indirect dependencies
+- **Package design**: One package per directory, package name matches directory name, package-level `doc.go` for documentation
+- **Build considerations**: Cross-compilation with `GOOS`/`GOARCH`, build tags for platform-specific code, `ldflags` for version injection
+
+### NN-testing-strategy.md (Go)
+
+- **Framework**: `testing` package from stdlib (no external framework required)
+- **Test file location**: `*_test.go` files in the same package (white-box) or `_test` package suffix (black-box)
+- **Table-driven tests**: Standard pattern using slice of test structs with `t.Run()` subtests
+- **Test helpers**: Functions accepting `testing.TB` with `t.Helper()` call at top
+- **Mocking**: Interfaces + manual mocks, or testify/mock, gomock, mockgen if project uses them
+- **Assertions**: stdlib `if got != want` pattern, or testify `assert`/`require` if project uses it
+- **Integration tests**: Build tags (`//go:build integration`) to separate from unit tests
+- **Benchmarks**: `func BenchmarkXxx(b *testing.B)` with `b.N` loop
+- **Test fixtures**: `testdata/` directory (ignored by Go tooling), `TestMain` for setup/teardown
+
+## Spec Quality Rules
+
+- All Go code must be valid syntax with complete type information — not pseudocode
+- Follow Go idioms:
+  - Return `error` as the last return value — never panic for expected failures
+  - Accept interfaces, return structs (depend on behavior, produce concrete types)
+  - Design meaningful zero values (a zero-valued struct should be usable or clearly invalid)
+  - No getters — use the field name directly (e.g., `user.Name` not `user.GetName()`)
+  - Use embedding for composition, not inheritance
+  - `context.Context` as the first parameter for any function that may block or be cancelled
+  - `error` as the last return value for any function that can fail
+- Include complete function signatures with named return values where they improve clarity
+- Document every exported type, function, and method with a comment starting with the identifier name
+- Use `//nolint` directives only with a justification comment
+
+## Verification Specifics
+
+- **Static analysis**: `go vet ./...` (catches common mistakes)
+- **Linting**: `golangci-lint run` (if `.golangci.yml` exists or CI uses it)
+- **Testing**: `go test ./...` (all packages)
+- **Building**: `go build ./...` (ensures all packages compile)
+- **Formatting**: `gofmt -l .` or `goimports -l .` (should produce no output)
+- **Module tidiness**: `go mod tidy` (ensures `go.mod` and `go.sum` are consistent)
+
+## Testing
+
+- **Framework**: `testing` stdlib package
+- **Test command**: `go test ./...` for all, `go test -v -run TestName ./pkg/...` for specific
+- **Table-driven tests**: Idiomatic pattern — slice of anonymous structs with `name`, input, and expected fields
+- **Subtests**: `t.Run("case name", func(t *testing.T) { ... })` for grouped assertions
+- **Assertions**: testify `assert`/`require` (if project uses it), otherwise manual `if` checks with `t.Errorf`
+- **Coverage**: `go test -coverprofile=coverage.out ./...` then `go tool cover -html=coverage.out`
+- **Race detection**: `go test -race ./...` for concurrency safety
+- **Fuzzing**: `func FuzzXxx(f *testing.F)` (Go 1.18+)
+
+## Common Frameworks
+
+| Category | Options |
+|----------|---------|
+| HTTP router | net/http (stdlib), chi, gin, echo, fiber |
+| Database | database/sql (stdlib), sqlx, pgx, ent, gorm |
+| Migrations | golang-migrate, goose, atlas |
+| CLI | cobra, urfave/cli, kong |
+| Logging | log/slog (stdlib), zerolog, zap |
+| Configuration | viper, envconfig, koanf |
+| Dependency injection | wire, fx, dig |
+| gRPC | google.golang.org/grpc, connect-go |
+| Testing | testify, gomock, go-cmp |
+
+## Example: Project-Level Override
+
+Create `.claude/references/stack-decisions.md` in your project root:
+
+```markdown
+# Stack Decisions
+
+## Runtime & Build
+- Go 1.22 with standard go toolchain
+- Makefile for build automation
+
+## Backend
+- chi for HTTP routing
+- sqlx with PostgreSQL
+- log/slog for structured logging
+
+## Testing
+- testify for assertions and mocking
+- Table-driven tests with t.Run() subtests
+- Build tag `integration` for integration tests
+
+## Conventions
+- Standard project layout (cmd/, internal/, pkg/)
+- golangci-lint with project .golangci.yml
+- Context as first parameter, error as last return
+- Interfaces defined at consumer site
+```

package/adapters/codex/references/stacks/python.md

@@ -0,0 +1,163 @@
+# Python Stack Profile
+
+Stack-specific guidance for Python projects (3.10+).
