@gtrabanco/pi-agentic-workflow 0.13.2 → 0.14.0

package/skills/review-spec/references/CHECKS.md

@@ -1,108 +0,0 @@
-## Snapshot, prompt, and Product checks
-
-Run in this order: build the snapshot, then falsify, then check. Nothing below
-writes to the reviewed artifact.
-
-### 1. Build the snapshot (exact bytes, one revision)
-
-```bash
-git rev-parse HEAD                       # sourceRevision — one value for the whole review
-```
-
-Construct `PreExecutionArtifactSnapshot v1` (`agentic-workflow/
-pre-execution-artifact-snapshot@1`) over the bytes just read. The authoritative
-validator is `@gtrabanco/agentic-workflow-schema`'s
-`validatePreExecutionArtifactSnapshotV1`; the generated JSON Schema is a
-structural projection, never the authority. Where that package is unavailable,
-record the same fields by hand and state `validated: manual` in the receipt note.
-
-A SPEC-stage snapshot is deliberately narrow:
-
-| Field | Value for this stage |
-|---|---|
-| `stage` | `spec` |
-| `unitKind` | `feature` (a `fix` unit is refused here — no Product half) |
-| `unitId` | the roadmap unit id, e.g. `28-evidence-grounded-spec-plan-review` |
-| `sourceRevision` | the exact revision read above |
-| `artifactRevisionId` | the author's current revision id from the handoff |
-| `artifacts` | **exactly one row**: `kind: spec`, `path` normalized repo-relative, `selector: spec-product-v1`, `byteLength`, lowercase SHA-256 `digest` |
-| `parentSpecSnapshotDigest` | `null` — a SPEC snapshot roots its own lineage |
-| `contexts` | each authoritative source actually consulted: `governing-issue`, `normalized-repository-state`, `architectural-invariants`, `dependency-unit`, `project-guide` — `present` with its exact digest, or `absent` with `null`. The roadmap row is read as routing data and deliberately unbound: the shared `ROADMAP.md` ledger moves for reasons this unit never reviewed (other units' rows, the status machine's own sanctioned writes) |
-
-`spec-product-v1` selects the title, `## Goal`, `## Branch`, `## Size`,
-`## Dependencies`, the whole Product half, and `## Design status` — never the
-empty or future Engineering half, so planning writes cannot invalidate this
-review by themselves. Contexts are all-or-nothing on purpose: "I did not look"
-is not representable, so an unread authority must appear as `absent` and is then
-visible to whoever reads the receipt.
-
-Ordering is normative, not cosmetic: artifact rows sort by UTF-8 path bytes,
-context rows by `kind` then `identifier`, and each `(kind, identifier)` context
-appears once. Duplicate kinds, out-of-order rows, or extra artifact rows are
-contract failures, not style.
-
-Then build the snapshot with the recipe owner —
-`pre-execution-review`'s [`SKILL.md`](<../../pre-execution-review/SKILL.md>) →
-SNAPSHOT reference: `bun scripts/pre-execution-snapshot.mjs build --stage spec
---unit <unitId>` (canonical serializer: sorted keys, context rows ordered by kind
-then identifier, UTF-8, lowercase SHA-256). The digest is stdout's first line, so
-this recipe writes no file; `--json` is in-repository only. Paste the digest it
-prints. Every verdict below is bound to that digest, and a refused build
-(partial binding) ends this turn in the refusal form [`OUTPUT.md`](OUTPUT.md) fixes —
-`Snapshot: refused` beside the builder's own code, never a hand-computed substitute.
-
-### 2. Clean-context falsification prompt
-
-Read the snapshot's Product bytes as if the document were adversarial, then
-answer, in writing, before checking anything:
-
-```text
-FALSIFICATION — <unitId> @ <sourceRevision short>
-- Name 3 specific product decisions in this half that a hostile reader could
-  call invented rather than recorded: <section/row pointers or "none found">
-- Name the user outcome the SPEC promises that has no observable check: <row>
-- Name one role the matrix leaves unspecified for a capability it does list:
-  <row or "none">
-- What would have to be true in the repository for this half to be wrong, and is
-  it true? <evidence pointer>
-- Verdict stance before checking: <CONFIRMED-GAPS | NO-CONFIRMED-GAPS>
-```
-
-The point is to try to break the document, not to summarize it. A gap this pass
-confirms is a finding; a suspicion it cannot evidence is not.
