@haposoft/cafekit 0.18.0 → 0.18.2

package/src/claude/skills/develop/SKILL.md

@@ -12,10 +12,7 @@ metadata:
 ---
 # Develop — implement, prove, synchronize
 
-Implement only the explicitly requested scope. For a process-first feature,
-`plan.md` and flat tasks are the durable packet; one closeout owner coordinates
-verification, review, sync, and docs impact without borrowing evidence.
-Develop never starts merely because Specs finished. The user invokes it.
+Implement only the explicitly requested scope. For a process-first feature, `plan.md` and flat tasks are the durable packet; one closeout owner coordinates verification, review, sync, and docs impact without borrowing evidence. Develop never starts merely because Specs finished. The user invokes it.
 
 ## Usage and pre-state guard
 
@@ -28,8 +25,7 @@ Develop never starts merely because Specs finished. The user invokes it.
 /cf:develop <feature> --notes
 ```
 
-`--notes` is opt-in. Only then load `references/implementation-notes-template.html`;
-record decisions, scope exceptions, risks, gaps, and verification limits. Never create it by default.
+`--notes` is opt-in. Only then load `references/implementation-notes-template.html`; record decisions, scope exceptions, risks, gaps, and verification limits. Never create it by default.
 
 Before any state mutation, reject `--flash` combined with `--parallel`:
 
@@ -41,31 +37,22 @@ The pair exits `2` before a task edit, receipt, worktree, subagent, or commit. D
 
 ## Resolve the work packet
 
-1. Resolve one `specs/<feature>/plan.md` plus flat `task-NN-*.md`; an explicit task path wins.
-2. Read GATE-SCOPE scope, exclusions, acceptance mapping, ownership, and task order.
-3. A task is unblocked only when every named dependency is `done` with a valid current inline Receipt.
-4. Without a packet, work directly only when the change is clear, isolated, reversible, and low-risk.
+- Resolve one `specs/<feature>/plan.md` plus flat `task-NN-*.md`; an explicit task path wins.
+- Read GATE-SCOPE scope, exclusions, acceptance mapping, ownership, and task order.
+- A task is unblocked only when every named dependency is `done` with a valid current inline Receipt.
+- Without a packet, work directly only when the change is clear, isolated, reversible, and low-risk.
 
 Ambiguity, overlapping ownership, a dependency cycle, or a missing Verification Plan is a blocker. Do not guess.
 
 ### Accepted process-first fast path
 
-When line two is `Specs-Contract: process-first-ready-v1`, reuse the accepted GATE-SCOPE/GATE-REVIEW.
-Perform only a narrow freshness scout for target revision, scope drift, ownership
-conflict, and dependency/state changes. Reopen GATE-SCOPE only for evidenced scope drift;
-do not research, replan, or add a routine user gate before a real blocker or GATE-DONE.
-This is a source instruction contract, not a parser/runtime or live-model guarantee;
-live-model adherence is `[UNVERIFIED]` without a host invocation.
+When line two is `Specs-Contract: process-first-ready-v1`, reuse the accepted GATE-SCOPE/GATE-REVIEW. Perform only a narrow freshness scout for target revision, scope drift, ownership conflict, and dependency/state changes. Reopen GATE-SCOPE only for evidenced scope drift; do not research, replan, or add a routine user gate before a real blocker or GATE-DONE. This is a source instruction contract, not a parser/runtime or live-model guarantee; live-model adherence is `[UNVERIFIED]` without a host invocation.
 
-Load the plan index into working context once. Later byte rereads are narrow drift
-checks; load only the active task's referenced coverage-profile rows, Outcome,
-Scope, Ownership, Steps, Acceptance, Dependencies, Verification Plan, Failure Protocol, owned code, and consumers.
+Load the plan index into working context once. Later byte rereads are narrow drift checks; load only the active task's referenced coverage-profile rows, Outcome, Scope, Ownership, Steps, Acceptance, Dependencies, Verification Plan, Failure Protocol, owned code, and consumers.
 
 ## Current-byte selection
 
-Reread current plan/task bytes before each selection and controller write. Concurrent
-Develop invocations are unsupported; detected state, task, or owned-path drift stops
-before any Status or Receipt write.
+Reread current plan/task bytes before each selection and controller write. Concurrent Develop invocations are unsupported; detected state, task, or owned-path drift stops before any Status or Receipt write.
 
 | Current bytes | Feature mode | Explicit task mode |
 |---|---|---|
@@ -77,89 +64,54 @@ before any Status or Receipt write.
 | No task is active | Select the first dependency-valid `pending` row in `plan.md` order. | Start only the exact pending target when dependencies are valid. |
 | Status is missing, duplicate, or unknown | Stop as malformed state. | Stop as malformed state. |
 
-Feature mode repeats this selection only after the current task closes. Specific-task
-mode never touches a sibling and returns after its successful sync without chaining or GATE-DONE.
+Feature mode repeats this selection only after the current task closes. Specific-task mode never touches a sibling and returns after its successful sync without chaining or GATE-DONE.
 
 ## Modes
 
 ### Sequential feature or specific task
 
-The controller sets the selected task's single `Status:` to `in_progress`.
-Implement its Outcome and Acceptance only. Keep one unblocked task at a time;
-never start the next before proof, review, and sync finish for the current task.
+The controller sets the selected task's single `Status:` to `in_progress`. Implement its Outcome and Acceptance only. Keep one unblocked task at a time; never start the next before proof, review, and sync finish for the current task.
 
 ### Parallel (`--parallel [N]`)
 
-Load `references/parallel-waves.md`. Require disjoint writes, satisfied dependencies,
-isolated worktrees, a bounded wave, and one controller writer; otherwise work sequentially.
+Load `references/parallel-waves.md`. Require disjoint writes, satisfied dependencies, isolated worktrees, a bounded wave, and one controller writer; otherwise work sequentially.
 
 ### Flash (`--flash`)
 
-Load `references/quality-gate.md`. Flash is an explicit speed trade-off, never completion: run a
-cheap preflight, skip dedicated tests, keep `Status: in_progress` with `FLASH_UNVERIFIED` and the
-blocker `awaiting /cf:test <feature>`, do not unblock dependents or report PASS, and
-stop this invocation without chaining.
-Only a later explicit non-Flash invocation may recover the task.
