@khoavu882/doflow 2.0.0 → 2.0.2

package/core/registry/package-templates/intake-category/files/category.json

@@ -0,0 +1,8 @@
+{
+  "id": "{{local}}",
+  "names": [],
+  "summary": "Replace this with what files this category holds.",
+  "rules": [
+    { "extensions": ["pdf"], "namePattern": "replace-with-a-name-pattern" }
+  ]
+}

package/core/registry/package-templates/intake-category/template.json

@@ -0,0 +1,4 @@
+{
+  "template": 1,
+  "path": "categories/{{local}}.json"
+}

package/core/registry/packages/doflow/doflow-package.json

@@ -1,9 +1,9 @@
 {
   "manifest": 1,
   "id": "doflow",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "summary": "DoFlow first-party presets",
-  "doflow": "=2.0.0",
+  "doflow": "=2.0.2",
   "contributions": [
     {
       "point": "debate-preset",

package/core/registry/rules.json

@@ -8,8 +8,8 @@
       "statement": "Conflict order: Safety > Scope > Quality > Speed. Prototype != Production requirements.",
       "sourceFile": "core/shared/guidance/rules/RULES.md",
       "category": "safety",
-      "enforcement": "mechanical",
-      "enforcementRef": "core/harnesses/shared/hooks/policies/pre-bash-guard.sh",
+      "enforcement": "advisory",
+      "enforcementRef": null,
       "neverAblate": true,
       "ablationCandidate": false
     },
@@ -64,7 +64,7 @@
       "sourceFile": "core/shared/guidance/PRINCIPLES.md",
       "category": "workflow",
       "enforcement": "mechanical",
-      "enforcementRef": "core/harnesses/shared/hooks/policies/pre-implementation-gate.sh",
+      "enforcementRef": "src/runtime/workflow-orchestrator.js",
       "neverAblate": false,
       "ablationCandidate": true
     },
@@ -159,11 +159,11 @@
     {
       "id": "rule-workflow-doflow-chain",
       "tag": "workflow",
-      "statement": "Feature delivery follows the doflow chain — see references/DOFLOW_CHAIN.md for the phase-gated flow, artifact contracts, and the enforced gate.",
+      "statement": "Feature delivery follows the doflow chain — see references/DOFLOW_CHAIN.md for the phase-gated flow, artifact contracts, and the advisory implement gate.",
       "sourceFile": "core/shared/guidance/rules/RULES.md",
       "category": "workflow",
       "enforcement": "mechanical",
-      "enforcementRef": "core/harnesses/shared/hooks/policies/pre-implementation-gate.sh",
+      "enforcementRef": "src/runtime/workflow-orchestrator.js",
       "neverAblate": false,
       "ablationCandidate": true
     },
@@ -173,8 +173,8 @@
       "statement": "Start it = Finish it. No partial features, TODO stubs, mocks, or \"not implemented\" throws.",
       "sourceFile": "core/shared/guidance/rules/RULES.md",
       "category": "workflow",
-      "enforcement": "mechanical",
-      "enforcementRef": "core/harnesses/shared/hooks/policies/stop-check.sh",
+      "enforcement": "advisory",
+      "enforcementRef": null,
       "neverAblate": false,
       "ablationCandidate": true
     },
@@ -401,7 +401,7 @@
     {
       "id": "rule-questions-noninteractive-fallback",
       "tag": "questions",
-      "statement": "Non-Interactive Fallback: When no native interactive question tool... is available: Do NOT generate {stage}-questions.md files... Adopt the recommended default choice, record the adopted decision and rationale in the stage notes or artifact, and proceed with execution.",
+      "statement": "Non-Interactive Fallback: When no native interactive question tool... is available, or attendance printed unattended for this stage: Do NOT generate {stage}-questions.md files... Adopt the recommended default choice, record the adopted decision and rationale in the stage notes or artifact, and proceed with execution.",
       "sourceFile": "core/shared/guidance/rules/RULES.md",
       "category": "questions",
       "enforcement": "advisory",

