@hanzlaa/rcode 2.1.0

package/rihal/workflows/secure-phase.md

@@ -0,0 +1,196 @@
+<purpose>
+Verify threat mitigations for a completed phase. Confirm SPRINT.md threat register dispositions are resolved. Update SECURITY.md.
+</purpose>
+
+<required_reading>
+@.rihal/references/ui-brand.md
+</required_reading>
+
+<available_agent_types>
+Valid Rihal subagent types (use exact names — do not fall back to 'general-purpose'):
+- rihal-security-auditor — Verifies threat mitigation coverage
+</available_agent_types>
+
+## Step 0 — Usage check
+
+If `$ARGUMENTS` is empty or contains only `--help` or `-h`:
+- Print the usage block below
+- STOP — do not proceed
+
+**Usage:**
+```
+/rihal:secure-phase <phase>
+```
+
+**Examples:**
+```
+/rihal:secure-phase 01
+/rihal:secure-phase 02.1
+```
+
+<process>
+
+## 0. Initialize
+
+```bash
+INIT=$(node ".rihal/bin/rihal-tools.cjs" init phase-op "${PHASE_ARG}")
+if [[ "$INIT" == @file:* ]]; then INIT=$(cat "${INIT#@file:}"); fi
+AGENT_SKILLS_AUDITOR=$(node ".rihal/bin/rihal-tools.cjs" agent-skills rihal-security-auditor 2>/dev/null)
+```
+
+Parse: `phase_dir`, `phase_number`, `phase_name`, `phase_slug`, `padded_phase`.
+
+```bash
+AUDITOR_MODEL=$(node ".rihal/bin/rihal-tools.cjs" resolve-model rihal-security-auditor --raw)
+SECURITY_CFG=$(node ".rihal/bin/rihal-tools.cjs" config-get workflow.security_enforcement --raw 2>/dev/null || echo "true")
+```
+
+If `SECURITY_CFG` is `false`: exit with "Security enforcement disabled. Enable via /rihal:settings."
+
+Display banner: `Rihal > SECURE PHASE {N}: {name}`
+
+## 1. Detect Input State
+
+```bash
+SECURITY_FILE=$(ls "${PHASE_DIR}"/*-SECURITY.md 2>/dev/null | head -1)
+PLAN_FILES=$(ls "${PHASE_DIR}"/*-SPRINT.md 2>/dev/null)
+SUMMARY_FILES=$(ls "${PHASE_DIR}"/*-SUMMARY.md 2>/dev/null)
+```
+
+- **State A** (`SECURITY_FILE` non-empty): Audit existing
+- **State B** (`SECURITY_FILE` empty, `PLAN_FILES` and `SUMMARY_FILES` non-empty): Run from artifacts
+- **State C** (`SUMMARY_FILES` empty): Exit — "Phase {N} not executed. Run /rihal:execute {N} first."
+
+## 2. Discovery
+
+### 2a. Read Phase Artifacts
+
+Read SPRINT.md — extract `<threat_model>` block: trust boundaries, STRIDE register (`threat_id`, `category`, `component`, `disposition`, `mitigation_plan`).
+
+### 2b. Read Summary Threat Flags
+
+Read SUMMARY.md — extract `## Threat Flags` entries.
+
+### 2c. Build Threat Register
+
+Per threat: `{ threat_id, category, component, disposition, mitigation_pattern, files_to_check }`
+
+## 3. Threat Classification
+
+Classify each threat:
+
+| Status | Criteria |
+|--------|----------|
+| CLOSED | mitigation found OR accepted risk documented in SECURITY.md OR transfer documented |
+| OPEN | none of the above |
+
+Build: `{ threat_id, category, component, disposition, status, evidence }`
+
+If `threats_open: 0` → skip to Step 6 directly.