-
-### 3. Product checks (fixed list — one row each, in order)
-
-| # | Check | PASS only if |
-|---|---|---|
-| C1 | Outcome ownership | the user outcome each in-scope item produces is stated and observable, not "improve X" |
-| C2 | Actors and roles | every actor that can trigger or be affected is named, and the role matrix covers every inventory role per capability with no unlisted role |
-| C3 | Entity closure | every entity introduced or touched resolves CRUD + state transitions to UI/API/test or an explicit `n/a: <reason>`; zero blank rows |
-| C4 | Limits and failure states | size/failure/empty/concurrency limits are stated or explicitly out of scope; each named failure state has a resolution |
-| C5 | Scope and non-goals | every out-of-scope bullet names an owner or a non-goal; nothing is excluded by silence |
-| C6 | Integration closure | one resolved row per subsystem of the derived capability inventory; none skipped; the inventory is recorded when `docs/CAPABILITIES.md` is absent |
-| C7 | Expectation sweep | ≥ 10 rows (M/L) / ≥ 5 (XS/S), each forced to in-scope/out-of-scope/deferred with a pointer |
-| C8 | Acceptance objectivity | every criterion is objective and labelled command-verified or read-verified, and every in-scope bullet maps to ≥ 1 criterion |
-| C9 | Internal contradiction | no two sections of the half assert incompatible behaviour, counts, or ownership |
-| C10 | Repository contradiction | the half's claims about existing surfaces match what is in the repository now (cited `path:line`, roadmap row, or frozen ledger fact) |
-| C11 | Evidence integrity | material claims resolve to `proven`/`decision` rows that are `current`; every `unknown` names an owner and next evidence; no `drifted`/`stale` row survives |
-| C12 | Open product choices | `Deferred decisions` is `none`, or each open item is genuinely product-owned and flagged for the human |
-| C13 | Engineering leakage | the Product half pre-fills no architecture, phases, tasks, or validators (that is the Plan stage's authority) |
-| C14 | Obligation containment | no current-unit obligation is exported to a future issue or "later" — the unit's own scope carries it |
-
-Every row gets exactly one result: `pass`, `finding`, or `n/a: <reason>`. `n/a`
-requires a reason that does not contradict scope (an accessibility row is `n/a`
-when no UI exists; "skipped because large" is not `n/a`).
-
-### 4. Assemble findings
-
-Each finding is one row of the receipt's `findings` array: stable `id`,
-`severity` (`info | low | medium | high | critical`), `class` (`product | plan |
-source | environment | runtime`), `claim` (what is wrong, with the section
-pointer), `evidenceRefs` (≥ 1 — a finding without evidence is a hunch and gets
-dropped), `verification` (`verified | unverified`), `resolution` (`open` on
-emission). Material = `medium` and above; a `low` row is a persisted report-note
-the stage author resolves without a re-review, and `info` is immaterial.
-Deflating a real defect below the `medium` minimum to unblock a pass is itself a
-finding; a `PASS` may not carry an open or
-unverified material row.

package/skills/review-spec/references/OUTPUT.md

@@ -1,160 +0,0 @@
-## Verdicts, receipt, and routes
-
-### Persist the receipt first, then report
-
-Append the receipt to the unit's `docs/features/<NN>-<slug>/progress.md` **and
-each finding row to the unit's `planning-findings.md`** with
-`stage: spec` (ledger contract: `pre-execution-review/references/LEDGERS.md`);
-create the file from that contract when the unit has none. A findings ledger the
-reviewer cannot write is not a ledger. Any later write to a reviewed artifact
-rotates `artifactRevisionId` and makes this receipt stale — that is the contract
-working, not a mistake. When a missing or stale receipt is the reason for re-entry,
-the re-entry command is the **emitted** `next.continuation` (`rendering` for display):
-quote it, never author exact command tokens.
-
-One `PreExecutionReviewReceipt v1`
-(`agentic-workflow/pre-execution-review-receipt@1`) per review, in a fenced block:
-
-```text
-## Pre-execution review receipt v1 — spec
-- Review: <receipt-id> · Snapshot: <64-hex|refused> · Verdict: <spec-review-pass|spec-review-fail|needs-design>
-- Unit: <unitId> · Stage: spec · Unit kind: <feature|fix> · Parent: null
-- Source revision: <40-hex> · Artifact revision: <artifactRevisionId>
-- Reviewer: <id> · Session: <id> · Role: reviewer · Author: <id>
-- Author exclusion: <enforced|not-enforceable> · Context clean: <true|false>
-- Model diversity: <same-model|cross-model|not-applicable> · Policy: <policyVersion>
-- Started/finished: <UTC>/<UTC> · Findings: <n> (material open: <n>)
-```
-
-Fields the runtime can enforce but a manual review must still state:
-`contextClean`, `authorExclusion`, `modelDiversity`. If context cleanliness is
-false or the reviewer identity equals the author's under an enforced exclusion,
-a PASS is not emit-able — return `SPEC-REVIEW-FAIL` and name the reason.