package/core/registry/settings.json

@@ -27,62 +27,62 @@
                  { "layer": "project", "kind": "decision-model", "path": "decision-model.json", "field": "model" }],
       "consumers": ["src/runtime/advice/config.js"], "description": "Decision-model name; a project may choose it while advice is on." },
     "advice.kinds.tier": { "type": "enum", "values": ["off", "shadow", "act"], "default": null,
-      "scope": "project-overridable", "combine": "override", "securityRelevant": false, "failSafe": "off",
+      "scope": "project-overridable", "combine": "override", "securityRelevant": true, "failSafe": "off",
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
       "consumers": ["src/runtime/advice/shadow-config.js"],
       "description": "Advice mode for the tier kind: off, shadow (record only) or act; unset keeps the kind's own path, the highest layer that sets it decides and an invalid value is off." },
     "advice.kinds.task-class": { "type": "enum", "values": ["off", "shadow", "act"], "default": null,
-      "scope": "project-overridable", "combine": "override", "securityRelevant": false, "failSafe": "off",
+      "scope": "project-overridable", "combine": "override", "securityRelevant": true, "failSafe": "off",
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
       "consumers": ["src/runtime/advice/shadow-config.js"],
       "description": "Advice mode for the task-class kind: off, shadow (record only) or act; unset keeps the kind's own path, the highest layer that sets it decides and an invalid value is off." },
     "advice.kinds.verify-risk": { "type": "enum", "values": ["off", "shadow", "act"], "default": null,
-      "scope": "project-overridable", "combine": "override", "securityRelevant": false, "failSafe": "off",
+      "scope": "project-overridable", "combine": "override", "securityRelevant": true, "failSafe": "off",
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
       "consumers": ["src/runtime/advice/shadow-config.js"],
       "description": "Advice mode for the verify-risk kind: off, shadow (record only) or act; unset keeps the kind's own path, the highest layer that sets it decides and an invalid value is off." },
     "advice.kinds.review-depth": { "type": "enum", "values": ["off", "shadow", "act"], "default": null,
-      "scope": "project-overridable", "combine": "override", "securityRelevant": false, "failSafe": "off",
+      "scope": "project-overridable", "combine": "override", "securityRelevant": true, "failSafe": "off",
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
       "consumers": ["src/runtime/advice/shadow-config.js"],
       "description": "Advice mode for the review-depth kind: off, shadow (record only) or act; unset keeps the kind's own path, the highest layer that sets it decides and an invalid value is off." },
     "advice.kinds.mcp-need": { "type": "enum", "values": ["off", "shadow", "act"], "default": null,
-      "scope": "project-overridable", "combine": "override", "securityRelevant": false, "failSafe": "off",
+      "scope": "project-overridable", "combine": "override", "securityRelevant": true, "failSafe": "off",
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
       "consumers": ["src/runtime/advice/shadow-config.js"],
       "description": "Advice mode for the mcp-need kind: off, shadow (record only) or act; unset keeps the kind's own path, the highest layer that sets it decides and an invalid value is off." },
     "advice.kinds.followup-triage": { "type": "enum", "values": ["off", "shadow", "act"], "default": null,
-      "scope": "project-overridable", "combine": "override", "securityRelevant": false, "failSafe": "off",
+      "scope": "project-overridable", "combine": "override", "securityRelevant": true, "failSafe": "off",
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
       "consumers": ["src/runtime/advice/shadow-config.js"],
       "description": "Advice mode for the followup-triage kind: off, shadow (record only) or act; unset keeps the kind's own path, the highest layer that sets it decides and an invalid value is off." },
     "advice.models.tier": { "type": "string", "default": null,
-      "scope": "project-overridable", "combine": "override", "securityRelevant": false,
+      "scope": "project-overridable", "combine": "override", "securityRelevant": true, "failSafe": { "gate": "advice.enabled" },
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
       "consumers": ["src/runtime/advice/shadow-config.js"],
       "description": "Decision-model name for the tier kind; unset uses advice.model." },
     "advice.models.task-class": { "type": "string", "default": null,
-      "scope": "project-overridable", "combine": "override", "securityRelevant": false,
+      "scope": "project-overridable", "combine": "override", "securityRelevant": true, "failSafe": { "gate": "advice.enabled" },
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
       "consumers": ["src/runtime/advice/shadow-config.js"],
       "description": "Decision-model name for the task-class kind; unset uses advice.model." },
     "advice.models.verify-risk": { "type": "string", "default": null,
-      "scope": "project-overridable", "combine": "override", "securityRelevant": false,
+      "scope": "project-overridable", "combine": "override", "securityRelevant": true, "failSafe": { "gate": "advice.enabled" },
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
       "consumers": ["src/runtime/advice/shadow-config.js"],
       "description": "Decision-model name for the verify-risk kind; unset uses advice.model." },
     "advice.models.review-depth": { "type": "string", "default": null,
-      "scope": "project-overridable", "combine": "override", "securityRelevant": false,
+      "scope": "project-overridable", "combine": "override", "securityRelevant": true, "failSafe": { "gate": "advice.enabled" },
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
       "consumers": ["src/runtime/advice/shadow-config.js"],
       "description": "Decision-model name for the review-depth kind; unset uses advice.model." },
     "advice.models.mcp-need": { "type": "string", "default": null,
-      "scope": "project-overridable", "combine": "override", "securityRelevant": false,
+      "scope": "project-overridable", "combine": "override", "securityRelevant": true, "failSafe": { "gate": "advice.enabled" },
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
       "consumers": ["src/runtime/advice/shadow-config.js"],
       "description": "Decision-model name for the mcp-need kind; unset uses advice.model." },
     "advice.models.followup-triage": { "type": "string", "default": null,
-      "scope": "project-overridable", "combine": "override", "securityRelevant": false,
+      "scope": "project-overridable", "combine": "override", "securityRelevant": true, "failSafe": { "gate": "advice.enabled" },
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
       "consumers": ["src/runtime/advice/shadow-config.js"],
       "description": "Decision-model name for the followup-triage kind; unset uses advice.model." },
@@ -110,10 +110,6 @@
       "legacy": [{ "layer": "user", "kind": "sentinel", "path": "autopilot/off", "value": "off" }],
       "consumers": ["src/runtime/settings/autopilot.js"],
       "description": "Roadmap autopilot kill switch, off until the owner turns it on; the env and the autopilot/off sentinel can only turn it off." },
-    "guard.workerDropDatabases": { "type": "string", "default": null, "scope": "project-only", "combine": "override",
-      "securityRelevant": true, "failSafe": { "state": "invalid" }, "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],
-      "consumers": ["src/runtime/worker/launch.js"],
-      "description": "Space-separated exact database names a worker session may DROP DATABASE; project layer only." },
     "hooks.harnesses": { "type": "string-list", "valuesRef": "harnesses.ids", "maxItems": 16, "maxLength": 32, "default": ["claude", "codex", "antigravity", "pi"],
       "scope": "global-only", "combine": "override", "securityRelevant": false,
       "env": null, "flag": null, "shellRead": null, "needsConfigHome": false, "legacy": [],

