@lumenflow/cli 2.4.0 → 2.5.1

package/dist/wu-done.js

@@ -65,6 +65,7 @@ CONTEXT_VALIDATION, } from '@lumenflow/core/dist/wu-constants.js';
 import { printGateFailureBox, printStatusPreview } from '@lumenflow/core/dist/wu-done-ui.js';
 import { ensureOnMain } from '@lumenflow/core/dist/wu-helpers.js';
 import { WU_PATHS } from '@lumenflow/core/dist/wu-paths.js';
+import { getConfig } from '@lumenflow/core/dist/lumenflow-config.js';
 import { writeWU, appendNote, parseYAML } from '@lumenflow/core/dist/wu-yaml.js';
 import { PLACEHOLDER_SENTINEL, validateWU, validateDoneWU, validateApprovalGates, } from '@lumenflow/core/dist/wu-schema.js';
 import { validateBacklogSync } from '@lumenflow/core/dist/backlog-sync-validator.js';
@@ -969,11 +970,14 @@ async function runGatesInWorktree(worktreePath, id, options = {}) {
 }
 async function validateStagedFiles(id, isDocsOnly = false) {
     const staged = await listStaged();
+    // WU-1311: Use config-based paths instead of hardcoded docs/04-operations paths
+    const config = getConfig();
+    const wuPath = `${config.directories.wuDir}/${id}.yaml`;
     // WU-1740: Include wu-events.jsonl to persist state store events
     const whitelist = [
-        `docs/04-operations/tasks/wu/${id}.yaml`,
-        'docs/04-operations/tasks/status.md',
-        'docs/04-operations/tasks/backlog.md',
+        wuPath,
+        config.directories.statusPath,
+        config.directories.backlogPath,
         WU_EVENTS_PATH,
     ];
     if (isDocsOnly) {
@@ -998,7 +1002,10 @@ async function validateStagedFiles(id, isDocsOnly = false) {
         return true;
     });
     if (unexpected.length > 0) {
-        const otherWuYamlOnly = unexpected.every((f) => /^docs\/04-operations\/tasks\/wu\/WU-\d+\.yaml$/.test(f));
+        // WU-1311: Use config-based pattern for WU YAML detection
+        const wuDirPattern = config.directories.wuDir.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const wuYamlRegex = new RegExp(`^${wuDirPattern}/WU-\\d+\\.yaml$`);
+        const otherWuYamlOnly = unexpected.every((f) => wuYamlRegex.test(f));
         if (otherWuYamlOnly) {
             console.warn(`${LOG_PREFIX.DONE} Warning: other WU YAMLs are staged; proceeding and committing only current WU files.`);
         }
@@ -1620,8 +1627,10 @@ async function executePreFlightChecks({ id, args, isBranchOnly, isDocsOnly, docM
     if (!specResult.valid) {
         console.error(`\n❌ Spec completeness validation failed for ${id}:\n`);
         specResult.errors.forEach((err) => console.error(`  - ${err}`));
+        // WU-1311: Use config-based path in error message
+        const specConfig = getConfig();
         console.error(`\nFix these issues before running wu:done:\n` +
-            `  1. Update docs/04-operations/tasks/wu/${id}.yaml\n` +
+            `  1. Update ${specConfig.directories.wuDir}/${id}.yaml\n` +
             `  2. Fill description with Context/Problem/Solution\n` +
             `  3. Replace ${PLACEHOLDER_SENTINEL} text with specific criteria\n` +
             `  4. List all modified files in code_paths\n` +

