@next-friday/create-app 6.0.2 → 7.1.0

package/templates/base/scripts/check-human-gates.ts

@@ -0,0 +1,383 @@
+import {existsSync, readdirSync, readFileSync, statSync} from "node:fs";
+import path from "node:path";
+
+type Problem = {
+  line: number;
+  message: string;
+  rule: string;
+};
+
+type Step = {
+  line: number;
+  text: string;
+};
+
+type SelfTestCase = {
+  expectedRule?: string;
+  name: string;
+  text: string;
+};
+
+const playbookDirectory = ".agents/skills/sdlc/playbooks";
+const agentOwnedWorkRule = ".agents/rules/agent-owned-work.md";
+const nextMarker = "**Next:**";
+
+const humanGateRoles = [
+  "originator",
+  "product owner",
+  "engineer",
+  "code owner",
+  "release manager",
+  "service owner",
+];
+
+const roleWords = new RegExp(String.raw`\b(?:${humanGateRoles.join("|")})s?\b`, "i");
+
+const waitingWordList = [
+  "wait",
+  "waits",
+  "approve",
+  "approves",
+  "approval",
+  "approved",
+  "approving",
+  "confirm",
+  "confirms",
+  "confirmation",
+  "permission",
+  "sign off",
+];
+
+const waitingWords = new RegExp(String.raw`\b(?:${waitingWordList.join("|")})\b`, "i");
+const roleList = humanGateRoles.join(", ");
+
+/**
+ * Blank every line of a fenced code block, keeping line numbers.
+ * @param text Playbook content with LF line endings.
+ * @returns The content with fenced lines emptied.
+ */
+function maskFencedBlocks(text: string): string {
+  let isFenced = false;
+
+  return text
+    .split("\n")
+    .map(line => {
+      const isFence = /^\s*(?:```|~~~)/.test(line);
+      const isMasked = isFenced || isFence;
+
+      isFenced = isFence ? !isFenced : isFenced;
+
+      return isMasked ? "" : line;
+    })
+    .join("\n");
+}
+
+/**
+ * Split a playbook into its numbered steps, each with its indented continuation lines.
+ * @param text Playbook content.
+ * @returns The steps with the line each starts on.
+ */
+function splitSteps(text: string): Step[] {
+  return Array.from(text.matchAll(/^\d+\. .*(?:\n[\t ]+\S.*)*/gm), match => ({
+    line: text.slice(0, match.index).split("\n").length,
+    text: match[0],
+  }));
+}
+
+/**
+ * Find gate lines whose bold sentence names no human gate role.
+ * @param lines Playbook lines.
+ * @returns One problem per such line.
+ */
+function findGateProblems(lines: string[]): Problem[] {
+  return lines
+    .map((text, index) => ({
+      text,
+      line: index + 1,
+    }))
+    .filter(({text}) => text.includes("**Gate:"))
+    .filter(({text}) => !roleWords.test(/\*\*Gate:(.*?)\*\*/.exec(text)?.[1] ?? ""))
+    .map(({line}) => ({
+      line,
+      rule: "A",
+      message: `a gate must name one of ${roleList} inside its bold sentence; write "**Gate: the <role> <does what>.**"`,
+    }));
+}
+
+/**
+ * Find steps that wait, approve, or confirm without naming a human gate role.
+ * @param text Playbook content.
+ * @returns One problem per such step.
+ */
+function findWaitingStepProblems(text: string): Problem[] {
+  return splitSteps(text)
+    .filter(step => waitingWords.test(step.text) && !roleWords.test(step.text))
+    .map(step => ({
+      rule: "B",
+      line: step.line,
+      message: `a step that waits, approves, or confirms must name who does it: one of ${roleList}`,
+    }));
+}
+
+/**
+ * Tell whether a path is a relative path without `..` to an existing regular file.
+ * @param targetPath Path from a `**Next:**` target.
+ * @returns True when the path is usable.
+ */
+function isProjectFile(targetPath: string): boolean {
+  const segments = targetPath.split(/[\\/]/);
+
+  return (
+    !path.isAbsolute(targetPath) &&
+    !segments.includes("..") &&
+    statSync(targetPath, {
+      throwIfNoEntry: false,
+    })?.isFile() === true
+  );
+}
+
+/**