-
-A `Snapshot:` line carries the digest the builder printed, or the one form a refused
-build may take — `refused`, with the builder's own code beside it, never a value
-computed here instead:
-
-```text
-- Snapshot: refused · Build: refused (<the reason code the builder printed>)
-```
-
-Write that pair in place of the `Snapshot:` line, end the turn with this stage's FAIL
-verdict, and file one finding row per refused artifact carrying its code verbatim: the
-checks bind to a snapshot, so with no snapshot none of them ran. `SNAPSHOT.md` owns why
-a refusal prints no digest and what a consumer then reads this receipt as.
-
-**Self-check (`verify --stage spec …`, POLICY §8).** In the same act as appending the
-receipt, run the recipe owner's re-verify for this stage and paste the sensor's JSON
-answer beside the verdict block before reporting:
-
-```bash
-bun scripts/pre-execution-snapshot.mjs verify --stage spec --unit <NN-slug> --dir docs/features/<NN>-<slug> --unit-kind <feature|fix>
-```
-
-A digest-bound receipt requires `structural.fresh: true` (and, for a PASS verdict,
-`current: true`); `exit 3` (`missing-receipt-snapshot`) or a digest-bound
-`structural.fresh: false` means the mark did not land — fix the write and re-run, the
-verdict is not emit-able in this turn. A `Snapshot: refused` receipt's
-`missing-receipt-snapshot` answer is its sanctioned form. A verdict block printed
-without the pasted self-check output is a contract defect — chat-only is
-`missing-receipt-snapshot` to every consumer.
-
-### Verdict blocks — return exactly one
-
-```text
-SPEC-REVIEW-PASS — <NN-slug>
-- Snapshot: <digest> · Artifact revision: <artifactRevisionId> · Checks: 14/14
-- Material findings open: 0 · Read-only: no reviewed artifact modified
-- Authority: planning may bind this receipt as its Product parent
-```
-
-```text
-SPEC-REVIEW-FAIL — <NN-slug> BLOCKED
-- Snapshot: <digest> · Artifact revision: <artifactRevisionId>
-- Failed checks: <Cnn, …>
-- Findings (unioned, one row each):
-  | id | severity | class | check | claim | evidence | verification |
-- Repair owner: `design-feature <NN-slug>` — one batch over this whole set
-```
-
-```text
-NEEDS-DESIGN — <NN-slug>
-- Snapshot: <digest> · Blocking rows: <Cnn / decision id>
-- Missing product choice (product authority only): <one bounded question>
-- Recommended default: <the smallest coherent answer>
-- Downstream: any Plan evidence bound to this unit is now invalid and must be
-  re-reviewed after the answer lands
-```
-
-`NEEDS-DESIGN` when the answer requires inventing product intent, scope, role,
-authority, or user outcome; `SPEC-REVIEW-FAIL` when the half is decidable but
-incomplete, contradictory, or unsupported. Never blend them, and never emit a
-fourth verdict.
-
-### Routes
-
-**Resolution map — the finding's `class` cell names its resolver, and only that
-resolver:** class `product` → `design-feature` (then `/review-spec` re-judges the
-new revision) · class `plan` → `plan-feature` / `plan-fix` re-cuts the plan (then
-`/review-plan` re-judges) · class `source` | `environment` | `runtime` → the
-executor's fold path (`/fold-findings`, then re-run `/review-change`).
-**`fold-findings` never repairs a planning artifact**, and a planning finding is
-never resolved by patching the artifact during review — folding repairs source,
-not authority.
-
-| Verdict | Who repairs | What happens next |
-|---|---|---|
-| `SPEC-REVIEW-PASS` | nobody | `/plan-feature <NN-slug>` binds this receipt + exact snapshot digest |
-| `SPEC-REVIEW-FAIL` | `design-feature` (the author) | one root-caused repair batch → new revision → next cycle (default re-review; a recorded wording-only batch skips it) |
-| `NEEDS-DESIGN` | the human, through `design-feature` | dated `## Amendments`/`Product decisions` entry → new revision → next cycle |
-
-A finding whose `class` is `plan`, `source`, `environment`, or `runtime` does not
-become work here: record it, keep it open, and route it to its owner (`review-plan`
-for plan defects, the executor for source defects). This skill repairs nothing and
-schedules nothing.
-
-Repeating this review follows the no-progress and convergence rules in
-`pre-execution-review/references/POLICY.md` §4: a repeat needs a
-changed snapshot or a named falsifiable question plus a new evidence route, and
-a second consecutive repair/re-review cycle prints `CONVERGENCE-ANOMALY` before
-any further edit. A third cycle never starts without explicit user instruction:
-the orchestrator's `stop-review-loop-cap` refusal stops the invocation and names
-`design-feature` as the human route, and a PASS resets the count. A
-`design-feature` repair turn re-reads the union of open findings
-from `planning-findings.md`, not just the newest receipt, so nothing recorded here
-is ever lost between cycles.
