@haposoft/cafekit 0.16.0-rc.6 → 0.16.0-rc.8

package/src/claude/skills/develop/references/quality-gate.md

@@ -1,99 +1,71 @@
-# Quality Gate — one closeout, separate proof and review
+# Quality gate — one closeout, separate proof and review
 
-This reference is loaded at develop closeout. It is an executable contract, not
-a fixed actor checklist. Canonical v2.1 policy input is authoritative; lane and
-`execution_tier` are derived/read-only compatibility views.
+Load this reference when closing a task or direct change. It defines ownership
+and evidence, not a fixed agent sequence.
 
-## Inputs and ownership
+## Ownership
 
-The single closeout owner receives the current scope, assurance, risk signals, blast
-radius, exact evidence commands, and the current diff. It calls the test owner
-once, then the review owner once when required. No parallel path, review path,
-or sync hook runs a duplicate hidden gate.
+- **Test owner:** executes the named commands and is the sole producer of
+  execution proof.
+- **Review owner:** evaluates correctness, security, scope, and reachability;
+  consumes proof but never creates it.
+- **Closeout owner:** normalizes both results, writes the task Receipt and
+  Status, and reports docs impact.
 
-- **Test owner:** executes commands and creates the canonical execution receipt.
-- **Review owner:** evaluates correctness, security, scope, and spec compliance;
-  consumes the receipt but never creates or claims execution proof.
-- **Closeout owner:** combines both results and performs one state/docs sync.
+Use `PASS | PASS_WITH_WARNINGS | FAIL | BLOCKED`. Only literal PASS plus all
+required proof can close. Review depth follows risk, blast radius, and repository
+policy, not file count.
 
-Review depth follows assurance, risk, and blast radius, not the number of files or
-tasks. There is no fixed Light/Standard/Deep agent sequence. The shared verdict
-surface is `PASS | PASS_WITH_WARNINGS | FAIL | BLOCKED`; all adapters must use
-the same normalizer.
-
-## Working directory (parallel mode)
-
-When an opt-in wave is active, each command runs in its task worktree. A
-collapse of one task does not cancel other in-flight tasks; merge and state
-synchronization remain single-writer operations.
-
-## Required evidence
+## Required proof
 
 Before completion, verify:
 
-1. compile/typecheck precheck and every exact command named by the active
-   `Verification Plan`;
-2. real runtime reachability and declared artifact inspection;
-3. canonical `receipts/<task-basename>.md` with task identity/path, non-empty
-   exact command, successful exit/result, expected versus observed behavior,
-   applicable negative/reachability proof, both provenance anchors bound to the
-   runtime's expected Base/Head pair, and required SHA-256 declarations;
-4. correctness/security/spec review at the selected depth;
-5. a real independent audit when `needsIndependentAudit` is persisted. The
-   audit must use schema version `1`, distinct reviewer and implementation
-   session IDs, matching expected Base/Head binding, concrete evidence, and
-   literal `verdict: "PASS"`.
-
-`PRECHECK_FAIL` outranks no-tests. Missing, pending, marker-only, contradictory,
-or placeholder proof is unfinished. `Audit: PASS` is not an independent audit.
-`NO_TESTS` may be retained as a legacy diagnostic input, but it can never become
-the shared completion verdict `PASS`.
+1. applicable compile/typecheck and every exact task command;
+2. at least one real test when automated tests are required;
+3. runtime reachability through the declared entrypoint or consumer;
+4. negative/failure behavior named by Acceptance;
+5. artifact bytes and SHA-256 when the task declares an artifact;
+6. an inline `## Receipt` with `Verification: PASS`, exact `Command`, `Exit: 0`,
+   runtime-bound Base/Head, and non-empty fenced command output;
+7. correctness/security/scope review at the required depth.
 
-## Spec compliance review
+`PRECHECK_FAIL` outranks no-tests. Missing, pending, placeholder, contradictory,
+zero-test, stale, copied, or marker-only proof is unfinished. A review PASS
+cannot replace execution evidence.
 
-Check scope lock, requirements, design contracts, task Acceptance, Verification
-Plan, runtime reachability, and artifact/provenance boundaries. A missing or orphaned
-runtime deliverable is a failure even when compilation succeeds.
+## Review focus
 
-**Specific-task mode:** review exactly the requested task and its diff, then
-stop. Do not select a next task.
+Check task Outcome, Scope, Acceptance, Dependencies, Verification Plan, changed
+diff, and actual consumers. Treat an unmounted UI, unregistered route, uncalled
+service, disconnected worker, missing export, or unconsumed artifact as a
+reachability failure even when compilation passes.
 