+ * Describe what is wrong with the text after a `**Next:**` marker.
+ * @param text The text after the marker.
+ * @returns The problem, or an empty string when the line is valid.
+ */
+function describeNextProblem(text: string): string {
+  const parts = text.replace(/\.\s*$/, "").split(";");
+
+  if (parts.length !== 3 || parts.some(part => part.trim() === "")) {
+    return `"${nextMarker}" needs exactly three non-empty parts separated by ";" and no other ";": the target, who runs it, and what starts it`;
+  }
+
+  const target = parts.at(0)?.trim() ?? "";
+  const targetPath = /^`([^`\s]+)`$/.exec(target)?.[1];
+
+  return target !== "none" && (targetPath === undefined || !isProjectFile(targetPath))
+    ? `the "${nextMarker}" target must be "none" or one backticked relative path to an existing file in the project, with no ".." segment, found ${target}`
+    : "";
+}
+
+/**
+ * Find a missing, repeated, or malformed `**Next:**` line.
+ * @param lines Playbook lines.
+ * @returns The problems with the next-step line.
+ */
+function findNextProblems(lines: string[]): Problem[] {
+  const nextLines = lines
+    .map((text, index) => ({
+      text,
+      line: index + 1,
+    }))
+    .filter(({text}) => text.startsWith(nextMarker));
+
+  const next = nextLines.at(0);
+
+  if (next === undefined || nextLines.length !== 1) {
+    return [
+      {
+        rule: "C",
+        line: next?.line ?? 1,
+        message: `a playbook needs exactly one line starting with "${nextMarker}", found ${nextLines.length}; write "${nextMarker} <target>; <who runs it>; <what starts it>."`,
+      },
+    ];
+  }
+
+  const message = describeNextProblem(next.text.slice(nextMarker.length));
+
+  return message === ""
+    ? []
+    : [
+        {
+          message,
+          rule: "C",
+          line: next.line,
+        },
+      ];
+}
+
+/**
+ * Check one playbook against rules A, B, and C.
+ * @param text Playbook content.
+ * @returns Every problem found.
+ */
+function checkPlaybook(text: string): Problem[] {
+  const unfenced = maskFencedBlocks(text.replaceAll("\r\n", "\n"));
+  const lines = unfenced.split("\n");
+
+  return [
+    ...findGateProblems(lines),
+    ...findWaitingStepProblems(unfenced),
+    ...findNextProblems(lines),
+  ];
+}
+
+/**
+ * List the human gate roles a rule text does not mention.
+ * @param ruleText Content of the agent-owned work rule.
+ * @returns The missing roles.
+ */
+function findMissingRoles(ruleText: string): string[] {
+  return humanGateRoles.filter(role => !ruleText.toLowerCase().includes(role));
+}
+
+const validNext = "**Next:** none; the person; when they write.";
+
+const selfTestCases: SelfTestCase[] = [
+  {
+    name: "gate names a role",
+    text: `**Gate: the originator corrects the draft.**\n\n${validNext}`,
+  },
+  {
+    expectedRule: "A",
+    name: "gate names no role",
+    text: `**Gate: the manager corrects the draft.**\n\n${validNext}`,
+  },
+  {
+    expectedRule: "A",
+    name: "role outside the bold gate sentence",
+    text: `**Gate: the draft is corrected.** The originator does it.\n\n${validNext}`,
+  },
+  {
+    name: "waiting step names a role",
+    text: `1. Wait for the engineer.\n\n${validNext}`,
+  },
+  ...waitingWordList.map(word => ({
+    expectedRule: "B",
+    name: `waiting word "${word}" names no role`,
+    text: `1. Ask, then ${word} for the answer.\n\n${validNext}`,
+  })),
+  {
+    name: "plural role",
+    text: `1. Wait for the engineers and the code owners.\n\n${validNext}`,
+  },
+  {
+    expectedRule: "B",
+    name: "longer word that starts with a role",
+    text: `1. Wait for the engineering team.\n\n${validNext}`,
+  },
+  {
+    name: "CRLF line endings",
+    text: `1. Ask, then wait.\r\n   - The code owner answers.\r\n\r\n${validNext}\r\n`,