-
-### Skill-specific turn-contract boxes
-
-```text
-✓ Snapshot digest computed from one revision and pasted; no mixed-revision bytes
-✓ All 14 Product checks resolved to pass / finding / n/a with a reason
-✓ One verdict block returned verbatim from the closed set
-✓ RUN `verify --stage spec` for this stage in-turn, JSON pasted beside the block;
-  `structural.fresh: true` (+ `current: true` on PASS) — `exit 3`/`structural.fresh: false` means
-  the mark did not land, fix and re-run, verdict not emit-able; `exit 4`/`current: false` means
-  a verdict persisted but not a PASS — the verdict itself is the emit result, route per verdict
-✓ `git status --porcelain` shows no change to any reviewed artifact
-✓ Closing `→ Next:` printed as the absolute last output
-```
-
-### Closing recommendation
-
-On PASS:
-
-```
-→ Next: /plan-feature <NN-slug> — Product half reviewed; the plan binds this receipt
-  · design changed underneath → re-run /review-spec <NN-slug> first
-  · recurring closure gaps across units → /product-audit (a systemic pattern, not one SPEC)
-```
-
-On FAIL or NEEDS-DESIGN, name every finding id once, in order, joined with ` + `:
-
-```
-→ Next: /design-feature <NN-slug> "<instruction>" — one repair batch for F1 + F2 + F4,
-    then /review-spec <NN-slug> judges the new artifact revision
-  · a third cycle → explicit user instruction first; the decider refuses it (`stop-review-loop-cap`) and names design-feature
-  · a product choice is missing → answer it in the instruction; nothing here chooses for you
-  · finding class is plan/source/environment/runtime → route to its owner, do not edit the SPEC
-```

package/skills/ship-roadmap/SKILL.md

@@ -1,120 +0,0 @@
----
-name: ship-roadmap
-user-invocable: true
-version: 5.2.2
-author: "Gabriel Trabanco <1969593+gtrabanco@users.noreply.github.com>"
-license: MIT
-argument-hint: "[--fullauto] | --continue [--fullauto]"
-description: >
-  Found or continue a roadmap autopilot one stage per invocation. Default:
-  human merge. --fullauto is invocation-scoped and uses the transient wrapper
-  only after a fresh audit. Triggers: "ship-roadmap", "ship the roadmap",
-  "autopilot this project".
----
-
-# Ship the roadmap (autopilot)
-
-Found once, then run the driver-fired loop (Claude `/loop`, external driver, or
-manual re-invocation): plan, implement, review, open and optionally merge one PR
-per roadmap unit. After the roadmap, sweep existing issues, ship fix-now work,
-report residue as proposals (never create backlog automatically), and print the
-final report. Use strong tiers for judgment, cheap tiers for typing, and humans
-at expensive-to-undo decisions.
-
-`ship-roadmap` is the conductor of the loop. It emits its native fixed `SHIP:`
-banner and closing `→ Next:` block; the package-owned machine-result profiles
-apply to the worker and sensor skills that a driver invokes inside the loop.
-
-## Turn contract — verify before ending the turn
-
-```
-✓ Exactly ONE stage advanced (or a terminal banner printed) and ONE line appended to the run log
-✓ Nothing was merged outside the active --fullauto wrapper; direct merge
-  commands remained blocked and no authorization survived the iteration
-✓ Artifact language: explicit user instruction > the project's declared docs language > English. The CONVERSATION language never decides — a Spanish prompt still produces English PRs/issues/commits/SPECs unless one of the first two says otherwise
-✓ The closing `→ Next:` block is printed as the ABSOLUTE last output
-```
-
-Any unchecked box means the turn is not done.
-
-## When to use
-
-Use for a locked roadmap with supervision at merge/end points. For one feature,
-one bug, or exploratory work use the manual planning/execution flow instead.
-
-## Step 0 — Discover the project (always first)
-
-Read before acting: `CLAUDE.md`/`AGENTS.md` Workflow conventions, documentation
-map, `docs/features/ROADMAP.md`, fix index, architecture doc, and `.github/`
-templates. Then establish:
-
-1. **Substrate:** if the guide, map, roadmap and fix index exist, skip founding
-   and confirm their answers; otherwise founding creates missing pieces.
-2. **Skills:** verify `plan-feature`, `execute-phase`, `review-change`, and
-   `audit-pr` are installed and record their directory for worker prompts. If
-   absent, stop with `npx skills add gtrabanco/agentic-workflow`. With
-   `--fullauto`, also require executable `.agentic-workflow/hooks/fullauto-merge.sh`
-   and its platform guard; otherwise route to `init-workspace`, never direct merge.