+
+## 4. Present Threat Plan
+
+Call AskUserQuestion with threat table and options:
+1. "Verify all open threats" → Step 5
+2. "Accept all open — document in accepted risks log" → add to SECURITY.md accepted risks, set all CLOSED, Step 6
+3. "Cancel" → exit
+
+## 5. Spawn rihal-security-auditor
+
+```
+Task(
+  prompt="Read .rihal/agents/rihal-security-auditor.md for instructions.\n\n" +
+    "<files_to_read>{PLAN, SUMMARY, impl files, SECURITY.md}</files_to_read>" +
+    "<threat_register>{threat register}</threat_register>" +
+    "<config>asvs_level: {SECURITY_ASVS}, block_on: {SECURITY_BLOCK_ON}</config>" +
+    "<constraints>Never modify implementation files. Verify mitigations exist — do not scan for new threats. Escalate implementation gaps.</constraints>" +
+    "${AGENT_SKILLS_AUDITOR}",
+  subagent_type="rihal-security-auditor",
+  model="{AUDITOR_MODEL}",
+  description="Verify threat mitigations for Phase {N}"
+)
+```
+
+Handle return:
+- `## SECURED` → record closures → Step 6
+- `## OPEN_THREATS` → record closed + open, present user with accept/block choice → Step 6
+- `## ESCALATE` → present to user → Step 6
+
+## 6. Write/Update SECURITY.md
+
+**State B (create):**
+1. Read template from `.rihal/templates/SECURITY.md`
+2. Fill: frontmatter, threat register, accepted risks, audit trail
+3. Write to `${PHASE_DIR}/${PADDED_PHASE}-SECURITY.md`
+
+**State A (update):**
+1. Update threat register statuses, append to audit trail:
+
+```markdown
+## Security Audit {date}
+| Metric | Count |
+|--------|-------|
+| Threats found | {N} |
+| Closed | {M} |
+| Open | {K} |
+```
+
+**ENFORCING GATE:** If `threats_open > 0` after all options exhausted (user did not accept, not all verified closed):
+
+```
+Rihal > PHASE {N} SECURITY BLOCKED
+{K} threats open — phase advancement blocked until threats_open: 0
+▶ Fix mitigations then re-run: /rihal:secure-phase {N}
+▶ Or document accepted risks in SECURITY.md and re-run.
+```
+
+Do NOT emit next-phase routing. Stop here.
+
+## 7. Commit
+
+```bash
+node ".rihal/bin/rihal-tools.cjs" commit "docs(phase-${PHASE}): add/update security threat verification"
+```
+
+## 8. Results + Routing
+
+**Secured (threats_open: 0):**
+```
+Rihal > PHASE {N} THREAT-SECURE
+threats_open: 0 — all threats have dispositions.
+▶ /rihal:validate {N}    validate test coverage
+▶ /rihal:verify-work {N}       run UAT
+```
+
+Display `/clear` reminder.
+
+</process>
+
+<success_criteria>
+- [ ] Security enforcement checked — exit if false
+- [ ] Input state detected (A/B/C) — state C exits cleanly
+- [ ] SPRINT.md threat model parsed, register built
+- [ ] SUMMARY.md threat flags incorporated
+- [ ] threats_open: 0 → skip directly to Step 6
+- [ ] User gate with threat table presented
+- [ ] Auditor spawned with complete context
+- [ ] All three return formats (SECURED/OPEN_THREATS/ESCALATE) handled
+- [ ] SECURITY.md created or updated
+- [ ] threats_open > 0 BLOCKS advancement (no next-phase routing emitted)
+- [ ] Results with routing presented on success
+</success_criteria>
+
+## Success Criteria
+
+- [ ] Task completed as requested
+- [ ] Output saved or reported
+- [ ] State updated if necessary
+- [ ] No errors encountered
+
+## On Error
+
+If arguments are invalid, missing files, or subagent fails:
+- Validate inputs match expected format
+- Check that required files exist
+- Retry with clearer arguments or report the specific error to the user
+

package/rihal/workflows/session-report.md

@@ -0,0 +1,187 @@
+# Workflow: rihal:session-report
+
+<purpose>
+Generate a comprehensive session report covering work done, token usage estimation, commits, decisions, blockers, and council sessions. Writes SESSION-REPORT-{date}.md to .planning/ directory.
