@khoavu882/doflow 2.0.0 → 2.0.1

package/core/shared/skills/do-flow/references/task_classes.md

@@ -125,10 +125,10 @@ A `caller-not-a-stage` rejection is about **you**, not about the class. Answer i
 stage — propose one of those, or hand the work to the skill this class names for the stage you
 meant. Re-proposing the same class will be rejected the same way.
 
-## The hard hook does not know about classes
+## The advisory hook does not know about classes
 
-`pre-implement-gate.sh` keys on branch and artifact state (what it denies: SKILL.md step 7): if the
-current branch already carries a feature directory the gate rejects, it denies source edits
+`pre-implement-gate.sh` keys on branch and artifact state (what it advises on: SKILL.md step 7): if the
+current branch already carries a feature directory the gate flags, it advises on source edits
 regardless of the class in play — so a `bug` or `trivial-edit` workflow started on that branch will
-be blocked at its implementation stage. Surface the hook's message as written. Do not route around
-it, and do not create placeholder artifacts to satisfy it.
+get that advisory at its implementation stage. Surface the hook's message as written. Do not route
+around it, and do not create placeholder artifacts to satisfy it.

package/core/shared/skills/do-implement/SKILL.md

@@ -53,6 +53,8 @@ Run every command below from the project root — the walk-up starts at `$PWD`.
 
 **Stop when** every work-list finding the contract names has an answer or a stated gap, **and** the last round produced no new work-list finding. A round that only restates what you already have is the last round. Report the remaining gaps rather than continuing.
 
+Once per stage, after `feature_slug` resolves, run `"$DOFLOW" attendance --task-id "<feature_slug>"`; `unattended` → `references/WORKFLOW_HANDOFF.md` § Unattended stage.
+
 2. **Resolve the task id, then evaluate readiness — skip only when standalone**:
    - `<task id>` is the same unit every recording stage keys on: the plan task id when one exists,
      otherwise the feature slug that step 1's `"$DOFLOW" paths --json` resolved, or the issue id you
@@ -73,9 +75,9 @@ Run every command below from the project root — the walk-up starts at `$PWD`.
      of `bug`, `refactor`, `dependency-change` or `trivial-edit` the recorded work already fits.
      `do-implement` never serves `feature`; that class's implementation stage is `/do-execute-plan`.
      ```bash
-     "$DOFLOW" classify --task-class "<proposed>" --calling-skill do-implement --json
+     "$DOFLOW" classify --task-class "<proposed>" --calling-skill do-implement --view brief --json
      ```
-     Branch on the returned `outcome`, not the exit code. `ACCEPTED` — the returned `workflow` names
+     Branch on `outcome`, not the exit code. `ACCEPTED` — the returned `workflow` names
      the validated class to evaluate readiness against. `REJECTED` — stop, print `message` verbatim
      (it names `validClasses`), ask the user to choose from that set, then re-validate; never
      substitute `feature` for the class that was rejected.
@@ -118,8 +120,8 @@ Run every command below from the project root — the walk-up starts at `$PWD`.
      established.
    - The repository's `pre-implement-gate` hook checks file existence (`requirement.md` /
      `design.md` / `plan.md`) on every `Edit`/`Write` call regardless of which skill is editing. On
-     a harness with an edit hook it also denies the edit of a task held to a readiness record that
-     is not `READY`; this step writes that record, and is not a way around the hook.
+     a harness with an edit hook it also advises when a held task's readiness record is not
+     `READY`; the hook never denies. This step writes that record, and is not a way around it.
 
 3. **Understand before writing**:
    - Read the files the change touches and their immediate neighbors — naming conventions, error
@@ -146,8 +148,8 @@ Run every command below from the project root — the walk-up starts at `$PWD`.
      unimplemented mock functions, or `throw new Error('Not implemented')` placeholders in the
      produced change. Every changed component must be fully wired and functional.
    - Before the first source edit, a run for this task needs step 2's recorded readiness to be
-     `READY`: the hook denies the edit otherwise where there is one, and elsewhere step 7's handoff
-     is refused after the edits are made. A standalone `NEEDS_EVIDENCE` does not pass it.
+     `READY`: the edit hook only advises, and the runtime refuses step 7's handoff after the edits are
+     made. A standalone `NEEDS_EVIDENCE` does not pass it.
    - Keep it scoped to what was asked — no bonus refactors, no speculative abstractions (the same
      scope-discipline rule the chain's own artifacts would otherwise remind you of; here, hold
      yourself to it directly).
@@ -215,6 +217,6 @@ advance past the mutating stage only this skill may complete.
 multi-task checklist through specialist subagents — that is `/do-execute-plan`'s job once a real
 plan exists; silently override the repository's own `pre-implement-gate` hook. That hook triggers
 on any `Edit`/`Write` call, not on which skill made it — a branch mid-chain with a started feature
-but no `design.md` still gets blocked here exactly as it would anywhere else, and that is by
+but no `design.md` still gets the same advisory here as it would anywhere else, and that is by
 design, not a gap this skill works around. Resolve a workflow gate, or start a workflow run for a
 standalone implementation.

package/core/shared/skills/do-plan/SKILL.md

@@ -37,13 +37,15 @@ Run every command below from the project root — the walk-up starts at `$PWD`.
 
 `feature_slug` `null` with a non-empty `candidate_slugs` is an unresolved choice, not "no active feature": ask one option per entry, re-resolve with `"$DOFLOW" paths --json --slug="<chosen>"`, and use that slug for the rest of this flow. `/do-flow` passing `--slug` already resolves it — no prompt then.
 