-It treats Flash output as ephemeral, inspects current bytes and the owned diff, and obtains fresh
-canonical proof through the trusted sync-finalize path. Never weaken, delete, or rewrite tests to make Flash look complete.
+Load `references/quality-gate.md`. Flash is an explicit speed trade-off, never completion: run a cheap preflight, skip dedicated tests, keep `Status: in_progress` with `FLASH_UNVERIFIED` and the blocker `awaiting /cf:test <feature>`, do not unblock dependents or report PASS, and stop this invocation without chaining. Only a later explicit non-Flash invocation may recover the task. It treats Flash output as ephemeral, inspects current bytes and the owned diff, and obtains fresh canonical proof through the trusted sync-finalize path. Never weaken, delete, or rewrite tests to make Flash look complete.
 
 ## Task cycle
 
 ### 1. Scout
 
-Trace entrypoints, callers, dependents, registration, errors, and owned files.
-Read the test or probe that will judge this task before implementing against it.
-Compilation does not prove an unmounted UI, unregistered route, uncalled service,
-or missing consumer.
+Trace entrypoints, callers, dependents, registration, errors, and owned files. Read the test or probe that will judge this task before implementing against it. Compilation does not prove an unmounted UI, unregistered route, uncalled service, or missing consumer.
 
-For an interrupted `in_progress` task, preserve and inspect current owned changes;
-discard ephemeral, remembered, or prior-attempt proof; compare unmet Acceptance
-against current task bytes and owned diff. Do not blindly replay a non-idempotent
-mutation. Resume only unmet work, then run fresh verification.
+For an interrupted `in_progress` task, preserve and inspect current owned changes; discard ephemeral, remembered, or prior-attempt proof; compare unmet Acceptance against current task bytes and owned diff. Do not blindly replay a non-idempotent mutation. Resume only unmet work, then run fresh verification.
 
 ### 2. Implement
 
 Unless under `--flash` or the command costs money or writes artifacts, run the task's exact Verification Plan command once before changing anything and expect it to fail; this pre-change run is not a repair round.
 Passing before any change, outside a resumed task, means the plan cannot judge the work and is a blocker; so is a failure naming something other than the unmet Acceptance, which is a blocker to raise, not a defect to work around while implementing. A failure from the command itself — a wrong path, a missing tool or module, the environment — is BLOCKED, not FAIL, even when the runner reports `not ok` and even when the Acceptance or a test file shows the right command: set the task's single `Status:` to `blocked` with a `Blocker:` line naming the command and its error, write no Receipt, revert any edit made in this run, and report; you may suggest a corrected command for the plan, but never run it as proof.
 
-Honor Scope, Ownership, Acceptance, and Dependencies. Do not silently replace named contracts;
-scope expansion requires evidence and a return to GATE-SCOPE, not implementation convenience.
-Load `references/subagent-patterns.md` when dispatch helps; only the controller writes Status or Receipt.
+Honor Scope, Ownership, Acceptance, and Dependencies. Do not silently replace named contracts; scope expansion requires evidence and a return to GATE-SCOPE, not implementation convenience. Load `references/subagent-patterns.md` when dispatch helps; only the controller writes Status or Receipt.
 
 ### 3. Verify, review, and close
 
-The test owner executes each exact Verification Plan and records real output. The
-review owner evaluates correctness, security, scope, and reachability without
-manufacturing proof. Use `PASS | PASS_WITH_WARNINGS | FAIL | BLOCKED`; only literal PASS can close.
+The test owner executes each exact Verification Plan and records real output. The review owner evaluates correctness, security, scope, and reachability without manufacturing proof. Use `PASS | PASS_WITH_WARNINGS | FAIL | BLOCKED`; only literal PASS can close.
 
-Load `references/quality-gate.md`. Remediate an observed failure (a blocked Command is not a failure to remediate), then rerun only
-affected proof/review. Do not blind-retry a blocked environment. One repair round is one
-observed failure plus its repair and rerun, from proof or from review alike. After three
-failed repair rounds, stop and ask the user.
+Load `references/quality-gate.md`. Remediate an observed failure (a blocked Command is not a failure to remediate), then rerun only affected proof/review. Do not blind-retry a blocked environment. One repair round is one observed failure plus its repair and rerun, from proof or from review alike. After three failed repair rounds, stop and ask the user.
 
-**The Receipt is written last, after proof and review have both passed**; writing it earlier
-and reopening the task is a defect, not a shortcut. After a real pass, the controller writes the task's final inline `## Receipt` with
-`Verification: PASS`, exact `Command`, `Exit: 0`, `Base:` and `Head:` copied from the `Base` and `Head` fields of `node .claude/scripts/provenance.cjs --project-root . --specs-root specs --spec-file <task file> --feature-name <feature> --session <any label> --json` run after the last change outside the specs root (never typed or computed by hand),
-non-empty current output, and required negative/reachability/artifact proof; then it
-sets `Status: done` and only implemented checkboxes. Missing, stale, contradictory,
-zero-test, placeholder, marker-only, skipped, or remembered proof is unfinished.
+**The Receipt is written last, after proof and review have both passed**; writing it earlier and reopening the task is a defect, not a shortcut. After a real pass, the controller writes the task's final inline `## Receipt` with `Verification: PASS`, exact `Command`, `Exit: 0`, `Base:` and `Head:` copied from the `Base` and `Head` fields of `node .claude/scripts/provenance.cjs --project-root . --specs-root specs --spec-file <task file> --feature-name <feature> --session <any label> --json` run after the last change outside the specs root (never typed or computed by hand), non-empty current output in a fenced block, and required negative/reachability/artifact proof; then it sets `Status: done` and only implemented checkboxes. Missing, stale, contradictory, zero-test, placeholder, marker-only, skipped, or remembered proof is unfinished.
 
 ### 4. Finish the requested boundary
 
-Reread the task after sync and recompute the queue from current bytes. Specific-task