+</purpose>
+
+
+## Step 0 — Usage check
+
+If `$ARGUMENTS` is empty or contains only `--help` or `-h`:
+
+```
+/rihal:session-report <argument-here>
+```
+
+**Examples:**
+```
+/rihal:session-report example 1
+/rihal:session-report example 2
+```
+
+STOP — do not proceed.
+
+## Step 1 — Check usage
+
+Verify .rihal/state.json exists:
+
+```bash
+test -f .rihal/state.json && echo "exists" || echo "missing"
+```
+
+If missing, print and stop:
+
+```
+No state found. Run /rihal:council or execute a plan to initialize state.
+```
+
+## Step 2 — Read state
+
+```bash
+cat .rihal/state.json
+```
+
+Parse the JSON. Extract:
+
+- `created` — project creation timestamp
+- `updated` — last update timestamp
+- `current_phase` — current phase (or null)
+- `current_plan` — plan number (0-based)
+- `executions` — array of execution records
+- `decisions` — array of decision records
+- `blockers` — array of blocker records
+- `council_sessions` — array of session records
+
+## Step 3 — Compute duration
+
+Calculate time span covered by this session:
+
+- **Start:** First timestamp in state (created, or first session/decision/blocker timestamp)
+- **End:** Last timestamp in state (updated, or last session/decision/blocker timestamp)
+- **Duration:** Human-readable format (e.g. "2 hours 15 minutes", "1 day")
+
+If no timestamps available, use current time as both start/end.
+
+## Step 4 — Count artifacts
+
+List all artifacts in `.planning/`:
+
+```bash
+find .planning -type f \( -name "council-session-*.json" -o -name "*-chain.md" -o -name "*-discuss.md" \) | wc -l
+```
+
+Extract counts:
+- **Council sessions:** count of `council-session-*.json` files
+- **Chains:** count of `*-chain.md` files
+- **Discusses:** count of `*-discuss.md` files
+
+## Step 5 — Estimate token usage
+
+Calculate estimated tokens (note: this is an estimate, not actual measurement):
+
+- **Council sessions:** count × 50,000 tokens (5 agents × 2 rounds × ~5K avg per agent)
+- **Chains:** count × 30,000 tokens (3-5 stages × ~8K avg per stage)
+- **Discusses:** count × 10,000 tokens (single agent, focused conversation)
+- **Execute:** (executions count) × 20,000 tokens (estimation only)
+
+**Total estimate:** sum of above (with disclaimer)
+
+## Step 6 — List commits
+
+Get commits touching rihal paths since state creation:
+
+```bash
+git log --since="$(date -d '$(cat .rihal/state.json | jq -r .created)' '+%Y-%m-%dT%H:%M:%S')" --oneline -- .rihal rihal/ .planning 2>/dev/null || git log --all --oneline -- .rihal rihal/ .planning 2>/dev/null | head -20
+```
+
+Extract commit hashes and subjects. If git errors, report gracefully (project may not be git-based).
+
+## Step 7 — Build report
+
+Write `.planning/SESSION-REPORT-{YYYY-MM-DD-HHmmss}.md` with this structure:
+
+```markdown
+# Session Report — {project_name}
+
+**Period:** {start_date} → {end_date} ({duration})
+
+## Work Summary
+
+- **Current Phase:** {phase or "None started"}
+- **Plan Progress:** {current_plan} / {total_plans}
+- **Council Sessions:** {count}
+- **Chains:** {count}
+- **Discusses:** {count}
+- **Decisions Logged:** {count}
+- **Blockers Identified:** {count} ({open_count} open)
+- **Commits:** {count}
+
+## Estimated Token Usage
+
+**Note:** Token estimates are approximations based on artifact counts.