package/core/registry/storage.json

@@ -596,8 +596,7 @@
       "match": "^[0-9a-f]{12}$",
       "rule": "report-orphan",
       "bound": {
-        "orphanGraceHours": 24,
-        "foreignMaxAgeDays": 180
+        "orphanGraceHours": 24
       },
       "protect": null,
       "moments": [
@@ -1704,6 +1703,14 @@
       "file": "src/runtime/history-compactor.js",
       "reason": "agent-docs deliverable (decisions/history archive and artifact stub)"
     },
+    {
+      "file": "src/runtime/intake/engine.js",
+      "reason": "user-provided files in a feature's additional-context folder: sorted into category subfolders and filed prompt text, each move journaled in the intake manifest"
+    },
+    {
+      "file": "src/runtime/intake/manifest.js",
+      "reason": "agent-docs deliverable (additional-context/.intake/manifest.json: the journaled record of every intake move)"
+    },
     {
       "file": "src/runtime/lifecycle/intent-writer.js",
       "reason": "agent-docs deliverable (agent-docs/intent/*.md)"

package/core/registry/telemetry.json

@@ -143,7 +143,7 @@
     "kind": ["hook", "verify.run", "verify.tier", "verify.check", "review.run", "package.verb"],
     "harness": ["claude", "codex", "opencode", "pi", "copilot", "kiro", "antigravity"],
     "event": ["PreToolUse", "tool_call", "UserPromptSubmit", "PostToolUse", "PostToolUseFailure"],
-    "policy": ["pre-bash-guard", "user-prompt-submit", "post-shell-observe"],
+    "policy": ["user-prompt-submit", "post-shell-observe"],
     "verdict": ["allow", "deny", "advisory", "error", "unsupported", "observe"],
     "source": ["verb", "dispatch"],
     "status": ["PASS", "FAIL", "UNRESOLVED", "SUBSUMED", "NOT_APPLICABLE", "SKIPPED", "NOT_RUN"],

package/core/registry/verification.json

@@ -15,11 +15,6 @@
       "testTargeted"
     ],
     "planOverrideBlock": "doflow-verification",
-    "completion": {
-      "requires": "all-required-tiers-pass",
-      "override": "explicit-user-acceptance",
-      "overrideRequiresAccepter": true
-    },
     "unresolvedDetectionFailureClass": "CONTEXT_MISSING",
     "notes": [
       "A tier whose command could not be detected and was not explicitly declared absent resolves to UNRESOLVED, and an UNRESOLVED required tier forces the whole report to INCONCLUSIVE. A gate never answers PASS about a check it did not run.",

package/core/shared/guidance/references/ARTIFACT_FORMAT.md

@@ -308,6 +308,13 @@ reading it whole:
   attributes, keys and cardinalities of that subdomain alone. The table catalog of entities, keys,
   indexes and ORM file references is unchanged and stays below the views. Splitting one diagram into
   views must not drop an entity, a key or a constraint the single diagram carried.
+- **`data-model.md` §3 to §9 — lifecycles, coupling and the rest.** §3 Lifecycles holds every
+  entity state, one `#### Lifecycle: <entity>` block each, and nothing else restates a state; §4 to
+  §9 are Cross-entity coupling, Invariants, Ownership / CRUD matrix, Event catalogue, Retention, PII
+  and migration, and History. Each `#### Dictionary: <entity>` row and each row of the §3 to §8
+  tables ends in a `Source` cell holding one of `FR-###`, `NFR-###`, `IC-###`, `code:<path>:<line>`,
+  `proposed`, or `UNKNOWN -> Open Point`. A `proposed` or `UNKNOWN -> Open Point` row is copied to
+  `design.md` Open Points for Review. A conditional section takes `N/A: [why]`.
 