package/dist/wu-edit.js

@@ -57,6 +57,8 @@ import { readInitiative, writeInitiative } from '@lumenflow/initiatives/dist/ini
 import { normalizeWUSchema } from '@lumenflow/core/dist/wu-schema-normalization.js';
 // WU-2253: Import WU spec linter for acceptance/code_paths validation
 import { lintWUSpec, formatLintErrors } from '@lumenflow/core/dist/wu-lint.js';
+// WU-1329: Import path existence validators for strict validation
+import { validateCodePathsExistence, validateTestPathsExistence, } from '@lumenflow/core/dist/wu-preflight-validators.js';
 /* eslint-disable security/detect-object-injection */
 const PREFIX = LOG_PREFIX.EDIT;
 /**
@@ -377,6 +379,8 @@ function parseArgs() {
             EDIT_OPTIONS.replaceDependencies,
             // WU-1039: Add exposure for done WU metadata updates
             WU_OPTIONS.exposure,
+            // WU-1329: Strict validation is default, --no-strict bypasses
+            WU_OPTIONS.noStrict,
         ],
         required: ['id'],
         allowPositionalId: true,
@@ -921,6 +925,37 @@ async function main() {
     // WU-1750: CRITICAL - Use transformed data for all subsequent operations
     // This ensures embedded newlines are normalized before YAML output
     const normalizedWU = validationResult.data;
+    // WU-1329: Strict validation of path existence (default behavior)
+    // --no-strict bypasses these checks
+    const strict = !opts.noStrict;
+    if (!strict) {
+        console.warn(`${PREFIX} WARNING: strict validation bypassed (--no-strict). Path existence checks skipped.`);
+    }
+    if (strict) {
+        const rootDir = process.cwd();
+        const strictErrors = [];
+        // Validate code_paths exist
+        if (normalizedWU.code_paths && normalizedWU.code_paths.length > 0) {
+            const codePathsResult = validateCodePathsExistence(normalizedWU.code_paths, rootDir);
+            if (!codePathsResult.valid) {
+                strictErrors.push(...codePathsResult.errors);
+            }
+        }
+        // Validate test_paths exist (unit, e2e - not manual)
+        if (normalizedWU.tests) {
+            const testPathsResult = validateTestPathsExistence(normalizedWU.tests, rootDir);
+            if (!testPathsResult.valid) {
+                strictErrors.push(...testPathsResult.errors);
+            }
+        }
+        if (strictErrors.length > 0) {
+            const errorList = strictErrors.map((e) => `  • ${e}`).join('\n');
+            die(`${PREFIX} ❌ Strict validation failed:\n\n${errorList}\n\n` +
+                `Options:\n` +
+                `  1. Fix the paths in the WU spec to match actual files\n` +
+                `  2. Use --no-strict to bypass path existence checks (not recommended)`);
+        }
+    }
     // Validate lane format if present (WU-923: block parent-only lanes with taxonomy)
     if (normalizedWU.lane) {
         validateLaneFormat(normalizedWU.lane);

