@jaimevalasek/aioson 1.30.2 → 1.36.0

package/src/commands/workflow-next.js

@@ -23,6 +23,20 @@ const { runSecurityAudit } = require('./security-audit');
 const dossierBootstrap = require('../dossier/dossier-bootstrap');
 const dossierStore = require('../dossier/store');
 const { emitDossierEvent } = require('../lib/dossier-telemetry');
+const { parseVerificationReport } = require('../verification/report-parser');
+const { applyPolicy } = require('../verification/policy-engine');
+const { normalizePolicy } = require('../verification/result');
+const {
+  evaluateContractIntegrityGate,
+  formatContractIntegrityGateError
+} = require('../harness/contract-integrity-gate');
+const { runSpecAnalyze } = require('./spec-analyze');
+const {
+  validateFeatureSlug,
+  featureContextDir,
+  verificationRunsDir,
+  relativeFromRoot
+} = require('../verification/path-policy');
 
 const STATE_RELATIVE_PATH = '.aioson/context/workflow.state.json';
 const CONFIG_RELATIVE_PATH = '.aioson/context/workflow.config.json';
@@ -31,21 +45,34 @@ const SCOPE_CHECK_MODES = new Set(['pre-dev', 'post-dev', 'post-fix', 'final']);
 
 const DEFAULT_FEATURE_WORKFLOW_BY_CLASSIFICATION = {
   MICRO: ['product', 'dev', 'qa'],
-  SMALL: ['product', 'analyst', 'scope-check', 'architect', 'discovery-design-doc', 'dev', 'qa'],
-  // MEDIUM routes through @pm after discovery-design-doc (mirrors the
-  // project-mode position): Gate C requires implementation-plan-{slug}.md and
-  // @pm is its canonical owner (AC-SDLC-15/16) — without the stage, the
-  // sequence dead-ends at @dev preflight with no agent to produce the plan.
-  MEDIUM: ['product', 'analyst', 'architect', 'discovery-design-doc', 'pm', 'scope-check', 'dev', 'pentester', 'qa']
+  // SMALL defaults to the lean lane: @sheldon is the single spec authority
+  // (requirements + spec + design-doc + readiness + plan + harness-contract in
+  // one pass), replacing analyst/scope-check/architect/discovery-design-doc.
+  // Those agents remain available as opt-in detours (allowDetours: true).
+  SMALL: ['product', 'sheldon', 'dev', 'qa'],
+  // MEDIUM collapses the spec phase into @orchestrator — the maestro that fans out
+  // to @analyst + @architect + @pm (+ @ux-ui when UI-heavy) as sub-agents, then
+  // consolidates/verifies/redoes their output into the gated spec package
+  // (requirements + spec[A/B/C approved] + design-doc + readiness + implementation-
+  // plan + harness-contract) and hands to @dev. SMALL = @sheldon solo (vertical),
+  // MEDIUM = @orchestrator fan-out (horizontal). The scope drift check is enforced at
+  // the dev/qa done gate (finalizeCurrentStage). @pentester stays as the post-dev
+  // security stage. analyst/architect/pm/ddd/scope-check/ux-ui remain opt-in detours.
+  MEDIUM: ['product', 'orchestrator', 'dev', 'pentester', 'qa']
 };
 
 // Stages eligible for autopilot handoff (auto_handoff: true in project.context.md).
 // Two segments — see .aioson/docs/autopilot-handoff.md:
-//   1. analyst -> dev: deterministic pre-dev chain. Prompt-only clients stop
-//      before the first @dev entry; workflow:execute --agentic may resume it
-//      through a fresh checkpointed activation.
+//   1. analyst -> dev: deterministic pre-dev chain. Prompt-only clients stop
+//      before the first @dev entry; workflow:execute --agentic may resume it
+//      through a fresh checkpointed activation.
 //   2. post-dev review cycle: @dev → @qa → @tester/@pentester (when their @qa triggers
 //      fire) → @validator → STOPS before feature:close (human approves the close).
+// @product and @sheldon are intentionally absent: per config.md, upstream agents
+// (@briefing/@product/@sheldon) always hand off MANUALLY. In the lean lane
+// (product → sheldon → dev → qa) this means auto_handoff is a deliberate no-op
+// pre-dev — @sheldon is the only pre-dev agent and hands off by hand — and is
+// active only on the post-dev cycle (dev → qa). This is by design, not an omission.
 const AUTOPILOT_HANDOFF_STAGES = new Set([
   'analyst', 'scope-check', 'architect', 'discovery-design-doc', 'pm',
   'dev', 'qa', 'tester', 'pentester', 'validator'
@@ -64,13 +91,21 @@ function normalizeClassification(value, fallback = 'MICRO') {
   return fallback;
 }
 
