@next-friday/create-app 5.0.2 → 5.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "5.0.2",
+  "version": "5.0.3",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",

package/templates/base/.agents/hooks/agent-mcp-gate.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+allow() {
+  printf '%s\n' '{"permission":"allow"}'
+  exit 0
+}
+
+block() {
+  jq -n --arg message "$1" '{permission:"deny",user_message:$message,agent_message:$message}'
+  printf 'agent-mcp-gate: %s\n' "$1" >&2
+  exit 2
+}
+
+trap 'block ".agents/hooks/agent-mcp-gate.sh failed. Stop and report this error to the user; agents may not edit the gate."' ERR
+command -v jq > /dev/null || block "jq is required to read the hook input. Install it: https://jqlang.org/download/"
+input=$(cat)
+tool=$(jq -r '.tool_name // empty' <<< "$input")
+if [[ $tool =~ (merge_pull_request|enable_pr_auto_merge|pull_request_review_write)$ ]]; then
+  block "A code owner approves a pull request and a person merges it. Do not approve or merge; report that the pull request waits on that review."
+fi
+allow

package/templates/base/.agents/hooks/agent-shell-gate.sh

@@ -12,6 +12,13 @@ block() {
   exit 2
 }
 
+irreversible=""
+
+# Record the first irreversible command, so the gate asks the person once a block has been ruled out.
+pause() {
+  [[ -n $irreversible ]] || irreversible=$1
+}
+
 trap 'block ".agents/hooks/agent-shell-gate.sh failed. Stop and report this error to the user; agents may not edit the gate."' ERR
 command -v jq > /dev/null || block "jq is required to read the hook input. Install it: https://jqlang.org/download/"
 input=$(cat)
@@ -23,6 +30,7 @@ redirect=$'\x1e'
 protected_names='(\.husky|\.agents|\.cursor|\.claude/rules|\.claude/settings(\.local)?\.json|\.git/hooks|\.git/config(\.worktree)?|\.lintstagedrc\.json|\.gitleaks\.toml|\.commitlintrc\.json|\.prettierrc\.json|prettier\.config\.ts|eslint\.config\.ts|scripts/(sync-agent-rules|check-agent-gates)\.ts)'
 protected="(^|[/=])$protected_names(/|$)"
 policy="Hooks and agent policy files are company policy; stop and ask the user."
+human_gate="A code owner approves a pull request and a person merges it. Do not approve or merge; report that the pull request waits on that review."
 in_protected=0
 
 # Split a command line into words as the shell does: quotes and backslashes are removed, and
@@ -239,16 +247,143 @@ check_git() {
       ;;
     commit-tree | update-ref) block "git commit-tree and git update-ref are blocked, because they create commits without hooks. Use git commit." ;;
     checkout | restore | rm | mv | apply)
+      local staged=0 worktree=0
       for word in ${rest[@]+"${rest[@]}"}; do
         if [[ $word =~ $protected ]]; then
           writes_protected "$word"
         fi
+        [[ $word == --staged || $word =~ ^-[a-zA-Z]*S ]] && staged=1
+        [[ $word == --worktree || $word =~ ^-[a-zA-Z]*W ]] && worktree=1
       done
+      if [[ $subcommand =~ ^(checkout|restore)$ ]] && ! ((staged == 1 && worktree == 0)); then
+        for word in ${rest[@]+"${rest[@]}"}; do
+          case $word in
+            . | ./ | :/) pause "git $subcommand $word discards uncommitted changes." ;;
+            --force) [[ $subcommand == checkout ]] && pause "git checkout --force discards uncommitted changes." ;;
+            --*) ;;
+            -*f*) [[ $subcommand == checkout ]] && pause "git checkout $word discards uncommitted changes." ;;
+          esac
+        done
+      fi
+      ;;
+    switch)
+      for word in ${rest[@]+"${rest[@]}"}; do
+        case $word in
+          --discard-changes | --force | -f) pause "git switch $word discards uncommitted changes." ;;
+        esac
+      done
+      ;;
+    push)
+      local dry_run=0
+      for word in ${rest[@]+"${rest[@]}"}; do
+        [[ $word == --dry-run || $word =~ ^-[a-zA-Z]*n[a-zA-Z]*$ ]] && dry_run=1
+      done
+      if ((dry_run == 0)); then
+        for word in ${rest[@]+"${rest[@]}"}; do
+          case $word in
+            --force | --force=* | --mirror | --delete | --prune) pause "git push $word overwrites or deletes work on the remote." ;;
+            --*) ;;
+            -*[fd]*) pause "git push $word overwrites or deletes work on the remote." ;;
+            +* | :*) pause "git push $word overwrites or deletes work on the remote." ;;
+          esac
+        done
+      fi
+      ;;
+    reset)
+      for word in ${rest[@]+"${rest[@]}"}; do
+        [[ $word == --hard || $word == --merge ]] && pause "git reset $word discards uncommitted changes."
+      done
+      ;;
+    clean)
+      local dry_run=0
+      for word in ${rest[@]+"${rest[@]}"}; do
+        [[ $word == --dry-run || $word =~ ^-[a-zA-Z]*n ]] && dry_run=1
+      done
+      ((dry_run == 1)) || pause "git clean deletes untracked files."
+      ;;
+    branch)
+      local delete=0 force=0
+      for word in ${rest[@]+"${rest[@]}"}; do
+        case $word in
+          --delete) delete=1 ;;
+          --force) force=1 ;;
+          --*) ;;
+          -*D*) delete=1 force=1 ;;
+          -*)
+            [[ $word == *d* ]] && delete=1
+            [[ $word == *f* ]] && force=1
+            ;;
+        esac
+      done
+      ((delete == 1 && force == 1)) && pause "Force-deleting a branch loses commits that no other branch holds."
+      ;;
+    stash)
+      [[ ${rest[0]:-} =~ ^(drop|clear)$ ]] && pause "git stash ${rest[0]} deletes stashed work."
+      ;;
+    worktree)
+      if [[ ${rest[0]:-} == remove ]]; then
+        for word in "${rest[@]:1}"; do
+          [[ $word == --force || $word == -f ]] && pause "git worktree remove $word deletes uncommitted work in that worktree."
+        done
+      fi
       ;;
   esac
   return 0
 }
 