package/dist/wu-prep.js

@@ -1,21 +1,28 @@
 #!/usr/bin/env node
+/* eslint-disable no-console -- CLI command uses console for status output */
 /**
  * WU Prep Helper (WU-1223)
  *
  * Prepares a WU for completion by running gates and generating docs in the worktree.
  * After successful prep, prints copy-paste instruction to run wu:done from main.
  *
+ * WU-1344: When gates fail on spec:linter due to pre-existing WU validation errors
+ * (not caused by the current WU), prints a ready-to-copy wu:done --skip-gates
+ * command with reason and fix-wu placeholders.
+ *
  * Workflow:
  * 1. Verify we're in a worktree (error if in main checkout)
  * 2. Run gates in the worktree
- * 3. Generate docs (if applicable)
- * 4. Print copy-paste instruction for wu:done from main
+ * 3. If gates fail, check if failures are pre-existing on main
+ * 4. If pre-existing, print skip-gates command; otherwise, print fix guidance
+ * 5. On success, print copy-paste instruction for wu:done from main
  *
  * Usage:
  *   pnpm wu:prep --id WU-XXX [--docs-only]
  *
  * @module
  */
+import { spawnSync } from 'node:child_process';
 import { createWUParser, WU_OPTIONS } from '@lumenflow/core/dist/arg-parser.js';
 import { die } from '@lumenflow/core/dist/error-handler.js';
 import { resolveLocation } from '@lumenflow/core/dist/context/location-resolver.js';
@@ -39,6 +46,84 @@ const PREP_OPTIONS = {
         description: 'Run docs-only gates (format, spec-linter)',
     },
 };
+/**
+ * WU-1344: Check if a gate name is the spec:linter gate.
+ * Used to identify when spec:linter fails so we can check for pre-existing failures.
+ *
+ * @param gateName - Name of the gate that failed
+ * @returns true if this is the spec:linter gate
+ */
+export function isPreExistingSpecLinterFailure(gateName) {
+    const normalizedName = gateName.toLowerCase().replace(/[:-]/g, '');
+    return normalizedName === 'speclinter';
+}
+/**
+ * WU-1344: Format a skip-gates command for wu:done.
+ * Includes --reason and --fix-wu placeholders.
+ *
+ * @param options - Configuration options
+ * @param options.wuId - The WU ID being completed
+ * @param options.mainCheckout - Path to main checkout
+ * @returns Formatted command string ready to copy-paste
+ */
+export function formatSkipGatesCommand(options) {
+    const { wuId, mainCheckout } = options;
+    return `cd ${mainCheckout} && pnpm wu:done --id ${wuId} --skip-gates --reason "pre-existing on main" --fix-wu WU-XXXX`;
+}
+/**
+ * WU-1344: Default implementation of execOnMain using spawnSync.
+ * Uses spawnSync with pnpm executable for safety (no shell injection risk).
+ */
+function defaultExecOnMain(mainCheckout) {
+    return async (cmd) => {
+        // Parse command to extract pnpm script name and args
+        // Expected format: "pnpm spec:linter" or similar
+        const parts = cmd.split(/\s+/);
+        const executable = parts[0];
+        const args = parts.slice(1);
+        const result = spawnSync(executable, args, {
+            cwd: mainCheckout,
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return {
+            exitCode: result.status ?? 1,
+            stdout: result.stdout ?? '',
+            stderr: result.stderr ?? '',
+        };
+    };
+}
+/**
+ * WU-1344: Check if spec:linter failures are pre-existing on main branch.
+ *
+ * Runs spec:linter on the main checkout to determine if the failures
+ * already exist there (i.e., not caused by the current WU).
+ *
+ * @param options - Configuration options
+ * @param options.mainCheckout - Path to main checkout
+ * @param options.execOnMain - Optional function to execute commands on main (for testing)
+ * @returns Result indicating whether failures are pre-existing
+ */
+export async function checkPreExistingFailures(options) {
+    const { mainCheckout, execOnMain = defaultExecOnMain(mainCheckout) } = options;
+    try {