-mode has already returned. Full-feature mode continues one task at a time, then runs
-the named feature-level integration and reachability checks. Before GATE-DONE, apply the
-quality-gate final-Head fixed point; show current evidence and limitations, and let
-the user decide completion.
+Reread the task after sync and recompute the queue from current bytes. Specific-task mode has already returned. Full-feature mode continues one task at a time, then runs the named feature-level integration and reachability checks. Before GATE-DONE, apply the quality-gate final-Head fixed point; show current evidence and limitations, and let the user decide completion.
 
-Evaluate docs impact from behavior actually changed: `none` means report only;
-`minor` or `major` updates only affected existing docs through the docs flow.
+Evaluate docs impact from behavior actually changed: `none` means report only; `minor` or `major` updates only affected existing docs through the docs flow.
 
 ## Definition of done
 
-Done requires satisfied acceptance, reachable behavior, current executable proof,
-stable Base/Head binding, resolved blocking review findings, and no scope substitution.
-`PASS_WITH_WARNINGS`, `NO_TESTS`, `FLASH_UNVERIFIED`, or review-only pass cannot close.
+Done requires satisfied acceptance, reachable behavior, current executable proof, stable Base/Head binding, resolved blocking review findings, and no scope substitution. `PASS_WITH_WARNINGS`, `NO_TESTS`, `FLASH_UNVERIFIED`, or review-only pass cannot close.
 
 ## Attached references
 

package/src/claude/skills/develop/references/subagent-patterns.md

@@ -50,9 +50,3 @@ After interruption, preserve the owned diff but discard ephemeral handoffs and
 remembered proof. Do not tell an implementation worker to repeat a non-idempotent
 action blindly; scope the resumed brief to unmet Acceptance and require fresh
 verification. Concurrent invocations remain unsupported, so drift blocks handoff.
-
-## Legacy workflow compatibility
-
-When the selected packet is legacy, include its persisted lane snapshot and
-obligations in the dispatch, but do not let workers edit that state or infer an
-independent result from a role label.

package/src/claude/skills/git/SKILL.md

@@ -24,7 +24,7 @@ Present options via AskUserQuestion — header "Git Operation": commit / push /
   `gh repo view --json defaultBranchRef` or `origin/HEAD`; never assume `main`/`develop`.
 - `finish`: fresh `git status` + verification, then present exactly 4 options:
   merge locally / push + PR / keep branch-worktree / discard (typed confirmation, as in the worktree lifecycle: `remove <dir-name>` / `delete <branch>`).
-- `worktree <desc>`: sibling dir `../<project>-<branch>` for isolated setup, branched from the current branch unless the user names a base, hydrating the installer-ignored `.claude/`, `.codex/`, `.agents/` it lacks. Git alone is enough (plus `rsync`); Orca, Herdr and Claude Code's own worktree are optional shortcuts, never required.
+- `worktree <desc>`: sibling dir `../<project>-<branch>` for isolated setup, branched from the current branch unless the user names a base, hydrating the installer-ignored `.claude/`, `.codex/`, `.agents/` it lacks. Git alone is enough (plus `rsync`); Orca, Herdr and the host's own worktree are optional shortcuts, never required.
 - `worktree list | remove <dir> | prune`: lifecycle in `references/worktree-blueprint.md` — never lose uncommitted, ignored or unmerged work: before `git worktree remove`, check `git -C <dir> status --porcelain --ignored` and `git -C <dir> log --oneline <base>..HEAD`, never `--force`, and anything they show needs the typed `remove <dir-name>`; use `git worktree prune` for a missing directory, never `rm -rf`.
 
 ## Hard rules for `commit`

package/src/claude/skills/git/references/worktree-blueprint.md

@@ -19,7 +19,7 @@ Tuỳ theo `<feature-description>`, hãy sinh ra một cái tên nhánh dạng K
 *Lưu ý: Nếu User chủ động gõ tên có sẵn mã Jira (TD-1234) hoặc tên tuyệt đối thì bỏ qua prefix Type.*
 
 ### Bước 3: Khởi Sinh Worktree (Sibling Pattern)
-**Mặc định luôn là cấp Sibling (`../`)**: skill không bao giờ tự tạo worktree lồng bên trong repo. Một đường dẫn lồng (dưới `.claude/worktrees/` đã bị ignore) chỉ chấp nhận khi chính người dùng hoặc công cụ host đã đặt tên và tạo ra nó; khi còn worktree lồng, không chạy `git clean -fdx` ở root repo vì nó xoá cả thư mục bị ignore.
+**Mặc định luôn là cấp Sibling (`../`)**: skill không bao giờ tự tạo worktree lồng bên trong repo. Một đường dẫn lồng dưới runtime đã bị ignore chỉ chấp nhận khi chính người dùng hoặc công cụ host đã đặt tên và tạo ra nó; khi còn worktree lồng, không chạy `git clean -fdx` ở root repo vì nó xoá cả thư mục bị ignore.
 
 Lối tắt tùy chọn (không bắt buộc, không phải điều kiện): `claude --worktree`, Orca, Herdr. Chỉ cần `git` (thêm `rsync` cho Bước 4); máy không có công cụ nào khác vẫn làm đủ mọi bước.
 

package/src/claude/skills/research/SKILL.md

@@ -12,17 +12,13 @@ metadata:
 ---
 # Research — proportional evidence for a decision
 
-Return a decision-ready answer, not a search diary or an unsorted option list.
-Research evaluates choices; it does not implement them or invent certainty.
+Return a decision-ready answer, not a search diary or an unsorted option list. Research evaluates choices; it does not implement them or invent certainty.
 
-## 1. Frame the decision
+## Frame the decision
 
-Restate the decision, project constraints, affected consumers, and what evidence
-would change the answer. Inspect current repository sources first whenever local
-fit matters. Ask the user only when a missing choice materially changes scope or
-safety; otherwise label bounded assumptions and continue.
+Restate the decision, project constraints, affected consumers, and what evidence would change the answer. Inspect current repository sources first whenever local fit matters. Ask the user only when a missing choice materially changes scope or safety; otherwise label bounded assumptions and continue.
 
-## 2. Select depth
+## Select depth
 
 Choose the smallest depth that can support the decision:
 
@@ -32,56 +28,29 @@ Choose the smallest depth that can support the decision:
 | Standard | Several viable options or a material integration choice | Verify material claims across at least two independent authoritative sources where available; compare fit and tradeoffs. |
 | Deep | High blast radius, hard-to-reverse architecture, security/compliance, substantial cost, or conflicting evidence | Complete Standard, then run a separate contradiction-and-gap round; use at least three independent sources for disputed material claims where available. |
 