-**Full-feature mode:** use the cumulative feature scope only at its closeout;
-intermediate synchronization does not claim feature completion. Run the Final
-Integration Scout when runtime-facing surfaces exist.
+Apply security checks relevant to the touched boundary: auth and tenant scope,
+input validation, secret redaction, path containment and symlinks, atomic writes,
+concurrency, cleanup, and safe error behavior. Do not add unrelated ceremony.
 
-## Correctness and security review
+Specific-task mode reviews only that task and stops. Full-feature mode uses
+cumulative scope only for the final integration check.
 
-Apply only the checks relevant to the touched boundary. For logging/redaction,
-check safe identifiers, quoted schemes, idempotence, and receipt secrecy. For
-filesystem writes, check lexical and canonical containment, symlink rejection,
-atomic same-directory replacement, cleanup, and canonical return paths. Add
-auth, persistence, provider, or concurrency checks only when scope/risk requires.
-
-## Quality cycle
+## Repair cycle
 
 ```text
-retry_count = 0
-while closeout is not PASS:
-  test owner executes required proof once
-  if proof is BLOCKED: stop without blind retry
-  review owner evaluates correctness/security/spec once
-  if FAIL: fix only the affected scope and rerun affected proof/review
-if retry_count reaches 3: stop and request user intervention
+test owner runs required proof once
+if BLOCKED: record prerequisite and stop
+if FAIL: repair the observed cause and rerun affected proof
+review owner evaluates the proven diff once
+if review FAIL: repair affected scope and rerun affected proof/review
+after three failed repair rounds: stop and request user direction
 ```
 
-Only `FAIL` enters remediation. `BLOCKED` is terminal until its prerequisite
-changes. `PASS_WITH_WARNINGS` is a review result only and remains unfinished;
-only literal `PASS` may close when all execution and policy obligations are
-complete.
-
-## Flash Gate (`--flash`)
+`PASS_WITH_WARNINGS` may report non-blocking observations but remains
+unfinished for state synchronization. Never retry an unchanged environment to
+manufacture a green result.
 
-Use only when the flag is explicit. Skip dedicated tests, full evidence
-execution, extended UI/manual checks, and review retry loops. Still perform a
-cheap preflight and scope/reachability sanity check.
+## Flash gate
 
-The flash record must contain exactly the unfinished semantics:
+With explicit `--flash`, run only a cheap available preflight and a basic
+scope/reachability check. Record:
 
 ```text
 Mode: --flash
@@ -101,54 +73,22 @@ Tests: skipped by user request
 Evidence: FLASH_UNVERIFIED
 Status: in_progress
 Blocker: awaiting /hapo:test <feature>
-Next verification: /hapo:test <feature>
-```
-
-The persisted flash input must also contain `dependencyBlocked: true`,
-`unblocks: false`, and a non-placeholder blocker, and must omit
-`readyForSync`, `flashTransition`, and `promotionReceipt`. Sync-finalize
-rejects minimal or caller-pre-promoted states.
-
-Terminal log:
-
-```text
-⚡ Step 4 Flash Gate: tests skipped by --flash; preflight=<pass|skipped>; evidence=FLASH_UNVERIFIED
 ```
 
-Do not report `Test PASS`, `Evidence PASS`, `Auto-Approved`, or
-`production-ready`. Flash never sets `done`, unblocks dependents, or promotes
-from a marker. Trusted sync-finalize alone may consume a fresh canonical PASS
-receipt and derive promotion.
-
-## Closeout and docs impact
-
-After the test receipt and review verdict are both available, the closeout owner
-uses the policy adapter and synchronizes state. A review-only pass cannot close
-missing execution proof. Evaluate docs impact from the actual behavior change:
-
-- `none`: record no docs edit and stop;
-- `minor` or `major`: update only affected existing docs through the normal docs
-  workflow.
-
-Do not run a docs checkpoint merely because a task completed. Do not refresh the
-whole repository for a local change.
-
-After every task receipt is valid, final integration execution creates
-`feature-receipt.md` once. A task-bearing feature cannot close without all task
-receipts and the feature receipt. A taskless Compact/Full feature closes from a
-valid feature receipt; absence before final closeout is not a failure. Receipts
-never supply or imply approval, readiness, audit status, or product semantics.
+Flash does not write a PASS receipt, mark done, unblock dependents, or report
+production readiness. Trusted sync-finalize may promote only after fresh proof
+passes the same receipt contract above.
 
-## Review threshold
+## Docs impact and C3
 
-`PASS` requires no Critical or High correctness/security/spec finding and no
-blocking Medium finding. `PASS_WITH_WARNINGS` may carry documented non-blocking
-findings. Finding count never selects review depth or overrides missing proof.
-Any missing proof, unresolved obligation, scope drift, contract substitution, or
-reachability failure remains unfinished regardless of review severity.
+After proof and review, classify docs impact as `none`, `minor`, or `major`.
+Update only affected existing docs when impact is not none. Show the user the
+current command evidence and limitations at C3; do not infer approval from a
+receipt.
 