+        // Run spec:linter on main checkout
+        const result = await execOnMain('pnpm spec:linter');
+        // If spec:linter fails on main, the failures are pre-existing
+        if (result.exitCode !== 0) {
+            return { hasPreExisting: true };
+        }
+        return { hasPreExisting: false };
+    }
+    catch (error) {
+        // If we can't check main, assume failures are NOT pre-existing
+        // (safer to require fixing rather than skipping)
+        return {
+            hasPreExisting: false,
+            error: error.message,
+        };
+    }
+}
 /**
  * Print success message with copy-paste instruction.
  */
@@ -106,6 +191,34 @@ async function main() {
     console.log(`${PREP_PREFIX} Location: ${location.cwd}`);
     console.log(`${PREP_PREFIX} Main checkout: ${location.mainCheckout}`);
     console.log('');
+    // WU-1344: Check for pre-existing spec:linter failures on main BEFORE running gates.
+    // We do this first because runGates() calls die() on failure, which exits the process
+    // before we can check. By checking first, we can set up an exit handler to show
+    // the skip-gates command if gates fail.
+    console.log(`${PREP_PREFIX} Checking for pre-existing spec:linter failures on main...`);
+    const preExistingCheck = await checkPreExistingFailures({
+        mainCheckout: location.mainCheckout,
+    });
+    if (preExistingCheck.hasPreExisting) {
+        console.log(`${PREP_PREFIX} ${EMOJI.WARNING} Pre-existing failures detected on main.`);
+        // Set up an exit handler to print the skip-gates command when gates fail
+        // This runs before process.exit() fully terminates the process
+        process.on('exit', (code) => {
+            if (code !== EXIT_CODES.SUCCESS) {
+                console.log('');
+                console.log(`${PREP_PREFIX} ${EMOJI.WARNING} Since failures are pre-existing on main, you can skip gates:`);
+                console.log('');
+                console.log(`    ${formatSkipGatesCommand({ wuId: id, mainCheckout: location.mainCheckout })}`);
+                console.log('');
+                console.log(`${PREP_PREFIX} Replace WU-XXXX with the WU that will fix these spec issues.`);
+                console.log('');
+            }
+        });
+    }
+    else {
+        console.log(`${PREP_PREFIX} No pre-existing failures on main.`);
+    }
+    console.log('');
     // Run gates in the worktree
     console.log(`${PREP_PREFIX} Running gates in worktree...`);
     const gatesResult = await runGates({
@@ -113,13 +226,23 @@ async function main() {
         docsOnly: args.docsOnly,
     });
     if (!gatesResult) {
-        die(`${EMOJI.FAILURE} Gates failed in worktree.\n\n` +
-            `Fix the gate failures and run wu:prep again.`);
+        // Gates failed - if pre-existing check was already done and showed failures,
+        // the exit handler above will print the skip-gates command.
+        // Otherwise, tell the user to fix the failures.
+        if (!preExistingCheck.hasPreExisting) {
+            die(`${EMOJI.FAILURE} Gates failed in worktree.\n\n` +
+                `Fix the gate failures and run wu:prep again.`);
+        }
+        // Pre-existing failures - exit with error, handler will print skip-gates command
+        process.exit(EXIT_CODES.ERROR);
     }
     // Success - print copy-paste instruction
     printSuccessMessage(id, location.mainCheckout);
 }
-main().catch((e) => {
-    console.error(e.message);
-    process.exit(EXIT_CODES.ERROR);
-});
+// WU-1181: Use import.meta.main instead of process.argv[1] comparison
+// The old pattern fails with pnpm symlinks because process.argv[1] is the symlink
+// path but import.meta.url resolves to the real path - they never match
+import { runCLI } from './cli-entry-point.js';
+if (import.meta.main) {
+    void runCLI(main);
+}