+// MEDIUM maestro lane: @orchestrator routes straight to @dev (it is the single
+// spec authority that fans out to analyst/architect/pm sub-agents and consolidates).
+function isMaestroOrchestratorState(state) {
+  const sequence = Array.isArray(state && state.sequence) ? state.sequence.map(normalizeAgentName) : [];
+  const idx = sequence.indexOf('orchestrator');
+  return idx !== -1 && sequence[idx + 1] === 'dev';
+}
+
 function buildDefaultWorkflowConfig() {
   return {
     version: 1,
     project: {
       MICRO: ['setup', 'dev'],
-      SMALL: ['setup', 'product', 'analyst', 'scope-check', 'architect', 'discovery-design-doc', 'dev', 'qa'],
-      MEDIUM: ['setup', 'product', 'analyst', 'architect', 'discovery-design-doc', 'ux-ui', 'pm', 'orchestrator', 'scope-check', 'dev', 'qa']
+      SMALL: ['setup', 'product', 'sheldon', 'dev', 'qa'],
+      MEDIUM: ['setup', 'product', 'orchestrator', 'dev', 'qa']
     },
     feature: DEFAULT_FEATURE_WORKFLOW_BY_CLASSIFICATION,
     rules: {
@@ -114,6 +149,18 @@ function getScopeCheckModeOption(options = {}) {
   );
 }
 
+function resolveVerificationPolicy(options = {}, state = {}) {
+  const explicit = options.verificationPolicy ||
+    options['verification-policy'] ||
+    options.verification_policy ||
+    options.policy;
+  if (explicit) return normalizePolicy(explicit) || 'standard';
+  // No explicit policy: MEDIUM features default to strict so the auto-injected
+  // scope-check verification briefing matches the strict `--check-report` the
+  // @dev / @scope-check prompts run. Smaller tiers stay advisory (standard).
+  return String(state.classification || '').toUpperCase() === 'MEDIUM' ? 'strict' : 'standard';
+}
+
 function chooseActiveFeature(features, preferredSlug = null) {
   const activeFeatures = (features || []).filter((feature) => feature.status === 'in_progress');
   if (preferredSlug) {
@@ -330,6 +377,19 @@ async function validateStageArtifacts(targetDir, state, stage) {
   }
 
   if (stage === 'orchestrator') {
+    // Maestro lane (MEDIUM, orchestrator → dev): the orchestrator is the single
+    // spec authority — "done" once the gated spec package exists (mirrors how the
+    // per-hop stages were inferred). Otherwise it is the parallel-impl coordinator
+    // and owns the lane workspace.
+    if (state.mode === 'feature' && slug && isMaestroOrchestratorState(state)) {
+      const designDoc = [path.join(base, `design-doc-${slug}.md`), path.join(base, 'design-doc.md')];
+      const readiness = [path.join(base, `readiness-${slug}.md`), path.join(base, 'readiness.md')];
+      return (await exists(path.join(base, `requirements-${slug}.md`)))
+        && (await exists(path.join(base, `spec-${slug}.md`)))
+        && (await exists(path.join(base, `implementation-plan-${slug}.md`)))
+        && (await anyExists(designDoc))
+        && (await anyExists(readiness));
+    }
     return await exists(path.join(base, 'parallel'));
   }
 
@@ -746,9 +806,94 @@ async function finalizeCurrentStage(targetDir, config, state, stageName) {
   if (!normalizedStage) {
     throw new Error('No stage is active to complete.');
   }
+  let auditCodeSummary = null;
 
