@next-friday/create-app 7.0.0 → 8.0.0

package/templates/base/.cursor/skills/security-policy/SKILL.md

@@ -5,8 +5,37 @@ description: Apply the organization's security policy. Use whenever writing or r
 
 # Security policy
 
-Owner: <the named policy owner>
+Owner: the code owner of this folder in `.github/CODEOWNERS`.
 
-Source of truth: <where the written policy lives>
+Standard: [OWASP Application Security Verification Standard 5.0.0](https://github.com/OWASP/ASVS/tree/v5.0.0/5.0/en), Level 1. This is the default; the owner replaces or tightens it by editing this file.
 
-This policy is not written yet. Report that as an area of concern.
+## Rules
+
+1. Find the chapters the change touches in the table below. A change that touches none meets this policy; say "Does not apply" and why.
+2. For each chapter it touches, open that chapter's file in the standard and list every Level 1 requirement that applies to the change. Cite each as `v5.0.0-<chapter>.<section>.<requirement>`, for example `v5.0.0-8.2.1`.
+3. Each cited requirement becomes a requirement of the spec, and a test or a review step of the plan.
+4. When you cannot open the standard, name the chapters, cite no requirement number from memory, and report that as an area of concern.
+5. A Level 1 requirement the change cannot meet is an area of concern. Never drop it silently.
+6. Secrets stay out of the repository, logs, and error messages; `.env.example` holds names only.
+
+## Chapters
+
+| Chapter | Covers                              | Level 1 requirements |
+| :------ | :---------------------------------- | :------------------- |
+| V1      | Encoding and Sanitization           | 8                    |
+| V2      | Validation and Business Logic       | 4                    |
+| V3      | Web Frontend Security               | 8                    |
+| V4      | API and Web Service                 | 2                    |
+| V5      | File Handling                       | 4                    |
+| V6      | Authentication                      | 13                   |
+| V7      | Session Management                  | 6                    |
+| V8      | Authorization                       | 4                    |
+| V9      | Self-contained Tokens               | 4                    |
+| V10     | OAuth and OIDC                      | 5                    |
+| V11     | Cryptography                        | 3                    |
+| V12     | Secure Communication                | 3                    |
+| V13     | Configuration                       | 1                    |
+| V14     | Data Protection                     | 2                    |
+| V15     | Secure Coding and Architecture      | 3                    |
+| V16     | Security Logging and Error Handling | 0                    |
+| V17     | WebRTC                              | 0                    |

package/templates/base/.cursor/skills/ux-policy/SKILL.md

@@ -5,8 +5,17 @@ description: Apply the organization's UX policy. Use whenever writing or reviewi
 
 # UX policy
 
-Owner: <the named policy owner>
+Owner: the code owner of this folder in `.github/CODEOWNERS`.
 
-Source of truth: <where the written policy lives>
+Standard: [Web Content Accessibility Guidelines (WCAG) 2.2](https://www.w3.org/TR/WCAG22/), Level AA: the page satisfies all the Level A and Level AA success criteria. This is the default; the owner replaces or tightens it by editing this file.
 
-This policy is not written yet. Report that as an area of concern.
+## Rules
+
+1. A change with no user interface meets this policy; say "Does not apply" and why.
+2. For a change with a user interface, the spec lists the success criteria the change touches, by number and name, and each becomes a requirement.
+3. Every interactive element works with the keyboard alone, shows where the focus is, and has a name a screen reader announces.
+4. Text and meaningful graphics meet the contrast minimum, and no information is carried by colour alone.
+5. Every form field has a visible label, and every error says in text which field is wrong and how to fix it.
+6. Check the criteria that WCAG 2.2 added at Level A and AA: 2.4.11 Focus Not Obscured (Minimum), 2.5.7 Dragging Movements, 2.5.8 Target Size (Minimum), 3.2.6 Consistent Help, 3.3.7 Redundant Entry, and 3.3.8 Accessible Authentication (Minimum).
+7. Every state the user can reach is designed: loading, empty, error, and success.
+8. A criterion the change cannot meet is an area of concern. Never drop it silently.