+Once per stage, after `feature_slug` resolves, run `"$DOFLOW" attendance --task-id "<feature_slug>"`; `unattended` → `references/WORKFLOW_HANDOFF.md` § Unattended stage.
+
 2. **Propose one task class; the runtime validates it** — name exactly one class id for the work
    being planned. `/do-flow` passes one when it invoked this skill; a user who named one settles it;
    otherwise derive it from `requirement.md` and `design.md`, not from their mere existence.
    ```bash
-   "$DOFLOW" classify --task-class "<proposed>" --calling-skill do-plan --json
+   "$DOFLOW" classify --task-class "<proposed>" --calling-skill do-plan --view brief --json
    ```
-Branch on the returned `outcome` field, not the exit code.
+Branch on `outcome`, not the exit code.
 - **`ACCEPTED`** — the returned `workflow` is this run's plan of record; read `stages`, `gates` and `handoff` off it rather than from memory.
 - **`REJECTED`** — **stop.** Print `message` verbatim (it already names `validClasses` and any `suggestions`), ask the user to choose from `validClasses`, then re-validate. Never substitute `feature`.
   A rejection may be about **you** rather than the class (`reason: caller-not-a-stage`). Then the fix is to propose one of the classes in `fit.hostingClasses`, or to hand the work to the skill this class names for the stage you meant — not to re-propose the same class.
@@ -59,8 +61,8 @@ stages to implementation, and writing them a `plan.md` adds a gate their workflo
 not have.
 
 3. **Precondition (advisory)** — if `has_requirement` or `has_design` is false, warn and offer to
-   run `/do-brainstorm` / `/do-design` first. This gate is **advisory** (skippable), not the hard
-   hook gate.
+   run `/do-brainstorm` / `/do-design` first. This gate is **advisory** (skippable), like the edit
+   hook.
 4. **Read inputs** — compile the recorded prior context first, using the same task id rule step 10
    uses below (the plan task id for anything already scoped to a single `- [ ]` task, otherwise the
    feature slug):
@@ -124,7 +126,7 @@ Filling §8's task dependency graph, read the guidance tree's `references/DIAGRA
    SHOULD`) and PASS/FAIL; a base MUST that tier-2 makes SHOULD names that overlay version in its
    row. On a violation, revise the approach first. A MUST marked FAIL or left
    without a row refuses step 11's handoff; a SHOULD FAIL is a note. That refusal is the runtime's,
-   beside the hard hook that covers artifact existence (`references/DOFLOW_CHAIN.md` scopes both).
+   beside the advisory hook on artifact existence (`references/DOFLOW_CHAIN.md` scopes both).
    There is no waiver: revise the plan, or a person amends the constitution with `/do-constitution`.
 7. **Decompose into Tasks (section 8)** — dependency-ordered, `[US#]`-traced to the requirement's
    user stories, owner+files named per task, with checkpoints and completion criteria.
@@ -197,7 +199,8 @@ Item schema, provenance rules, and the refused-field list: the guidance tree's `
    ```bash
    "$DOFLOW" render-audit --slug="<task id>" --json
    ```
-   Leave any returned approval gate for `/do-flow` or `/do-execute-plan` to present.
+   Leave any returned approval gate for `/do-flow` or `/do-execute-plan` to present (unattended: the loop
+   decides it by policy).
 
 12. **Stop** — report the plan path, Constitution Check result, the task count (`[P]`/sequential),
    and the derived branch name/repo count when the Repo Branch Plan is populated.

package/core/shared/workflows/do-flow-chain.md

@@ -13,5 +13,7 @@ delivery sequence, pausing where human judgment matters:
 5. Execute `/do-execute-plan --scope next` repeatedly until the plan's checklist is complete.
 6. Run `/do-test`, then `/do-code-review`, and report both results before proposing any commit.
 
+Unattended (no person watching), stop at each pause above and report; silence is never approval.
+
 If the user comments directly inside any specification file, re-read it, apply the requested
 changes, and ask for approval again before moving on.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@khoavu882/doflow",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "DoFlow config installer — npx CLI for the registry-driven multi-harness install/update/remove lifecycle",
   "keywords": [
     "claude-code",

package/src/adapters/claude/index.js

@@ -29,6 +29,12 @@ const SETTINGS_RENDERER = 'claude-settings';
  *    its install destination is declared (paths.statuslineScript).
  */
 const SETTINGS_FILES = ['settings.json', 'keybindings.json'];
+/** Hook entries an earlier DoFlow wrote into settings.json and no longer ships. The update prunes their
+ * scripts, so a merge strips these entries from the live file (and a remove does too) instead of leaving a
+ * hook that points at a missing script. Written in the global form; `retiredHooks` rewrites the prefix for project scope. */
+const RETIRED_SETTINGS_HOOKS = {
+  PreToolUse: [{ matcher: 'Bash', hooks: [{ type: 'command', command: `${GLOBAL_HOOK_PREFIX}pre-bash-guard.sh` }] }],
+};
 