+# Merging and approving are human gates. Read gh's words with their flags and flag values set aside.
+check_gh() {
+  local -a args=(${@+"$@"}) positional=()
+  local count=${#args[@]} index=0 word
+  while ((index < count)); do
+    word=${args[index]}
+    case $word in
+      -R | --repo | --hostname | -b | --body | -F | --body-file | -t | --title | -B | --base | -H | --head | -X | --method | -f | --field | --raw-field | -H | --header | -q | --jq | --template | --input)
+        index=$((index + 2))
+        continue
+        ;;
+      -*) ;;
+      *) positional+=("$word") ;;
+    esac
+    index=$((index + 1))
+  done
+  local first=${positional[0]:-} second=${positional[1]:-}
+  if [[ $first =~ ^(repo|issue|release)$ && $second == delete ]]; then
+    block "gh $first delete is blocked. Stop and ask the user."
+  fi
+  [[ $first == alias && $second =~ ^(set|import)$ ]] && block "gh aliases are blocked, because an alias can hide a merge or an approval. Run the gh command directly."
+  [[ $first == pr && $second == merge ]] && block "$human_gate"
+  if [[ $first == pr && $second == review ]]; then
+    index=0
+    while ((index < count)); do
+      word=${args[index]}
+      case $word in
+        -b | --body | -F | --body-file | -R | --repo) index=$((index + 1)) ;;
+        --approve | --approve=*) block "$human_gate" ;;
+        --*) ;;
+        -*a*) block "$human_gate" ;;
+      esac
+      index=$((index + 1))
+    done
+  fi
+  if [[ $first == api ]]; then
+    local joined=" ${args[*]} "
+    if [[ $joined =~ pulls/[^/[:space:]]+/merge/?[[:space:]?] || $joined =~ repos/[^/[:space:]]+/[^/[:space:]]+/merges[/[:space:]?] || $joined == *mergePullRequest* || $joined == *enablePullRequestAutoMerge* || $joined == *enqueuePullRequest* || $joined =~ =[\"\']?APPROVE([^A-Za-z_]|$) || $joined =~ event[\"\']?:[[:space:]]*[\"\']?APPROVE ]]; then
+      block "$human_gate"
+    fi
+    if [[ $joined == *pending_deployments* && $joined =~ state=[\"\']?approved ]]; then
+      block "A release manager approves a deployment. Do not approve it; report that the deployment waits on that approval."
+    fi
+    if [[ $joined =~ (query|event|state)=@ ]]; then
+      block "gh api reading a query, a review event, or a deployment state from a file is blocked, because the gate cannot read it. Pass the value inline."
+    fi
+    if [[ $joined =~ [[:space:]]--input([[:space:]]|=) && ($joined =~ [[:space:]]graphql[[:space:]] || $joined =~ pulls/[^/[:space:]]+/(reviews|merge) || $joined == *pending_deployments*) ]]; then
+      block "gh api reading this request body from a file or stdin is blocked, because the gate cannot read it. Pass the fields inline."
+    fi
+  fi
+  return 0
+}
+
 check_command() {
   local -a args=()
   local word name is_writer=0
@@ -288,17 +423,28 @@ check_command() {
   done
   ((${#args[@]} > 0)) || return 0
   name=${args[0]##*/}
+  # A wrapper such as timeout, xargs, or find -exec runs the command named after it.
+  case $name in
+    git | gh | bash | sh | zsh | dash | ksh | eval) ;;
+    *)
+      for ((index = 1; index < ${#args[@]}; index++)); do
+        case ${args[index]##*/} in
+          git | gh | bash | sh | zsh | dash | ksh | eval)
+            check_command "${args[@]:index}"
+            break
+            ;;
+        esac
+      done
+      ;;
+  esac
 
   case $name in
     git) check_git "${args[@]:1}" ;;
-    gh)
-      if [[ ${args[1]:-} =~ ^(repo|issue|release)$ && ${args[2]:-} == delete ]]; then
-        block "gh ${args[1]} delete is blocked. Stop and ask the user."
-      fi
-      ;;
+    gh) check_gh "${args[@]:1}" ;;
     bash | sh | zsh | dash | ksh)
       for ((index = 1; index < ${#args[@]}; index++)); do
         if [[ ${args[index]} =~ ^-[a-zA-Z]*c[a-zA-Z]*$ ]]; then
+          [[ ${args[index + 1]:-} == -- ]] && index=$((index + 1))
           gate_line "${args[index + 1]:-}"
           break
         fi
@@ -363,4 +509,13 @@ gate_line() {
 }
 
 gate_line "$command"
+if [[ -n $irreversible ]]; then
+  message="$irreversible It cannot be undone, so ask the person before running it."
+  if [[ $(jq -r '.hook_event_name // empty' <<< "$input") == PreToolUse ]]; then
+    jq -n --arg message "$message" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:$message}}'
+  else
+    jq -n --arg message "$message" '{permission:"ask",user_message:$message,agent_message:$message}'
+  fi
+  exit 0
+fi
 allow

package/templates/base/.agents/rules/agent-owned-work.md

@@ -1,3 +1,16 @@
 # Agent-Owned Work
 
-Do the work that an agent, a script, or an API can do; do not hand it to the user. Before you ask the user, check the code, data, docs, and tools that already exist. Ask only for what no one else can provide, such as payment, legal identity, or a business fact recorded nowhere. Constitution edits follow `constitution-changes.md`.
+Find facts yourself, and do every step an agent, a script, or an API can do; never ask a person to do it.
+
+Work starts only when a person asks for it or a trigger runs it. Answer a question or a statement without turning it into work. Once a task starts, carry it to the next human gate without asking.
+
+The human gates:
+
+- The originator or the product owner corrects an intent before it is committed.
+- The product owner accepts an intent or a spec.
+- An engineer approves a plan.
+- A code owner approves a pull request, and a person merges it.
+- A release manager approves a production release.
+- A service owner triages a finding.
+
+A decision that no file and no earlier answer settles belongs to a person: write it into the artifact as a proposal they correct at the next gate, or ask them when the work cannot continue without it. Pause before an irreversible action, such as a force push other than `--force-with-lease` on your own branch, a hard reset, or deleting work. Constitution edits follow `constitution-changes.md`.

package/templates/base/.agents/skills/babysit-pr/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: babysit-pr
-description: Drive a pull request you opened until it waits only on code owner approval. Use when asked to babysit, watch, or finish a pull request.
+description: Drive a pull request you opened until it waits only on code owner approval. Use right after you open a pull request, or when a person asks you to babysit one.
 ---
 
