@next-friday/create-app 9.2.0 → 9.3.0

package/templates/base/{.agents/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/playbooks/fix.md

@@ -2,10 +2,10 @@
 
 This playbook takes a defect in behaviour that already exists to a pull request. It has no intent and no spec: its plan is the only file it adds under `intent/`.
 
-1. Decide that the request qualifies. It qualifies only when the request is a defect in behaviour that already exists, and the fix adds no new behaviour and no new dependency and changes no schema and no public interface. When a condition fails, say which one in two lines and follow `.agents/skills/sdlc/playbooks/plan.md` instead.
+1. Decide that the request qualifies. It qualifies only when the request is a defect in behaviour that already exists, and the fix adds no new behaviour and no new dependency and changes no schema and no public interface. When a condition fails, say which one in two lines and follow `playbooks/plan.md` instead.
 2. Reproduce the defect yourself by running the code, and keep the output. Ask the person only when you can name the specific reason you cannot reach it, such as a credential or a service this session cannot use.
 3. Find the cause from what running the code shows. List the candidate causes, rule each out with a command or an observation, and never guess. Name the one cause the evidence leaves. When it leaves none, or more than one, say so and ask for what is missing.
-4. Write the plan from the template in `.agents/skills/sdlc/playbooks/build.md`, in the language of the files already in `intent/`, and keep the reply in the language the person wrote in. The title is `# Plan: <title> (fix)`. Use exactly the template's four headings, and keep the plan short. Name the file `intent/<short-description>/plan.md`; the folder holds only this file.
+4. Write the plan from the template in `playbooks/build.md`. The title is `# Plan: <title> (fix)`. Use exactly the template's four headings, and keep the plan short. Name the file `intent/<short-description>/plan.md`; the folder holds only this file.
    - **Files that change:** every file, marked new, changed, or deleted, with one line on what it does afterwards.
    - **Order of work:** the cause and the evidence for it, then numbered steps. Each ends with the check that proves it.
    - **Risks:** what the fix could break, and each option you chose not to take and why.
@@ -14,10 +14,10 @@ This playbook takes a defect in behaviour that already exists to a pull request.
    Show the whole plan and name the file only as `intent/<short-description>/plan.md`. In plan mode you cannot write the file. Show the plan as the plan.
 
 5. **Gate: the engineer accepts the plan.** Ask whether an engineer could fix the defect from it, and for their GitHub handle when you cannot read it. Revise until they say yes. Change no code and commit nothing before that yes. In plan mode, approving the plan is that yes.
-6. Create the branch `fix/<short-description>` as `AGENTS.md` says. Set the plan's `Accepted by:` line, under its title, to the handle of the engineer who said yes in step 5, and commit `intent/<short-description>/plan.md` as the first commit.
+6. Create the branch `fix/<short-description>` as `playbooks/open-pr.md` says. Set the plan's `Accepted by:` line, under its title, to the handle of the engineer who said yes in step 5, and commit `intent/<short-description>/plan.md` as the first commit.
 7. Reproduce the defect as a test. Run it and check that it fails for the reason the cause gives. Commit the failing test before any fix.
-8. Make the test pass without editing it. On a `fix/` branch, `.agents/hooks/agent-test-edit-gate.sh` blocks test edits once the failing test is committed. On a branch with another name, create `.git/bug-fix-in-progress` first, and delete it once the test passes.
-9. Run every check under **Verifying your work** in `AGENTS.md`. Keep the output. When one fails, fix the code, and never skip, delete, or weaken a test. When a check cannot run in this session, say which one and why, and never report it as passed.
-10. Go on in the same turn, without asking. Follow `.agents/skills/sdlc/playbooks/open-pr.md`, and then `.agents/skills/sdlc/playbooks/review.md`.
+8. Make the test pass without editing it.
+9. Run every check the project's agent instructions name. Keep the output. When one fails, fix the code, and never skip, delete, or weaken a test. When a check cannot run in this session, say which one and why, and never report it as passed.
+10. Go on in the same turn, without asking. Follow `playbooks/open-pr.md`, and then `playbooks/review.md`.
 