package/templates/base/SETUP.md

@@ -4,8 +4,8 @@ This project follows Anthropic's [AI-native SDLC Playbook](https://claude.com/re
 
 ## How a change flows
 
-1. **Plan:** the originator of an idea, a ticket, or an incident sends it with `/sdlc`, which interviews them and writes `intent/<change>/intent.md`. The product owner merges it with `Status: accepted.` or `Status: rejected.`
-2. **Design:** `spec.md` is written from the accepted intent with the policy skills loaded (`write-spec` skill). The product owner resolves concerns with the policy owners.
+1. **Plan:** the originator of an idea, a ticket, or an incident sends it with `/sdlc`, which interviews them and writes `intent/<change>/intent.md`. The product owner accepts it by merging it with `Status: accepted.`, or rejects it by closing its pull request.
+2. **Design:** `spec.md` is written from the accepted intent with the policy skills loaded (send the intent's path with `/sdlc`). The product owner resolves concerns with the policy owners.
 3. **Build:** the engineer starts in plan mode, approves the plan, and commits it as `plan.md`. A tech lead approves higher-risk plans.
 4. **Test:** the session runs **Verifying your work** in `AGENTS.md`.
 5. **Review:** Claude Code Review and Bugbot review by `REVIEW.md`. A code owner approves; the agent never does.
@@ -93,13 +93,13 @@ Also replace the owner placeholder in `.github/zizmor.yml`.
 
 - **Sources of truth (engineering lead):** for each artifact, name one system as the source of truth: this repository, an existing tool such as Jira, or, as the minimum, a link both ways (the record id in the file and the commit SHA in the record).
 - **Higher risk (engineering lead):** decide which changes count as higher risk. A tech lead or architect approves their specs and plans.
-- **Policies (each policy owner, with an engineer):** write the policy in `.agents/skills/<area>-policy/SKILL.md` from the owner's source of truth, then run `pnpm rules:sync`. Test that the skill triggers: ask for the relevant task in different ways and confirm the skill loads each time. The policy owner approves every later change as its code owner.
+- **Policies (each policy owner, with an engineer):** each `.agents/skills/<area>-policy/SKILL.md` ships a default (security: OWASP ASVS 5.0.0 Level 1; UX: WCAG 2.2 Level AA; compliance: the OECD privacy principles; brand: one declared source for every brand value). Review it, replace or add the organization's own rules, then run `pnpm rules:sync`. Test that the skill triggers: ask for the relevant task in different ways and confirm the skill loads each time. The policy owner approves every later change as its code owner.
 - **Production gate (engineering leadership, with change management and compliance):** name the release managers and add them as required reviewers on the `prod` environment, as the README's deploy section describes. `.agents/hooks/agent-production-gate.sh` blocks an agent's shell commands that dispatch a `prod` deploy, run a Railway command with `prod` as its environment, or push a release tag. It does not read MCP tools. A release manager whose own agent session must do one of these starts the agent with `RELEASE_APPROVAL` set to the approval record, for example `RELEASE_APPROVAL=CHG-123 claude`.
 - **Review (tech lead):** replace `src/gen/` in `.agents/review.md` with this project's generated paths, then run `pnpm rules:sync`, which renders it to `REVIEW.md` for Claude Code Review. Once a month, rate the review findings and tune `.agents/review.md`.
 - **People without Git experience:** connect GitHub to Claude (claude.ai or Cowork), so Claude commits `intent.md` for them.
 