+  },
+  {
+    name: "gate inside a fenced block",
+    text: `\`\`\`\n**Gate: the manager corrects the draft.**\n\`\`\`\n\n${validNext}`,
+  },
+  {
+    name: "next inside a fenced block",
+    text: `\`\`\`\n**Next:** none; ; x\n\`\`\`\n\n${validNext}`,
+  },
+  {
+    expectedRule: "B",
+    name: "waiting word on a continuation line",
+    text: `1. Ask.\n   - Wait for the answer.\n\n${validNext}`,
+  },
+  {
+    name: "role on a continuation line covers the step",
+    text: `1. Ask, then wait.\n   - The code owner answers.\n\n${validNext}`,
+  },
+  {
+    name: "target is an existing path",
+    text: "**Next:** `package.json`; an agent; when asked.",
+  },
+  {
+    expectedRule: "C",
+    name: "target path does not exist",
+    text: "**Next:** `missing/file.md`; an agent; when asked.",
+  },
+  {
+    expectedRule: "C",
+    name: "target is an absolute path",
+    text: "**Next:** `/etc/hostname`; an agent; when asked.",
+  },
+  {
+    expectedRule: "C",
+    name: "target has a .. segment",
+    text: "**Next:** `.agents/../package.json`; an agent; when asked.",
+  },
+  {
+    expectedRule: "C",
+    name: "target is a directory",
+    text: "**Next:** `.agents`; an agent; when asked.",
+  },
+  {
+    expectedRule: "C",
+    name: "target is not backticked",
+    text: "**Next:** package.json; an agent; when asked.",
+  },
+  {
+    expectedRule: "C",
+    name: "next has two parts",
+    text: "**Next:** none; the person.",
+  },
+  {
+    expectedRule: "C",
+    name: "next has an empty part",
+    text: "**Next:** none; ; when they write.",
+  },
+  {
+    expectedRule: "C",
+    name: "next is missing",
+    text: "1. Answer.",
+  },
+  {
+    expectedRule: "C",
+    name: "next appears twice",
+    text: `${validNext}\n${validNext}`,
+  },
+];
+
+const selfTestFailures = selfTestCases
+  .filter(({expectedRule, text}) => {
+    const rules = checkPlaybook(text).map(problem => problem.rule);
+
+    return expectedRule === undefined ? rules.length > 0 : rules.join(",") !== expectedRule;
+  })
+  .map(({name}) => name);
+
+if (findMissingRoles(humanGateRoles.join(" ")).length > 0) {
+  selfTestFailures.push("a rule naming every role has no missing role");
+}
+
+if (findMissingRoles("no role").length !== humanGateRoles.length) {
+  selfTestFailures.push("a rule naming no role is missing every role");
+}
+
+if (existsSync(playbookDirectory) && existsSync(agentOwnedWorkRule)) {
+  if (selfTestFailures.length > 0) {
+    const failureLines = selfTestFailures.map(name => `- ${name}`);
+
+    process.stderr.write(`Human gate self-tests failed:\n${failureLines.join("\n")}\n`);
+    process.exitCode = 1;
+  } else {
+    const playbooks = readdirSync(playbookDirectory)
+      .filter(name => name.endsWith(".md"))
+      .map(name => `${playbookDirectory}/${name}`);
+
+    const problemLines = [
+      ...playbooks.flatMap(playbook =>
+        checkPlaybook(readFileSync(playbook, "utf8")).map(
+          ({line, message}) => `${playbook}:${line}: ${message}`,
+        ),
+      ),
+      ...findMissingRoles(readFileSync(agentOwnedWorkRule, "utf8")).map(
+        role =>
+          `${agentOwnedWorkRule}:1: the human gate role "${role}" is missing; name it in the rule or remove it from scripts/check-human-gates.ts`,
+      ),
+    ];
+
+    if (problemLines.length > 0) {
+      process.stderr.write(`${problemLines.join("\n")}\n`);
+      process.exitCode = 1;
+    } else {
+      process.stdout.write(
+        `Checked ${playbooks.length} playbooks against ${humanGateRoles.length} human gate roles.\n`,
+      );
+    }
+  }
+} else {
+  process.stderr.write(
+    `Run from the project root: ${playbookDirectory} and ${agentOwnedWorkRule} must exist.\n`,
+  );
+
+  process.exitCode = 1;
+}