 function sha256(value     ) {
   return crypto.createHash('sha256').update(value).digest('hex');
@@ -194,6 +200,18 @@ function createClaudeAdapter({ declaredPaths = declaredHarnessPaths().claude } =
     const { hooks, ...rest } = parsed;
     return { raw: serializeSettings(rest), droppedHooks: hooks };
   }
+  function retiredHooks(scope     ) {
+    const raw = JSON.stringify(RETIRED_SETTINGS_HOOKS);
+    return JSON.parse(scope === 'global' ? raw : raw.split(GLOBAL_HOOK_PREFIX).join(PROJECT_HOOK_PREFIX));
+  }
+  /** The managed settings text with the retired hook entries added, so a remove strips them as well. */
+  function withRetiredHooks(raw     , scope     ) {
+    let parsed;
+    try { parsed = JSON.parse(raw); } catch { return raw; }
+    const hooks = { ...(parsed.hooks || {}) };
+    for (const [event, entries] of Object.entries     (retiredHooks(scope))) hooks[event] = [...(hooks[event] || []), ...entries];
+    return JSON.stringify({ ...parsed, hooks });
+  }
   /** The live settings without DoFlow's own entries of `hooks`; every other key is left alone. */
   function withoutManagedHooks(current     , hooks     ) {
     if (!hooks || !current || typeof current !== 'object' || current.hooks === undefined) return current;
@@ -246,7 +264,9 @@ function createClaudeAdapter({ declaredPaths = declaredHarnessPaths().claude } =
         // entries, so a drifted file is safe to process rather than a reason to refuse.
         changes.push({ assetId: asset.id, target, operation: 'remove', ownershipIdentity: `doflow:claude:settings:${fileName}`,
           ...settingsChangeExtras(fileName), fingerprint: prev.fingerprint,
-          managed: settingsContent(fileName, fs.readFileSync(sourceAbs, 'utf8'), scope),
+          managed: fileName === 'settings.json'
+            ? withRetiredHooks(settingsContent(fileName, fs.readFileSync(sourceAbs, 'utf8'), scope), scope)
+            : settingsContent(fileName, fs.readFileSync(sourceAbs, 'utf8'), scope),
           projection: { renderer: SETTINGS_RENDERER } });
       }
       if (previous.get(statuslineScriptName)) {
@@ -286,7 +306,8 @@ function createClaudeAdapter({ declaredPaths = declaredHarnessPaths().claude } =
         const currentRaw = fs.readFileSync(target, 'utf8');
         let merged;
         try {
-          merged = mergeSettings(withoutManagedHooks(JSON.parse(currentRaw), tiered.droppedHooks), JSON.parse(managedRaw));
+          const live = fileName === 'settings.json' ? withoutManagedHooks(JSON.parse(currentRaw), retiredHooks(scope)) : JSON.parse(currentRaw);
+          merged = mergeSettings(withoutManagedHooks(live, tiered.droppedHooks), JSON.parse(managedRaw));
         } catch {
           conflicts.push(`${fileName} is not valid JSON and cannot be merged`);
           continue;

package/src/adapters/codex/hooks.js

@@ -17,6 +17,41 @@ const SUPPORTED_EVENTS = new Set([
   'UserPromptSubmit', 'SubagentStop', 'Stop', 'SessionStart', 'SubagentStart', 'SessionEnd',
 ]);
 
+// An earlier DoFlow wired a pre-bash-guard front door into hooks.json and deployed its script. Both
+// are gone from the shipped source; a merge drops the entry from the live file so an updated install
+// does not keep a hook that runs a script nothing refreshes, and the script goes with it. Only the
+// exact command DoFlow shipped is dropped: a user's own hook that happens to name a script of the same
+// file name stays.
+const RETIRED_HOOK_SCRIPT = 'pre-bash-guard.sh';
+const RETIRED_HOOK_COMMAND = 'bash "$(root=$(git rev-parse --show-toplevel 2>/dev/null) && [ -f "$root/.codex/hooks/pre-bash-guard.sh" ] && printf \'%s/.codex/hooks/pre-bash-guard.sh\' "$root" || printf \'%s/hooks/pre-bash-guard.sh\' "${CODEX_HOME:-$HOME/.codex}")"';
+
+function withoutRetiredHooks(hooks     )      {
+  const result                      = {};
+  for (const [event, groups] of Object.entries     (hooks || {})) {
+    if (!Array.isArray(groups)) { result[event] = groups; continue; }
+    const kept = groups.map((group     ) => (Array.isArray(group?.hooks)
+      ? { ...group, hooks: group.hooks.filter((handler     ) => handler?.command !== RETIRED_HOOK_COMMAND) }
+      : group)).filter((group     ) => !Array.isArray(group?.hooks) || group.hooks.length > 0);
+    if (kept.length) result[event] = kept;
+  }
+  return result;
+}
+
+/** Whether the retired front door is still on disk as DoFlow's own (it names the bridge call it was written with). */
+function ownsRetiredHookScript(destinationHooksDir        , fsImpl      = fs)          {
+  const target = path.join(destinationHooksDir, RETIRED_HOOK_SCRIPT);
+  try {
+    return fsImpl.lstatSync(target).isFile() && fsImpl.readFileSync(target, 'utf8').includes('doflow_bridge codex PreToolUse pre-bash-guard');
+  } catch { return false; }
+}
+
+/** Delete the retired front door when it is still DoFlow's own. */
+function removeRetiredHookScript(destinationHooksDir        , fsImpl      = fs, dryRun = false)         {
+  if (!ownsRetiredHookScript(destinationHooksDir, fsImpl)) return 0;
+  if (!dryRun) { try { fsImpl.unlinkSync(path.join(destinationHooksDir, RETIRED_HOOK_SCRIPT)); } catch { return 0; } }
+  return 1;
+}
+
 function validationError(errors          , message        )       { errors.push(message); }
 
 function validateHooksConfig(config     )                                                      {
@@ -148,7 +183,7 @@ function planCodexHooks({ config, sourceFile, sourceHooksDir, destinationContext
     try {
       const existing = JSON.parse(original);
       if (existing?.hooks && desired?.hooks) {
-        mergedDesired = { ...existing, ...desired, hooks: mergeHooks(existing.hooks, desired.hooks) };
+        mergedDesired = { ...existing, ...desired, hooks: mergeHooks(withoutRetiredHooks(existing.hooks), desired.hooks) };
       }
     } catch {
       // malformed existing will be flagged or left for schema validation
@@ -167,7 +202,7 @@ function planCodexHooks({ config, sourceFile, sourceHooksDir, destinationContext
     return { ok: false, status: 'conflict', destination, original, changes: [], commands,
       errors: scripts.edited.map((name        ) => `Codex hook script '${name}' was modified outside DoFlow`) };
   }
-  const scriptsOnly = !configChanged && scripts.stale.length > 0;
+  const scriptsOnly = !configChanged && (scripts.stale.length > 0 || ownsRetiredHookScript(destinationHooksDir, fsImpl));
   const changed = configChanged || scriptsOnly;
   // The scripts deployCodexHooks copies beside hooks.json, so a backup of this change holds them too.
   const companionTargets = [...new Set([
@@ -204,6 +239,7 @@ function deployCodexHooks(plan     , { dryRun = false, fsImpl = fs }
     fsImpl.copyFileSync(source, target);
     fsImpl.chmodSync(target, fsImpl.statSync(source).mode & 0o777);
   }
+  removeRetiredHookScript(plan.destinationHooksDir, fsImpl);
   return { ...plan, applied: true };
 }
 