   // ── Harness Done Gate ───────────────────────────────────────────────────
   if (state.mode === 'feature' && state.featureSlug) {
+    if (normalizedStage === 'dev' || normalizedStage === 'qa') {
+      const integrityGate = await evaluateContractIntegrityGate(targetDir, state.featureSlug, {
+        runChecks: true
+      });
+      if (!integrityGate.ok) {
+        const errMsg = formatContractIntegrityGateError(integrityGate, normalizedStage);
+        await logError(targetDir, normalizedStage, errMsg, 'harness-contract');
+        throw new Error(errMsg);
+      }
+
+      // ── Scope drift gate (absorbs @scope-check's deterministic spec:analyze) ──
+      // scope-check is no longer a default stage; preserve its drift check so a
+      // dev/qa completion still blocks on real drift — a design-doc/readiness that
+      // declares `readiness: blocked`, or a malformed/invalid harness-contract.json.
+      // Non-strict spec:analyze only raises error-severity findings for those
+      // genuine problems (never for merely-absent artifacts), so this never
+      // false-blocks an artifact-light feature. Defensive: never crashes the run.
+      try {
+        const drift = await runSpecAnalyze({
+          args: [targetDir],
+          options: { feature: state.featureSlug },
+          logger: { log() {}, error() {} }
+        });
+        if (drift && Array.isArray(drift.findings) && drift.summary && drift.summary.errors > 0) {
+          const errs = drift.findings
+            .filter((f) => f.severity === 'error')
+            .map((f) => `  - ${f.check}: ${f.message}`)
+            .join('\n');
+          const driftMsg = `[Scope Drift Gate] @${normalizedStage} blocked — spec:analyze found ${drift.summary.errors} drift error(s):\n${errs}\nResolve the drift (or run @scope-check) before completing this stage.`;
+          await logError(targetDir, normalizedStage, driftMsg, 'scope-drift');
+          throw new Error(driftMsg);
+        }
+      } catch (driftErr) {
+        if (driftErr && driftErr.message && driftErr.message.includes('[Scope Drift Gate]')) throw driftErr;
+        // spec:analyze unavailable or non-analyzable — non-blocking
+      }
+
+      // ── Code-quality gate (deterministic audit:code) ───────────────────────
+      // Build-free scan of the changed files for the non-security categories
+      // (anti-patterns / TODOs / dead code / duplication). Unlike the integrity
+      // and drift gates above — which enforce the feature's DECLARED contract /
+      // spec — audit:code is a heuristic opinion, so it defaults to ADVISORY: the
+      // report is persisted (.aioson/context/audit-code.json), a guard event is
+      // emitted, and a summary rides the finalize result, but the stage is NOT
+      // blocked. Set verification.json `audit_code.tracked_gate: "block"` to make a
+      // HIGH finding in scope a hard gate, or "off" to skip. Defensive: only a
+      // deliberate block-mode throw escapes; any other error is swallowed.
+      try {
+        const { readVerificationConfig, getAuditCodePolicy } = require('../verification-policy');
+        const auditPolicy = getAuditCodePolicy(await readVerificationConfig(targetDir));
+        if (auditPolicy.tracked_gate !== 'off') {
+          const { runAuditCode } = require('./audit-code');
+          const codeAudit = await runAuditCode({
+            args: [targetDir],
+            options: { changed: auditPolicy.scope !== 'full', json: true, suppressExitCode: true },
+            logger: { log() {}, error() {} }
+          });
+          const high = codeAudit && codeAudit.by_severity ? (codeAudit.by_severity.HIGH || 0) : 0;
+          const med = codeAudit && codeAudit.by_severity ? (codeAudit.by_severity.MED || 0) : 0;
+          const categories = Object.keys((codeAudit && codeAudit.by_category) || {});
+          auditCodeSummary = { gate: auditPolicy.tracked_gate, scope: auditPolicy.scope, high, med, categories };
+          if (high > 0 && auditPolicy.tracked_gate === 'block') {
+            const msg = `[Code-Quality Gate] @${normalizedStage} blocked — audit:code found ${high} HIGH finding(s) in the ${auditPolicy.scope} files (${categories.join(', ')}). Fix them, or relax verification.json audit_code.tracked_gate to "advisory"/"off". See .aioson/context/audit-code.json`;
+            await logError(targetDir, normalizedStage, msg, 'audit-code');
+            throw new Error(msg);
+          }
+          if (high > 0) {
+            try {
+              const { emitGuardEvent } = require('../harness/guard-events');
+              await emitGuardEvent(targetDir, {
+                eventType: 'audit_code_findings',
+                agent: normalizedStage,
+                message: `${high} HIGH / ${med} MED in ${auditPolicy.scope} files (${categories.join(', ')}) — advisory`,
+                payload: { slug: state.featureSlug, high, med, scope: auditPolicy.scope }
+              });
+            } catch { /* telemetry best-effort */ }
+          }
+        }
+      } catch (auditErr) {
+        if (auditErr && auditErr.message && auditErr.message.includes('[Code-Quality Gate]')) throw auditErr;
+        // audit:code unavailable / non-git — non-blocking
+      }
+    }
+
     const contractPath = path.join(targetDir, '.aioson', 'plans', state.featureSlug, 'harness-contract.json');
     const progressPath = path.join(targetDir, '.aioson', 'plans', state.featureSlug, 'progress.json');
     