package/templates/nestjs/.agents/rules.json

@@ -12,7 +12,7 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "description": "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves",
     "globs": [
       ".agents/rules/**",
       ".agents/rules.json",

package/templates/nestjs/.claude/rules/constitution-changes.md

@@ -22,4 +22,4 @@ paths:
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/nestjs/.cursor/rules/constitution-changes.mdc

@@ -1,5 +1,5 @@
 ---
-description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+description: "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves"
 globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,.prettierrc.json,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
 alwaysApply: false
 ---
@@ -8,4 +8,4 @@ alwaysApply: false
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/nestjs/.github/workflows/ci.yml

@@ -79,6 +79,8 @@ jobs:
         run: pnpm rules:check
       - name: Check agent gates
         run: pnpm gates:check
+      - name: Check human gates
+        run: pnpm human-gates:check
       - name: Check lint
         run: pnpm lint:check
       - name: Check formatting

package/templates/nestjs/AGENTS.md

@@ -36,7 +36,9 @@ If a test fails, fix the code, not the test.
 4. **Log through Nest's `Logger`.** It goes to the `ConsoleLogger` set in `src/main.ts`.
 5. **Start from the accepted spec, in plan mode.** Claude Code starts every session in plan mode (`.claude/settings.json`); in Cursor, switch to Plan Mode before the first edit. Give the plan the change's `intent/<change>/intent.md` and `spec.md`, and have it name the files that change, the order of the work, and the tests that prove it. Commit the approved plan as `intent/<change>/plan.md`. When implementation departs from the plan, update `plan.md` in the same commit.
 6. **Start a bug fix with a failing test.** Reproduce the bug as a test, run it, and confirm it fails for the reason you expect. Commit that test. Then create `.git/bug-fix-in-progress`, so `.agents/hooks/agent-test-edit-gate.sh` blocks test edits, and make the test pass without editing it. Delete `.git/bug-fix-in-progress` when the fix is done.
-7. **Start work only when a person asks or a trigger runs it, and stop only at the human gates, before an irreversible action, or for a decision only a person can make.** A question or a statement gets an answer, not a file, a commit, or a pull request. Once a task starts, carry it to the next gate without asking; `.agents/rules/agent-owned-work.md` lists the gates.
+7. **Start work only when a person asks or a trigger runs it, and stop only at the human gates, before an irreversible action, or for a decision only a person can make.** A question or a statement gets an answer, not a file, a commit, or a pull request. When a message reports a problem without asking for work, answer in a few lines and end with the message that would start the work: `/sdlc` followed by their own words. Once a task starts, carry it to the next gate without asking; `.agents/rules/agent-owned-work.md` lists the gates.
+8. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Drive it until it is green and waits only on code owner approval, as `babysit-pr` describes. Rebase and `git push --force-with-lease` only branches you own. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
+9. **Write replies a person can check.** Reply in the language the person wrote in. Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 
 ## Things Claude gets wrong
 