@@ -220,7 +256,7 @@ function shippedHookScripts(scriptsDir     , fsImpl      = fs)           {
  * user edited or added stays. The directory goes only once it is empty. */
 function removeCodexHookScripts({ scriptsDir, destinationHooksDir }                                                        = {}, { dryRun = false, fsImpl = fs }                                     = {})                      {
   if (!destinationHooksDir || !fsImpl.existsSync(destinationHooksDir)) return { removed: 0 };
-  let removed = 0;
+  let removed = removeRetiredHookScript(destinationHooksDir, fsImpl, dryRun);
   for (const name of shippedHookScripts(scriptsDir, fsImpl)) {
     const target = path.join(destinationHooksDir, name);
     // lstat, not stat: a symlink (even to a file with the shipped bytes) is not DoFlow's copy.

package/src/adapters/codex/index.js

@@ -503,9 +503,22 @@ function createCodexAdapter({ declaredPaths = declaredHarnessPaths()[HARNESS] }
         hooks = { ...hooks, ok: false, status: 'conflict', changes: [], errors: ['Codex hooks.json was modified outside DoFlow'] };
       }
     }
+    if (hooks.ok) hooks = withStaleScriptReleases(hooks, scriptRows(neutralResources, context));
     return hooks;
   }
 
+  /** A script row for a name the source no longer ships (a retired front door) is released with the
+   * plan, so the ledger does not keep a row for a file the update deletes. The script itself goes by
+   * its bytes (deployCodexHooks), so this only drops the row. */
+  function withStaleScriptReleases(hooks     , rows       ) {
+    const shipped = new Set(hooks.scriptNames);
+    const releases = rows.filter((row     ) => !shipped.has(row.identity)).map((row     ) => ({ type: 'remove', assetId: row.assetId, identity: row.identity,
+      target: row.target, ownershipIdentity: row.ownershipIdentity, kind: row.kind, release: true }));
+    if (!releases.length) return hooks;
+    return { ...hooks, changes: [...hooks.changes, ...releases],
+      ...(hooks.status === 'unchanged' ? { status: 'change', scriptsOnly: true } : {}) };
+  }
+
   /** Agents/hooks share one removing-vs-planning fork: removal always owns both via the neutral
    * ledger's own records, regardless of what native input the caller provided this run. */
   /** A removal drops the rows of the hook scripts too. The scripts themselves go by their bytes

package/src/adapters/copy-tree.js

@@ -371,14 +371,13 @@ function kiroHook({ name, trigger, matcher, script, timeout }
   };
 }
 
-/** The three preToolUse hooks every DoFlow-rendered Kiro agent carries. The MCP guard uses the
+/** The two preToolUse hooks every DoFlow-rendered Kiro agent carries. The MCP guard uses the
  * "*" matcher: Kiro documents "@<server>" (every tool of one server) and "*" but no all-MCP
  * matcher, and mcp-tool-guard.sh exits 0 immediately for any non-MCP tool name, so "*" costs one
  * fast no-op for built-in tools and still covers every MCP server. */
 function kiroPreToolUseHooks()        {
   return [
     kiroHook({ name: 'doflow-pre-implementation-gate', trigger: 'preToolUse', matcher: 'write', script: 'pre-implement-gate.sh', timeout: 10 }),
-    kiroHook({ name: 'doflow-pre-bash-guard', trigger: 'preToolUse', matcher: 'shell', script: 'pre-bash-guard.sh', timeout: 10 }),
     kiroHook({ name: 'doflow-mcp-tool-guard', trigger: 'preToolUse', matcher: '*', script: 'mcp-tool-guard.sh', timeout: 10 }),
   ];
 }

package/src/cli/commands/status.js

@@ -136,7 +136,7 @@ function cmdStatus(o     )       {
     if (line) console.log(line);
     if (status.errors.length) console.log(`  ${`${label} issues:`.padEnd(24)}${status.errors.join('; ')}`);
     if (harness === 'codex') {
-      console.log('  Codex capability gaps: no Claude-only event emulation is installed; review docs/capability-map.md#codex-capability-detail');
+      console.log('  Codex capability gaps: no Claude-only event emulation is installed');
     }
   }
   if (ctx.registry) {

package/src/cli/index.js

@@ -150,7 +150,7 @@ function parseArgs(argv          )      {
       case '--action': {
         const val = argv[i + 1];
         // `review`, `protocol`, `config`, `primary` and `package` answer a missing value as usage, exit 2; other verbs keep exit 1.
-        if (val === undefined || val.startsWith('-')) { console.error(`doflow: ${a} requires a value`); process.exit(o.cmd === 'review' || o.cmd === 'protocol' || o.cmd === 'config' || o.cmd === 'primary' || o.cmd === 'fleet' || o.cmd === 'transcript' || o.cmd === 'package' ? 2 : 1); }
+        if (val === undefined || val.startsWith('-')) { console.error(`doflow: ${a} requires a value`); process.exit(o.cmd === 'review' || o.cmd === 'protocol' || o.cmd === 'config' || o.cmd === 'primary' || o.cmd === 'fleet' || o.cmd === 'transcript' || o.cmd === 'package' || o.cmd === 'worktree' ? 2 : 1); }
         o.action = val; o.actionGiven = true; i++; break;
       }
       case '--task-class': {
@@ -248,7 +248,7 @@ function parseArgs(argv          )      {
 
 /** Verbs that answer an unrecognised flag as a usage error (exit 2); every other verb keeps exit 1. */
 function unknownFlagExit(cmd               )         {
-  return cmd === 'protocol' || cmd === 'config' || cmd === 'rules' || cmd === 'review' ? 2 : 1;
+  return cmd === 'protocol' || cmd === 'config' || cmd === 'rules' || cmd === 'review' || cmd === 'worktree' || cmd === 'attendance' ? 2 : 1;
 }
 