+
+- Council Sessions: {count} × 50K = {total}K
+- Chains: {count} × 30K = {total}K
+- Discusses: {count} × 10K = {total}K
+- Execute/Deploy: {count} × 20K = {total}K
+- **Total Estimate: {grand_total}K tokens**
+
+## Recent Decisions
+
+{list last 5 decisions, format: "• {decision} — {phase} ({date})"}
+
+{or: "No decisions logged in this session."}
+
+## Open Blockers
+
+{list all unresolved blockers, format: "⚠ {description} — {phase} (added {date})"}
+
+{or: "No open blockers."}
+
+## Recent Council Sessions
+
+{list last 5 council sessions, format: "• {date} — {question_slug} — Panel: {panel}"}
+
+{or: "No council sessions in this session."}
+
+## Commits in Phase
+
+{list commits with hash and subject}
+
+{or: "No commits to tracked paths."}
+
+## Next Steps
+
+- Address {count} open blocker(s) before proceeding
+- Plan next phase with `/rihal:plan-phase {next_phase}`
+```
+
+## Step 8 — Print confirmation
+
+Print success:
+
+```
+✓ Session report written to .planning/SESSION-REPORT-{date}.md
+```
+
+Then print summary:
+- Period covered
+- Total artifacts
+- Estimated tokens
+- Open blockers count
+
+## Success Criteria
+
+- [ ] `.planning/SESSION-REPORT-{date}.md` written with all sections populated
+- [ ] Report includes artifact counts, token estimates, decisions, blockers, and commits
+- [ ] Confirmation message printed with period and summary
+- [ ] Report is readable markdown with proper formatting
+
+## On Error
+
+- **No state.json found:** print error and stop (Step 1).
+- **state.json has invalid JSON:** print error with path and stop.
+- **No artifacts in .planning/:** report gracefully ("No session artifacts found yet.").
+- **Git not available:** report gracefully ("Git not available, skipping commit history.").
+- **Write permission denied to .planning/:** print error and stop.
+- **Insufficient readable history:** report gracefully and skip that section.

package/rihal/workflows/settings.md

@@ -0,0 +1,185 @@
+# Workflow: rihal:settings
+
+<purpose>
+Interactive configuration wizard for Rihal project settings. Collects user preferences for model profile, research strategy, execution gates, and branching strategy, then writes them back to .rihal/config.yaml.
+</purpose>
+
+
+## Step 0 — Usage check
+
+If `$ARGUMENTS` is empty or contains only `--help` or `-h`:
+
+```
+/rihal:settings <argument-here>
+```
+
+**Examples:**
+```
+/rihal:settings example 1
+/rihal:settings example 2
+```
+
+STOP — do not proceed.
+
+<available_tools>
+- AskUserQuestion — collect user input
+- Read — read current config.yaml
+- Write — write updated config.yaml
+- Bash — validate git state if needed
+</available_tools>
+
+## Step 1 — Initialize
+
+Load current settings from `.rihal/config.yaml`:
+
+```bash
+[ -f .rihal/config.yaml ] && cat .rihal/config.yaml || echo "# No config yet"
+```
+
+Parse the config to extract current values:
+- `model_profile` (default: "balanced")
+- `enable_research_pre_step` (default: "false")
+- `enable_plan_checker_loop` (default: "true")
+- `enable_post_execute_verifier` (default: "false")
+- `branching_strategy` (default: "none")
+
+Store these as `current_*` variables for pre-fill use.
+
+## Step 2 — Collect Settings
+
+Use AskUserQuestion to prompt the user for each setting. Pre-fill current values where applicable.
+
+### Setting 1: Model Profile
+
+```
+Question:
+Which model profile would you like to use?