-**Next:** `.agents/skills/sdlc/playbooks/open-pr.md`; an agent; in the same turn, as soon as step 9 passes.
+**Next:** `playbooks/open-pr.md`; an agent; in the same turn, as soon as step 9 passes.

package/templates/base/{.cursor/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/playbooks/maintain.md

@@ -2,19 +2,17 @@
 
 This playbook starts from a finding such as an alert, a monitoring ticket, a failing run, or an incident. No one answers questions while it runs.
 
-1. Read the finding the request gives: what was seen, where, when, and its link or log. When the request gives no finding, say so in two lines and stop. When the finding asks for a new capability and reports no fault, say that a person sends it with `/sdlc`, and stop.
-2. Diagnose without changing anything. Read the logs, the code, and the changes merged before the finding. When `bands.yaml` names the tools for the finding's tier, use only those. Write no file outside `intent/`, start no deploy, and act only through a route that `bands.yaml` lists for that tier: `pull_request` is the pull request in step 5, and any other route is a runbook of that name. When the finding names no tier, or the project has no `bands.yaml`, use read-only tools only. When the tier's action is only to log, put the finding in your reply and stop.
-3. Write `intent/<change>/intent.md` from the template in `.agents/skills/sdlc/playbooks/plan.md`, in the language of the files already in `intent/`. Use exactly the template's five headings.
+1. Read the finding the request gives: what was seen, where, when, and its link or log. When the request gives no finding, say so in two lines and stop. When the finding asks for a new capability and reports no fault, say that a person sends it with `/sdlc:sdlc-mode`, and stop.
+2. Diagnose without changing anything. Read the logs, the code, and the changes merged before the finding. When `bands.yaml` names the tools for the finding's tier, use only those. Write no file outside `intent/`, start no deploy, and act only through a route that `bands.yaml` lists for that tier: `pull_request` is the pull request in step 5, and any other route is a runbook of that name. When the finding names no tier, use read-only tools only. When the tier's action is only to log, put the finding in your reply and stop.
+3. Write `intent/<change>/intent.md` from the template in `playbooks/plan.md`. Use exactly the template's five headings.
    - **Problem:** the anomaly and its evidence: the number, its source, and the time.
    - **Proposed outcome:** what the fixed system does, as its user would see it.
    - **Open questions:** everything the evidence does not settle, including the cause when you could not prove it. Never state a cause you did not verify.
 
-   In the author line, name what started the run, such as "Author: maintain job (alert <link>). Status: draft."
-
 4. Run the confidence check. It is a check, not a person.
    - Start a subagent that has not seen the diagnosis, give it only the finding, the logs and files you read, and `intent.md`, and have it try to disprove the **Problem** section from the evidence. When you cannot start a subagent, read the evidence again from the first line as if someone else wrote the intent.
    - When a claim does not survive, move it under **Open questions**, and say in the pull request that the confidence check failed and on which claim.
-5. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as `AGENTS.md` says for branches and pull requests. Put the evidence and the confidence check's result first in its description, under the template's first heading. When you cannot open a pull request from this session, say so and give the pushed branch's name.
-6. **Gate: the service owner triages the finding.** The service owner merges the pull request to fix the finding now, leaves it open to schedule it, or closes it to dismiss it. A dismissal tunes the bands: the service owner adjusts `bands.yaml` so the same noise raises fewer findings. The service owner asks the product owner to decide a product-facing finding. You do none of these. Report the pull request's URL, keep it green as `.agents/skills/sdlc/playbooks/review.md` says, and wait.
+5. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as the opening paragraph of `playbooks/open-pr.md` says for branches and pull requests. When you cannot open a pull request from this session, say so and give the pushed branch's name.
+6. **Gate: the service owner triages the finding.** The service owner merges the pull request to fix the finding now, leaves it open to schedule it, or closes it to dismiss it. A dismissal tunes the bands: the service owner adjusts `bands.yaml` so the same noise raises fewer findings. The service owner asks the product owner to decide a product-facing finding. You do none of these. Report the pull request's URL, keep it green as `playbooks/review.md` says, and wait.
 