 /** Longest part of an unrecognised argument echoed back; the rest is cut and marked. */
@@ -277,6 +277,7 @@ const RUNTIME_STRING_FLAGS = new Map([
   ['--request', 'request'],            // classify: request text for an advisory second opinion
   ['--request-file', 'requestFile'],   // classify: request text read from a file
   // decision --action add. `--statement`, `--stage`, `--slug` and `--batch` above are shared.
+  ['--run-id', 'runId'],               // intake --action undo: the sort run to undo (default: the latest)
   ['--topic', 'topic'],                // the subject key a decision is live on
   ['--channel', 'channel'],            // question | gate | prompt | default | resolution
   ['--supersedes', 'supersedes'],      // comma-separated DEC-### ids this decision replaces
@@ -434,8 +435,9 @@ const RUNTIME_STRING_FLAGS = new Map([
   ['--dir', 'dir'],                   // package --action new: authored package target directory
   ['--name', 'name'],                  // slot: the slot's name, 1 to 64 characters of a-z, 0-9 and - (115 IC-008)
   ['--label', 'label'],                // slot --action run: the holder's label, at most 80 characters (115 IC-008)
-  ['--cursor', 'cursor'],              // transcript --action read: the cursor an earlier read returned (093 IC-022)
-  ['--limit', 'limit'],                // transcript --action read: at most this many events, validated in the verb (093 IC-022)
+  ['--cursor', 'cursor'],              // transcript --action read: the cursor an earlier read returned (093 IC-022) · followup --action list: the nextCursor of an earlier page (137 IC-004)
+  ['--limit', 'limit'],                // transcript --action read: at most this many events, validated in the verb (093 IC-022) · followup --action list: the page size (137 IC-004)
+  ['--view', 'view'],                  // followup --action list, lifecycle --action overview, classify: brief or full, validated in the verb (137 IC-001)
   ['--window', 'window'],              // transcript --action stats: minutes, 1 to 60, validated in the verb (093 IC-023)
   ['--port', 'port'],                  // ui: the Console's port, 0 to 65535, checked in commands/ui.ts (092 IC-008)
 ]);
@@ -546,7 +548,7 @@ Commands:
   context-grant        Grant one compacted summary to a launched run and lineage (--summary, --to-run, --to-lineage)
   retrieval-plan       Declare a stage's information needs, attempt retrieval, then report every declared item
   outcome              Record a task's terminal state with its basis, or show it (--task-id)
-  classify             Validate a proposed task class and return its workflow (--task-class)
+  classify             Validate a proposed task class and return its workflow (--task-class [--view brief|full])
   workflow             Resolve a task class to its stages, gates and readiness templates
   orchestrate          Start or resume a run: complete stages, decide gates (--action)
   research-request     Open, list or resolve a feature-stage research question (--task-id)
@@ -577,15 +579,16 @@ Commands:
                        config unset <key> --layer user|project|local [--json]   remove the key from that layer's file
   scaffold             Emit the reviewable code scaffold the active feature's artifacts imply
   decision             Register, list or compact the active feature's decisions (--action init|add|list|compact)
-  followup             Record, list, take, settle, promote or report what a feature left unfinished (--action add|list|take|settle|promote|report)
-  lifecycle            Open follow-ups, feature tracking, releases and status for the project (--action overview|init|release|status|merged)
+  intake               Sort, preview, undo, list or file prompt text for the active feature's additional-context folder (--action sort|preview|undo|list|file-prompt)
+  followup             Record, list, take, settle, promote or report what a feature left unfinished (--action add|list|take|settle|promote|report; list: [--view brief|full] [--cursor <c>] [--limit <n>] [--ids <FU-id,...>])
+  lifecycle            Open follow-ups, feature tracking, releases and status for the project (--action overview|init|release|status|merged; overview: [--view brief|full])
   goal                 Add, check, link, list or close a goal and its checklist (--action add|item|check|link|list|done)
   failure              List, settle or switch off the failures DoFlow captured on this machine (--action list|settle|capture)
                        (a value beginning with '-' must be written --flag=value)
   roadmap              Session-driven autopilot runner (--action render|status|next|audit|init-policy [--check] [--row <id>] [--run <id>]).
                        roadmap --action init-policy [--commit] writes the gate policy for review, or with --commit commits it onto local develop when develop is not checked out in a worktree (otherwise it prints the commands to run there; never pushes);
                        roadmap seed --action check|apply|amend --draft <path> [--json] validates and writes new rows;
-                       rows written while autopilot is on land proposed; roadmap promote <id...> [--json] (person, autopilot off) makes them ready
+                       rows written while autopilot is on land proposed; roadmap promote <id...> [--json] (person: asks y/N on the terminal) makes them ready
   plan-check           Check a plan's task lines the way the task-attempt ledger reads them: plan-check <plan path> [--json]
   review               Validate a feature's review/findings.json; print errors, advisories and counts (exit 0 valid, 1 invalid, 2 usage).
                        review --action check [--slug <name> | --path <findings.json>] [--json]
@@ -604,6 +607,10 @@ Commands:
   transcript           Read an agent's recent events, or the project's traffic (read-only, run in a project).
                        transcript --action read --agent <key> [--cursor <c>] [--limit <n>] [--json]   masked events and DoFlow's record events (exit 0, 1 agent-not-in-project or session-not-in-project, 2 usage)
                        transcript --action stats [--window <minutes 1..60>] [--json]   events per minute, tool calls, tokens, who works with whom (exit 0, 2 usage)
+  worktree             Remove a merged feature's worktree and branch, never by force (--action cleanup).
+                       worktree --action cleanup --slug <row slug> [--json]   copies agent-docs/doflow/<slug> back to the main checkout first (exit 0 cleaned, 1 kept or lease-held with the reason, 2 usage)
+  attendance           Say whether a person is watching a stage (read-only).
+                       attendance --task-id <row slug> [--run <rl-id>] [--json]   prints "unattended <source>" or "attended <reason>" (exit 0, 2 usage)
   package              List the contribution points a package may fill, check a package directory, show the packages, add and update a local package, or turn it on and off.
                        package --action points [--json]
                        package --action check --path <dir> [--json]   (read-only; exit 0 clean, 1 findings, 2 usage)
@@ -673,6 +680,7 @@ Runtime verb arguments (accept --flag value or --flag=value):
                        failure: list|settle|capture
                        roadmap: render|status|next|audit|init-policy (seed: check|apply|amend; promote <id...>)
                        slot: run|list|peek|release
+                       worktree: cleanup
                        models: sync|list|describe
                        review: check|start
                        protocol: list|resolve
@@ -700,6 +708,8 @@ Runtime verb arguments (accept --flag value or --flag=value):
                                             disposition in the JSON; 2 usage or an unreadable store or plan)
       --rationale, --proposed-by, --calling-skill    classify
       --request <text>, --request-file <file>  classify (mutually exclusive; optional second opinion)
+      --view brief|full                     followup --action list (default brief), lifecycle --action overview, classify (default full); brief drops detail, full is the whole answer
+      --cursor <c>, --limit <n>             followup --action list (the cursor is opaque: pass back a page's nextCursor); also transcript --action read
       --intent, --query, --check            route
       --statement, --claim-id,
       --evidence-id, --relation             claim
@@ -772,6 +782,8 @@ Runtime verb arguments (accept --flag value or --flag=value):
       --tag, --confirm, --feature,
       --exclude (repeatable), --reason      lifecycle (release, merged)
       --fp, --as, --reason, --set, --all    failure (list, settle, capture)
+      --run-id <id>                         intake --action undo (default: the latest sort run that has a move to undo)
+      --stdin | --file <path>, --stage      intake --action file-prompt (the text, unchanged, from exactly one of --stdin or --file; --stage names the filing stage)
       --harness, --need (repeatable),
       --model-check, --budget-tokens,
       --task, --token, --prompt-file,