@@ -848,7 +993,11 @@ async function finalizeCurrentStage(targetDir, config, state, stageName) {
     detour: null
   });
 
-  return { state: nextState, completedStage: normalizedStage };
+  return {
+    state: nextState,
+    completedStage: normalizedStage,
+    ...(auditCodeSummary ? { auditCode: auditCodeSummary } : {})
+  };
 }
 
 /**
@@ -1032,6 +1181,8 @@ async function resolveStageDependencies(targetDir, state, stageName, agent) {
       'readiness.md',
       'ui-spec.md',
       slug ? `implementation-plan-${slug}.md` : 'implementation-plan.md',
+      slug ? `features/${slug}/implementation-ledger.md` : null,
+      slug ? `features/${slug}/verification-report.md` : null,
       'dev-state.md',
       'last-handoff.json',
       'project-pulse.md'
@@ -1139,6 +1290,146 @@ function buildScopeCheckActivationContext(state, mode) {
   return lines.join('\n');
 }
 
+function routeLabel(route) {
+  return route ? `@${normalizeAgentName(route)}` : '@qa';
+}
+
+function workflowGuidanceForVerification(verdict, route, normalReturnTo) {
+  if (verdict === 'PASS') {
+    return `PASS: keep normal workflow ownership (${routeLabel(normalReturnTo || route)}), then continue diff/scope review.`;
+  }
+  if (verdict === 'NEEDS_DEV_FIX') {
+    return 'NEEDS_DEV_FIX: do not approve clean post-dev scope; route concrete file:line findings to @dev.';
+  }
+  if (verdict === 'NEEDS_SCOPE_DECISION') {
+    return `NEEDS_SCOPE_DECISION: route to ${routeLabel(route)}; do not patch product scope locally.`;
+  }
+  if (verdict === 'NEEDS_QA_RECHECK') {
+    return 'NEEDS_QA_RECHECK: route to @qa after scope alignment is clear.';
+  }
+  if (verdict === 'NEEDS_SECURITY_REVIEW') {
+    return 'NEEDS_SECURITY_REVIEW: preserve the security review owner and route to @pentester.';
+  }
+  return `INCONCLUSIVE: route to the owner of missing evidence (${routeLabel(route)}) when strict verification applies.`;
+}
+
+async function findImplementationVerificationReport(targetDir, slug) {
+  const slugResult = validateFeatureSlug(slug);
+  if (!slugResult.ok) return null;
+
+  const latestPath = path.join(featureContextDir(targetDir, slug), 'verification-report.md');
+  if (await exists(latestPath)) {
+    return {
+      absolutePath: latestPath,
+      relativePath: relativeFromRoot(targetDir, latestPath),
+      source: 'latest'
+    };
+  }
+
+  const runsDir = verificationRunsDir(targetDir, slug);
+  let entries = [];
+  try {
+    entries = await fs.readdir(runsDir);
+  } catch {
+    return null;
+  }
+  const reportName = entries
+    .filter((entry) => /-report\.md$/i.test(entry))
+    .sort()
+    .pop();
+  if (!reportName) return null;
+
+  const reportPath = path.join(runsDir, reportName);
+  return {
+    absolutePath: reportPath,
+    relativePath: relativeFromRoot(targetDir, reportPath),
+    source: 'verification-runs'
+  };
+}
+
+async function buildImplementationVerificationBriefing(targetDir, state, scopeCheckMode, policy) {
+  const mode = inferScopeCheckMode(state, scopeCheckMode);
+  if (
+    state.mode !== 'feature' ||
+    !state.featureSlug ||
+    !['post-dev', 'post-fix', 'final'].includes(mode)
+  ) {
+    return null;
+  }
+
+  const slug = state.featureSlug;
+  const latestPath = `.aioson/context/features/${slug}/verification-report.md`;
+  const reportRef = await findImplementationVerificationReport(targetDir, slug);