 ### The `N/A: [why]` escape
 

package/core/shared/guidance/references/DOFLOW_CHAIN.md

@@ -4,8 +4,8 @@ A spec-kit-style, phase-gated delivery loop (`do-brainstorm → do-design → do
 do-execute-plan → do-test → do-code-review`) on top of the rest of the `/do-*` skills and the seven
 specialist agents (`core-implementer`, `delivery-lead`, `quality-guardian`,
 `research-writer`, `reviewer`, `spec-analyst`, `system-architect`). Discipline borrowed from
-spec-kit; enforcement done with the harness's real hooks rather than a prompt-read registry.
-The implement-gate hook is registered in
+spec-kit; hooks advise, and the runtime enforces order and readiness at handoff rather than a
+prompt-read registry. The implement-gate hook is registered in
 `settings.json`. `do-constitution` sits outside the numbered chain — a standalone,
 still-invocable skill that maintains the persistent rules every phase inherits, not a phase
 itself. `do-implement` sits outside the numbered chain too, for the opposite reason: it is the
@@ -19,7 +19,7 @@ remains the chain's own implementation phase.
 |------|-------|
 | `skills/` | Chain skills: `do-brainstorm` (also creates the feature branch/dir, writes `requirement.md`, optionally captures a PBI/ticket ID), `do-design` (writes `design.md`), `do-plan` (also writes the dependency-ordered task checklist inside `plan.md`, plus a Repo Branch Plan for multi-repo features), `do-execute-plan` (also supports `--scaffold` to emit a reviewable code scaffold under the feature dir — the source layout, signatures and test stubs the three artifacts imply, plus a per-dependency-service contract frame — and lazily creates/tracks each repo's branch as it's first touched; a non-local dependency with a `external-contract:` field gets a frame generated from that doc instead of the default silent skip), `do-test`, `do-code-review`. `do-constitution` is standalone, not part of the numbered chain. |
 | `scripts/doflow/` | The runtime seam. Skills call `bin/doflow-run <verb>` and never name a helper: the dispatcher decides which `bash/*.sh` helper or Node command serves each verb. The dispatcher owns the verb namespace and is the only place it is written down — an inventory here is the drift this row used to produce. |
-| `shared/hooks/policies/` | `mcp-tool-guard.sh`: MCP policy; `pre-bash-guard.sh`: command denials; `pre-implementation-gate.sh`: artifact/readiness edit gate; `stop-check.sh`: blocks stopping on unfinished-work markers. Harnesses with hook support call these; support differs per harness. |
+| `shared/hooks/policies/` | `mcp-tool-guard.sh`: MCP policy; `emission.sh`: nudges; `pre-implementation-gate.sh`: artifact/readiness edit advice; `stop-check.sh`: warns on unfinished-work markers. Harnesses with hook support call these; support differs per harness. |
 | `templates/doflow/` | `constitution-template.md` (tier-2); `data-model-template.md`; `design-template.md`; `external-contract-template.md`; `intent-template.md`; `plan-template.md`; `question-log-template.md`; `requirement-template.md`; `specs-template.md`; `state-template.md`. Chain skills seed feature dirs from a shared pool, not per-skill `assets/`. |
 | `guidance/references/` | `ARTIFACT_FORMAT.md`, `ARTIFACT_VOICE.md`, `CONSTITUTION_BASE.md` (global tier-1), `DIAGRAM_GUIDE.md`, `DOFLOW_CHAIN.md`, `EVIDENCE_LEDGER.md`, `MODEL_SELECTION.md`, `ORCHESTRATION.md`, `RESEARCH_CONFIG.md`, `WORKFLOW_HANDOFF.md`. |
 