 ## 7. Later, as the guardrails mature
 
-- Run the `write-spec` skill by hand first, then as an organization-level slash command, then as a job that commits `spec.md` as a pull request when an `intent.md` merges.
+- Send the intent's path with `/sdlc` by hand first, then as an organization-level slash command, then as a job that commits `spec.md` as a pull request when an `intent.md` merges.
 - Make auto mode the default for routine work: a tight `spec.md`, a small blast radius, and code the tests already cover.
 - Replace `bands.yaml` with this project's metric, add a unit-tested detection script that reads it, and add the trigger that runs it.

package/templates/base/intent/README.md

@@ -4,7 +4,7 @@ This folder is the intent home. Every change starts here as an `intent.md`, and
 
 - Each change has its own folder, `intent/<change>/`, where `<change>` is a short kebab-case name. The folder holds `intent.md` (Plan), then `spec.md` (Design), then `plan.md` (Build).
 - **Plan.** An idea, a ticket, or an incident becomes `intent.md`, written by sending the idea with `/sdlc`, which interviews the originator. The originator corrects the draft before it is committed, and the product owner reviews it in its pull request. Merging its pull request records the decision: `Status: accepted.` accepts it, and `Status: rejected.` rejects it.
-- **Design.** The `write-spec` skill turns the accepted `intent.md` into `spec.md`, committed alongside it. The product owner reviews the spec against the idea and resolves each area of concern with its policy owner. Accepting the spec starts the build.
+- **Design.** Sending the intent's path with `/sdlc` turns the accepted `intent.md` into `spec.md`, committed alongside it. The product owner reviews the spec against the idea and resolves each area of concern with its policy owner. Accepting the spec starts the build.
 - **Build.** The engineer starts in plan mode with `intent.md` and `spec.md`, and commits the approved plan as `plan.md`. When implementation departs from the plan, `plan.md` changes in the same commit.
 