package/templates/nestjs/package.json

@@ -22,6 +22,7 @@
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
+    "human-gates:check": "node scripts/check-human-gates.ts",
     "knip": "knip",
     "lint": "eslint . --fix --cache --max-warnings=0 --no-inline-config",
     "lint:check": "eslint . --cache --max-warnings=0 --no-inline-config",
@@ -43,7 +44,7 @@
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
-    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
+    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm human-gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {
     "@nestjs/common": "12.3.2",

package/templates/nextjs/.agents/rules.json

@@ -12,7 +12,7 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "description": "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves",
     "globs": [
       ".agents/rules/**",
       ".agents/rules.json",

package/templates/nextjs/.claude/rules/constitution-changes.md

@@ -22,4 +22,4 @@ paths:
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/nextjs/.cursor/rules/constitution-changes.mdc

@@ -1,5 +1,5 @@
 ---
-description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+description: "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves"
 globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,prettier.config.ts,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
 alwaysApply: false
 ---
@@ -8,4 +8,4 @@ alwaysApply: false
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/nextjs/.github/workflows/ci.yml

@@ -79,6 +79,8 @@ jobs:
         run: pnpm rules:check
       - name: Check agent gates
         run: pnpm gates:check
+      - name: Check human gates
+        run: pnpm human-gates:check
       - name: Check lint
         run: pnpm lint:check
       - name: Check formatting

package/templates/nextjs/AGENTS.md

@@ -36,7 +36,9 @@ If a test fails, fix the code, not the test.
 4. **Read configuration from environment variables and fail when one is missing.** Document each variable in `.env.example`.
 5. **Start from the accepted spec, in plan mode.** Claude Code starts every session in plan mode (`.claude/settings.json`); in Cursor, switch to Plan Mode before the first edit. Give the plan the change's `intent/<change>/intent.md` and `spec.md`, and have it name the files that change, the order of the work, and the tests that prove it. Commit the approved plan as `intent/<change>/plan.md`. When implementation departs from the plan, update `plan.md` in the same commit.
 6. **Start a bug fix with a failing test.** Reproduce the bug as a test, run it, and confirm it fails for the reason you expect. Commit that test. Then create `.git/bug-fix-in-progress`, so `.agents/hooks/agent-test-edit-gate.sh` blocks test edits, and make the test pass without editing it. Delete `.git/bug-fix-in-progress` when the fix is done.
-7. **Start work only when a person asks or a trigger runs it, and stop only at the human gates, before an irreversible action, or for a decision only a person can make.** A question or a statement gets an answer, not a file, a commit, or a pull request. Once a task starts, carry it to the next gate without asking; `.agents/rules/agent-owned-work.md` lists the gates.
+7. **Start work only when a person asks or a trigger runs it, and stop only at the human gates, before an irreversible action, or for a decision only a person can make.** A question or a statement gets an answer, not a file, a commit, or a pull request. When a message reports a problem without asking for work, answer in a few lines and end with the message that would start the work: `/sdlc` followed by their own words. Once a task starts, carry it to the next gate without asking; `.agents/rules/agent-owned-work.md` lists the gates.
+8. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Drive it until it is green and waits only on code owner approval, as `babysit-pr` describes. Rebase and `git push --force-with-lease` only branches you own. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
+9. **Write replies a person can check.** Reply in the language the person wrote in. Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 
 ## Things Claude gets wrong
 

package/templates/nextjs/package.json

@@ -19,6 +19,7 @@
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
+    "human-gates:check": "node scripts/check-human-gates.ts",
     "knip": "knip",
     "lint": "eslint . --fix --cache --max-warnings=0 --no-inline-config",
     "lint:check": "eslint . --cache --max-warnings=0 --no-inline-config",
@@ -37,7 +38,7 @@
     "test:watch": "vitest",
     "typecheck": "next typegen && tsc --noEmit -p tsconfig.json",
     "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
-    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
+    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm human-gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {
     "next": "16.4.3",

package/templates/nodejs/.agents/rules.json

@@ -12,7 +12,7 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "description": "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves",
     "globs": [
       ".agents/rules/**",
       ".agents/rules.json",

package/templates/nodejs/.claude/rules/constitution-changes.md

@@ -22,4 +22,4 @@ paths:
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/nodejs/.cursor/rules/constitution-changes.mdc