 # Babysit a pull request

package/templates/base/.agents/skills/git-workflow/SKILL.md

@@ -11,5 +11,5 @@ The repository uses trunk-based development.
 - Write commit messages in the format that `@next-friday/commitlint-config-friday` defines. The `commit-msg` hook rejects anything else.
 - When work ends in a pull request, push its branch and open the pull request ready for review without asking. CI skips drafts. Work that does not end in one, such as an investigation or a prototype, opens none.
 - Fill the pull request body from `.github/pull_request_template.md`.
-- After you open a pull request, report its URL and continue. Drive it to merge-ready only when the user asks, and watch the checks with `gh pr checks --watch`. Merge only when the user asks to merge, land, or ship. Merge with `--squash`, bottom-up for a stack.
+- After you open a pull request, report its URL and drive it until it is green and waits only on code owner approval, as `babysit-pr` describes. Never approve or merge it: a code owner approves, and a person merges with `--squash`, bottom-up for a stack.
 - Rebase and `git push --force-with-lease` only branches you own.

package/templates/base/.agents/skills/write-intent/SKILL.md

@@ -1,15 +1,16 @@
 ---
 name: write-intent
-description: Write intent.md, the proto-spec that starts a change. Use whenever someone describes an idea, a problem, or a change they want, before a spec or code exists.
+description: Write intent.md, the proto-spec that starts a change, by interviewing the originator. Run it with /write-intent.
+disable-model-invocation: true
 ---
 
 # Write intent.md
 
 1. Let the originator describe the problem in their own words: what they cannot do today, who is affected, what better looks like, and what is out of scope.
-2. Brainstorm until the idea is concrete. Ask the questions an analyst would ask: scope, users, constraints, and what success looks like.
-3. Write the result as `intent/<change>/intent.md`, where `<change>` is a short kebab-case name, using the template below.
-4. Ask the originator to correct anything you misunderstood.
-5. Commit `intent.md` and open a pull request. The product owner accepts it by merging the pull request, or rejects it by setting `Status: rejected.` and merging.
+2. Interview them in rounds until no decision is left to guess. Each round, ask every question whose prerequisites are already settled, numbered, each with your recommended answer, worded so "yes" accepts it. Then wait for the answers, and build the next round on them. Aim at the problem (who, how often, and a number with its source), the outcome as the user would see it, the constraints, and what is out of scope.
+3. Find facts yourself: read the code, the docs, and the existing `intent/` folders before you ask, and never ask what a file can tell you. Put only decisions to the originator. When they cannot answer one yet, record it as an open question instead of guessing.
+4. Write the result as `intent/<change>/intent.md`, where `<change>` is a short kebab-case name, using the template below. Show the whole draft, and ask whether it matches what they meant. Revise it until they say it does.
+5. When the originator confirms the draft, commit `intent.md` and open a pull request. The product owner accepts it by merging the pull request, or rejects it by setting `Status: rejected.` and merging.
 
 ## Template
 

package/templates/base/.agents/skills/write-spec/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: write-spec
-description: Produce spec.md, the requirements and design spec, from an accepted intent.md. Use when an intent.md has been accepted and the change needs its spec.
+description: Produce spec.md, the requirements and design spec, from an accepted intent.md. Use when a person or a trigger asks for the spec of an accepted intent.md.
 ---
 
 # Write spec.md
@@ -9,4 +9,4 @@ Read the `intent.md` the user names, and follow this prompt:
 
 > Read the attached intent.md and produce a requirements and design spec for integrating it into our existing codebase. Apply the skills available to you so the plan conforms to our brand guidelines, security policies and UX standards. Document the spec fully as spec.md, ready to hand to the engineering team. Describe clearly any areas of concern, especially where you cannot satisfy contradicting policies.
 
-Write `spec.md` alongside that `intent.md`, in the same folder. Answer each open question from `intent.md`, or carry it forward.
+Write `spec.md` alongside that `intent.md`, in the same folder. Answer each open question from `intent.md`, or carry it forward. Commit it and open a pull request; the product owner accepts the spec by merging it.

package/templates/base/.claude/settings.json

@@ -41,7 +41,8 @@
       "Bash(git *core.hookspath*)",
       "Bash(git commit-tree*)",
       "Bash(git update-ref*)",
-      "Bash(*HUSKY=0*)"
+      "Bash(*HUSKY=0*)",
+      "Bash(gh pr merge*)"
     ]
   },
   "hooks": {
@@ -78,6 +79,17 @@
             "timeout": 10
           }
         ]
+      },
+      {
+        "matcher": "mcp__.*__(merge_pull_request|enable_pr_auto_merge|pull_request_review_write)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.agents/hooks/agent-mcp-gate.sh",
+            "timeout": 10,
+            "onFailure": "block"
+          }
+        ]
       }
     ],
     "PostToolUse": [

package/templates/base/.claude/skills/babysit-pr/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: babysit-pr
-description: Drive a pull request you opened until it waits only on code owner approval. Use when asked to babysit, watch, or finish a pull request.
+description: Drive a pull request you opened until it waits only on code owner approval. Use right after you open a pull request, or when a person asks you to babysit one.
 ---
 
 # Babysit a pull request

package/templates/base/.claude/skills/git-workflow/SKILL.md

@@ -11,5 +11,5 @@ The repository uses trunk-based development.
 - Write commit messages in the format that `@next-friday/commitlint-config-friday` defines. The `commit-msg` hook rejects anything else.
 - When work ends in a pull request, push its branch and open the pull request ready for review without asking. CI skips drafts. Work that does not end in one, such as an investigation or a prototype, opens none.
 - Fill the pull request body from `.github/pull_request_template.md`.
-- After you open a pull request, report its URL and continue. Drive it to merge-ready only when the user asks, and watch the checks with `gh pr checks --watch`. Merge only when the user asks to merge, land, or ship. Merge with `--squash`, bottom-up for a stack.
+- After you open a pull request, report its URL and drive it until it is green and waits only on code owner approval, as `babysit-pr` describes. Never approve or merge it: a code owner approves, and a person merges with `--squash`, bottom-up for a stack.
 - Rebase and `git push --force-with-lease` only branches you own.

package/templates/base/.claude/skills/write-intent/SKILL.md

@@ -1,15 +1,16 @@
 ---
 name: write-intent
-description: Write intent.md, the proto-spec that starts a change. Use whenever someone describes an idea, a problem, or a change they want, before a spec or code exists.
+description: Write intent.md, the proto-spec that starts a change, by interviewing the originator. Run it with /write-intent.
+disable-model-invocation: true
 ---
 