 ## Which file holds what

package/templates/base/scripts/check-human-gates.ts

@@ -0,0 +1,383 @@
+import {existsSync, readdirSync, readFileSync, statSync} from "node:fs";
+import path from "node:path";
+
+type Problem = {
+  line: number;
+  message: string;
+  rule: string;
+};
+
+type Step = {
+  line: number;
+  text: string;
+};
+
+type SelfTestCase = {
+  expectedRule?: string;
+  name: string;
+  text: string;
+};
+
+const playbookDirectory = ".agents/skills/sdlc/playbooks";
+const agentOwnedWorkRule = ".agents/rules/agent-owned-work.md";
+const nextMarker = "**Next:**";
+
+const humanGateRoles = [
+  "originator",
+  "product owner",
+  "engineer",
+  "code owner",
+  "release manager",
+  "service owner",
+];
+
+const roleWords = new RegExp(String.raw`\b(?:${humanGateRoles.join("|")})s?\b`, "i");
+
+const waitingWordList = [
+  "wait",
+  "waits",
+  "approve",
+  "approves",
+  "approval",
+  "approved",
+  "approving",
+  "confirm",
+  "confirms",
+  "confirmation",
+  "permission",
+  "sign off",
+];
+
+const waitingWords = new RegExp(String.raw`\b(?:${waitingWordList.join("|")})\b`, "i");
+const roleList = humanGateRoles.join(", ");
+
+/**
+ * Blank every line of a fenced code block, keeping line numbers.
+ * @param text Playbook content with LF line endings.
+ * @returns The content with fenced lines emptied.
+ */
+function maskFencedBlocks(text: string): string {
+  let isFenced = false;
+
+  return text
+    .split("\n")
+    .map(line => {
+      const isFence = /^\s*(?:```|~~~)/.test(line);
+      const isMasked = isFenced || isFence;
+
+      isFenced = isFence ? !isFenced : isFenced;
+
+      return isMasked ? "" : line;
+    })
+    .join("\n");
+}
+
+/**
+ * Split a playbook into its numbered steps, each with its indented continuation lines.
+ * @param text Playbook content.
+ * @returns The steps with the line each starts on.
+ */
+function splitSteps(text: string): Step[] {
+  return Array.from(text.matchAll(/^\d+\. .*(?:\n[\t ]+\S.*)*/gm), match => ({
+    line: text.slice(0, match.index).split("\n").length,
+    text: match[0],
+  }));
+}
+
+/**
+ * Find gate lines whose bold sentence names no human gate role.
+ * @param lines Playbook lines.
+ * @returns One problem per such line.
+ */
+function findGateProblems(lines: string[]): Problem[] {
+  return lines
+    .map((text, index) => ({
+      text,
+      line: index + 1,
+    }))
+    .filter(({text}) => text.includes("**Gate:"))
+    .filter(({text}) => !roleWords.test(/\*\*Gate:(.*?)\*\*/.exec(text)?.[1] ?? ""))
+    .map(({line}) => ({
+      line,
+      rule: "A",
+      message: `a gate must name one of ${roleList} inside its bold sentence; write "**Gate: the <role> <does what>.**"`,
+    }));
+}
+
+/**
+ * Find steps that wait, approve, or confirm without naming a human gate role.
+ * @param text Playbook content.
+ * @returns One problem per such step.
+ */
+function findWaitingStepProblems(text: string): Problem[] {
+  return splitSteps(text)
+    .filter(step => waitingWords.test(step.text) && !roleWords.test(step.text))
+    .map(step => ({
+      rule: "B",
+      line: step.line,
+      message: `a step that waits, approves, or confirms must name who does it: one of ${roleList}`,
+    }));
+}
+
+/**
+ * Tell whether a path is a relative path without `..` to an existing regular file.
+ * @param targetPath Path from a `**Next:**` target.
+ * @returns True when the path is usable.
+ */
+function isProjectFile(targetPath: string): boolean {
+  const segments = targetPath.split(/[\\/]/);
+
+  return (
+    !path.isAbsolute(targetPath) &&
+    !segments.includes("..") &&
+    statSync(targetPath, {
+      throwIfNoEntry: false,
+    })?.isFile() === true
+  );
+}
+
+/**
+ * Describe what is wrong with the text after a `**Next:**` marker.