+
+Options:
+  1. quality (Opus for reasoning agents, Sonnet for executor, Haiku for utilities)
+  2. balanced (Sonnet across the board) [CURRENT]
+  3. budget (Haiku across the board)
+  4. inherit (Use parent session model, no override)
+
+Your choice: [pre-filled with current_model_profile]
+```
+
+Valid responses: 1, 2, 3, 4, or exact names (quality, balanced, budget, inherit).
+Map numeric choices to profile names. Store as `new_model_profile`.
+
+### Setting 2: Enable Research Pre-step
+
+```
+Question:
+Enable research pre-step in /rihal:plan by default?
+
+This runs a research phase before planning if enabled, providing additional context.
+
+Options:
+  1. Yes
+  2. No [CURRENT]
+
+Your choice:
+```
+
+Valid responses: 1/yes/y or 2/no/n. Store as `new_enable_research_pre_step` (true/false string).
+
+### Setting 3: Enable Plan-Checker Loop
+
+```
+Question:
+Enable sprint-checker loop during /rihal:plan?
+
+This verifies and repairs plans before execution if enabled.
+
+Options:
+  1. Yes [CURRENT]
+  2. No
+
+Your choice:
+```
+
+Valid responses: 1/yes/y or 2/no/n. Store as `new_enable_plan_checker_loop` (true/false string).
+
+### Setting 4: Enable Post-Execute Verifier Gates
+
+```
+Question:
+Enable post-execute verifier gates?
+
+This runs verification after each task execution to catch regressions and issues.
+
+Options:
+  1. Yes
+  2. No [CURRENT]
+
+Your choice:
+```
+
+Valid responses: 1/yes/y or 2/no/n. Store as `new_enable_post_execute_verifier` (true/false string).
+
+### Setting 5: Branching Strategy
+
+```
+Question:
+What branching strategy should workflows use?
+
+Options:
+  1. none (No branching, work on current branch)
+  2. feature-branch (Create feature branches, leave checkout to user)
+  3. worktree-isolation (Use git worktrees for isolated work)
+
+Your choice: [pre-filled with current_branching_strategy]
+```
+
+Valid responses: 1, 2, 3, or exact names (none, feature-branch, worktree-isolation).
+Map numeric choices to strategy names. Store as `new_branching_strategy`.
+
+## Step 3 — Write Config
+
+After collecting all settings, write them back to `.rihal/config.yaml` using `rihal-tools.cjs config set`:
+
+```bash
+node .rihal/bin/rihal-tools.cjs config set --key model_profile --value "$new_model_profile"
+node .rihal/bin/rihal-tools.cjs config set --key enable_research_pre_step --value "$new_enable_research_pre_step"
+node .rihal/bin/rihal-tools.cjs config set --key enable_plan_checker_loop --value "$new_enable_plan_checker_loop"
+node .rihal/bin/rihal-tools.cjs config set --key enable_post_execute_verifier --value "$new_enable_post_execute_verifier"
+node .rihal/bin/rihal-tools.cjs config set --key branching_strategy --value "$new_branching_strategy"
+```
+
+## Step 4 — Confirm and Print
+
+Print a summary of the new settings:
+
+```
+✓ Settings updated successfully!
+
+Model Profile: $new_model_profile
+Research pre-step: $new_enable_research_pre_step
+Plan-checker loop: $new_enable_plan_checker_loop
+Post-execute verifier: $new_enable_post_execute_verifier
+Branching strategy: $new_branching_strategy
+
+Settings saved to: .rihal/config.yaml
+```
+
+Print a tip:
+
+```
+Tip: Use /rihal:resume-work to reload config and continue work.
+```
+
+## Success Criteria
+
+- [ ] Task completed as requested
+- [ ] Output saved or reported
+- [ ] State updated if necessary
+- [ ] No errors encountered
+
+## On Error
+
+If arguments are invalid, missing files, or subagent fails:
+- Validate inputs match expected format
+- Check that required files exist
+- Retry with clearer arguments or report the specific error to the user
+