-3. **Run:** existing `docs/features/SHIP_DECISIONS.md` or an open
-   `docs/ship-founding` PR means resume with `--continue`; bare invocation reports
-   status instead of founding again.
-4. **Shape:** greenfield/existing, branch, and dirty tree; unexplained dirty
-   default branch stops (never clean it silently).
-
-
-## Progressive loading — select the invocation route
-
-The allowlist is exactly the linked paths below. Never invent another reference.
-Every route starts with [guardrails](references/GUARDRAILS.md), then loads only
-its matching row:
-
-**Hard rule for `--continue` at AUDIT:** LOAD exactly, in this order,
-`references/GUARDRAILS.md`, `references/RECOVERY_AND_SELECTION.md`,
-`references/STOP_CONDITIONS.md`, `references/ADVANCE.md`,
-`references/MODEL_ROUTING.md`, and
-`references/AUDIT_AND_MERGE.md`; after the stage, load
-`references/CLOSEOUT_AND_LOG.md`. When the run is not terminal and all named
-primitives exist, every other reference is forbidden for that turn.
-
-| Condition now | LOAD complete route in this order | SKIP now |
-|---|---|---|
-| Found or inspect a run, no `--continue` (default mode or greenfield `--fullauto`) | [guardrails](references/GUARDRAILS.md) → [founding](references/FOUNDING.md) | recovery, stop conditions, advance, model routing, audit/merge, terminal report, portability |
-| Existing-repo founding with `--fullauto` | [guardrails](references/GUARDRAILS.md) → [founding](references/FOUNDING.md) → [audit and merge policy](references/AUDIT_AND_MERGE.md) | recovery, stop conditions, advance, model routing, terminal report, portability |
-| Continue one non-AUDIT iteration | [guardrails](references/GUARDRAILS.md) → [recovery and selection](references/RECOVERY_AND_SELECTION.md) → [stop conditions](references/STOP_CONDITIONS.md) → [advance](references/ADVANCE.md) → [model routing](references/MODEL_ROUTING.md) before stage execution → [closeout and log](references/CLOSEOUT_AND_LOG.md) after it | founding, audit/merge, terminal report, portability |
-| Continue an AUDIT/fullauto iteration | [guardrails](references/GUARDRAILS.md) → [recovery and selection](references/RECOVERY_AND_SELECTION.md) → [stop conditions](references/STOP_CONDITIONS.md) → [advance](references/ADVANCE.md) → [model routing](references/MODEL_ROUTING.md) → [audit and merge policy](references/AUDIT_AND_MERGE.md) before the AUDIT stage → [closeout and log](references/CLOSEOUT_AND_LOG.md) after it | founding, terminal report, portability |
-| Terminal stop/report | the active row above, then [terminal report](references/TERMINAL_REPORT.md) | unrelated rows |
-| A named platform primitive is absent | the active row above, then [portability](references/PORTABILITY.md) | unrelated rows |
-
-Do not load terminal reporting before terminal state or portability when all
-primitives exist. Model routing precedes every stage; audit/merge precedes every
-AUDIT stage, including non-`--fullauto` runs.
-
-Selected resources are one hop from this file. Fixed banners, transitions, floor
-checks and output blocks are normative; an unreadable required resource stops the
-run—never improvise from an older run.
-
-## Portability
-
-The workflow is driver-neutral. Use the exact [portability](references/PORTABILITY.md)
-fallback only when a primitive is unavailable; keep stage order and safety floors.
-
-## Relationship to other skills
-
-| Relation | Skills/policy |
-|---|---|
-| Compose (same/lower tier) | `init-workspace`; JIT `design-feature` + `plan-feature-scaffold`; `plan-feature`; the review→fold manual path (`/review-change` → `/fold-findings` on `REVIEW-FAIL` → re-run `/review-change`); verdict-only `audit-pr`; `audit-docs`. |
-| Cheap workers | `execute-phase` (fresh context/phase), mechanical folds, audit-blocker fixes; use the validated worker model. |
-| Human hand-off | Default merges, `product-audit` (higher effort), and report issue batches via `triage-issue`. |
-| Sibling | `workflow-status` supplies the strict sensor result; worker skills use the package-owned output profiles, while the conductor keeps its native `SHIP:` turn contract. |
-
-Manual feature-by-feature flow remains the default; this skill packages it with
-the human at its edges.
-
-## Done when
-
-- A terminal banner and final report exist with an open PR; roadmap statuses are
-  true; every PR is merged, open/audited, or parked with a reason. `SHIP: COMPLETE`
-  also accounts for the issue sweep and reports residue as proposals.