+ * @param text The text after the marker.
+ * @returns The problem, or an empty string when the line is valid.
+ */
+function describeNextProblem(text: string): string {
+  const parts = text.replace(/\.\s*$/, "").split(";");
+
+  if (parts.length !== 3 || parts.some(part => part.trim() === "")) {
+    return `"${nextMarker}" needs exactly three non-empty parts separated by ";" and no other ";": the target, who runs it, and what starts it`;
+  }
+
+  const target = parts.at(0)?.trim() ?? "";
+  const targetPath = /^`([^`\s]+)`$/.exec(target)?.[1];
+
+  return target !== "none" && (targetPath === undefined || !isProjectFile(targetPath))
+    ? `the "${nextMarker}" target must be "none" or one backticked relative path to an existing file in the project, with no ".." segment, found ${target}`
+    : "";
+}
+
+/**
+ * Find a missing, repeated, or malformed `**Next:**` line.
+ * @param lines Playbook lines.
+ * @returns The problems with the next-step line.
+ */
+function findNextProblems(lines: string[]): Problem[] {
+  const nextLines = lines
+    .map((text, index) => ({
+      text,
+      line: index + 1,
+    }))
+    .filter(({text}) => text.startsWith(nextMarker));
+
+  const next = nextLines.at(0);
+
+  if (next === undefined || nextLines.length !== 1) {
+    return [
+      {
+        rule: "C",
+        line: next?.line ?? 1,
+        message: `a playbook needs exactly one line starting with "${nextMarker}", found ${nextLines.length}; write "${nextMarker} <target>; <who runs it>; <what starts it>."`,
+      },
+    ];
+  }
+
+  const message = describeNextProblem(next.text.slice(nextMarker.length));
+
+  return message === ""
+    ? []
+    : [
+        {
+          message,
+          rule: "C",
+          line: next.line,
+        },
+      ];
+}
+
+/**
+ * Check one playbook against rules A, B, and C.
+ * @param text Playbook content.
+ * @returns Every problem found.
+ */
+function checkPlaybook(text: string): Problem[] {
+  const unfenced = maskFencedBlocks(text.replaceAll("\r\n", "\n"));
+  const lines = unfenced.split("\n");
+
+  return [
+    ...findGateProblems(lines),
+    ...findWaitingStepProblems(unfenced),
+    ...findNextProblems(lines),
+  ];
+}
+
+/**
+ * List the human gate roles a rule text does not mention.
+ * @param ruleText Content of the agent-owned work rule.
+ * @returns The missing roles.
+ */
+function findMissingRoles(ruleText: string): string[] {
+  return humanGateRoles.filter(role => !ruleText.toLowerCase().includes(role));
+}
+
+const validNext = "**Next:** none; the person; when they write.";
+
+const selfTestCases: SelfTestCase[] = [
+  {
+    name: "gate names a role",
+    text: `**Gate: the originator corrects the draft.**\n\n${validNext}`,
+  },
+  {
+    expectedRule: "A",
+    name: "gate names no role",
+    text: `**Gate: the manager corrects the draft.**\n\n${validNext}`,
+  },
+  {
+    expectedRule: "A",
+    name: "role outside the bold gate sentence",
+    text: `**Gate: the draft is corrected.** The originator does it.\n\n${validNext}`,
+  },
+  {
+    name: "waiting step names a role",
+    text: `1. Wait for the engineer.\n\n${validNext}`,
+  },
+  ...waitingWordList.map(word => ({
+    expectedRule: "B",
+    name: `waiting word "${word}" names no role`,
+    text: `1. Ask, then ${word} for the answer.\n\n${validNext}`,
+  })),
+  {
+    name: "plural role",
+    text: `1. Wait for the engineers and the code owners.\n\n${validNext}`,
+  },
+  {
+    expectedRule: "B",
+    name: "longer word that starts with a role",
+    text: `1. Wait for the engineering team.\n\n${validNext}`,
+  },
+  {
+    name: "CRLF line endings",
+    text: `1. Ask, then wait.\r\n   - The code owner answers.\r\n\r\n${validNext}\r\n`,