@@ -52,7 +52,7 @@ remains the chain's own implementation phase.
   `requirement.md`'s `**Intent:**` field — the argument that does so is declared in `/do-brainstorm`'s
   own `argument-hint`, which is where a single-skill argument is owned. Discovery without an intent is
   unchanged and is the ordinary case.
-- **Implement gate (hard):** Denies source edits for started features missing `requirement.md`/`design.md`/`plan.md` (`missing-artifacts`), or held tasks without READY at their workflow's first source-mutating stage (`readiness-missing`, `readiness-not-ready`, `readiness-wrong-template`, or `readiness-store-conflict` when a linked worktree's copy differs from the main checkout's). Other blockers: `shared/hooks/policies/`, and the planning stage's exit, which refuses a constitution MUST conflict ("Two-tier constitution" below); all other chain gates are advisory/skippable.
+- **Implement gate (advisory):** Advises on source edits for started features missing `requirement.md`/`design.md`/`plan.md` (`missing-artifacts`), or held tasks without READY at their workflow's first source-mutating stage (`readiness-missing`, `readiness-not-ready`, `readiness-wrong-template`, or `readiness-store-conflict` when a linked worktree's copy differs from the main checkout's). Only these block: an MCP tool call matching a blocked pattern, faults under the `strict-1` profile, and the planning stage's exit, which refuses a constitution MUST conflict ("Two-tier constitution" below); all other chain gates are advisory/skippable.
 - **Two-tier constitution — what is computed vs. what is convention.**
   `references/CONSTITUTION_BASE.md` (tier-1, global) is overlaid by
   `<repo>/agent-docs/constitution.md` (tier-2, per-repo), and tier-2 takes precedence. **That

package/core/shared/guidance/references/ORCHESTRATION.md

@@ -33,3 +33,5 @@ items with the required author. After a failed/stopped agent, check status, log,
 
 Use sensible defaults. Ask one structured question only when a contract or behavior changes beyond
 the request; resolve agent questions rather than forwarding a list.
+Unattended, that same case halts per RULE_04 (WORKFLOW_HANDOFF.md § Unattended stage): the
+recommended default is not adopted.

package/core/shared/guidance/references/WORKFLOW_HANDOFF.md

@@ -40,6 +40,23 @@ With or without a register, record in this step each finding left unfixed, item
 and gate answer that defers work:
 `"$DOFLOW" followup --action add --stage <stage> --statement "<one line>"`.
 
+## Unattended stage
+
+Per stage run `"$DOFLOW" attendance --task-id "<feature_slug>"`. Unless it printed a line starting
+`unattended`, ask as the skill says. Otherwise RULE_04 applies and:
+
+1. **Ask nothing, decide no gate.** Gates are the loop's: no `decide-gate` (not even for zero
+   markers); hand off and stop. A gate is never a default, nor is closing a goal.
+2. **The run supplies** the class (`taskClass` in `orchestrate --action status --task-id
+   "<feature_slug>" --json`), the slug (the `feat/<slug>` branch) and `commit.branch`. A rejected
+   class, several slugs, a `--from` clash or readiness `ASK_USER` halts.
+3. **Record an adopted default** in the decision batch: `channel` `default`, `rationale`
+   `unattended:<source>`, `stage` the nearest accepted ownership-table name.
+4. **Halt, never hand off,** when no sensible default exists, a contract would change or a
+   permission is denied: `"$DOFLOW" followup --action add --stage <stage as in 3> --statement
+   "<why it blocks>"`, report and stop; the row is held.
+5. **Never apply `--fix` or send private context** (leave the request `unresolved`).
+
 ## The handoff call
 
 After a skill finishes its work, call the resolved runtime seam:
@@ -71,7 +88,8 @@ Use `--result passed|failed|unverified` to record the stage's outcome. Omission
 For bug reproduction, observing the expected failure can satisfy the stage contract; the command's
 nonzero exit alone is not the stage verdict. Reruns append a note and preserve the original outcome.
 
-Only handle an `awaitingGate` if the skill owns that gate and the handoff just completed its anchor.
+Only handle an `awaitingGate` if the skill owns that gate and the handoff just completed its anchor;
+unattended, never handle one (§ Unattended stage).
 Follow the owning skill's decision rules; this API supplies no authorization. A deferral is not a
 rejection. The lower-level `decide-gate` action remains explicit.
 

package/core/shared/guidance/rules/RULES.md

@@ -8,7 +8,7 @@ Conflict order: Safety > Scope > Quality > Speed. Prototype != Production requir
 - **Parallel when write sets are disjoint; otherwise sequential.** Use task lists past 3 tasks when available.
 - Run lint/typecheck before marking complete.
 - Check deps (package.json) and existing patterns before any changes.
-- Feature delivery follows the doflow chain — see `references/DOFLOW_CHAIN.md` for the phase-gated flow, artifact contracts, and the enforced gate.
+- Feature delivery follows the doflow chain — see `references/DOFLOW_CHAIN.md` for the phase-gated flow, artifact contracts, and the advisory implement gate.
 - Start it = Finish it. No partial features, TODO stubs, mocks, or "not implemented" throws. <!-- must-carry -->
 - All generated code must work as specified; no scaffolding placeholders.
 
@@ -35,7 +35,7 @@ Conflict order: Safety > Scope > Quality > Speed. Prototype != Production requir
 - One question that unblocks beats three that re-litigate settled choices.
 