 # Write intent.md
 
 1. Let the originator describe the problem in their own words: what they cannot do today, who is affected, what better looks like, and what is out of scope.
-2. Brainstorm until the idea is concrete. Ask the questions an analyst would ask: scope, users, constraints, and what success looks like.
-3. Write the result as `intent/<change>/intent.md`, where `<change>` is a short kebab-case name, using the template below.
-4. Ask the originator to correct anything you misunderstood.
-5. Commit `intent.md` and open a pull request. The product owner accepts it by merging the pull request, or rejects it by setting `Status: rejected.` and merging.
+2. Interview them in rounds until no decision is left to guess. Each round, ask every question whose prerequisites are already settled, numbered, each with your recommended answer, worded so "yes" accepts it. Then wait for the answers, and build the next round on them. Aim at the problem (who, how often, and a number with its source), the outcome as the user would see it, the constraints, and what is out of scope.
+3. Find facts yourself: read the code, the docs, and the existing `intent/` folders before you ask, and never ask what a file can tell you. Put only decisions to the originator. When they cannot answer one yet, record it as an open question instead of guessing.
+4. Write the result as `intent/<change>/intent.md`, where `<change>` is a short kebab-case name, using the template below. Show the whole draft, and ask whether it matches what they meant. Revise it until they say it does.
+5. When the originator confirms the draft, commit `intent.md` and open a pull request. The product owner accepts it by merging the pull request, or rejects it by setting `Status: rejected.` and merging.
 
 ## Template
 

package/templates/base/.claude/skills/write-spec/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: write-spec
-description: Produce spec.md, the requirements and design spec, from an accepted intent.md. Use when an intent.md has been accepted and the change needs its spec.
+description: Produce spec.md, the requirements and design spec, from an accepted intent.md. Use when a person or a trigger asks for the spec of an accepted intent.md.
 ---
 
 # Write spec.md
@@ -9,4 +9,4 @@ Read the `intent.md` the user names, and follow this prompt:
 
 > Read the attached intent.md and produce a requirements and design spec for integrating it into our existing codebase. Apply the skills available to you so the plan conforms to our brand guidelines, security policies and UX standards. Document the spec fully as spec.md, ready to hand to the engineering team. Describe clearly any areas of concern, especially where you cannot satisfy contradicting policies.
 
-Write `spec.md` alongside that `intent.md`, in the same folder. Answer each open question from `intent.md`, or carry it forward.
+Write `spec.md` alongside that `intent.md`, in the same folder. Answer each open question from `intent.md`, or carry it forward. Commit it and open a pull request; the product owner accepts the spec by merging it.

package/templates/base/.cursor/hooks.json

@@ -32,6 +32,13 @@
         "timeout": 10
       }
     ],
+    "beforeMCPExecution": [
+      {
+        "command": ".agents/hooks/agent-mcp-gate.sh",
+        "timeout": 10,
+        "failClosed": true
+      }
+    ],
     "afterFileEdit": [
       {
         "command": ".agents/hooks/agent-format-after-edit.sh"

package/templates/base/.cursor/rules/agent-owned-work.mdc

@@ -1,8 +1,21 @@
 ---
-description: "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+description: "Agent-owned work: do every step an agent can do, start only when asked, and stop at the human gates"
 alwaysApply: true
 ---
 
 # Agent-Owned Work
 
-Do the work that an agent, a script, or an API can do; do not hand it to the user. Before you ask the user, check the code, data, docs, and tools that already exist. Ask only for what no one else can provide, such as payment, legal identity, or a business fact recorded nowhere. Constitution edits follow `constitution-changes.md`.
+Find facts yourself, and do every step an agent, a script, or an API can do; never ask a person to do it.
+
+Work starts only when a person asks for it or a trigger runs it. Answer a question or a statement without turning it into work. Once a task starts, carry it to the next human gate without asking.
+
+The human gates:
+
+- The originator or the product owner corrects an intent before it is committed.
+- The product owner accepts an intent or a spec.
+- An engineer approves a plan.
+- A code owner approves a pull request, and a person merges it.
+- A release manager approves a production release.
+- A service owner triages a finding.
+
+A decision that no file and no earlier answer settles belongs to a person: write it into the artifact as a proposal they correct at the next gate, or ask them when the work cannot continue without it. Pause before an irreversible action, such as a force push other than `--force-with-lease` on your own branch, a hard reset, or deleting work. Constitution edits follow `constitution-changes.md`.

package/templates/base/.cursor/skills/babysit-pr/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: babysit-pr
-description: Drive a pull request you opened until it waits only on code owner approval. Use when asked to babysit, watch, or finish a pull request.
+description: Drive a pull request you opened until it waits only on code owner approval. Use right after you open a pull request, or when a person asks you to babysit one.
 ---
 
 # Babysit a pull request

package/templates/base/.cursor/skills/git-workflow/SKILL.md

@@ -11,5 +11,5 @@ The repository uses trunk-based development.
 - Write commit messages in the format that `@next-friday/commitlint-config-friday` defines. The `commit-msg` hook rejects anything else.
 - When work ends in a pull request, push its branch and open the pull request ready for review without asking. CI skips drafts. Work that does not end in one, such as an investigation or a prototype, opens none.
 - Fill the pull request body from `.github/pull_request_template.md`.
-- After you open a pull request, report its URL and continue. Drive it to merge-ready only when the user asks, and watch the checks with `gh pr checks --watch`. Merge only when the user asks to merge, land, or ship. Merge with `--squash`, bottom-up for a stack.
+- After you open a pull request, report its URL and drive it until it is green and waits only on code owner approval, as `babysit-pr` describes. Never approve or merge it: a code owner approves, and a person merges with `--squash`, bottom-up for a stack.
 - Rebase and `git push --force-with-lease` only branches you own.

package/templates/base/.cursor/skills/write-intent/SKILL.md

@@ -1,15 +1,16 @@
 ---
 name: write-intent
-description: Write intent.md, the proto-spec that starts a change. Use whenever someone describes an idea, a problem, or a change they want, before a spec or code exists.
+description: Write intent.md, the proto-spec that starts a change, by interviewing the originator. Run it with /write-intent.
+disable-model-invocation: true
 ---
 