package/dist/wu-spawn.js

@@ -36,11 +36,14 @@ import { parseYAML } from '@lumenflow/core/dist/wu-yaml.js';
 import { die } from '@lumenflow/core/dist/error-handler.js';
 import { WU_STATUS, PATTERNS, FILE_SYSTEM, EMOJI } from '@lumenflow/core/dist/wu-constants.js';
 // WU-1603: Check lane lock status before spawning
+// WU-1325: Import lock policy getter for lane availability check
 import { checkLaneLock } from '@lumenflow/core/dist/lane-lock.js';
+import { getLockPolicyForLane, getWipLimitForLane } from '@lumenflow/core/dist/lane-checker.js';
 import { minimatch } from 'minimatch';
 // WU-2252: Import invariants loader for spawn output injection
 import { loadInvariants, INVARIANT_TYPES } from '@lumenflow/core/dist/invariants-runner.js';
 import { validateSpawnArgs, generateExecutionModeSection, generateThinkToolGuidance, recordSpawnToRegistry, formatSpawnRecordedMessage, } from '@lumenflow/core/dist/wu-spawn-helpers.js';
+// eslint-disable-next-line sonarjs/deprecation -- legacy factory used by CLI spawns
 import { SpawnStrategyFactory } from '@lumenflow/core/dist/spawn-strategy.js';
 import { getConfig } from '@lumenflow/core/dist/lumenflow-config.js';
 import { generateClientSkillsGuidance, generateSkillsSelectionSection, resolveClientConfig, } from '@lumenflow/core/dist/wu-spawn-skills.js';
@@ -1146,11 +1149,17 @@ ${SPAWN_END_SENTINEL}
 }
 /**
  * WU-1603: Check if a lane is currently occupied by another WU
+ * WU-1325: Now considers lock_policy - lanes with policy=none are never occupied
  *
  * @param {string} lane - Lane name (e.g., "Operations: Tooling")
  * @returns {import('@lumenflow/core/dist/lane-lock.js').LockMetadata|null} Lock metadata if occupied, null otherwise
  */
 export function checkLaneOccupation(lane) {
+    // WU-1325: Lanes with lock_policy=none never report as occupied
+    const lockPolicy = getLockPolicyForLane(lane);
+    if (lockPolicy === 'none') {
+        return null;
+    }
     const lockStatus = checkLaneLock(lane);
     if (lockStatus.locked && lockStatus.metadata) {
         return lockStatus.metadata;
@@ -1160,7 +1169,10 @@ export function checkLaneOccupation(lane) {
 export function generateLaneOccupationWarning(lockMetadata, targetWuId, options = {}) {
     const { isStale = false } = options;
     let warning = `⚠️  Lane "${lockMetadata.lane}" is occupied by ${lockMetadata.wuId}\n`;
-    warning += `   This violates WIP=1 (Work In Progress limit of 1 per lane).\n\n`;
+    // WU-1346: Use injected values if provided, otherwise look up from config
+    const lockPolicy = options.lockPolicy ?? getLockPolicyForLane(lockMetadata.lane);
+    const wipLimit = options.wipLimit ?? getWipLimitForLane(lockMetadata.lane);
+    warning += `   This violates WIP=${wipLimit} (lock_policy=${lockPolicy}).\n\n`;
     if (isStale) {
         warning += `   ⏰ This lock is STALE (>24 hours old) - the WU may be abandoned.\n`;
         warning += `   Consider using pnpm wu:block --id ${lockMetadata.wuId} if work is stalled.\n\n`;
@@ -1319,6 +1331,7 @@ async function main() {
         }
     }
     // Create strategy
+    // eslint-disable-next-line sonarjs/deprecation -- legacy factory used by CLI spawns
     const strategy = SpawnStrategyFactory.create(clientName);
     const clientContext = { name: clientName, config: resolveClientConfig(config, clientName) };
     if (clientName === 'codex-cli' || args.codex) {