-Escalate depth when evidence conflicts, a primary source is missing, or a finding
-changes the decision boundary. Do not inflate source counts with mirrors or
-articles that repeat the same upstream claim. Stop when new evidence no longer
-changes the ranking, limitations, or unresolved gaps.
+Escalate depth when evidence conflicts, a primary source is missing, or a finding changes the decision boundary. Do not inflate source counts with mirrors or articles that repeat the same upstream claim. Stop when new evidence no longer changes the ranking, limitations, or unresolved gaps.
 
-## 3. Gather evidence
+## Gather evidence
 
 - Repository claims: cite a resolvable `path:line` anchor from current bytes.
-- External claims: prefer current official documentation, standards, research
-  papers, maintainer material, and release notes. Browse when facts may have
-  changed; record the source date or applicable version.
-- For each material claim record: claim, URL or repository anchor, authority,
-  date/version, applicability to this project, and status
-  `confirmed | inferred | unresolved`.
-- A source count is not confidence. Explain conflicts, missing primary evidence,
-  version mismatch, and why a source does or does not apply.
-
-Use delegated researchers only as optional acceleration when two or more
-independent evidence tracks can be bounded. The controller owns the question,
-source reconciliation, and final recommendation. If delegation is unavailable,
-unauthorized, or not useful, research sequentially with the same evidence bar.
-When a researcher's report feeds the answer, keep its `Depth:` line, its status labels and its `path:line` anchors, reconciled with your own evidence.
-
-## 4. Synthesize
-
-For comparisons, rank only viable options and name a winner when evidence and
-project fit support one. For every ranked option include fit, decisive evidence,
-tradeoffs, adoption/operational risks, and limitations. If evidence cannot choose
-a winner, return `unresolved` plus the smallest fact or experiment that would.
-
-Use the four mandatory H2 sections from
-`.claude/skills/specs/templates/research.md`. Keep claim records and comparisons
-inside `## Evidence Summary`; do not add or reorder mandatory H2 headings.
-
-## 5. Output and persistence
-
-Default to a concise answer in chat. Persist only when:
-
-1. one explicitly resolved active Spec requires durable `research.md`; save to
-   that exact `specs/<feature>/research.md`, preserving its existing lifecycle; or
-2. the user explicitly requests a durable report and approves its destination.
-
-Do not create a Spec or `_shared` archive merely to save an answer. The
-controller performs any authorized write after reviewing and redacting the
-output; delegated researchers never write reports or task state. Always state
-depth used, decisive evidence, recommendation, limitations, and unresolved gaps.
-Give every material claim in the answer its status in parentheses — `(confirmed)`, `(inferred)` or `(unresolved)` — in English whatever the answer's language.
+- External claims: prefer current official documentation, standards, research papers, maintainer material, and release notes. Browse when facts may have changed; record the source date or applicable version.
+- For each material claim record: claim, URL or repository anchor, authority, date/version, applicability to this project, and status `confirmed | inferred | unresolved`.
+- A source count is not confidence. Explain conflicts, missing primary evidence, version mismatch, and why a source does or does not apply.
+
+Use delegated researchers only as optional acceleration when two or more independent evidence tracks can be bounded. The controller owns the question, source reconciliation, and final recommendation. If delegation is unavailable, unauthorized, or not useful, research sequentially with the same evidence bar. When a researcher's report feeds the answer, keep its `Depth:` line, its status labels and its `path:line` anchors, reconciled with your own evidence.
+
+## Synthesize
+
+For comparisons, rank only viable options and name a winner when evidence and project fit support one. For every ranked option include fit, decisive evidence, tradeoffs, adoption/operational risks, and limitations. If evidence cannot choose a winner, return `unresolved` plus the smallest fact or experiment that would.
+
+Use the four mandatory H2 sections from `.claude/skills/specs/templates/research.md`. Keep claim records and comparisons inside `## Evidence Summary`; do not add or reorder mandatory H2 headings.
+
+## Output and persistence
+
+Default to a concise answer in chat. Persist only when: one explicitly resolved active Spec requires durable `research.md`; save to that exact `specs/<feature>/research.md`, preserving its existing lifecycle; or the user explicitly requests a durable report and approves its destination.
+
+Do not create a Spec or `_shared` archive merely to save an answer. The controller performs any authorized write after reviewing and redacting the output; delegated researchers never write reports or task state. Always state depth used, decisive evidence, recommendation, limitations, and unresolved gaps. Give every material claim in the answer its status in parentheses — `(confirmed)`, `(inferred)` or `(unresolved)` — in English whatever the answer's language.
 
 ## Handoff boundary
 
-Research may recommend Brainstorm or Specs when a material product/design choice
-remains. It never starts Develop, edits implementation code, claims user approval,
-or presents source/installed evidence as live-system proof.
+Research may recommend Brainstorm or Specs when a material product/design choice remains. It never starts Develop, edits implementation code, claims user approval, or presents source/installed evidence as live-system proof.

package/src/claude/skills/sync/SKILL.md

@@ -12,9 +12,7 @@ metadata:
 ---
 # Sync — file-state synchronization
 
-Synchronize only observed state. For the primary process-first layout, the
-single `Status:` field and inline `## Receipt` in each flat task file are the
-state. Never infer proof, approval, review independence, or product readiness.
+Synchronize only observed state. For the primary process-first layout, the single `Status:` field and inline `## Receipt` in each flat task file are the state. Never infer proof, approval, review independence, or product readiness.
 
 ## Commands
 
@@ -28,45 +26,25 @@ state. Never infer proof, approval, review independence, or product readiness.
 /cf:sync
 ```
 