 # Write intent.md
 
 1. Let the originator describe the problem in their own words: what they cannot do today, who is affected, what better looks like, and what is out of scope.
-2. Brainstorm until the idea is concrete. Ask the questions an analyst would ask: scope, users, constraints, and what success looks like.
-3. Write the result as `intent/<change>/intent.md`, where `<change>` is a short kebab-case name, using the template below.
-4. Ask the originator to correct anything you misunderstood.
-5. Commit `intent.md` and open a pull request. The product owner accepts it by merging the pull request, or rejects it by setting `Status: rejected.` and merging.
+2. Interview them in rounds until no decision is left to guess. Each round, ask every question whose prerequisites are already settled, numbered, each with your recommended answer, worded so "yes" accepts it. Then wait for the answers, and build the next round on them. Aim at the problem (who, how often, and a number with its source), the outcome as the user would see it, the constraints, and what is out of scope.
+3. Find facts yourself: read the code, the docs, and the existing `intent/` folders before you ask, and never ask what a file can tell you. Put only decisions to the originator. When they cannot answer one yet, record it as an open question instead of guessing.
+4. Write the result as `intent/<change>/intent.md`, where `<change>` is a short kebab-case name, using the template below. Show the whole draft, and ask whether it matches what they meant. Revise it until they say it does.
+5. When the originator confirms the draft, commit `intent.md` and open a pull request. The product owner accepts it by merging the pull request, or rejects it by setting `Status: rejected.` and merging.
 
 ## Template
 

package/templates/base/.cursor/skills/write-spec/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: write-spec
-description: Produce spec.md, the requirements and design spec, from an accepted intent.md. Use when an intent.md has been accepted and the change needs its spec.
+description: Produce spec.md, the requirements and design spec, from an accepted intent.md. Use when a person or a trigger asks for the spec of an accepted intent.md.
 ---
 
 # Write spec.md
@@ -9,4 +9,4 @@ Read the `intent.md` the user names, and follow this prompt:
 
 > Read the attached intent.md and produce a requirements and design spec for integrating it into our existing codebase. Apply the skills available to you so the plan conforms to our brand guidelines, security policies and UX standards. Document the spec fully as spec.md, ready to hand to the engineering team. Describe clearly any areas of concern, especially where you cannot satisfy contradicting policies.
 
-Write `spec.md` alongside that `intent.md`, in the same folder. Answer each open question from `intent.md`, or carry it forward.
+Write `spec.md` alongside that `intent.md`, in the same folder. Answer each open question from `intent.md`, or carry it forward. Commit it and open a pull request; the product owner accepts the spec by merging it.

package/templates/base/SETUP.md

@@ -4,7 +4,7 @@ This project follows Anthropic's [AI-native SDLC Playbook](https://claude.com/re
 
 ## How a change flows
 
-1. **Plan:** an idea, a ticket, or an incident becomes `intent/<change>/intent.md` (`write-intent` skill). The product owner merges it with `Status: accepted.` or `Status: rejected.`
+1. **Plan:** the originator of an idea, a ticket, or an incident runs `/write-intent`, which interviews them and writes `intent/<change>/intent.md`. The product owner merges it with `Status: accepted.` or `Status: rejected.`
 2. **Design:** `spec.md` is written from the accepted intent with the policy skills loaded (`write-spec` skill). The product owner resolves concerns with the policy owners.
 3. **Build:** the engineer starts in plan mode, approves the plan, and commits it as `plan.md`. A tech lead approves higher-risk plans.
 4. **Test:** the session runs **Verifying your work** in `AGENTS.md`.

package/templates/base/scripts/check-agent-gates.ts

@@ -2,6 +2,7 @@ import {spawnSync} from "node:child_process";
 
 type GateCase = {
   expectedExit: 0 | 2;
+  expectedPermission?: "allow" | "ask";
   gate: string;
   input: Record<string, unknown>;
   name: string;
@@ -10,6 +11,7 @@ type GateCase = {
 const shellGate = ".agents/hooks/agent-shell-gate.sh";
 const suppressionGate = ".agents/hooks/agent-suppression-gate.sh";
 const constitutionGate = ".cursor/hooks/agent-constitution-gate.sh";
+const mcpGate = ".agents/hooks/agent-mcp-gate.sh";
 const sourceFile = "src/example.ts";
 
 const blockedCommands = [
@@ -80,6 +82,68 @@ const blockedCommands = [
   "while true; do git commit -n -m x; done",
   "if git commit -n -m x; then true; fi",
   "printf x > .git/config.worktree",
+  "gh pr merge 1 --squash",
+  "gh pr merge 1 --auto",
+  "gh -R next-friday/example pr merge 1",
+  "gh pr -R next-friday/example merge 1",
+  "timeout 5 gh pr merge 1",
+  "nice -n 5 gh pr merge 1",
+  "xargs gh pr merge",
+  "gh pr review 1 --approve",
+  "gh pr review 1 --approve=true",
+  "gh pr review 1 -a",
+  "gh -R next-friday/example pr review 1 -a",
+  "gh alias set m 'pr merge'",
+  "gh api repos/next-friday/example/pulls/1/merge -X PUT",
+  "gh api graphql -f query='mutation { mergePullRequest(input: {}) { clientMutationId } }'",
+  "gh api graphql -f query=@query.graphql",
+  "gh api repos/next-friday/example/pulls/1/reviews -f event=APPROVE",
+  "gh api -X POST repos/next-friday/example/actions/runs/1/pending_deployments -f state=approved",
+  "gh pr review 1 -ca",
+  "gh alias import aliases.yml",
+  "gh api graphql -Fquery=@query.graphql",
+  "gh api graphql --input query.json",
+  "gh api -X POST repos/next-friday/example/pulls/1/reviews --input review.json",
+  "gh api repos/next-friday/example/actions/runs/1/pending_deployments -F state=@state.txt",
+  "gh api graphql -f query='mutation { enablePullRequestAutoMerge(input: {}) { clientMutationId } }'",
+  "gh api graphql -f query='mutation { enqueuePullRequest(input: {}) { clientMutationId } }'",
+  "gh api graphql -f query='mutation($e: PullRequestReviewEvent!) { addPullRequestReview(input: {event: $e}) { clientMutationId } }' -f e=APPROVE",
+  "gh api -X POST repos/next-friday/example/merges -f base=main -f head=feature",
+  "gh api -X PUT repos/next-friday/example/pulls/1/merge/",
+  "timeout 5 bash -c 'gh pr merge 1'",
+  "find . -exec sh -c 'gh pr merge 1' ;",
+  "sudo -u me bash -c 'gh pr merge 1'",
+  "bash -c -- 'gh pr merge 1'",
+];
+
+const irreversibleCommands = [
+  "git push --force",
+  "git push -f origin x",
+  "git push origin x -f",
+  "git push -uf origin x",
+  "git push origin +x",
+  "git push origin :x",
+  "git push -d origin x",
+  "git push --delete origin x",
+  "git push --mirror",
+  "git reset --hard HEAD~1",
+  "git -C . reset --hard",
+  "git clean -fd",
+  "git clean -xdf",
+  "git branch -D x",
+  "git branch -df x",
+  "git branch --delete --force x",
+  "git checkout .",
+  "git checkout -- .",
+  "git checkout -f main",
+  "git restore .",
+  "git restore --worktree .",
+  "git switch --discard-changes main",
+  "git stash drop",
+  "git worktree remove --force x",
+  "git restore :/",
+  "timeout 5 git push --force",
+  "xargs git reset --hard",
 ];
 