package/dist/wu-unblock.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+/* eslint-disable no-console -- CLI tool requires console output */
 /**
  * WU Unblock Helper
  *
@@ -16,12 +17,15 @@
 import { existsSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { assertTransition } from '@lumenflow/core/dist/state-machine.js';
-import { checkLaneFree } from '@lumenflow/core/dist/lane-checker.js';
+import { checkLaneFree, getLockPolicyForLane } from '@lumenflow/core/dist/lane-checker.js';
+// WU-1325: Import lane lock functions for policy-based lock acquisition on unblock
+import { acquireLaneLock } from '@lumenflow/core/dist/lane-lock.js';
 import { getGitForCwd } from '@lumenflow/core/dist/git-adapter.js';
 import { die } from '@lumenflow/core/dist/error-handler.js';
 import { todayISO } from '@lumenflow/core/dist/date-utils.js';
 import { createWUParser, WU_OPTIONS } from '@lumenflow/core/dist/arg-parser.js';
 import { WU_PATHS, defaultWorktreeFrom } from '@lumenflow/core/dist/wu-paths.js';
+import { getConfig } from '@lumenflow/core/dist/lumenflow-config.js';
 import { readWU, writeWU, appendNote } from '@lumenflow/core/dist/wu-yaml.js';
 import { STATUS_SECTIONS, PATTERNS, LOG_PREFIX, WU_STATUS, REMOTES, BRANCHES, GIT_REFS, FILE_SYSTEM, EXIT_CODES, MICRO_WORKTREE_OPERATIONS, } from '@lumenflow/core/dist/wu-constants.js';
 import { defaultBranchFrom } from '@lumenflow/core/dist/wu-done-validators.js';
@@ -88,7 +92,8 @@ function handleLaneOccupancy(laneCheck, lane, id, force) {
         `  1. Wait for ${laneCheck.occupiedBy} to complete or block\n` +
         `  2. Move ${id} to a different lane\n` +
         `  3. Use --force to override (P0 emergencies only)\n\n` +
-        `To check lane status: grep "${STATUS_SECTIONS.IN_PROGRESS}" docs/04-operations/tasks/status.md`);
+        // WU-1311: Use config-based status path
+        `To check lane status: grep "${STATUS_SECTIONS.IN_PROGRESS}" ${getConfig().directories.statusPath}`);
 }
 /**
  * Handle optional worktree creation after unblock
@@ -221,6 +226,33 @@ async function main() {
         getGitForCwd().run(`git push ${REMOTES.ORIGIN} ${BRANCHES.MAIN}`);
     }
     handleWorktreeCreation(args, doc);
+    // WU-1325: Re-acquire lane lock when WU is unblocked (only for lock_policy=active)
+    // For policy=all, lock was retained through the block cycle
+    // For policy=none, no lock exists to acquire
+    try {
+        if (lane && lane !== 'Unknown') {
+            const lockPolicy = getLockPolicyForLane(lane);
+            if (lockPolicy === 'active') {
+                const lockResult = acquireLaneLock(lane, id);
+                if (lockResult.acquired && !lockResult.skipped) {
+                    console.log(`${PREFIX} Lane lock re-acquired for "${lane}" (lock_policy=active)`);
+                }
+                else if (!lockResult.acquired) {
+                    // Lock acquisition failed - another WU claimed the lane while we were blocked
+                    console.warn(`${PREFIX} Warning: Could not re-acquire lane lock: ${lockResult.error}`);
+                    console.warn(`${PREFIX} Another WU may have claimed lane "${lane}" while this WU was blocked.`);
+                }
+            }
+            else if (lockPolicy === 'all') {
+                console.log(`${PREFIX} Lane lock retained for "${lane}" (lock_policy=all)`);
+            }
+            // For policy=none, no lock exists - nothing to do
+        }
+    }
+    catch (err) {
+        // Non-blocking: lock acquisition failure should not block the unblocking operation
+        console.warn(`${PREFIX} Warning: Could not acquire lane lock: ${err.message}`);
+    }
     console.log(`\n${PREFIX} Marked in progress and pushed.`);
     console.log(`- WU: ${id} — ${title}`);
     if (args.reason)