-Resolve one regular direct-child task inside `specs/<feature>/`. Reject path
-escape, symlink, ambiguity, missing `plan.md`, duplicate Status fields, and
-unsupported status values.
+Resolve one regular direct-child task inside `specs/<feature>/`. Reject path escape, symlink, ambiguity, missing `plan.md`, duplicate Status fields, and unsupported status values.
 
 ## Task synchronization
 
-1. Read the task Outcome, Acceptance, Dependencies, Verification Plan, current
-   Status, and Receipt before editing.
-2. Starting or resuming changes only Status to `in_progress`. Update only
-   checkboxes whose implementation is real.
-3. Blocking changes Status to `blocked` and records a concrete blocker; it does
-   not create proof.
-4. Done requires a current inline Receipt with `Verification: PASS`, exact
-   Command, `Exit: 0`, runtime-bound Base/Head, non-empty fenced output, and any
-   required negative/reachability/artifact proof.
-5. Write or replace the Receipt before changing Status to `done`. Missing,
-   stale, contradictory, placeholder, failure, or zero-test evidence keeps the
-   task `in_progress` or `blocked`.
-6. Re-read the file after the surgical edit and confirm exactly one Status and
-   one Receipt section.
+- Read the task Outcome, Acceptance, Dependencies, Verification Plan, current Status, and Receipt before editing.
+- Starting or resuming changes only Status to `in_progress`. Update only checkboxes whose implementation is real.
+- Blocking changes Status to `blocked` and records a concrete blocker; it does not create proof.
+- Done requires a current inline Receipt with `Verification: PASS`, exact Command, `Exit: 0`, runtime-bound Base/Head, non-empty fenced output, and any required negative/reachability/artifact proof.
+- Write or replace the Receipt before changing Status to `done`. Missing, stale, contradictory, placeholder, failure, or zero-test evidence keeps the task `in_progress` or `blocked`.
+- Re-read the file after the surgical edit and confirm exactly one Status and one Receipt section.
 
-`sync-finalize` is the only promotion path for `FLASH_UNVERIFIED`. It requires
-fresh canonical PASS proof, revalidates Base/Head and artifacts, clears the
-flash blocker, then derives `done`. Caller-supplied promotion booleans and a
-marker alone have no authority.
+`sync-finalize` is the only promotion path for `FLASH_UNVERIFIED`. It requires fresh canonical PASS proof, revalidates Base/Head and artifacts, clears the flash blocker, then derives `done`. Caller-supplied promotion booleans and a marker alone have no authority.
 
 ## Audit
 
-Scan only `specs/<feature>/task-*.md` beside `plan.md`. Compare plan task rows,
-task filenames, dependencies, Status, acceptance mapping, and Receipts. Report
-missing files, unknown rows, cycles, duplicate fields, done-without-proof,
-proof-on-unfinished-task, and overlapping ownership.
+Scan only `specs/<feature>/task-*.md` beside `plan.md`. Compare plan task rows, task filenames, dependencies, Status, acceptance mapping, and Receipts. Report missing files, unknown rows, cycles, duplicate fields, done-without-proof, proof-on-unfinished-task, and overlapping ownership.
 