package/src/cli/runtime-commands.js

@@ -54,6 +54,7 @@ const { handleLeakScanCommand } = require('../runtime/leak-scan.js');
 const { handleRecoverCommand } = require('../runtime/recovery.js');
 const { handleScaffoldCommand } = require('../runtime/scaffold/generate.js');
 const { handleDecisionCommand, isReservedChannel, CHANNEL_RESERVED } = require('../runtime/decision-register.js');
+const { handleIntakeCommand } = require('../runtime/intake/index.js');
 const { handleFollowupCommand, handleLifecycleCommand, handleGoalCommand } = require('../runtime/lifecycle/cli.js');
 const { projectRoot: lifecycleProjectRoot } = require('../runtime/lifecycle/root.js');
 const { upkeepAfterVerb } = require('../runtime/storage/upkeep.js');
@@ -66,6 +67,8 @@ const { handleProtocolCommand } = require('../runtime/review/protocol-command.js
 const { handleRulesCommand } = require('../runtime/rules-report.js');
 const { handlePackageCommand } = require('../runtime/packages/command.js');
 const { handleModelsCommand } = require('../runtime/models/command.js');
+const { handleWorktreeCommand } = require('../runtime/roadmap/worktree-cleanup.js');
+const { handleAttendanceCommand } = require('../runtime/roadmap/attendance.js');
 // `plan-check` is read-only (115 IC-001): no upkeep, which would write `.gitignore` and `upkeep-due`.
 // `review` writes only its one telemetry line (095 IC-003).
 // `protocol` only prints the registry and the resolved protocol (119 IC-004), so it has nothing to keep up.
@@ -73,9 +76,10 @@ const { handleModelsCommand } = require('../runtime/models/command.js');
 // `primary` only prints the resolved main session (120 IC-008) and writes nothing.
 // `fleet` only lists the projects this machine knows from two read-only stores (093 IC-019) and writes nothing.
 // `transcript` only reads agents' transcripts and DoFlow's own records and prints them (093 IC-022, IC-023); it writes nothing.
+// `attendance` is read-only; `worktree --action cleanup` removes a merged feature's worktree under the roadmap lease and writes no DoFlow state, so neither runs upkeep.
 // `package` stays here (122 IC-012): `new` writes only the target folder; `add --plan`, `update --plan` and `remove` write the store and lock and run upkeep (see `runsUpkeep`).
 // `slot` is not here: `run`, `list` and `release` write the slot files and run upkeep; only `slot --action peek` is read-only and skips it (093 IC-018 b, see `runsUpkeep`).
-const NO_UPKEEP = new Set(['storage', 'config', 'plan-check', 'review', 'protocol', 'rules', 'primary', 'package', 'models', 'fleet', 'transcript']);
+const NO_UPKEEP = new Set(['storage', 'config', 'plan-check', 'review', 'protocol', 'rules', 'primary', 'package', 'models', 'fleet', 'transcript', 'worktree', 'attendance']);
 const runsUpkeep = (o     )          => (!NO_UPKEEP.has(o.cmd) && !(o.cmd === 'slot' && o.actionGiven && o.action === 'peek'))
   || (o.cmd === 'package' && ((typeof o.planId === 'string' && (o.action === 'add' || o.action === 'update')) || o.action === 'remove'));
 // Required on first use, so a CLI whose failure modules cannot be loaded still runs every other verb.
@@ -378,10 +382,12 @@ function dispatchRuntimeCommandInner(o     , moment     )      {
     // The feature is resolved from the working directory (or --slug) by the same resolver
     // `scaffold` uses; the flags are the caller's own statements, validated by the register module.
     case 'decision': return handleDecisionCommand({ action: o.action, projectRoot: evidenceRoot(o), slug: o.slug, json: o.json, flags: { topic: o.topic, statement: o.statement, channel: o.channel, stage: o.stage, rationale: o.rationale, supersedes: o.supersedes, refs: o.refs, source: o.source, batch: o.batchPath, all: o.all } });
+    // 136: the feature is resolved the way `decision` resolves it; the engine moves files only inside its additional-context folder.
+    case 'intake': return handleIntakeCommand({ action: o.action, projectRoot: evidenceRoot(o), slug: o.slug, json: o.json, flags: { runId: o.runId, stdin: o.stdin, file: o.file, stage: o.stage } });
     // Feature 046: the project's follow-up store lives at the repository root (never `-g`, which
     // the handlers refuse), so the working directory is the starting point, not a scope switch.
-    case 'followup': return handleFollowupCommand({ action: o.actionGiven ? o.action : undefined, cwd: evidenceRoot(o), global: o.global, slug: o.slug, json: o.json, flags: { statement: o.statement, stage: o.stage, source: o.source, taskClass: o.taskClass, taskId: o.taskId, release: o.release, batch: o.batchPath, channel: o.channel, state: o.state, ids: o.ids, as: o.as, reason: o.reason, evidence: o.evidence, title: o.title, file: o.file, stdin: o.stdin, text: o.text, feature: o.feature, tag: o.tag, confirm: o.confirm, exclude: o.exclude } });