package/dist/wu-validate.js

@@ -3,13 +3,15 @@
  * WU Validation Tool
  *
  * Validates WU YAML files against schema and checks for quality warnings.
- * Returns exit code 0 if valid (warnings are advisory, not blocking).
- * Returns exit code 1 only for schema errors.
+ *
+ * WU-1329: Strict mode is now the DEFAULT behavior.
+ * - Warnings are treated as errors by default
+ * - Use --no-strict to restore legacy advisory-only warnings behavior
  *
  * Usage:
- *   pnpm wu:validate --id WU-123         # Validate specific WU
- *   pnpm wu:validate --all               # Validate all WUs
- *   pnpm wu:validate --all --strict      # Fail on warnings too
+ *   pnpm wu:validate --id WU-123         # Validate with strict mode (default)
+ *   pnpm wu:validate --all               # Validate all WUs with strict mode
+ *   pnpm wu:validate --all --no-strict   # Warnings are advisory (legacy behavior)
  *
  * @see {@link packages/@lumenflow/cli/src/lib/wu-schema.ts} - Schema definitions
  */
@@ -27,12 +29,14 @@ const LOG_PREFIX = '[wu:validate]';
 /**
  * Validate a single WU file
  *
+ * WU-1329: strict defaults to true (warnings treated as errors)
+ *
  * @param {string} wuPath - Path to WU YAML file
  * @param {object} options - Validation options
- * @param {boolean} options.strict - Treat warnings as errors
+ * @param {boolean} options.strict - Treat warnings as errors (default: true)
  * @returns {{valid: boolean, warnings: string[], errors: string[]}}
  */
-function validateSingleWU(wuPath, { strict = false } = {}) {
+function validateSingleWU(wuPath, { strict = true } = {}) {
     const errors = [];
     const warnings = [];
     // Read and parse YAML
@@ -74,11 +78,13 @@ function validateSingleWU(wuPath, { strict = false } = {}) {
 /**
  * Validate all WU files
  *
+ * WU-1329: strict defaults to true (warnings treated as errors)
+ *
  * @param {object} options - Validation options
- * @param {boolean} options.strict - Treat warnings as errors
+ * @param {boolean} options.strict - Treat warnings as errors (default: true)
  * @returns {{totalValid: number, totalInvalid: number, totalWarnings: number, results: object[]}}
  */
-function validateAllWUs({ strict = false } = {}) {
+function validateAllWUs({ strict = true } = {}) {
     const wuDir = WU_PATHS.WU_DIR();
     if (!existsSync(wuDir)) {
         die(`WU directory not found: ${wuDir}`);
@@ -110,7 +116,7 @@ function validateAllWUs({ strict = false } = {}) {
 async function main() {
     const args = createWUParser({
         name: 'wu-validate',
-        description: 'Validate WU YAML files against schema',
+        description: 'Validate WU YAML files against schema (strict mode by default, WU-1329)',
         options: [
             WU_OPTIONS.id,
             {
@@ -119,17 +125,19 @@ async function main() {
                 type: 'boolean',
                 description: 'Validate all WUs',
             },
-            {
-                name: 'strict',
-                flags: '-s, --strict',
-                type: 'boolean',
-                description: 'Treat warnings as errors',
-            },
+            // WU-1329: Change from --strict to --no-strict (strict is now default)
+            WU_OPTIONS.noStrict,
         ],
         required: [],
         allowPositionalId: true,
     });
-    const { id, all, strict } = args;
+    const { id, all, noStrict } = args;
+    // WU-1329: Strict mode is the default, --no-strict opts out
+    const strict = !noStrict;
+    // WU-1329: Log when strict validation is bypassed
+    if (noStrict) {
+        console.warn(`${LOG_PREFIX} WARNING: strict validation bypassed (--no-strict). Warnings will be advisory only.`);
+    }
     if (!id && !all) {
         die('Must specify --id WU-XXX or --all');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumenflow/cli",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "description": "Command-line interface for LumenFlow workflow framework",
   "keywords": [
     "lumenflow",
@@ -74,7 +74,11 @@
     "initiative-status": "./dist/initiative-status.js",
     "initiative-add-wu": "./dist/initiative-add-wu.js",
     "initiative-plan": "./dist/initiative-plan.js",
-    "init-plan": "./dist/init-plan.js",
+    "init-plan": "./dist/initiative-plan.js",
+    "plan-create": "./dist/plan-create.js",
+    "plan-link": "./dist/plan-link.js",
+    "plan-edit": "./dist/plan-edit.js",
+    "plan-promote": "./dist/plan-promote.js",
     "agent-session": "./dist/agent-session.js",
     "agent-session-end": "./dist/agent-session-end.js",
     "agent-log-issue": "./dist/agent-log-issue.js",
@@ -144,11 +148,11 @@
     "pretty-ms": "^9.2.0",
     "simple-git": "^3.30.0",
     "yaml": "^2.8.2",
-    "@lumenflow/core": "2.4.0",
-    "@lumenflow/metrics": "2.4.0",
-    "@lumenflow/memory": "2.4.0",
-    "@lumenflow/initiatives": "2.4.0",
-    "@lumenflow/agent": "2.4.0"
+    "@lumenflow/metrics": "2.5.1",
+    "@lumenflow/core": "2.5.1",
+    "@lumenflow/initiatives": "2.5.1",
+    "@lumenflow/agent": "2.5.1",
+    "@lumenflow/memory": "2.5.1"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^4.0.17",

package/templates/core/.lumenflow/constraints.md.template

@@ -1,13 +1,13 @@
 # LumenFlow Constraints Capsule
 
-**Version:** 1.0
+**Version:** 1.1
 **Last updated:** {{DATE}}
 
-This document contains the 6 non-negotiable constraints that every agent must keep "in working memory" from first plan through `wu:done`.
+This document contains the 7 non-negotiable constraints that every agent must keep "in working memory" from first plan through `wu:done`.
 