+  const lines = [
+    '## Implementation verification briefing',
+    `Policy: ${policy}`,
+    `Expected latest report: ${latestPath}`,
+    'Workflow note: this briefing only validates local report artifacts; it never runs `--tool` or any external auditor.'
+  ];
+
+  if (!reportRef) {
+    lines.push('Report status: missing');
+    if (state.classification === 'MICRO') {
+      lines.push('MICRO: missing report is not a workflow blocker by default; record residual risk only when the dev handoff relied on verification.');
+    } else if (state.classification === 'MEDIUM' && policy === 'strict') {
+      lines.push('Strict MEDIUM guidance: do not issue final clean scope approval until @dev produces a valid report or documents an explicit N/A rationale.');
+    } else {
+      lines.push('Guidance: absence is advisory unless the feature policy or dev handoff made verification strict.');
+    }
+    return {
+      status: 'missing',
+      mode,
+      policy,
+      report_path: null,
+      verdict: 'INCONCLUSIVE',
+      recommended_route: state.classification === 'MICRO' ? state.next || 'qa' : 'dev',
+      briefing: lines.join('\n')
+    };
+  }
+
+  lines.push(`Report path: ${reportRef.relativePath}`);
+  lines.push(`Validate command: aioson verify:implementation . --feature=${slug} --check-report=${reportRef.relativePath} --policy=${policy} --json`);
+
+  const parsed = await parseVerificationReport(targetDir, slug, reportRef.relativePath, policy);
+  if (!parsed.ok) {
+    lines.push(`Report status: invalid (${parsed.reason})`);
+    lines.push('Guidance: treat this as INCONCLUSIVE local evidence; do not treat auditor prose as PASS.');
+    return {
+      status: 'invalid',
+      mode,
+      policy,
+      report_path: reportRef.relativePath,
+      verdict: 'INCONCLUSIVE',
+      recommended_route: 'qa',
+      reason: parsed.reason,
+      briefing: lines.join('\n')
+    };
+  }
+
+  const policyResult = applyPolicy(parsed.report, policy);
+  lines.push('Report status: schema-valid');
+  lines.push(`Report verdict: ${parsed.report.verdict}`);
+  lines.push(`Policy verdict: ${policyResult.verdict}`);
+  lines.push(`Policy route: ${routeLabel(policyResult.recommended_route)}`);
+  lines.push(`Blocking findings: ${policyResult.blocking_findings_count || 0}`);
+  lines.push(`Guidance: ${workflowGuidanceForVerification(policyResult.verdict, policyResult.recommended_route, state.next)}`);
+  lines.push('Scope-check still must inspect the diff and approved plan; a PASS report is not final approval.');
+
+  return {
+    status: 'valid',
+    mode,
+    policy,
+    report_path: reportRef.relativePath,
+    report_source: reportRef.source,
+    verdict: policyResult.verdict,
+    auditor_verdict: parsed.report.verdict,
+    recommended_route: policyResult.recommended_route,
+    blocking_findings_count: policyResult.blocking_findings_count || 0,
+    reason: policyResult.reason,
+    briefing: lines.join('\n')
+  };
+}
+
 function buildStageActivationContext(state, stageName, dependencies, scopeCheckMode = null) {
   if (stageName === 'scope-check') {
     return buildScopeCheckActivationContext(state, scopeCheckMode);
@@ -1155,7 +1446,16 @@ function buildStageActivationContext(state, stageName, dependencies, scopeCheckM
   ].join('\n');
 }
 