 **Non-Interactive Fallback**
-When no native interactive question tool (one that presents options and returns the user's choice) is available in the current session:
+When no native interactive question tool (one that presents options and returns the user's choice) is available in the current session, or `"$DOFLOW" attendance` printed `unattended` for this stage (the rules in WORKFLOW_HANDOFF.md § Unattended stage apply; a gate is never a default):
 - Do NOT generate `{stage}-questions.md` files or halt execution waiting for manual file edits.
 - Adopt the recommended default choice, record the adopted decision and rationale in the stage notes or artifact, and proceed with execution.
 - If no sensible default exists and execution cannot safely proceed without user input, report the specific ambiguity and halt.

package/core/shared/scripts/doflow/bash/do-git-state.sh

@@ -111,10 +111,14 @@ is_dirty() {
 # means anything. The local branch was used unconditionally, so a develop that had not been pulled
 # made every distance wrong by however stale it was — observed live at 22 reported against 32.
 #
-# The remote-tracking ref is preferred where it exists; the local branch is the fallback for a
-# repository with no remote or one never fetched. Preferring it does not make the answer *fresh* —
-# origin/develop is only as current as the last fetch — so the third field reports how far the
-# local branch trails, which is non-zero exactly when a `git fetch` would change the answer.
+# The remote-tracking ref is preferred where it exists, unless the local branch is strictly ahead
+# of it (origin/<branch> is an ancestor of the branch and they differ): then the local branch holds
+# integrated work the remote has not seen yet, and measuring from origin would count that work as
+# the caller's own. An equal, behind or diverged local branch keeps the remote preference; the local
+# branch is the fallback for a repository with no remote or one never fetched. Preferring the remote
+# does not make the answer *fresh* — origin/develop is only as current as the last fetch — so the
+# third field reports how far the local branch trails, which is non-zero exactly when a `git fetch`
+# would change the answer.
 #
 # Echoes: "<ref> <kind> <local-behind-remote>"
 resolve_integration_ref() {
@@ -125,6 +129,10 @@ resolve_integration_ref() {
     kind="remote-tracking"
     if git rev-parse --verify --quiet "refs/heads/${branch}" >/dev/null 2>&1; then
       behind="$(git rev-list --count "${branch}..origin/${branch}" 2>/dev/null || echo 0)"
+      if [ "$behind" = "0" ] && [ "$(git rev-list --count "origin/${branch}..${branch}" 2>/dev/null || echo 0)" -gt 0 ]; then
+        ref="$branch"
+        kind="local"
+      fi
     fi
   fi
   printf '%s %s %s\n' "$ref" "$kind" "$behind"

package/core/shared/scripts/doflow/bash/do-parallel-check.sh

@@ -12,6 +12,10 @@ case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; th
 # reducing dispatch overhead. The script forms groups from `owner:` fields, computes union
 # file sets per group, and reports overlaps across groups (`group_overlaps[]`).
 #
+# Owner and files are read from the whole task block: the task line and a `Verify:` line under it. A task
+# that declares no `files:` (`files: none` is a declaration), or declares different sets, is named in
+# `files_missing[]` / `files_conflict[]`, and while one exists `parallel_safe` is `null`, never `true`.
+#
 # Advisory by design: it reports overlaps and grouping decisions; the calling skill decides
 # to serialize or group dispatch. It never edits the plan and never dispatches anything.
 #
@@ -67,7 +71,70 @@ plan_abs="$repo_root/$plan_rel"
 