-**Next:** `.agents/skills/sdlc/playbooks/design.md`; an agent; when the service owner has merged the intent's pull request and a person or a job sends `/sdlc` with the intent's path.
+**Next:** `playbooks/design.md`; an agent; when the service owner has merged the intent's pull request and a person or a job sends `/sdlc:sdlc-mode` with the intent's path.

package/templates/base/plugins/sdlc/cursor/skills/sdlc-mode/playbooks/open-pr.md

@@ -0,0 +1,17 @@
+# Open the pull request
+
+Branch from the latest `origin/main`, and open the pull request ready for review. Name the branch as the project's contributing guide says and fill the body from `.github/pull_request_template.md`. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
+
+1. Clean the diff against the default branch. Remove debug output, commented-out code, changes the plan does not name, and comments that add nothing the code does not show.
+2. Do what the project's `AGENTS.md` and `CONTRIBUTING.md` require for this kind of change.
+3. When step 1 or 2 changed a file, run the checks the project's agent instructions name again. When one fails, fix the code and run it again. Commit only when they pass.
+4. Push the branch and open the pull request ready for review, as this playbook's opening paragraph says. When the branch already has a pull request, update that one. Fill the body from `.github/pull_request_template.md`:
+   - what changed and why, with the paths of `intent/<change>/spec.md` and `plan.md` when they exist;
+   - `Closes #<issue>` for each issue that already exists and that the change closes. When there is none, write what the template's own section asks for, and leave it out when the template has no such section.
+   - each check you ran, with its result copied from the output.
+
+   When you cannot open a pull request from this session, say so, give the pushed branch's name, and go on to step 5: the review reads the pushed branch's diff.
+
+5. Go on in the same turn, without asking: follow `playbooks/review.md`.
+
+**Next:** `playbooks/review.md`; an agent; in the same turn, as soon as step 4 is done.

package/templates/base/{.agents/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/playbooks/plan.md

@@ -3,16 +3,16 @@
 This playbook writes the intent. The build plan, `intent/<change>/plan.md`, comes later and is not written here.
 