@@ -1,5 +1,5 @@
 ---
-description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+description: "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves"
 globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,.prettierrc.json,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
 alwaysApply: false
 ---
@@ -8,4 +8,4 @@ alwaysApply: false
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/nodejs/.github/workflows/ci.yml

@@ -79,6 +79,8 @@ jobs:
         run: pnpm rules:check
       - name: Check agent gates
         run: pnpm gates:check
+      - name: Check human gates
+        run: pnpm human-gates:check
       - name: Check lint
         run: pnpm lint:check
       - name: Check formatting

package/templates/nodejs/AGENTS.md

@@ -34,7 +34,9 @@ If a test fails, fix the code, not the test.
 3. **Read configuration from environment variables and fail when one is missing**, as `parsePort` does. Document each variable in `.env.example`; `pnpm start` and `pnpm start:dev` load `.env`.
 4. **Start from the accepted spec, in plan mode.** Claude Code starts every session in plan mode (`.claude/settings.json`); in Cursor, switch to Plan Mode before the first edit. Give the plan the change's `intent/<change>/intent.md` and `spec.md`, and have it name the files that change, the order of the work, and the tests that prove it. Commit the approved plan as `intent/<change>/plan.md`. When implementation departs from the plan, update `plan.md` in the same commit.
 5. **Start a bug fix with a failing test.** Reproduce the bug as a test, run it, and confirm it fails for the reason you expect. Commit that test. Then create `.git/bug-fix-in-progress`, so `.agents/hooks/agent-test-edit-gate.sh` blocks test edits, and make the test pass without editing it. Delete `.git/bug-fix-in-progress` when the fix is done.
-6. **Start work only when a person asks or a trigger runs it, and stop only at the human gates, before an irreversible action, or for a decision only a person can make.** A question or a statement gets an answer, not a file, a commit, or a pull request. Once a task starts, carry it to the next gate without asking; `.agents/rules/agent-owned-work.md` lists the gates.
+6. **Start work only when a person asks or a trigger runs it, and stop only at the human gates, before an irreversible action, or for a decision only a person can make.** A question or a statement gets an answer, not a file, a commit, or a pull request. When a message reports a problem without asking for work, answer in a few lines and end with the message that would start the work: `/sdlc` followed by their own words. Once a task starts, carry it to the next gate without asking; `.agents/rules/agent-owned-work.md` lists the gates.
+7. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Drive it until it is green and waits only on code owner approval, as `babysit-pr` describes. Rebase and `git push --force-with-lease` only branches you own. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
+8. **Write replies a person can check.** Reply in the language the person wrote in. Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 
 ## Things Claude gets wrong
 

package/templates/nodejs/package.json

@@ -18,6 +18,7 @@
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
+    "human-gates:check": "node scripts/check-human-gates.ts",
     "knip": "knip",
     "lint": "eslint . --fix --cache --max-warnings=0 --no-inline-config",
     "lint:check": "eslint . --cache --max-warnings=0 --no-inline-config",
@@ -37,7 +38,7 @@
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
-    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
+    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm human-gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "devDependencies": {
     "@commitlint/cli": "21.2.4",

package/templates/payload/.agents/rules.json

@@ -12,7 +12,7 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "description": "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves",
     "globs": [
       ".agents/rules/**",
       ".agents/rules.json",

package/templates/payload/.claude/rules/constitution-changes.md

@@ -22,4 +22,4 @@ paths:
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/payload/.cursor/rules/constitution-changes.mdc

@@ -1,5 +1,5 @@
 ---
-description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+description: "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves"
 globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,.prettierrc.json,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
 alwaysApply: false
 ---
@@ -8,4 +8,4 @@ alwaysApply: false
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.