 # Pipeline: awk outputs tab-separated values (one per line), jq reads raw lines as strings,
 # aggregates them into an array, then processes each row.
+#
+# A task is its whole block: the `- [ ] <id>` line and the indented lines under it, up to the next task or
+# heading. `owner:` and `files:` are read from the task line and from a `Verify:` line (the layout plans
+# written with a verification line use); each is the text after the line's first em dash. A task that
+# declares files twice must declare the same set twice: a different set is `conflict`, and a task that
+# declares none is `missing`. `files: none` is a declaration of an empty set, not a missing one.
 awk -v want="$phase" '
+  # Sorted, de-duplicated, comma-joined form of a comma list, so two spellings of one set compare equal.
+  function normalize(list,    n, parts, i, j, t, out, last) {
+    n = split(list, parts, ",")
+    for (i = 1; i <= n; i++) { gsub(/^[ \t]+|[ \t]+$/, "", parts[i]) }
+    for (i = 2; i <= n; i++) {
+      t = parts[i]
+      for (j = i - 1; j >= 1 && parts[j] > t; j--) parts[j + 1] = parts[j]
+      parts[j + 1] = t
+    }
+    out = ""; last = "\001"
+    for (i = 1; i <= n; i++) {
+      if (parts[i] == "" || parts[i] ~ /^none/ || parts[i] == last) continue
+      out = out (out == "" ? "" : ",") parts[i]
+      last = parts[i]
+    }
+    return out
+  }
+  # Reads one line'"'"'s owner:/files: fields into the current task.
+  function declare(line,    dash_pos, section, o, f) {
+    dash_pos = index(line, "—")
+    if (dash_pos == 0) return
+    section = substr(line, dash_pos + length("—"))
+    if (match(section, /owner:[^;]*/)) {
+      o = substr(section, RSTART + 7, RLENGTH - 7)
+      gsub(/^[ \t]+|[ \t]+$/, "", o)
+      if (o != "") {
+        if (owner == "") owner = o
+        else if (owner != o) conflict = 1
+      }
+    }
+    if (match(section, /files:[^;]*/)) {
+      f = substr(section, RSTART + 6, RLENGTH - 6)
+      gsub(/^[ \t]+|[ \t]+$/, "", f)
+      if (f == "") return
+      declared++
+      set = normalize(f)
+      if (declared == 1) first = set
+      else if (set != first) conflict = 1
+      m = split(set, items, ",")
+      for (k = 1; k <= m; k++) if (items[k] != "" && !(items[k] in seen)) { seen[items[k]] = 1; order[++norder] = items[k] }
+    }
+  }
+  function flush(    status, k) {
+    if (id == "") return
+    status = conflict ? "conflict" : (declared == 0 ? "missing" : "ok")
+    if (norder == 0) print id "\t" par "\t" owner "\t\t" status
+    for (k = 1; k <= norder; k++) print id "\t" par "\t" owner "\t" order[k] "\t" status
+    id = ""
+  }
+  function start(line) {
+    id = substr(line, RSTART + 6, RLENGTH - 6)
+    par = (line ~ /^- \[[ x]\] [^ ]+ \[P\]/) ? "P" : "S"
+    owner = ""; declared = 0; conflict = 0; first = ""; norder = 0
+    delete seen; delete order
+    declare(line)
+  }
+  /^#+ / { flush() }
   /^### Phase / {
     inphase = ($3 == want)
     next
@@ -75,43 +142,22 @@ awk -v want="$phase" '
   /^### / { inphase = 0; next }
   !inphase { next }
   /^- \[[ x]\] / {
-    line = $0
-    if (match(line, /^- \[[ x]\] [^ ]+/) == 0) next
-    id = substr(line, RSTART + 6, RLENGTH - 6)
-    par = (line ~ /^- \[[ x]\] [^ ]+ \[P\]/) ? "P" : "S"
-    # Extract only the portion after em-dash for owner:/files: parsing
-    dash_pos = index(line, "—")
-    if (dash_pos == 0) {
-      print id "\t" par "\t\t"
-      next
-    }
-    field_section = substr(line, dash_pos + length("—"))
-    owner = ""
-    if (match(field_section, /owner:[^;]*/)) {
-      owner = substr(field_section, RSTART + 7, RLENGTH - 7)
-      gsub(/^[ \t]+|[ \t]+$/, "", owner)
-    }
-    if (match(field_section, /files:[^;]*/)) {
-      files = substr(field_section, RSTART + 6, RLENGTH - 6)
-      n = split(files, parts, ",")
-      emitted = 0
-      for (i = 1; i <= n; i++) {
-        f = parts[i]
-        gsub(/^[ \t]+|[ \t]+$/, "", f)
-        if (f == "" || f ~ /^none/) continue
-        print id "\t" par "\t" owner "\t" f
-        emitted = 1
-      }
-      if (!emitted) print id "\t" par "\t" owner "\t"
-    } else {
-      print id "\t" par "\t" owner "\t"
-    }
+    flush()
+    if (match($0, /^- \[[ x]\] [^ ]+/) == 0) next
+    start($0)
+    next
   }
+  id != "" && /^[ \t]*[-*]?[ \t]*\**Verify\**:/ { declare($0) }
+  END { flush() }
 ' "$plan_abs" | jq -R . | jq -s --arg phase "$phase" '
   # Convert array of tab-separated strings to array of objects
   map(split("\t")) |
-  map({id: .[0], par: .[1], owner: (.[2] // ""), file: (.[3] // "")}) |
+  map({id: .[0], par: .[1], owner: (.[2] // ""), file: (.[3] // ""), meta: (.[4] // "missing")}) |
   . as $rows |
+
+  # Tasks whose file metadata cannot establish anything: none declared, or declarations that disagree
+  ([.[] | select(.meta == "missing") | .id] | unique) as $files_missing |
+  ([.[] | select(.meta == "conflict") | .id] | unique) as $files_conflict |
   