-- Locked answers, iteration evidence, outcomes and recommendations are traceable
-  in `SHIP_DECISIONS.md`, the run log and report; the report states exact next
-  human actions (merges, triage, proposals, product-audit timing).

package/skills/ship-roadmap/references/ADVANCE.md

@@ -1,117 +0,0 @@
-## Advance exactly one stage
-
-4. **ADVANCE exactly one stage:**
-   - **DESIGN (mid-run `idea`/`defined` unit only)** — compose `design-feature`
-     in-turn (equal tier, opus/high — within the ≥ rule already stated for
-     founding), **deriving the product half strictly from the locked
-     `SHIP_DECISIONS.md` record — no new questions, ever** (the "no further
-     questions after the interview" contract this skill already enforces for
-     every other stage applies here identically). Walk capability closure
-     from what rounds 2–4 already answered for this feature; stamp `## Design
-     status: designed` and promote the roadmap row `idea → defined` on
-     success. Then compose `plan-feature-scaffold` in the same iteration to
-     promote `defined → planned` (both writes are the same JIT pass — a
-     feature never sits mid-promotion between iterations). **Undesignable
-     from the locked record** (the feature as scoped contradicts a locked
-     decision, or needs an answer rounds 2–4 never covered) → do **not**
-     guess and do **not** ask: emit `NEEDS_INPUT`, **park the unit** with the
-     specific gap recorded (mirrors a red-gate park — see Stop conditions),
-     and SELECT continues with the next startable unit this same run (or ends
-     the iteration per the capacity guard if none remain). A parked
-     undesignable unit is picked back up only by a human answering the
-     recorded question and re-running `/design-feature <slug> "<answer>"`
-     directly — the autopilot never re-asks it.
-   - **REVIEW-SPEC** (only between DESIGN and PLAN) — compose `review-spec` in a
-     clean context at the routed tier (opus/high), never in the turn that wrote the
-     product half. `SPEC-REVIEW-PASS` releases the unit into PLAN. A FAIL whose
-     findings are common-root-cause or wording-only returns to the same unit's
-     author for one root-caused repair batch, then a fresh review. `NEEDS-DESIGN`
-     means a product choice is open that this run's locked record cannot answer:
-     **park the unit** with the exact question (`NEEDS_INPUT`, same shape as the
-     undesignable park above) — the autopilot never answers a product question
-     itself, and `SELECT` continues with the next startable unit.
-   - **PLAN** — compose `plan-feature` in-turn via its scoped path (equal
-     tier). Every unit reaching PLAN holds a current `SPEC-REVIEW-PASS` (REVIEW-SPEC
-     ran first, or the unit was already planned before this gate existed and its
-     own Product receipt is current), so `plan-feature`'s PRODUCT-REVIEW gate passes
-     here. The interview path is **forbidden** mid-run:
-     SPEC gaps are resolved silently from the decision record and logged. JIT
-     planning that reveals the feature's premise is wrong (obsolete, absorbed,
-     impossible on this stack) → mark it blocked with the contradiction
-     recorded; never re-ask.
-   - **REVIEW-PLAN** (only between PLAN and EXECUTE) — compose `review-plan` in a
-     clean context at the routed tier over the plan the previous stage just froze.
-     `PLAN-REVIEW-PASS` releases EXECUTE. A FAIL routes by root cause: plan-local
-     (bad phase cut, blank validator, ledger drift) → root-caused re-cut by the
-     planning author and a review; product-rooted or an assumption this record
-     cannot settle → PLAN-REVIEW-FAIL with class: product → design-feature. A second local cycle
-     that changes nothing stops editing and reports `CONVERGENCE-ANOMALY` instead of
-     burning a third budget. **No stage between PLAN and EXECUTE may create a forge
-     issue or defer an obligation to one** — an unmet obligation fails this stage, it
-     is never exported.
-   - **EXECUTE** — run each unfinished **implementation phase** in a **fresh cheap-tier context**: on Claude
-     Code, spawn one subagent per phase with `model: sonnet` (the override is
-     the only mechanism that runs *below* the conductor's turn tier); on an
-     agent without subagents, the equivalent is one headless invocation per
-     phase driven from outside (see `docs/workflow/ORCHESTRATION.md`), or —
-     last resort — executing the phase in THIS turn while noting in the run
-     log that it ran at the conductor's tier. Whatever the mechanism, the
-     phase executor is instructed to read the **installed `execute-phase`
-     SKILL.md first** (at the skills directory
-     located in Step 0 and recorded in the decision record — e.g.