+
+## Stack Identity
+
+- **Language**: Python 3.10+ (required for modern type hint syntax: `X | Y` unions, `match` statements)
+- **Package management**: pip, uv, poetry, pdm, or pipenv (check for respective lock/config files)
+- **Type checking**: mypy, pyright, or pytype
+- **Linting**: ruff, flake8, pylint
+
+## Discovery Checklist
+
+When examining a Python project, check for:
+
+- **Project manifest**: `pyproject.toml` (modern), `setup.py`/`setup.cfg` (legacy), `requirements.txt` (minimal)
+- **Package manager**: `uv.lock` (uv), `poetry.lock` (poetry), `pdm.lock` (pdm), `Pipfile.lock` (pipenv)
+- **Monorepo**: `pants.toml` (Pants), `BUILD` files (Bazel), `nx.json` with Python plugins, or plain workspace structure
+- **Framework**: FastAPI, Django, Flask, Starlette, Litestar
+- **Database**: SQLAlchemy, Django ORM, Tortoise ORM, SQLModel
+- **Validation**: Pydantic, attrs, marshmallow
+- **Testing**: pytest (dominant), unittest
+- **Type checking**: `mypy.ini`, `pyrightconfig.json`, or `[tool.mypy]` / `[tool.pyright]` in `pyproject.toml`
+
+## Archetype Conventions
+
+### 00-core-definitions.md (Python)
+
+- **Data structures**: Use `dataclasses` for simple data containers, Pydantic `BaseModel` for validated/serializable models. Use `TypedDict` for dict-shaped data.
+- **Type aliases**: Use `type` statements (3.12+) or `TypeAlias` annotation
+- **Union types**: Use `X | Y` syntax (3.10+)
+- **Protocols**: Use `typing.Protocol` for structural subtyping (Python's equivalent of interfaces)
+- **Error/exception hierarchy**: Base exception class inheriting from `Exception` (or a more specific built-in); domain-specific subclasses with typed attributes
+- **Constants and enumerations**: Use `enum.Enum`, `enum.StrEnum`, or module-level constants with `Final` annotation
+- **Module exports**: Define `__all__` in `__init__.py` for explicit public API
+
+### 01-architecture-layout.md (Python)
+
+- **Project layout**: `src/` layout (recommended) or flat layout
+- **pyproject.toml**: `[project]` table with `name`, `dependencies`, `optional-dependencies`, `[project.scripts]` for CLI entry points
+- **Tool configuration**: `[tool.pytest.ini_options]`, `[tool.mypy]`, `[tool.ruff]` sections in `pyproject.toml`
+- **Module entry points**: `__init__.py` files with explicit `__all__` lists for re-exports
+- **Namespace packages**: When applicable, `py.typed` marker for PEP 561 compliance
+
+### Monorepo conventions (if applicable)
+
+- **Workspace structure**: `packages/` or `libs/` directories with individual `pyproject.toml` per package
+- **Internal dependencies**: Path dependencies in `pyproject.toml` or editable installs
+- **Build coordination**: Pants, Bazel, or Makefile-based orchestration
+
+## Spec Quality Rules
+
+- All Python code must be valid syntax with complete type annotations — not pseudocode
+- Use Google-style or NumPy-style docstrings consistently (match project convention)
+- Include `Args`, `Returns`, `Raises` sections in docstrings for every public function
+- Use `Protocol` classes to define interfaces/contracts
+- Include explicit import statements in all code examples
+- Use `async def` for asynchronous operations where applicable
+
+### Example: Well-Specified Function
+
+```python
+class SessionExpiredError(AuthError):
+    """Raised when a session token has expired.