-    case 'lifecycle': return handleLifecycleCommand({ action: o.actionGiven ? o.action : undefined, cwd: evidenceRoot(o), global: o.global, slug: o.slug, json: o.json, flags: { take: o.take, intent: o.intent, goal: o.goal, maintain: o.maintain, since: o.since, tag: o.tag, confirm: o.confirm, feature: o.feature, exclude: o.exclude, reason: o.reason, channel: o.channel } });
+    case 'followup': return handleFollowupCommand({ action: o.actionGiven ? o.action : undefined, cwd: evidenceRoot(o), global: o.global, slug: o.slug, json: o.json, flags: { statement: o.statement, stage: o.stage, source: o.source, taskClass: o.taskClass, taskId: o.taskId, release: o.release, batch: o.batchPath, channel: o.channel, state: o.state, ids: o.ids, view: o.view, cursor: o.cursor, limit: o.limit, as: o.as, reason: o.reason, evidence: o.evidence, title: o.title, file: o.file, stdin: o.stdin, text: o.text, feature: o.feature, tag: o.tag, confirm: o.confirm, exclude: o.exclude } });
+    case 'lifecycle': return handleLifecycleCommand({ action: o.actionGiven ? o.action : undefined, cwd: evidenceRoot(o), global: o.global, slug: o.slug, json: o.json, flags: { view: o.view, take: o.take, intent: o.intent, goal: o.goal, maintain: o.maintain, since: o.since, tag: o.tag, confirm: o.confirm, feature: o.feature, exclude: o.exclude, reason: o.reason, channel: o.channel } });
     case 'goal': return handleGoalCommand({ action: o.actionGiven ? o.action : undefined, cwd: evidenceRoot(o), global: o.global, slug: o.slug, json: o.json, flags: { goal: o.goal, statement: o.statement, item: o.item, text: o.text, evidence: o.evidence, unmet: o.unmet, replace: o.replace, reason: o.reason, channel: o.channel } });
     // The failure store is per machine, so `-g` changes nothing and the working directory only matters
     // to `settle --as imported`, which looks for the DoFlow repository from there.
@@ -389,7 +395,7 @@ function dispatchRuntimeCommandInner(o     , moment     )      {
     // The rest of design §4.2's Node arm. REPO_ROOT locates the registries that ship with the
     // package (workflows, capabilities, verification); evidenceRoot(o) locates the caller's own
     // state and source tree, following the same scope rules as every other command.
-    case 'classify': return handleClassifyCommand({ taskClass: o.taskClass, rationale: o.rationale, proposedBy: o.proposedBy, callingSkill: o.callingSkill, request: o.request, requestFile: o.requestFile, taskId: o.taskId, projectRoot: evidenceRoot(o), json: o.json });
+    case 'classify': return handleClassifyCommand({ taskClass: o.taskClass, rationale: o.rationale, proposedBy: o.proposedBy, callingSkill: o.callingSkill, view: o.view, request: o.request, requestFile: o.requestFile, taskId: o.taskId, projectRoot: evidenceRoot(o), json: o.json });
     case 'workflow': return handleWorkflowCommand({ taskClass: o.taskClass, json: o.json });
     case 'orchestrate': return handleOrchestrateCommand({ action: o.action, taskId: o.taskId, taskClass: o.taskClass, stage: o.stage, gate: o.gate, node: o.node, decision: o.decision, policy: o.policy, note: o.note, reason: o.reason, forced: o.forced, verificationPlan: o.verificationPlan, scope: o.scope, invariants: o.invariants, result: o.result, mcpOutcome: o.mcpOutcome, callingSkill: o.callingSkill, slug: o.slug, recordSlug: storeSlug, dryRun: o.dryRun, json: o.json, repoRoot: REPO_ROOT, stateRoot: storeRoot, sourceRoot: evidenceRoot(o), buildAdapters: buildAdapterRegistry });
     case 'research-request': return handleResearchRequestCommand({ slug: storeSlug, action: o.action === 'status' ? 'list' : o.action, taskId: requireTaskId(o), stageId: o.stageId, question: o.question, reason: o.reason, blocking: o.blocking === undefined ? undefined : o.blocking === 'true' ? true : o.blocking === 'false' ? false : o.blocking, requestId: o.requestId, outcome: o.researchOutcome, claimId: o.claimId, evidenceIds: o.evidenceIds, gap: o.gap, json: o.json, projectRoot: storeRoot, sourceRoot: evidenceRoot(o) });
@@ -432,6 +438,8 @@ function dispatchRuntimeCommandInner(o     , moment     )      {
     case 'fleet': return handleFleetCommand({ action: o.actionGiven ? o.action : undefined, json: o.json, flags: o.flagsGiven, env: process.env, cwd: process.cwd() });
     case 'transcript': return handleTranscriptCommand({ action: o.actionGiven ? o.action : undefined, agent: o.agent, cursor: o.cursor, limit: o.limit, window: o.window, json: o.json, flags: o.flagsGiven, env: process.env, cwd: process.cwd() });
     case 'models': return handleModelsCommand({ action: o.actionGiven ? o.action : (o.positional?.[0] || 'list'), positional: o.positional, harness: o.harness, model: o.model, json: o.json, projectRoot: evidenceRoot(o) });
+    case 'worktree': return handleWorktreeCommand({ action: o.actionGiven ? o.action : undefined, slug: o.slug, json: o.json, flags: o.flagsGiven, env: process.env, cwd: process.cwd() });
+    case 'attendance': return handleAttendanceCommand({ taskId: o.taskId, run: o.run, json: o.json, flags: o.flagsGiven, env: process.env, cwd: process.cwd() });
     default: console.error(`doflow: unknown command '${o.cmd}'`); process.exit(1);
   }
 }