-async function activateStage(targetDir, state, locale, tool, explicitAgent = null, requestedMode = null, scopeCheckMode = null) {
+async function activateStage(
+  targetDir,
+  state,
+  locale,
+  tool,
+  explicitAgent = null,
+  requestedMode = null,
+  scopeCheckMode = null,
+  verificationPolicy = 'standard'
+) {
   const stageName = normalizeAgentName(explicitAgent || state.current || state.next);
   if (!stageName) {
     return {
@@ -1270,6 +1570,13 @@ async function activateStage(targetDir, state, locale, tool, explicitAgent = nul
 
   const instructionPath = await resolveExistingInstructionPath(targetDir, agent, locale);
   const dependencies = await resolveStageDependencies(targetDir, state, stageName, agent);
+  const verificationBriefing = stageName === 'scope-check'
+    ? await buildImplementationVerificationBriefing(targetDir, state, scopeCheckMode, verificationPolicy)
+    : null;
+  const activationContext = [
+    buildStageActivationContext(state, stageName, dependencies, scopeCheckMode),
+    verificationBriefing && verificationBriefing.briefing
+  ].filter(Boolean).join('\n\n');
   let prompt = buildAgentPrompt(agent, tool, {
     instructionPath,
     targetDir,
@@ -1278,7 +1585,7 @@ async function activateStage(targetDir, state, locale, tool, explicitAgent = nul
     capabilitySummary: buildAgentCapabilitySummary(agentManifest, tool),
     dependsOn: dependencies,
     autoHandoff,
-    activationContext: buildStageActivationContext(state, stageName, dependencies, scopeCheckMode)
+    activationContext
   });
 
   if (testBriefing) {
@@ -1316,7 +1623,20 @@ async function activateStage(targetDir, state, locale, tool, explicitAgent = nul
     agent: stageName,
     instructionPath,
     prompt,
-    effectiveMode
+    effectiveMode,
+    verification: verificationBriefing
+      ? {
+          status: verificationBriefing.status,
+          mode: verificationBriefing.mode,
+          policy: verificationBriefing.policy,
+          report_path: verificationBriefing.report_path,
+          verdict: verificationBriefing.verdict,
+          auditor_verdict: verificationBriefing.auditor_verdict || null,
+          recommended_route: verificationBriefing.recommended_route,
+          blocking_findings_count: verificationBriefing.blocking_findings_count || 0,
+          reason: verificationBriefing.reason || null
+        }
+      : null
   };
 }
 
@@ -1416,7 +1736,8 @@ async function runWorkflowNext({ args, options, logger, t }) {
       const autoHeal = Boolean(options['auto-heal'] || options.autoHeal);
       const isHealabled = autoHeal && (
         err.message.includes('[Technical Gate BLOCKED]') ||
-        err.message.includes('[Handoff Contract BLOCKED]')
+        err.message.includes('[Handoff Contract BLOCKED]') ||
+        err.message.includes('[Harness Contract Gate BLOCKED]')
       );
       if (isHealabled) {
         const failedStage = normalizeAgentName(options.complete === true ? state.current || state.next : options.complete);
@@ -1425,7 +1746,16 @@ async function runWorkflowNext({ args, options, logger, t }) {
         if (retryCount < require('../self-healing').MAX_RETRIES) {
           await require('../self-healing').incrementRetryCount(targetDir, failedStage, err.message.substring(0, 200));
           // Build healing activation
-          const baseActivation = await activateStage(targetDir, state, locale, tool, failedStage, options.mode || null);
+          const baseActivation = await activateStage(
+            targetDir,
+            state,
+            locale,
+            tool,
+            failedStage,
+            options.mode || null,
+            null,
+            resolveVerificationPolicy(options, state)
+          );
           const healingPrompt = buildHealingPrompt(
             baseActivation.prompt || '',
             failedStage,
@@ -1552,7 +1882,17 @@ async function runWorkflowNext({ args, options, logger, t }) {
   const activationAgent = normalizeAgentName(requestedAgent || state.current || state.next);
   const scopeCheckMode = activationAgent === 'scope-check' ? getScopeCheckModeOption(options) : null;
   const requestedAutonomyMode = scopeCheckMode && activationAgent === 'scope-check' ? null : options.mode || null;
-  const activation = await activateStage(targetDir, state, locale, tool, requestedAgent, requestedAutonomyMode, scopeCheckMode);
+  const verificationPolicy = resolveVerificationPolicy(options, state);
+  const activation = await activateStage(
+    targetDir,
+    state,
+    locale,
+    tool,
+    requestedAgent,
+    requestedAutonomyMode,
+    scopeCheckMode,
+    verificationPolicy
+  );
   state = activation.state;
 