-     `.claude/skills/execute-phase/SKILL.md` in Claude Code) and follow it for
-     exactly one explicit phase: tests-first where it
-     applies, gate green, one commit, per-phase docs. Two autopilot overrides
-     to its recipe: (a) **never ask** — SPEC ambiguity is resolved from the
-     committed decision record with the most conservative reading, and the
-     assumption is surfaced in the phase docs so the conductor logs it;
-     (b) the **P1 planning commit also carries `ROADMAP.md`** (the feature's
-     `in-progress` flip rides it; the **`done` flip rides the PR-stage commit**
-     when the PR opens; any flips left at run end ride the report commit).
-     Stop before the literal final `Hardening & PR` phase: PR owns that explicit
-     phase so close-out has one owner. Never bundle phases into one worker.
-   - **REVIEW** — compose the review→fold path (equal tier) once: `/review-change`, then `/fold-findings` (on `REVIEW-FAIL`), then re-run `/review-change`. It reuses a current exact-SHA receipt or runs `review-change`
-     context-clean, batches compatible fixes through `fold-findings`, and
-     re-reviews only changed HEADs. Default correction budget is two; unchanged
-     evidence stops NO-PROGRESS. L/sensitive features
-     forward `--adversarial 2` (security/auth: `3`) as the unattended floor;
-     other units use one final reviewer. There are no intermediate phase
-     reviews in autopilot: phase gates + frozen acceptance guard execution,
-     and the independent final loop judges one complete candidate. Independent
-     future work remains proposals; no review/fold stage creates issues.
-   - **PR** — run the unit's explicit final `Hardening & PR` phase through one
-     fresh cheap-tier `execute-phase` worker. That canonical close-out flips the
-     feature to `done` (built, not merged), pushes, creates the PR with `Closes
-     #N` where issue-born, prints its URL, links it from the roadmap, commits the
-     link, and pushes. Reconcile an already-open matching PR idempotently; never
-     create a second one. The stage is incomplete until the row carries its PR
-     link and the branch is clean/current.
-   - **AUDIT** — compose `audit-pr` in-turn (equal tier); bind the verdict to
-     the PR's head SHA in the run log, and **print the PR's full URL next to
-     the verdict in the iteration output** (the human merging works from the
-     chat, not from a CI monitor). MERGE-READY → default mode logs and
-     moves on; `--fullauto` treats `audit-pr` as verdict/comment-only, checks
-     the floors, **records the merge intent in the run log first**, then calls
-     `.agentic-workflow/hooks/fullauto-merge.sh` with only the PR number and
-     run id. The wrapper derives and verifies head, base, decision, and audit
-     evidence from the forge. Never invoke `gh pr merge` directly.
-     BLOCKED → in-scope blockers go to a
-     cheap-tier worker next iteration (max 2 audit cycles, then the feature is
-     parked and the loop moves on); the fixer's cycle ends committed AND
-     pushed (step 5), so the re-audit judges the real branch.
-
-   Fix units take the same pair in miniature: **plan-fix → REVIEW-PLAN → EXECUTE
-   (`--fix`)** — a fix has no Product hop to wait on (D6), so its plan review is the
-   only pre-execution gate it can have. The stage sequence is per-feature and size-dependent — always **one stage
-   per iteration**: a feature starting at `idea`/`defined` gets a DESIGN stage
-   first; one already `planned` (including the founding-scaffolded feature 01)
-   goes to its missing review stage, and skips to EXECUTE only when a current
-   `PLAN-REVIEW-PASS` is bound to its bytes. Every size follows
-   **[DESIGN → REVIEW-SPEC] → PLAN → REVIEW-PLAN → EXECUTE**
-   (implementation phases, fresh cheap worker per phase) → PR (explicit
-   `Hardening & PR`) → REVIEW (bounded final loop) → AUDIT. Risk changes final
-   review strength, not phase cadence. The two review stages are the pre-execution
-   pair: they judge documents in a clean context and are **not** the post-code
-   REVIEW loop, which stays exactly as described below. Merge policy is unchanged —
-   the human (or the `--fullauto` wrapper behind its recorded floors) still owns the
-   merge, and neither review stage may merge, close, or file anything.

package/skills/ship-roadmap/references/AUDIT_AND_MERGE.md

@@ -1,64 +0,0 @@
-### Merge policy
-
-**Default — the human merges.** The autopilot opens PRs and never merges. It
-continues with the next feature whose dependencies are all merged (new branches
-always cut from the freshly pulled default branch); when everything remaining
-waits on human merges, it stops with `SHIP: BLOCKED` + the unblock map. After
-merging, re-run the same launch command (`/loop /ship-roadmap --continue`, plus
-`--fullauto` on fullauto runs) — recovery records the merges (the rows are already
-`done` from PR-open), unblocks the dependents, and resumes.