-An audit writes nothing until the user confirms the named changes; then repair
-deterministic formatting drift only and never pick a winner in a semantic conflict.
-Read `references/rebind-and-audit.md` before a rebind, a bare call, or a file
-report, and `references/sync-protocols.md` for surgical update and audit rules.
+An audit writes nothing until the user confirms the named changes; then repair deterministic formatting drift only and never pick a winner in a semantic conflict. Read `references/rebind-and-audit.md` before a rebind, a bare call, or a file report, and `references/sync-protocols.md` for surgical update and audit rules.
 
 ## Docs impact
 
-When a task becomes done, report `Docs impact: none|minor|major`. Create no docs
-work for `none`; update only affected existing docs for minor or major.
+When a task becomes done, report `Docs impact: none|minor|major`. Create no docs work for `none`; update only affected existing docs for minor or major.

package/src/claude/skills/sync/references/rebind-and-audit.md

@@ -46,8 +46,8 @@ Never archive, move, rename, or delete a packet, change the specs root, or edit
 ## Bare call
 
 `/cf:sync` without arguments audits every process-first packet under the specs
-root and writes nothing. Report legacy (`spec.json`) and archived packets
-without touching them. End by asking with `AskUserQuestion` when the host has
+root and writes nothing. Report archived packets, and packet directories without
+`plan.md` that CafeKit no longer reads, without touching them. End by asking with `AskUserQuestion` when the host has
 it, otherwise ask in text and stop. Only a reply that arrives after the report
 and names the changes counts as confirmation; an instruction given before the
 report, such as "close everything", does not.

package/src/claude/skills/test/SKILL.md

@@ -12,57 +12,36 @@ metadata:
 ---
 # Test — execution proof owner
 
-`cf:test` executes the smallest adequate real verification and owns the
-canonical execution result. For process-first work it returns one typed proof
-handoff to the controller; it never writes task state or the inline Receipt.
-Review consumes validated proof and never invents or duplicates execution.
+`cf:test` executes the smallest adequate real verification and owns the canonical execution result. For process-first work it returns one typed proof handoff to the controller; it never writes task state or the inline Receipt. Review consumes validated proof and never invents or duplicates execution.
 
 ## Usage
-
 ```text
-/cf:test
-/cf:test --full
+/cf:test [--full]
 /cf:test <scope-or-path>
 /cf:test <feature-name>
-/cf:test specs/<feature>
-/cf:test specs/<feature>/task-NN-<slug>.md
-/cf:test --ui <url>
-/cf:test --ui-auth <url>
-/cf:test --ui-flow <url>
+/cf:test specs/<feature>[/task-NN-<slug>.md]
+/cf:test --ui|--ui-auth|--ui-flow <url>
 ```
-
 ## Hard gates
-
 - Never claim a pass without executing the exact relevant command.
 - Never mock, weaken, delete, or skip a failing assertion to obtain green.
-- Missing tooling, a missing command, nonzero exit, or zero executed tests is
-  never `PASS`. Do not auto-install project-local tooling during proof.
-- Preserve exact commands, counts, output, reachability, proof level, Base,
-  Head, artifact hashes, and redaction labels.
-- Source, installed, and live proof are distinct. Live adherence is
-  `[UNVERIFIED]` without a host invocation.
-- Use only `PASS | PASS_WITH_WARNINGS | FAIL | BLOCKED`. Unknown, malformed,
-  partial, contradictory, duplicate, skipped, or stale proof fails closed.
-
+- Missing tooling, a missing command, nonzero exit, or zero executed tests is never `PASS`. Do not auto-install project-local tooling during proof.
+- Preserve exact commands, counts, output, reachability, proof level, Base, Head, artifact hashes, and redaction labels.
+- Source, installed, and live proof are distinct. Live adherence is `[UNVERIFIED]` without a host invocation.
+- Use only `PASS | PASS_WITH_WARNINGS | FAIL | BLOCKED`. Unknown, malformed, partial, contradictory, duplicate, skipped, or stale proof fails closed.
 ## Target routing
-
-Classify current filesystem bytes before selecting tests. Use `lstat` so broken
-links count as markers. Never migrate or repair packet state while testing.
+Classify current filesystem bytes before selecting tests. Use `lstat` so broken links count as markers. Never migrate or repair packet state while testing.
 
 | Observed state | Route |
 |---|---|
-| Valid regular `plan.md` with `Specs-Contract: process-first-ready-v1`, one or more valid regular flat `task-NN-*.md`, and no legacy marker | Process-first |
-| Any flat marker that is orphaned, malformed, duplicated, symlinked, nonregular, or mixed with a legacy marker | `BLOCKED` |
-| Valid regular legacy root resolving every nested task and separate receipt, with no flat marker | Legacy adapter |
-| Orphan, malformed, symlinked, nonregular, identity-conflicting, or mixed legacy state | `BLOCKED` |
-| No flat or legacy marker | Ordinary non-Spec testing |
+| Valid regular `plan.md` with `Specs-Contract: process-first-ready-v1` and one or more valid regular flat `task-NN-*.md` | Process-first |
+| Any flat marker that is orphaned, malformed, duplicated, symlinked, or nonregular | `BLOCKED` |
+| A packet directory with no `plan.md` that holds the old JSON planning state | `BLOCKED`: CafeKit no longer reads it; move the work to a `plan.md` packet |
+| No flat marker | Ordinary non-Spec testing |
 
-A flat marker is a direct-child `plan.md` or `task-NN-*.md`. A legacy marker is
-`spec.json`, a nested legacy task, or a separate legacy receipt. See
-`references/execution-strategy.md` for the complete validation truth table.
+A flat marker is a direct-child `plan.md` or `task-NN-*.md`. See `references/execution-strategy.md` for the complete validation truth table.
 