   // ── Living Memory: if a reflect manifest is pending (created above by the
@@ -1590,7 +1930,8 @@ async function runWorkflowNext({ args, options, logger, t }) {
     completed: state.completed,
     skipped: state.skipped,
     sequence: state.sequence,
-    autonomyMode: activation.effectiveMode || null
+    autonomyMode: activation.effectiveMode || null,
+    verification: activation.verification || null
   };
   await appendWorkflowEvent(targetDir, eventPayload);
   const runtime = await syncWorkflowRuntime(targetDir, {
@@ -1645,6 +1986,7 @@ async function runWorkflowNext({ args, options, logger, t }) {
     runtime,
     agent: activation.agent,
     effectiveMode: activation.effectiveMode || null,
+    verification: activation.verification || null,
     instructionPath: activation.instructionPath,
     prompt: activation.prompt
   };

package/src/commands/workflow-plan.js

@@ -3,11 +3,11 @@
 const path = require('node:path');
 const { validateProjectContextFile } = require('../context');
 
-const WORKFLOW_BY_CLASSIFICATION = {
-  MICRO: ['setup', 'dev'],
-  SMALL: ['setup', 'product', 'analyst', 'scope-check', 'architect', 'dev', 'qa'],
-  MEDIUM: ['setup', 'product', 'analyst', 'architect', 'ux-ui', 'pm', 'orchestrator', 'scope-check', 'dev', 'qa']
-};
+const WORKFLOW_BY_CLASSIFICATION = {
+  MICRO: ['setup', 'dev'],
+  SMALL: ['setup', 'product', 'sheldon', 'dev', 'qa'],
+  MEDIUM: ['setup', 'product', 'orchestrator', 'dev', 'qa']
+};
 
 function normalizeClassification(value, fallback = 'MICRO') {
   const text = String(value || '').trim().toUpperCase();

package/src/constants.js

@@ -46,6 +46,8 @@ const MANAGED_FILES = [
   '.aioson/docs/squad/session-operations.md',
   '.aioson/docs/squad/genome-bindings.md',
   '.aioson/docs/feature-expansion-taxonomy.md',
+  '.aioson/docs/prototype-contract.md',
+  '.aioson/docs/reference-identity.md',
   '.aioson/docs/product/conversation-playbook.md',
   '.aioson/docs/product/research-loop.md',
   '.aioson/docs/product/quality-lens.md',
@@ -81,6 +83,8 @@ const MANAGED_FILES = [
   '.aioson/skills/process/briefing-expansion-scout/SKILL.md',
   '.aioson/skills/process/product-scope-expansion/SKILL.md',
   '.aioson/skills/process/sheldon-expansion-audit/SKILL.md',
+  '.aioson/skills/process/prototype-forge/SKILL.md',
+  '.aioson/skills/process/reference-identity-extract/SKILL.md',
   '.aioson/skills/static/laravel-conventions.md',
   '.aioson/skills/static/tall-stack-patterns.md',
   '.aioson/skills/static/jetstream-setup.md',

package/src/gateway-pointer-merge.js

@@ -31,6 +31,12 @@ function buildBlock(templateContent) {
   return `${MARKER_BEGIN}\n${BLOCK_NOTICE}\n\n${body}${MARKER_END}\n`;
 }
 
+function trimBlankLinesAfterBlock(content, rangeEnd) {
+  let end = rangeEnd;
+  while (content[end] === '\n' || content[end] === '\r') end += 1;
+  return end;
+}
+
 function findBlockRange(content) {
   const start = content.indexOf(MARKER_BEGIN);
   if (start === -1) return null;
@@ -71,7 +77,7 @@ async function mergeGatewayPointer({ templatePath, targetPath, backupRoot, targe
   let action;
   if (range) {
     const before = stripLegacyUnmanagedGateway(existing.slice(0, range.start));
-    const after = existing.slice(range.end);
+    const after = existing.slice(trimBlankLinesAfterBlock(existing, range.end));
     const cleanBefore = before.length === 0 || before.endsWith('\n') ? before : `${before}\n`;
     next = `${cleanBefore}${block}${after}`;
     action = 'block_updated';