-
-**`--fullauto` — dual-keyed.** Auto-merge requires a fresh SHA-bound
-`audit-pr:merge-ready` comment and `merge: fullauto` in the decision file at
-the PR's current head — stale or caller-supplied local evidence can never
-enable it. The **first
-feature PR of a greenfield run is always human-merged** (calibration: inspect
-one complete artifact — code, tests, docs, review trail — before delegating).
-
-This AUDIT stage is the **sole automated merge authority**. Authorization lasts
-for this invocation and this merge attempt only:
-
-1. `audit-pr` returns a fresh SHA-bound MERGE-READY verdict and never merges.
-2. Record merge intent in `.ship-run.log` before execution.
-3. Invoke exactly:
-
-   ```sh
-   .agentic-workflow/hooks/fullauto-merge.sh \
-     --pr <number> --run-id <run-id>
-   ```
-
-   The wrapper derives the PR head and forge default base itself. A project
-   with no forge-reported checks fails closed.
-4. The wrapper re-checks the current PR head, forge default base, SHA-bound
-   audit comment, decision file fetched from that head, clean/synchronized
-   branch, mergeability, and CI evidence. It
-   creates a namespaced marker under the git common directory only after those
-   checks, installs cleanup with `trap`, and removes the marker on success,
-   failure, signal, or already-merged recovery.
-5. After the forge reports MERGED, the wrapper posts one idempotent comment
-   marked `<!-- agentic-workflow:automerge head=<sha> -->`, containing the run,
-   audited head, and merge commit. That PR comment is the durable automerge log;
-   no repository log grows.
-
-Direct `gh pr merge`, `glab mr merge`, `git merge`, and forge-API merge calls
-remain blocked by the command guard at all times. There is no `.automerge` file
-and no persistent exception for a later manual `audit-pr` or shell session.
-
-Non-negotiable floors, evaluated fresh immediately before every merge —
-**fail-closed: a floor that cannot be evaluated counts as breached**:
-
-1. **Never merge red** — re-verify CI status via the forge CLI at merge time;
-   the audit verdict is evidence, fresh green CI is the precondition. In a
-   no-CI project the accepted evidence is a **fresh local verification-gate run
-   on the PR's exact head SHA**, recorded in the run log — without one of the
-   two, the floor is unevaluable and therefore breached.
-2. **Verdict freshness** — MERGE-READY must reference the PR's current head
-   SHA; any later commit forces a re-audit.
-3. **Sensitive-area pause** — PRs touching the declared sensitive set are
-   never auto-merged; the run continues around them and the report flags them.
-4. **Destructive-operation pause** — data-deleting or schema-destructive
-   diffs pause even when not in the declared set (users forget to declare it).
-5. **Forge refusal is a signal** — never bypass branch protection, never
-   force-push, never merge to anything but the default branch; a refused merge
-   parks the PR and is reported.
-6. **Budget floors still bind** — no cap is exempted by `--fullauto`.

package/skills/ship-roadmap/references/CLOSEOUT_AND_LOG.md

@@ -1,27 +0,0 @@
-## Close out and log the iteration
-
-5. **CLEAN CLOSE-OUT — verify before logging the stage complete.** A stage
-   only counts as advanced when the conductor has RUN and checked, on the
-   unit's branch: `git status --porcelain` → empty (no tracked modification
-   left behind — **docs included**: progress/testing/known-issues/roadmap
-   edits ride the stage's commit, never linger), and — once the unit's PR
-   exists — `git status -sb` after `git fetch` → not ahead of the remote
-   (every commit pushed; the PR and CI must see what was actually done).
-   A subagent that "finished" but left the tree dirty or the branch unpushed
-   did NOT finish: the conductor commits/pushes the remainder itself (same
-   stage, same iteration) or marks the stage partial. This check is
-   unconditional for REVIEW-SPEC/REVIEW-PLAN repairs, EXECUTE, REVIEW fix cycles,
-   PR, and AUDIT fix cycles.
-6. **LOG** one line to `.ship-run.log`; print `→ Next: <unit> (CONTINUE)` (the
-   canonical next-step shape; `CONTINUE` stays the loop's keep-going signal).
-   **Say WHY the turn is ending** — one explicit
-   line before the `→ Next:` block, always one of: "iteration complete — one
-   stage advanced (normal; re-invoke to continue)", "parked <unit>: <exact cap
-   hit — red-gate retries / review ping-pong / audit ping-pong / 3 partials /
-   planning contradiction>", or the terminal banner's reason. A turn ending
-   silently reads as a crash on agents without `/loop` — never leave the stop
-   unexplained.
-
-**Capacity guard:** an iteration that cannot finish its stage in one turn
-(e.g. an oversized review) writes a partial-stage marker and ends cleanly;
-three consecutive partials on the same stage parks the feature as blocked.