-### Reachability Failure
+## Legacy workflow compatibility
 
-An unmounted UI, unregistered route, uncalled service/loader, disconnected
-worker/command/provider/reducer, missing artifact consumer, or other orphaned
-runtime-facing output is a review failure.
+Existing kernel packets keep their separate `receipts/<task-basename>.md`, task
+identity/path metadata, final `feature-receipt.md`, persisted independent-audit
+obligations, and completion-authority checks. The same proof/review ownership
+applies. Do not copy that storage shape into a flat process-first task.

package/src/claude/skills/develop/references/subagent-patterns.md

@@ -1,51 +1,44 @@
 # Capability dispatch patterns
 
-This reference is optional. Load it only when the persisted lane requires
-independent capability work. Role names are runtime configuration, not workflow
-policy: resolve them from the installed catalog instead of hardcoding an actor
-name or a sequence in a skill.
+Load this optional reference only when a task benefits from independent
+inspection, implementation, verification, review, or docs capability. Runtime
+role names are configuration, not workflow policy.
 
-## Dispatch contract
+## Dispatch packet
 
-Every dispatch prompt includes:
+Every dispatch includes:
 
-- Work context: the git root of the primary files;
-- Reports path: `<work-context>/plans/reports/`;
-- Plans path: `<work-context>/plans/`;
-- exact task/scope and owned files;
-- lane snapshot, risk/blast-radius obligations, and stop conditions;
-- required output, evidence, and status.
+- work context and reports/plans paths;
+- exact task outcome, scope, acceptance, and dependencies;
+- owned read/write paths and explicit exclusions;
+- risk, blast radius, stop conditions, and required evidence;
+- expected status and handoff format.
 
-Use a capability request such as:
-
-```text
-dispatch(capability="inspection|implementation|verification|review|docs",
-  work_context="<root>",
-  scope="<task or feature>",
-  owned_files=["<paths>"],
-  obligations=["<persisted obligations>"],
-  output="<required packet and evidence>")
-```
-
-The runtime may map a capability to a local role. That mapping must not change
-the lane, add ceremony, or become a new persisted policy field.
+Use one capability per concrete responsibility. The runtime may map it to an
+available local role, but that mapping cannot add scope or weaken proof.
 
 ## Independence and ownership
 
-- Inspection may report entrypoints and blast radius but does not edit source.
-- Implementation edits only the active task scope and does not sync state.
-- Verification is the sole producer of canonical execution proof.
-- Review consumes proof and reports correctness/security/spec findings only.
-- Documentation work is invoked only after a real docs-impact decision.
+- Inspection traces entrypoints and risks without editing source.
+- Implementation edits only granted paths and does not write task state.
+- Verification is the sole producer of executable proof.
+- Review consumes proof and reports findings without claiming execution.
+- Documentation starts only after a real docs-impact decision.
+- The controller alone writes Status and inline Receipt.
 
-Specific-task mode ends after one task. Full-feature mode may continue only
-after the closeout owner synchronizes the current task and finds another
-unblocked task. A capability result marked `PENDING`, `BLOCKED`, or lacking
-provenance cannot be converted into PASS by the controller.
+A specific-task invocation ends after that task. Full-feature execution may
+continue only after the current task is synchronized and the next dependency
+set is recomputed.
 
 ## Safe fallback
 
-If the required capability or isolated workspace is unavailable, keep the
-workflow in `BLOCKED` or run the permitted main-session check. Do not substitute
-a model, profile, or actor silently, and do not claim an independent result
-without an actually independent execution.
+If a required capability or isolated workspace is unavailable, record BLOCKED
+or run only a permitted main-session check. Never silently substitute an actor
+for an independence requirement. A PENDING, BLOCKED, or provenance-free result
+cannot be normalized to PASS.
+
+## Legacy workflow compatibility
+
+When the selected packet is legacy, include its persisted lane snapshot and
+obligations in the dispatch, but do not let workers edit that state or infer an
+independent result from a role label.

package/src/claude/skills/question/SKILL.md

@@ -73,7 +73,7 @@ If `unclear`, ask one focused follow-up with the minimum choices needed.
 
 Repo evidence priority:
 1. `README.md`, `AGENTS.md`, `CLAUDE.md`
-2. relevant `docs/`, `specs/`, `.claude/`, `.opencode/`
+2. relevant `docs/`, `specs/`, `.claude/`
 3. source files, tests, scripts, package manifests, config files
 4. git history only when the question asks about changes or provenance