package/src/lifecycle/coverage.js

@@ -2,7 +2,6 @@
 
 const crypto = require('node:crypto');
 const CLASS_ORDER = Object.freeze(['unknown', 'unsupported', 'observation', 'advisory', 'blocking']);
-const POLICY_ORDER = Object.freeze(['pre-implementation-gate', 'pre-bash-guard', 'session-context', 'mcp-tool-guard', 'stop-check']);
 const HARNESS_ORDER = Object.freeze(['claude', 'codex', 'opencode', 'pi', 'copilot', 'kiro', 'antigravity']);
 const BEHAVIOUR_ORDER = Object.freeze(['context-authority', 'default-silence', 'summary-scope', 'summary-grant', 'identity', 'check-freshness']);
 const NEVER_BLOCKING_EVENTS = new Set([
@@ -43,32 +42,4 @@ function enforcementFor(coverage     , query
     reason: weakest ? `${weakest.class} at (${weakest.policy}, ${weakest.harness}, ${weakest.event}, ${weakest.profile})` : `unknown at (${query.policy}, ${query.harness}, *, ${query.profile ?? '*'})`,
   };
 }
-function renderEnforcementMatrix(coverage     )         {
-  const order = (items                   , value        ) => {
-    const index = items.indexOf(value);
-    return index < 0 ? items.length : index;
-  };
-  const rows = [...coverage.rows].sort((a     , b     ) => order(POLICY_ORDER, a.policy) - order(POLICY_ORDER, b.policy)
-    || order(HARNESS_ORDER, a.harness) - order(HARNESS_ORDER, b.harness)
-    || a.event.localeCompare(b.event) || a.profile.localeCompare(b.profile));
-  const lines = [`Schema ${coverage.schemaVersion}; revision ${coverage.revision}; ${coverage.rowsDigest}`, '| Policy | Harness | Native event | Profile | Class | Verification | Prerequisites | Does not cover |', '|---|---|---|---|---|---|---|---|'];
-  for (const row of rows) lines.push(`| ${row.policy} | ${row.harness} | ${row.event} | ${row.profile} | ${row.class} | ${row.verification} | ${(row.prerequisites || []).join(', ')} | ${(row.doesNotCover || []).join(', ')} |`);
-  return lines.join('\n');
-}
-// IC-019: one row per behaviour x harness, ordered by IC-018's behaviour list, then HARNESS_ORDER.
-function renderBehaviourMatrix(coverage     )         {
-  const order = (items                   , value        ) => {
-    const index = items.indexOf(value);
-    return index < 0 ? items.length : index;
-  };
-  const entries = [...(coverage.behaviours || [])].sort((a     , b     ) => order(BEHAVIOUR_ORDER, a.behaviour) - order(BEHAVIOUR_ORDER, b.behaviour)
-    || order(HARNESS_ORDER, a.harness) - order(HARNESS_ORDER, b.harness)
-    || a.behaviour.localeCompare(b.behaviour) || a.harness.localeCompare(b.harness));
-  const lines = [`Schema ${coverage.schemaVersion}; revision ${coverage.revision}`, '| Behaviour | Harness | Status | Limitation or tests |', '|---|---|---|---|'];
-  for (const entry of entries) {
-    const detail = entry.status === 'enforced' ? (entry.tests || []).join(', ') : (entry.limitation || '');
-    lines.push(`| ${entry.behaviour} | ${entry.harness} | ${entry.status} | ${detail} |`);
-  }
-  return lines.join('\n');
-}
-module.exports = { enforcementFor, renderEnforcementMatrix, renderBehaviourMatrix, BEHAVIOUR_ORDER, HARNESS_ORDER, rowsDigest, UnknownEnforcementTarget, NEVER_BLOCKING_EVENTS };
+module.exports = { enforcementFor, BEHAVIOUR_ORDER, HARNESS_ORDER, rowsDigest, UnknownEnforcementTarget, NEVER_BLOCKING_EVENTS };

package/src/lifecycle/hook-tier.js

@@ -39,13 +39,13 @@ function resolveHookTier({ env = process.env, loadSettings }
 }
 
 /** One WARN line per planned harness that gets no hooks although it is the primary session (claude)
- * or a worker the person configured: there it runs without DoFlow's destructive-command guard. */
+ * or a worker the person configured: there it runs without DoFlow's gates. */
 function hookTierWarnings(registry     , targets          , tier                                                   )           {
   const warnings           = [];
   for (const harness of registry.harnesses) {
     if (!targets.includes(harness.id) || tier.harnesses.includes(harness.id) || !getsHooks(registry, harness)) continue;
     const role = harness.id === 'claude' ? 'the primary session' : tier.workers?.includes(harness.id) ? `a worker in ${WORKERS_KEY}` : null;
-    if (role) warnings.push(`${harness.id} is ${role} but not in ${HOOKS_KEY}: it runs without DoFlow's hooks, gates or destructive-command guard`);
+    if (role) warnings.push(`${harness.id} is ${role} but not in ${HOOKS_KEY}: it runs without DoFlow's hooks or gates`);
   }
   return warnings;
 }