 ---
 
-## The 6 Non-Negotiable Constraints
+## The 7 Non-Negotiable Constraints
 
 ### 1. Worktree Discipline and Git Safety
 
@@ -19,8 +19,40 @@ This document contains the 6 non-negotiable constraints that every agent must ke
 - Hooks block WU commits from main checkout
 - Forbidden commands on main: `git reset --hard`, `git stash`, `git clean -fd`, `git push --force`
 
+**MANDATORY PRE-WRITE CHECK**
+
+Before ANY Write/Edit/Read operation:
+
+1. **Verify worktree location**:
+
+   ```bash
+   pwd
+   # Must show: .../worktrees/<lane>-wu-xxx
+   ```
+
+2. **Verify relative paths only**:
+   - ✅ `docs/...`, `packages/...`, `apps/...`, `./...`
+   - ❌ `/home/...`, `/Users/...`, or full repo paths
+
+3. **Docs-only exception (documentation WUs)**:
+   - You may run **read-only** commands from main (e.g., `pnpm gates --docs-only`).
+   - **All file writes still require a worktree**. If no worktree exists, claim one first.
+
 **Why:** Worktree isolation prevents cross-contamination between parallel WUs and protects the main branch.
 
+**NEVER "QUICK FIX" ON MAIN**
+
+If you see something broken on main (failing gates, format issues, typos, lint errors):
+
+- ❌ **Don't** fix it directly, even if it seems small or helpful
+- ❌ **Don't** run `prettier --write`, `pnpm lint --fix`, or any command that modifies files
+- ✅ **Do** report the issue to the user
+- ✅ **Do** create a WU if a fix is needed
+
+**Why this matters:** The "helpful fix" instinct causes agents to modify files on main without a worktree. While commits are blocked by hooks, the files are still modified, requiring manual cleanup. Every change—no matter how small—needs a worktree.
+
+**If you're on main and want to change something: STOP. Create a WU first.**
+
 ---
 
 ### 2. WUs Are Specs, Not Code
@@ -94,6 +126,32 @@ This document contains the 6 non-negotiable constraints that every agent must ke
 
 ---
 
+### 7. Test Ratchet Pattern (WU-1253)
+
+**Rule:** NEW test failures block gates; pre-existing failures (in baseline) warn but do not block.
+
+**Baseline File:** `.lumenflow/test-baseline.json`
+
+**Enforcement:**
+
+- Gates compare current test results against baseline
+- NEW failures (not in baseline) = **BLOCK** (must fix or add to baseline)
+- Pre-existing failures (in baseline) = **WARNING** (continue, do not block WU)
+- Fixed tests auto-removed from baseline (ratchet forward)
+
+**When gates fail due to tests:**
+
+1. Check baseline: `cat .lumenflow/test-baseline.json`
+2. If failure is pre-existing: warning shown, WU proceeds
+3. If failure is NEW: fix the test or add to baseline with:
+   ```bash
+   pnpm baseline:add --test "<test_name>" --reason "<why>" --fix-wu WU-XXXX
+   ```
+
+**Why:** Agents should not be blocked by unrelated failures. The ratchet ensures quality improves over time (failures can only be removed, never added without justification).
+
+---
+
 ## Mini Audit Checklist
 
 Before running `wu:done`, verify:

package/templates/core/AGENTS.md.template

@@ -17,11 +17,11 @@ cd worktrees/<lane>-wu-xxxx
 pnpm gates
 
 # 3. Complete (ALWAYS run this!)
-cd {{PROJECT_ROOT}}
+cd <project-root>
 pnpm wu:done --id WU-XXXX
 ```
 
-> **Complete CLI reference:** See [quick-ref-commands.md](docs/04-operations/_frameworks/lumenflow/agent/onboarding/quick-ref-commands.md)
+> **Complete CLI reference:** See [quick-ref-commands.md]({{QUICK_REF_LINK}})
 
 ---