 ## Spec-Aware Mode
-
 <SCOPE-GATE>
 For a feature target, test only current accepted scope, the active task's exact
 Verification Plan, and reachable runtime surfaces. Missing or orphaned
@@ -70,37 +49,19 @@ reachability fails even when a command exits successfully.
 </SCOPE-GATE>
 
 For a process-first feature:
-
-1. Read current `plan.md` and flat task bytes. Select only a contained regular
-   task whose dependencies allow proof.
-2. Use the task's exact `Command`, exact unique `Named probes`, `Reachability`,
-   `Oracle`, `Counterexample`, required proof level, and artifact declaration.
-3. Run the smallest adequate proof. `--full` expands scope but cannot weaken
-   the Verification Plan or substitute unrelated green tests.
-4. Return exactly one canonical `test-proof-v1` object. Do not edit `plan.md`,
-   `Status:`, the task's `## Receipt`, or any sibling task.
-5. The Develop controller validates the payload, recomputes its digest, checks
-   current provenance, and alone writes process-first Status and inline Receipt.
-
+- Read current `plan.md` and flat task bytes. Select only a contained regular task whose dependencies allow proof.
+- Use the task's exact `Command`, exact unique `Named probes`, `Reachability`, `Oracle`, `Counterexample`, required proof level, and artifact declaration.
+- Run the smallest adequate proof. `--full` expands scope but cannot weaken the Verification Plan or substitute unrelated green tests.
+- Return exactly one canonical `test-proof-v1` object. Do not edit `plan.md`, `Status:`, the task's `## Receipt`, or any sibling task.
+- The Develop controller validates the payload, recomputes its digest, checks current provenance, and alone writes process-first Status and inline Receipt.
 ## Execution
-
-1. Detect commands from task and repository files; never invent them.
-2. Run a cheap compile or typecheck precheck when the project provides one.
-3. Execute the exact task command and all named probes with real counts.
-4. For Ordinary non-Spec testing, before any `PASS` or `PASS_WITH_WARNINGS`,
-   read the tests that cover the target or changed code (every test file when
-   the suite is small). When an assertion or its pass condition depends on a
-   nondeterministic source — the clock, randomness, the network, shared
-   filesystem state or test order — the verdict is `FAIL`, naming the source,
-   even when every run passes. When only setup depends on one, rerun just the
-   suspect tests at least twice more; any differing outcome is `FAIL` as flaky.
-   A single green run of such a test is not `PASS`. This step does not apply to
-   process-first Named probes, which run exactly once.
-5. Inspect negative paths, runtime reachability, and declared artifacts.
-6. Capture tracked, untracked, and ignored project-command drift separately
-   from runtime Head. Never silently clean or hide project changes.
-7. Redact sensitive material, validate the complete proof object, then return a
-   concise human report separately from the machine handoff.
+- Detect commands from task and repository files; never invent them.
+- Run a cheap compile or typecheck precheck when the project provides one.
+- Execute the exact task command and all named probes with real counts.
+- For Ordinary non-Spec testing, before any `PASS` or `PASS_WITH_WARNINGS`, read the tests that cover the target or changed code (every test file when the suite is small). When an assertion or its pass condition depends on a nondeterministic source — the clock, randomness, the network, shared filesystem state or test order — the verdict is `FAIL`, naming the source, even when every run passes. When only setup depends on one, rerun just the suspect tests at least twice more; any differing outcome is `FAIL` as flaky. A single green run of such a test is not `PASS`. This step does not apply to process-first Named probes, which run exactly once.
+- Inspect negative paths, runtime reachability, and declared artifacts.
+- Capture tracked, untracked, and ignored project-command drift separately from runtime Head. Never silently clean or hide project changes.
+- Redact sensitive material, validate the complete proof object, then return a concise human report separately from the machine handoff.
 
 Required proof follows the behavior:
 
@@ -113,45 +74,23 @@ Required proof follows the behavior:
 | layout, focus, labels, keyboard | viewport/visual/accessibility check |
 | regression | reproduction before fix plus passing regression |
 | security/performance | only when requirement, risk, or boundary requires it |
-
 ## Process-first proof handoff
-
 The machine payload is canonical UTF-8 JSON with exact top-level keys:
-
 ```text
-schema_version, target, verdict, command, exit, counts, provenance,
-proof_level, expected, observed, reachability, artifacts, branches,
-raw_output, redactions, payload_sha256
+schema_version, target, verdict, command, exit, counts, provenance, proof_level, expected, observed, reachability, artifacts, branches, raw_output, redactions, payload_sha256
 ```
 
-`schema_version` is exactly `test-proof-v1`; unknown keys block. Branch IDs map
-one-to-one to exact unique Named probes. The digest is lowercase SHA-256 of
-stable JSON excluding only `payload_sha256`. Exact field shapes, nullable
-pre-execution `BLOCKED` rules, and aggregation live in
-`references/execution-strategy.md`.
-
-Only all required branches passing with exact command, exit 0, executed > 0,
-failed/skipped 0, matching Base/Head, `reachability.status: PASS`, valid artifact
-hashes, and safe redaction can aggregate `PASS`. Aggregate in this order:
-`FAIL` > `BLOCKED` > `PASS_WITH_WARNINGS` > `PASS`.
+`schema_version` is exactly `test-proof-v1`; unknown keys block. Branch IDs map one-to-one to exact unique Named probes. The digest is lowercase SHA-256 of stable JSON excluding only `payload_sha256`. Exact field shapes, nullable pre-execution `BLOCKED` rules, and aggregation live in `references/execution-strategy.md`.
 