   # Separate by parallel/sequential
   ([.[] | select(.par == "P") | .id] | unique)   as $par |
@@ -200,8 +246,15 @@ awk -v want="$phase" '
     # a non-empty `group_overlaps` naming the very file two groups both write. `do-execute-plan`
     # tells the reader to branch on this field and never on the exit code, so either shape
     # authorises concurrent writes to one file.
+    #
+    # A task with no `files:` (or two that disagree) has an unknown write set, so a phase containing one
+    # is never reported safe: `null` (unknown, run serially) unless a real overlap already makes it `false`.
     parallel_safe: (if (($par | length) == 0 and ($seq | length) == 0) then null
-                    else (($overlaps | length) == 0 and ($final_group_overlaps | length) == 0) end),
+                    elif (($overlaps | length) > 0 or ($final_group_overlaps | length) > 0) then false
+                    elif (($files_missing | length) > 0 or ($files_conflict | length) > 0) then null
+                    else true end),
+    files_missing: $files_missing,
+    files_conflict: $files_conflict,
     serialize: ([$overlaps[] | .tasks[]] | unique),
     groups: $final_groups,
     group_overlaps: $final_group_overlaps,

package/core/shared/scripts/doflow/bash/do-review-package.sh

@@ -21,7 +21,10 @@ case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; th
 # Usage:
 #   do-review-package.sh --task=<id> --base=<sha> --head=<sha> [--slug=<slug>] [--json]
 #
-# Emits: {path, commits, bytes, base, head}
+# Emits: {path, commits, bytes, base, head}, plus missing[] when the rules block could not be built.
+#
+# Between the title and the commit list the package carries the "Rules that apply to you" block: the
+# mustCarry lines of the rule ledger (core/registry/rules.json), as the task and group briefs print them.
 
 set -uo pipefail
 
@@ -96,10 +99,40 @@ if [ "${commits:-0}" -eq 0 ]; then
   exit 2
 fi
 
+# The registry file `core/registry/<name>` of the runtime this script belongs to: next to the checkout or
+# projected runtime found above this script, else the global projected runtime (as do-task-brief.sh).
+registry_file() { # registry_file <name>
+  local d="$script_dir" c
+  while [ -n "$d" ] && [ "$d" != "/" ]; do
+    for c in "$d/core/registry/$1" "$d/runtime/core/registry/$1"; do
+      if [ -f "$c" ]; then printf '%s' "$c"; return 0; fi
+    done
+    d="$(dirname "$d")"
+  done
+  c="${HOME:-}/.doflow/runtime/core/registry/$1"
+  if [ -f "$c" ]; then printf '%s' "$c"; fi
+  return 0
+}
+
+missing='[]'
+rules_block=""
+rules_file="$(registry_file rules.json)"
+if [ -z "$rules_file" ]; then
+  missing='["brief-rules: core/registry/rules.json is missing"]'
+else
+  rule_lines="$(jq -r 'if (.mustCarry | type) == "array" and (.mustCarry | length) > 0 and (.mustCarry | all(type == "string")) then .mustCarry[] | "- " + . else empty end' "$rules_file" 2>/dev/null)"
+  if [ -z "$rule_lines" ]; then
+    missing='["brief-rules: core/registry/rules.json has no mustCarry array"]'
+  else
+    rules_block="$(printf '## Rules that apply to you\n\n%s\n' "$rule_lines")"
+  fi
+fi
+
 write_ok=1
 {
   echo "# Review package: $base7..$head7"
   echo
+  if [ -n "$rules_block" ]; then printf '%s\n\n' "$rules_block"; fi
   echo "## Commits"
   git log --oneline "$base..$head_ref"
   echo
@@ -127,5 +160,6 @@ jq -n \
   --argjson commits "${commits:-0}" \
   --argjson bytes "${bytes:-0}" \
   --arg base "$base7" --arg head "$head7" \
-  '{path:$path, commits:$commits, bytes:$bytes, base:$base, head:$head}'
+  --argjson missing "$missing" \
+  '{path:$path, commits:$commits, bytes:$bytes, base:$base, head:$head} + (if ($missing | length) > 0 then {missing:$missing} else {} end)'
 exit 0

package/core/shared/scripts/doflow/bash/validate-artifacts.sh

@@ -216,7 +216,7 @@ for f in "${targets[@]}"; do
     esac
   fi
   # Paths reach awk through the environment: -v would process backslash escapes inside them.
-  out=$(DF_ART_DIR="$(dirname "$f")" DF_HIST_ROOT="$hist_root" awk -v is_plan="$([ "$(basename "$f")" = "plan.md" ] && echo 1 || echo 0)" \
+  out=$(LC_ALL=C DF_ART_DIR="$(dirname "$f")" DF_HIST_ROOT="$hist_root" awk -v is_plan="$([ "$(basename "$f")" = "plan.md" ] && echo 1 || echo 0)" \
     -v stale_map="$file_stale_map" -v reg_ok="$file_reg_ok" -v known_ids="$file_known_ids" -v sq="'" '
     # Inline markup is presentation, not value: "**Superseded → X**" and "`Live`" mean the same as
     # their bare forms, so emphasis is stripped before any comparison.