 const allowedCommands = [
@@ -104,8 +168,37 @@ const allowedCommands = [
   'gh pr create --title "ci(x): remove HUSKY=0 usage"',
   "git push -n",
   "node scripts/check-agent-gates.ts",
+  "git push -u origin x",
+  "git push --dry-run --force",
+  "git push --force-with-lease origin x",
+  'gh pr create --title "fix(x): y" --body z',
+  "gh pr comment 1 --body x",
+  'gh pr review 1 -c -b "fix -a flag"',
+  'gh api repos/next-friday/example/issues/1/comments -f body="Please APPROVE"',
+  "gh api repos/next-friday/example/pulls/1",
+  "gh pr checks 1 --watch",
+  "git branch -d x",
+  "git checkout feature",
+  "git checkout .changeset/x.md",
+  "git restore --staged .",
+  "git clean -n",
+  "git reset --soft HEAD~1",
+  "git stash pop",
+  "timeout 60 pnpm test",
+  'gh api graphql -f query="query { viewer { login } }"',
+  'gh api repos/next-friday/example/issues/1/comments -f body="APPROVED by QA"',
 ];
 
+const mcpTools = {
+  blocked: [
+    "mcp__github__merge_pull_request",
+    "github__merge_pull_request",
+    "github__enable_pr_auto_merge",
+    "github__pull_request_review_write",
+  ],
+  allowed: ["github__create_pull_request", "github__add_issue_comment"],
+};
+
 const protectedPaths = [
   ".agents/rules/code-comments.md",
   ".agents/rules.json",
@@ -148,14 +241,57 @@ const cases: GateCase[] = [
       name: `Claude Bash: ${command}`,
     },
   ]),
+  ...irreversibleCommands.flatMap(command => [
+    {
+      gate: shellGate,
+      input: {
+        command,
+      },
+      expectedExit: 0 as const,
+      expectedPermission: "ask" as const,
+      name: `Cursor shell asks first: ${command}`,
+    },
+    {
+      gate: shellGate,
+      input: {
+        hook_event_name: "PreToolUse",
+        tool_input: {
+          command,
+        },
+      },
+      expectedExit: 0 as const,
+      expectedPermission: "ask" as const,
+      name: `Claude Bash asks first: ${command}`,
+    },
+  ]),
   ...allowedCommands.map(command => ({
     gate: shellGate,
     input: {
       command,
     },
     expectedExit: 0 as const,
+    expectedPermission: "allow" as const,
     name: `shell: ${command}`,
   })),
+  ...mcpTools.blocked.map(tool => ({
+    gate: mcpGate,
+    input: {
+      tool_name: tool,
+      tool_input: "{}",
+    },
+    expectedExit: 2 as const,
+    name: `MCP: ${tool}`,
+  })),
+  ...mcpTools.allowed.map(tool => ({
+    gate: mcpGate,
+    input: {
+      tool_name: tool,
+      tool_input: "{}",
+    },
+    expectedExit: 0 as const,
+    expectedPermission: "allow" as const,
+    name: `MCP: ${tool}`,
+  })),
   {
     gate: suppressionGate,
     name: "suppression: eslint-disable",
@@ -235,6 +371,28 @@ const cases: GateCase[] = [
   },
 ];
 
+/**
+ * Reads the permission a gate printed in the format its tool reads: Claude Code's
+ * `hookSpecificOutput` for a `PreToolUse` input, and Cursor's `permission` otherwise.
+ * @param gateCase - The case whose input decides the format.
+ * @param stdout - The gate's standard output.
+ * @returns The permission, or undefined when the output is not JSON.
+ */
+function permissionOf(gateCase: GateCase, stdout: string): string | undefined {
+  try {
+    const output = JSON.parse(stdout) as {
+      hookSpecificOutput?: {permissionDecision?: string};
+      permission?: string;
+    };
+
+    return gateCase.input.hook_event_name === "PreToolUse" && gateCase.expectedPermission === "ask"
+      ? output.hookSpecificOutput?.permissionDecision
+      : output.permission;
+  } catch {
+    return undefined;
+  }
+}
+
 const failures = cases.filter(gateCase => {
   const result = spawnSync(gateCase.gate, {
     env: {
@@ -245,13 +403,22 @@ const failures = cases.filter(gateCase => {
     input: JSON.stringify(gateCase.input),
   });
 
-  return result.status !== gateCase.expectedExit;
+  const isPermissionWrong =
+    gateCase.expectedPermission !== undefined &&
+    permissionOf(gateCase, result.stdout.toString()) !== gateCase.expectedPermission;
+
+  return result.status !== gateCase.expectedExit || isPermissionWrong;
 });
 
 if (failures.length > 0) {
-  const failureLines = failures.map(
-    gateCase => `- ${gateCase.name} (expected exit ${gateCase.expectedExit})`,
-  );
+  const failureLines = failures.map(gateCase => {
+    const permission =
+      gateCase.expectedPermission === undefined
+        ? ""
+        : ` and permission ${gateCase.expectedPermission}`;
+
+    return `- ${gateCase.name} (expected exit ${gateCase.expectedExit}${permission})`;
+  });
 
   process.stderr.write(`Agent gate checks failed:\n${failureLines.join("\n")}\n`);
   process.exitCode = 1;

package/templates/nestjs/.agents/rules.json

@@ -1,6 +1,6 @@
 {
   "agent-owned-work": {
-    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+    "description": "Agent-owned work: do every step an agent can do, start only when asked, and stop at the human gates"
   },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"