+  },
+  {
+    name: "gate inside a fenced block",
+    text: `\`\`\`\n**Gate: the manager corrects the draft.**\n\`\`\`\n\n${validNext}`,
+  },
+  {
+    name: "next inside a fenced block",
+    text: `\`\`\`\n**Next:** none; ; x\n\`\`\`\n\n${validNext}`,
+  },
+  {
+    expectedRule: "B",
+    name: "waiting word on a continuation line",
+    text: `1. Ask.\n   - Wait for the answer.\n\n${validNext}`,
+  },
+  {
+    name: "role on a continuation line covers the step",
+    text: `1. Ask, then wait.\n   - The code owner answers.\n\n${validNext}`,
+  },
+  {
+    name: "target is an existing path",
+    text: "**Next:** `package.json`; an agent; when asked.",
+  },
+  {
+    expectedRule: "C",
+    name: "target path does not exist",
+    text: "**Next:** `missing/file.md`; an agent; when asked.",
+  },
+  {
+    expectedRule: "C",
+    name: "target is an absolute path",
+    text: "**Next:** `/etc/hostname`; an agent; when asked.",
+  },
+  {
+    expectedRule: "C",
+    name: "target has a .. segment",
+    text: "**Next:** `.agents/../package.json`; an agent; when asked.",
+  },
+  {
+    expectedRule: "C",
+    name: "target is a directory",
+    text: "**Next:** `.agents`; an agent; when asked.",
+  },
+  {
+    expectedRule: "C",
+    name: "target is not backticked",
+    text: "**Next:** package.json; an agent; when asked.",
+  },
+  {
+    expectedRule: "C",
+    name: "next has two parts",
+    text: "**Next:** none; the person.",
+  },
+  {
+    expectedRule: "C",
+    name: "next has an empty part",
+    text: "**Next:** none; ; when they write.",
+  },
+  {
+    expectedRule: "C",
+    name: "next is missing",
+    text: "1. Answer.",
+  },
+  {
+    expectedRule: "C",
+    name: "next appears twice",
+    text: `${validNext}\n${validNext}`,
+  },
+];
+
+const selfTestFailures = selfTestCases
+  .filter(({expectedRule, text}) => {
+    const rules = checkPlaybook(text).map(problem => problem.rule);
+
+    return expectedRule === undefined ? rules.length > 0 : rules.join(",") !== expectedRule;
+  })
+  .map(({name}) => name);
+
+if (findMissingRoles(humanGateRoles.join(" ")).length > 0) {
+  selfTestFailures.push("a rule naming every role has no missing role");
+}
+
+if (findMissingRoles("no role").length !== humanGateRoles.length) {
+  selfTestFailures.push("a rule naming no role is missing every role");
+}
+
+if (existsSync(playbookDirectory) && existsSync(agentOwnedWorkRule)) {
+  if (selfTestFailures.length > 0) {
+    const failureLines = selfTestFailures.map(name => `- ${name}`);
+
+    process.stderr.write(`Human gate self-tests failed:\n${failureLines.join("\n")}\n`);
+    process.exitCode = 1;
+  } else {
+    const playbooks = readdirSync(playbookDirectory)
+      .filter(name => name.endsWith(".md"))
+      .map(name => `${playbookDirectory}/${name}`);
+
+    const problemLines = [
+      ...playbooks.flatMap(playbook =>
+        checkPlaybook(readFileSync(playbook, "utf8")).map(
+          ({line, message}) => `${playbook}:${line}: ${message}`,
+        ),
+      ),
+      ...findMissingRoles(readFileSync(agentOwnedWorkRule, "utf8")).map(
+        role =>
+          `${agentOwnedWorkRule}:1: the human gate role "${role}" is missing; name it in the rule or remove it from scripts/check-human-gates.ts`,
+      ),
+    ];
+
+    if (problemLines.length > 0) {
+      process.stderr.write(`${problemLines.join("\n")}\n`);
+      process.exitCode = 1;
+    } else {
+      process.stdout.write(
+        `Checked ${playbooks.length} playbooks against ${humanGateRoles.length} human gate roles.\n`,
+      );
+    }
+  }
+} else {
+  process.stderr.write(
+    `Run from the project root: ${playbookDirectory} and ${agentOwnedWorkRule} must exist.\n`,
+  );
+
+  process.exitCode = 1;
+}