+
+    Attributes:
+        expired_at: When the session expired.
+    """
+
+    def __init__(self, expired_at: datetime) -> None:
+        self.expired_at = expired_at
+        super().__init__(
+            code="SESSION_EXPIRED",
+            message=f"Session expired at {expired_at.isoformat()}",
+        )
+
+
+async def refresh_session_token(
+    current_token: str,
+    *,
+    max_age: timedelta = SESSION_DURATION,
+    refresh_threshold: timedelta = REFRESH_THRESHOLD,
+    signing_key: bytes,
+) -> str | None:
+    """Refresh a session token if it's within the refresh threshold.
+
+    Returns a new token with an extended expiry, or None if the session
+    is not eligible for refresh (valid but outside threshold).
+
+    Args:
+        current_token: The JWT string from the session cookie.
+        max_age: Maximum age of a token eligible for refresh.
+        refresh_threshold: How close to expiry before refresh is allowed.
+        signing_key: Secret key for signing the new token.
+
+    Returns:
+        New session token string, or None if refresh is not possible.
+
+    Raises:
+        SessionExpiredError: If the token has already expired.
+        TokenValidationError: If the token signature is invalid.
+    """
+    ...
+```
+
+## Verification Specifics
+
+- **Type checking**: `mypy .`, `mypy src/`, `pyright`, or `pyright src/`
+- **Linting**: `ruff check .` or `flake8`
+- **Formatting**: `ruff format --check .` or `black --check .`
+- **Import validation**: `mypy` with `--strict` or `--disallow-untyped-defs` catches missing type annotations
+- **Module export validation**: `__all__` lists in `__init__.py` match spec's public API
+
+## Testing
+
+- **Framework**: pytest (with `conftest.py` for fixtures)
+- **Fixtures**: Define in `conftest.py` at appropriate scope (session, module, function)
+- **Mocking**: `unittest.mock.patch`, `monkeypatch` fixture, or `pytest-mock`
+- **Coverage**: `pytest-cov` with `--cov=src/` flag
+- **Test file location**: `tests/` directory mirroring `src/` structure, or co-located `test_*.py` files
+- **Async testing**: `pytest-asyncio` for async function tests
+- **Type testing**: Runtime checks with `isinstance()`, static checks with `reveal_type()`
+
+## Common Frameworks
+
+| Category | Options |
+|----------|---------|
+| Web (async) | FastAPI, Starlette, Litestar |
+| Web (sync) | Django, Flask |
+| Database ORM | SQLAlchemy, Django ORM, SQLModel, Tortoise ORM |
+| Migrations | Alembic (SQLAlchemy), Django migrations |
+| Validation | Pydantic, attrs, marshmallow |
+| Task queues | Celery, Dramatiq, Huey, ARQ |
+| CLI | Click, Typer, argparse |
+| HTTP client | httpx, aiohttp, requests |
+
+## Example: Project-Level Override
+
+Create `.claude/references/stack-decisions.md` in your project root:
+
+```markdown
+# Stack Decisions
+
+## Runtime & Build
+- Python 3.12 with uv for package management
+- src/ layout with pyproject.toml
+
+## Backend
+- FastAPI for HTTP framework
+- SQLAlchemy 2.0 with PostgreSQL (async)
+- Pydantic v2 for validation and serialization
+
+## Testing
+- pytest with pytest-asyncio
+- Factory Boy for test fixtures
+- Coverage target: 90%
+
+## Conventions
+- Google-style docstrings
+- ruff for linting and formatting
+- mypy with --strict for type checking
+- __all__ exports in every __init__.py
+```