+Only all required branches passing with exact command, exit 0, executed > 0, failed/skipped 0, matching Base/Head, `reachability.status: PASS`, valid artifact hashes, and safe redaction can aggregate `PASS`. Aggregate in this order: `FAIL` > `BLOCKED` > `PASS_WITH_WARNINGS` > `PASS`.
 ## Persistent-write and authentication boundary
-
-- `.hapo/test-memory.json` is optional read-only context. Hash absent/present
-  bytes before and after; never create, merge, or update it during proof.
-- Put only Test-owned temporary files outside the project and clean them.
-  Never create Test-owned reports, caches, lazy installs, or auth state.
-- For authenticated UI proof, prefer the project's own auth helper. Otherwise
-  use only an explicitly selected user-controlled profile bound to a confirmed
-  HTTPS or localhost origin, identity, permissions, and action scope.
-- Block cross-origin redirects and destructive production actions without fresh
-  consent. Never ask for, export, paste, or persist cookies or tokens.
-- Redact Authorization, Cookie, Set-Cookie, session tokens, credentials, and
-  scoped PII from commands, headers/bodies, logs, screenshots, and reports.
-  If safe proof is impossible, return `BLOCKED`.
+- `.hapo/test-memory.json` is optional read-only context. Hash absent/present bytes before and after; never create, merge, or update it during proof.
+- Put only Test-owned temporary files outside the project and clean them. Never create Test-owned reports, caches, lazy installs, or auth state.
+- For authenticated UI proof, prefer the project's own auth helper. Otherwise use only an explicitly selected user-controlled profile bound to a confirmed HTTPS or localhost origin, identity, permissions, and action scope.
+- Block cross-origin redirects and destructive production actions without fresh consent. Never ask for, export, paste, or persist cookies or tokens.
+- Redact Authorization, Cookie, Set-Cookie, session tokens, credentials, and scoped PII from commands, headers/bodies, logs, screenshots, and reports. If safe proof is impossible, return `BLOCKED`.
 
 ## Verdict and report
-
 ```markdown
 ## Test Verdict
 
@@ -170,35 +109,12 @@ hashes, and safe redaction can aggregate `PASS`. Aggregate in this order:
 - [controller handoff, exact failure, or changed prerequisite]
 ```
 
-Do not place the full JSON payload, secrets, verbose raw logs, or screenshots in
-the concise report. `PASS_WITH_WARNINGS` remains unfinished; only literal
-validated `PASS` may be synchronized by the controller.
-
-When the target's task can be read — a process-first packet, or a packet
-`BLOCKED` while it is classified that still holds exactly one regular flat task
-with a readable `Command` and `Named probes` — end the final message with the
-concise report, then a `### Machine handoff (test-proof-v1)` heading and exactly
-one fenced `json` block holding the validated payload. The handoff block follows
-the report and is not part of it. No further fenced block follows it. A
-pre-execution `BLOCKED` takes the same placement; its shape is in
-`references/execution-strategy.md` §4. For any other target, end with the
-report and the line `No payload: target not identifiable.`
-
-## Legacy workflow compatibility
-
-A valid legacy packet keeps the v2.1 adapter, legacy task resolution, and its
-separate receipt path. Do not write process-first inline proof into it. If
-legacy proof identities conflict or the packet is mixed/malformed, return
-`BLOCKED`; never choose one source or migrate it during unrelated testing.
-
-Flash legacy behavior remains proof-only: testing may make a current
-`FLASH_UNVERIFIED` task eligible for trusted sync-finalize, but never promotes
-state or unblocks dependents itself. Only explicit trusted sync-finalize may
-promote it.
+Do not place the full JSON payload, secrets, verbose raw logs, or screenshots in the concise report. `PASS_WITH_WARNINGS` remains unfinished; only literal validated `PASS` may be synchronized by the controller.
 
+When the target's task can be read — a process-first packet, or a packet `BLOCKED` while it is classified that still holds exactly one regular flat task with a readable `Command` and `Named probes` — end the final message with the concise report, then a `### Machine handoff (test-proof-v1)` heading and exactly one fenced `json` block holding the validated payload. The handoff block follows the report and is not part of it. No further fenced block follows it. A pre-execution `BLOCKED` takes the same placement; its shape is in `references/execution-strategy.md` §4. For any other target, end with the report and the line `No payload: target not identifiable.`
+## Flash proof
+Flash behavior remains proof-only: testing may make a current `FLASH_UNVERIFIED` task eligible for trusted sync-finalize, but never promotes state or unblocks dependents itself. Only explicit trusted sync-finalize may promote it.
 ## References
-
-- `references/execution-strategy.md` — routing, payload schema, aggregation,
-  blast radius, UI safety, and report separation.
+- `references/execution-strategy.md` — routing, payload schema, aggregation, blast radius, UI safety, and report separation.
 - `references/failure-triage.md` — failure classification and four verdicts.
 - `references/test-memory.md` — optional read-only historical context.