package/templates/nestjs/AGENTS.md

@@ -36,12 +36,13 @@ If a test fails, fix the code, not the test.
 4. **Log through Nest's `Logger`.** It goes to the `ConsoleLogger` set in `src/main.ts`.
 5. **Start from the accepted spec, in plan mode.** Claude Code starts every session in plan mode (`.claude/settings.json`); in Cursor, switch to Plan Mode before the first edit. Give the plan the change's `intent/<change>/intent.md` and `spec.md`, and have it name the files that change, the order of the work, and the tests that prove it. Commit the approved plan as `intent/<change>/plan.md`. When implementation departs from the plan, update `plan.md` in the same commit.
 6. **Start a bug fix with a failing test.** Reproduce the bug as a test, run it, and confirm it fails for the reason you expect. Commit that test. Then create `.git/bug-fix-in-progress`, so `.agents/hooks/agent-test-edit-gate.sh` blocks test edits, and make the test pass without editing it. Delete `.git/bug-fix-in-progress` when the fix is done.
+7. **Start work only when a person asks or a trigger runs it, and stop only at the human gates, before an irreversible action, or for a decision only a person can make.** A question or a statement gets an answer, not a file, a commit, or a pull request. Once a task starts, carry it to the next gate without asking; `.agents/rules/agent-owned-work.md` lists the gates.
 
 ## Things Claude gets wrong
 
 When Claude makes a mistake twice, add the correction here.
 
-- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
+- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It also blocks merging or approving a pull request, approving a deployment, and gh aliases, and asks the person before an irreversible git command such as a force push or a hard reset. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
 
 ## Related documentation
 

package/templates/nextjs/.agents/rules.json

@@ -1,6 +1,6 @@
 {
   "agent-owned-work": {
-    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+    "description": "Agent-owned work: do every step an agent can do, start only when asked, and stop at the human gates"
   },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"

package/templates/nextjs/AGENTS.md

@@ -32,17 +32,18 @@ If a test fails, fix the code, not the test.
 
 1. **Follow `.agents/rules/`.** `.agents/rules.json` gives each rule's scope; Claude Code and Cursor load them. After changing either, or a skill or subagent in `.agents/skills/` or `.agents/agents/`, run `pnpm rules:sync`; `pnpm check` fails on stale copies.
 2. **Put unit tests next to the code as `app/**/*.test.{ts,tsx}` and Playwright end-to-end tests in `test/` as `*.e2e.test.ts`.** Vitest collects only the first pattern.
-3. **Ask the user before adding component tests.** They need a DOM test environment, and Vitest runs in Node.js.
+3. **Component tests need a DOM test environment, and Vitest runs in Node.js.** Add that environment with the first component test.
 4. **Read configuration from environment variables and fail when one is missing.** Document each variable in `.env.example`.
 5. **Start from the accepted spec, in plan mode.** Claude Code starts every session in plan mode (`.claude/settings.json`); in Cursor, switch to Plan Mode before the first edit. Give the plan the change's `intent/<change>/intent.md` and `spec.md`, and have it name the files that change, the order of the work, and the tests that prove it. Commit the approved plan as `intent/<change>/plan.md`. When implementation departs from the plan, update `plan.md` in the same commit.
 6. **Start a bug fix with a failing test.** Reproduce the bug as a test, run it, and confirm it fails for the reason you expect. Commit that test. Then create `.git/bug-fix-in-progress`, so `.agents/hooks/agent-test-edit-gate.sh` blocks test edits, and make the test pass without editing it. Delete `.git/bug-fix-in-progress` when the fix is done.
+7. **Start work only when a person asks or a trigger runs it, and stop only at the human gates, before an irreversible action, or for a decision only a person can make.** A question or a statement gets an answer, not a file, a commit, or a pull request. Once a task starts, carry it to the next gate without asking; `.agents/rules/agent-owned-work.md` lists the gates.
 
 ## Things Claude gets wrong
 
 When Claude makes a mistake twice, add the correction here.
 
 - **First end-to-end run**: run `pnpm exec playwright install chromium` once. `pnpm test:e2e` starts the development server unless one is already running.
-- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
+- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It also blocks merging or approving a pull request, approving a deployment, and gh aliases, and asks the person before an irreversible git command such as a force push or a hard reset. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
 
 ## Related documentation
 

package/templates/nodejs/.agents/rules.json

@@ -1,6 +1,6 @@
 {
   "agent-owned-work": {
-    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+    "description": "Agent-owned work: do every step an agent can do, start only when asked, and stop at the human gates"
   },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"

package/templates/nodejs/AGENTS.md

@@ -34,12 +34,13 @@ If a test fails, fix the code, not the test.
 3. **Read configuration from environment variables and fail when one is missing**, as `parsePort` does. Document each variable in `.env.example`; `pnpm start` and `pnpm start:dev` load `.env`.
 4. **Start from the accepted spec, in plan mode.** Claude Code starts every session in plan mode (`.claude/settings.json`); in Cursor, switch to Plan Mode before the first edit. Give the plan the change's `intent/<change>/intent.md` and `spec.md`, and have it name the files that change, the order of the work, and the tests that prove it. Commit the approved plan as `intent/<change>/plan.md`. When implementation departs from the plan, update `plan.md` in the same commit.
 5. **Start a bug fix with a failing test.** Reproduce the bug as a test, run it, and confirm it fails for the reason you expect. Commit that test. Then create `.git/bug-fix-in-progress`, so `.agents/hooks/agent-test-edit-gate.sh` blocks test edits, and make the test pass without editing it. Delete `.git/bug-fix-in-progress` when the fix is done.
+6. **Start work only when a person asks or a trigger runs it, and stop only at the human gates, before an irreversible action, or for a decision only a person can make.** A question or a statement gets an answer, not a file, a commit, or a pull request. Once a task starts, carry it to the next gate without asking; `.agents/rules/agent-owned-work.md` lists the gates.
 
 ## Things Claude gets wrong
 
 When Claude makes a mistake twice, add the correction here.
 
-- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
+- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It also blocks merging or approving a pull request, approving a deployment, and gh aliases, and asks the person before an irreversible git command such as a force push or a hard reset. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
 
 ## Related documentation
 

package/templates/payload/.agents/rules.json

@@ -1,6 +1,6 @@
 {
   "agent-owned-work": {
-    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+    "description": "Agent-owned work: do every step an agent can do, start only when asked, and stop at the human gates"
   },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"

package/templates/payload/AGENTS.md

@@ -35,17 +35,18 @@ If a test fails, fix the code, not the test.
 1. **Follow `.agents/rules/`.** `.agents/rules.json` gives each rule's scope; Claude Code and Cursor load them. After changing either, or a skill or subagent in `.agents/skills/` or `.agents/agents/`, run `pnpm rules:sync`; `pnpm check` fails on stale copies.
 2. **Change the schema only through collections, then regenerate and commit.** Payload generates `src/app/(payload)/`, `src/payload-types.ts`, and `src/migrations/`; run `pnpm generate:types`, `pnpm generate:importmap`, and `pnpm migrate:create <name>`. Do not edit those files by hand.
 3. **Put unit tests next to the code as `src/**/*.test.{ts,tsx}` and Playwright end-to-end tests in `test/` as `*.e2e.test.ts`.** Vitest collects only the first pattern.
-4. **Ask the user before adding component tests.** They need a DOM test environment, and Vitest runs in Node.js.
+4. **Component tests need a DOM test environment, and Vitest runs in Node.js.** Add that environment with the first component test.
 5. **Read configuration through `requireEnvironment` in `src/environment.ts`.** Document each variable in `.env.example`.
 6. **Start from the accepted spec, in plan mode.** Claude Code starts every session in plan mode (`.claude/settings.json`); in Cursor, switch to Plan Mode before the first edit. Give the plan the change's `intent/<change>/intent.md` and `spec.md`, and have it name the files that change, the order of the work, and the tests that prove it. Commit the approved plan as `intent/<change>/plan.md`. When implementation departs from the plan, update `plan.md` in the same commit.
 7. **Start a bug fix with a failing test.** Reproduce the bug as a test, run it, and confirm it fails for the reason you expect. Commit that test. Then create `.git/bug-fix-in-progress`, so `.agents/hooks/agent-test-edit-gate.sh` blocks test edits, and make the test pass without editing it. Delete `.git/bug-fix-in-progress` when the fix is done.
+8. **Start work only when a person asks or a trigger runs it, and stop only at the human gates, before an irreversible action, or for a decision only a person can make.** A question or a statement gets an answer, not a file, a commit, or a pull request. Once a task starts, carry it to the next gate without asking; `.agents/rules/agent-owned-work.md` lists the gates.
 
 ## Things Claude gets wrong
 
 When Claude makes a mistake twice, add the correction here.
 
 - **Database for `pnpm dev` and end-to-end tests**: both need a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`; the README lists every variable. Run `pnpm exec playwright install chromium` once before the first `pnpm test:e2e`.
-- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
+- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It also blocks merging or approving a pull request, approving a deployment, and gh aliases, and asks the person before an irreversible git command such as a force push or a hard reset. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
 
 ## Related documentation
 

package/templates/turborepo/.agents/rules.json

@@ -1,6 +1,6 @@
 {
   "agent-owned-work": {
-    "description": "Agent-owned work: do what an agent, script, or API can do instead of asking the user"
+    "description": "Agent-owned work: do every step an agent can do, start only when asked, and stop at the human gates"
   },
   "automation-owned-checks": {
     "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"

package/templates/turborepo/AGENTS.md

@@ -37,10 +37,11 @@ If a test fails, fix the code, not the test.
 1. **Follow `.agents/rules/`.** `.agents/rules.json` gives each rule's scope; Claude Code and Cursor load them. After changing either, or a skill or subagent in `.agents/skills/` or `.agents/agents/`, run `pnpm rules:sync`; `pnpm check` fails on stale copies.
 2. **Change the backoffice schema only through collections, then regenerate and commit.** Payload generates `apps/backoffice/src/app/(payload)/`, `apps/backoffice/src/payload-types.ts`, and `apps/backoffice/src/migrations/`; run `pnpm generate:types`, `pnpm generate:importmap`, and `pnpm migrate:create <name>`. Do not edit those files by hand.
 3. **Put unit tests next to the code and Playwright end-to-end tests in `apps/app/test/` and `apps/backoffice/test/` as `*.e2e.test.ts`.** Vitest collects `apps/app/app/**/*.test.{ts,tsx}` and `apps/backoffice/src/**/*.test.{ts,tsx}`.
-4. **Ask the user before adding component tests.** They need a DOM test environment, and Vitest runs in Node.js.
+4. **Component tests need a DOM test environment, and Vitest runs in Node.js.** Add that environment with the first component test.
 5. **Read backoffice configuration through `requireEnvironment` in `apps/backoffice/src/environment.ts`.** Document each variable in `.env.example`.
 6. **Start from the accepted spec, in plan mode.** Claude Code starts every session in plan mode (`.claude/settings.json`); in Cursor, switch to Plan Mode before the first edit. Give the plan the change's `intent/<change>/intent.md` and `spec.md`, and have it name the files that change, the order of the work, and the tests that prove it. Commit the approved plan as `intent/<change>/plan.md`. When implementation departs from the plan, update `plan.md` in the same commit.
 7. **Start a bug fix with a failing test.** Reproduce the bug as a test, run it, and confirm it fails for the reason you expect. Commit that test. Then create `.git/bug-fix-in-progress`, so `.agents/hooks/agent-test-edit-gate.sh` blocks test edits, and make the test pass without editing it. Delete `.git/bug-fix-in-progress` when the fix is done.
+8. **Start work only when a person asks or a trigger runs it, and stop only at the human gates, before an irreversible action, or for a decision only a person can make.** A question or a statement gets an answer, not a file, a commit, or a pull request. Once a task starts, carry it to the next gate without asking; `.agents/rules/agent-owned-work.md` lists the gates.
 
 ## Things Claude gets wrong
 
@@ -48,7 +49,7 @@ When Claude makes a mistake twice, add the correction here.
 
 - **Next.js docs live per app**: this Next.js version differs from your training data. Read the guide in `apps/app/node_modules/next/dist/docs/` or `apps/backoffice/node_modules/next/dist/docs/` before writing Next.js code; the workspace root has no `next` package.
 - **Database for `pnpm dev` and end-to-end tests**: the backoffice needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`; the README lists every variable. Run `pnpm --filter ./apps/app exec playwright install chromium` once before the first `pnpm test:e2e`.
-- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
+- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It also blocks merging or approving a pull request, approving a deployment, and gh aliases, and asks the person before an irreversible git command such as a force push or a hard reset. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
 
 ## Related documentation