package/templates/nestjs/.agents/rules.json

@@ -12,7 +12,7 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "description": "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves",
     "globs": [
       ".agents/rules/**",
       ".agents/rules.json",

package/templates/nestjs/.claude/rules/constitution-changes.md

@@ -22,4 +22,4 @@ paths:
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/nestjs/.cursor/rules/constitution-changes.mdc

@@ -1,5 +1,5 @@
 ---
-description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+description: "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves"
 globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,.prettierrc.json,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
 alwaysApply: false
 ---
@@ -8,4 +8,4 @@ alwaysApply: false
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/nestjs/.github/workflows/ci.yml

@@ -79,6 +79,8 @@ jobs:
         run: pnpm rules:check
       - name: Check agent gates
         run: pnpm gates:check
+      - name: Check human gates
+        run: pnpm human-gates:check
       - name: Check lint
         run: pnpm lint:check
       - name: Check formatting

package/templates/nestjs/package.json

@@ -22,6 +22,7 @@
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
+    "human-gates:check": "node scripts/check-human-gates.ts",
     "knip": "knip",
     "lint": "eslint . --fix --cache --max-warnings=0 --no-inline-config",
     "lint:check": "eslint . --cache --max-warnings=0 --no-inline-config",
@@ -43,7 +44,7 @@
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
-    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
+    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm human-gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {
     "@nestjs/common": "12.3.2",

package/templates/nextjs/.agents/rules.json

@@ -12,7 +12,7 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "description": "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves",
     "globs": [
       ".agents/rules/**",
       ".agents/rules.json",

package/templates/nextjs/.claude/rules/constitution-changes.md

@@ -22,4 +22,4 @@ paths:
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/nextjs/.cursor/rules/constitution-changes.mdc

@@ -1,5 +1,5 @@
 ---
-description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+description: "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves"
 globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,prettier.config.ts,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
 alwaysApply: false
 ---
@@ -8,4 +8,4 @@ alwaysApply: false
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/nextjs/.github/workflows/ci.yml

@@ -79,6 +79,8 @@ jobs:
         run: pnpm rules:check
       - name: Check agent gates
         run: pnpm gates:check
+      - name: Check human gates
+        run: pnpm human-gates:check
       - name: Check lint
         run: pnpm lint:check
       - name: Check formatting

package/templates/nextjs/package.json

@@ -19,6 +19,7 @@
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
+    "human-gates:check": "node scripts/check-human-gates.ts",
     "knip": "knip",
     "lint": "eslint . --fix --cache --max-warnings=0 --no-inline-config",
     "lint:check": "eslint . --cache --max-warnings=0 --no-inline-config",
@@ -37,7 +38,7 @@
     "test:watch": "vitest",
     "typecheck": "next typegen && tsc --noEmit -p tsconfig.json",
     "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
-    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
+    "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm human-gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {
     "next": "16.4.3",

package/templates/nodejs/.agents/rules.json

@@ -12,7 +12,7 @@
     "description": "Codebase hygiene: modify existing code instead of accumulating new code"
   },
   "constitution-changes": {
-    "description": "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue",
+    "description": "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves",
     "globs": [
       ".agents/rules/**",
       ".agents/rules.json",

package/templates/nodejs/.claude/rules/constitution-changes.md

@@ -22,4 +22,4 @@ paths:
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/nodejs/.cursor/rules/constitution-changes.mdc

@@ -1,5 +1,5 @@
 ---
-description: "Constitution changes: change rules, hooks, and agent settings only through a dedicated issue"
+description: "Constitution changes: change rules, hooks, and agent settings in a pull request a code owner approves"
 globs: ".agents/rules/**,.agents/rules.json,.agents/hooks/**,.claude/settings.json,.claude/rules/**,.cursor/rules/**,.cursor/hooks/**,.cursor/hooks.json,scripts/sync-agent-rules.ts,scripts/check-agent-gates.ts,.husky/**,.commitlintrc.json,.prettierrc.json,eslint.config.ts,.lintstagedrc.json,.gitleaks.toml"
 alwaysApply: false
 ---
@@ -8,4 +8,4 @@ alwaysApply: false
 
 The constitution is the set of files that agent settings deny to agents: rules, hooks, lint, format, and commit configuration, and the agent settings themselves. It is company policy.
 
-A developer changes the constitution through a dedicated issue, never inside a feature pull request. When a task needs a constitution change, propose it to the user, reference that issue, and wait for it to merge before the task depends on it.
+The constitution changes in a pull request like any other change, and a code owner approves it in review. Agent settings stop an agent from editing these files. When a task needs a constitution change, write the exact new text and the files it goes in on the pull request; a person commits it to that branch.

package/templates/nodejs/.github/workflows/ci.yml

@@ -79,6 +79,8 @@ jobs:
         run: pnpm rules:check
       - name: Check agent gates
         run: pnpm gates:check
+      - name: Check human gates
+        run: pnpm human-gates:check
       - name: Check lint
         run: pnpm lint:check
       - name: Check formatting