 1. Let the originator describe the problem in their own words: what they cannot do today, who is affected, what better looks like, and what is out of scope.
-2. Read the code, the docs, and the existing `intent/` folders. Never ask what a file or a command can tell you: the author, for one, is `git config user.name`.
-3. Interview until the originator has said four things: the problem, the outcome, the constraints, and what is out of scope. The problem names who is affected, how often, and a number with its source. The outcome is what the user would see.
+2. Read the code, the docs, and the existing `intent/` folders. Find the rest yourself: the author, for one, is `git config user.name`.
+3. Interview until the originator has said four things: the problem, the outcome, the constraints, and what is out of scope. The outcome is what the user would see.
    - **When all four are already said, go to step 4 in the same turn.**
    - **When one is missing, ask and stop.** Write no draft in that turn. Ask in rounds. Each round holds only questions that do not depend on another question in the same round. Number the questions. Each asks one thing and carries a concrete answer you recommend, worded so "yes" accepts it. A recommended answer is a fact or a choice, such as "Recommended: only the checkout page", never an instruction to the person. When you have no answer to recommend, write "No recommendation" and ask plainly. Wait for the answers, and build the next round on them.
-4. Write `intent/<change>/intent.md` from the template below, where `<change>` is a short kebab-case name. Write the file in the language of the files already in `intent/`. Use exactly the template's five headings. What is out of scope goes under **Proposed outcome**. Anything else that is unknown, unverified, or not yet decided goes under **Open questions**. Write "None" only when nothing is, and never list what the originator already answered. Show the whole draft, and name the file only as `intent/<change>/intent.md`. In plan mode you cannot write the file. Show the draft as the plan, and write the file once it is approved.
+4. Write `intent/<change>/intent.md` from the template below, where `<change>` is a short kebab-case name. Use exactly the template's five headings. What is out of scope goes under **Proposed outcome**. Anything else that is unknown, unverified, or not yet decided goes under **Open questions**. Write "None" only when nothing is, and never list what the originator already answered. Show the whole draft, and name the file only as `intent/<change>/intent.md`. In plan mode you cannot write the file. Show the draft as the plan, and write the file once it is approved.
 5. **Gate: the originator corrects the draft.** Ask whether it matches what they meant, and revise until they say yes. Commit nothing, push nothing, and open no pull request before that yes. In plan mode, the originator approving the plan is that yes.
-6. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as `AGENTS.md` says for branches and pull requests.
-7. **Gate: the product owner accepts or rejects the intent.** The product owner merges the pull request to accept the intent, or closes it to reject it. You do neither. The file stays `Status: draft.`: never write `Status: accepted.` in this pull request, because the spec's pull request sets it. Report the pull request's URL, keep it green as `.agents/skills/sdlc/playbooks/review.md` says, and wait.
+6. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as the opening paragraph of `playbooks/open-pr.md` says for branches and pull requests.
+7. **Gate: the product owner accepts or rejects the intent.** The product owner merges the pull request to accept the intent, or closes it to reject it. You do neither. The file stays `Status: draft.`: never write `Status: accepted.` in this pull request, because the spec's pull request sets it. Report the pull request's URL, keep it green as `playbooks/review.md` says, and wait.
 
-**Next:** `.agents/skills/sdlc/playbooks/design.md`; an agent; when the product owner has merged the intent's pull request and a person or a job asks for the spec.
+**Next:** `playbooks/design.md`; an agent; when the product owner has merged the intent's pull request and a person or a job asks for the spec.
 
 ## Template
 

package/templates/base/{.claude/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/playbooks/question.md

@@ -1,8 +1,8 @@
 # Question
 
 1. Find the facts: read the files and run read-only commands.
-2. Answer, citing `path:line` or command output for each claim, as the **Write replies a person can check** convention in `AGENTS.md` says.
+2. Answer, stating as a fact only what you opened or ran in this turn.
 3. Write no file, make no commit, push nothing, and post nothing to GitHub or another service.
-4. When the answer shows work worth doing, offer it in one line, such as "Send `/sdlc write an intent for this` to start the change", and stop.
+4. When the answer shows work worth doing, offer it in one line, such as "Send `/sdlc:sdlc-mode write an intent for this` to start the change", and stop.
 
 **Next:** none; the person; when they send a new message.

package/templates/base/{.agents/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/playbooks/review.md

@@ -1,17 +1,16 @@
 # Review phase: review the pull request and drive it to green
 
 1. Find what to review: the pull request this session just opened, or the pull request or branch the request names. When there is no pull request, or this session cannot reach its host, review the branch's diff against the default branch and put the findings in your reply in place of a comment.
-2. Review with a fresh context. Start a subagent that has not seen the work. Give it only the diff, `REVIEW.md`, and the change's `intent/<change>/spec.md` and `plan.md`. When you cannot start a subagent, read the diff again from the first line as if someone else wrote it. The review runs each pass in `REVIEW.md` and reports each finding with its pass, **Important** or **Nit**, `path:line`, and the evidence. A change that is not a fix, an intent, or a spec, and has no `spec.md` or no `plan.md`, is itself a finding.
-3. Post the findings as one comment on the pull request, most severe first. Write "No findings" when there are none. A finding does not decide the merge. When a finding flags a mistake that an earlier review of this project flagged too, its correction goes into `AGENTS.md` under **Things Claude gets wrong** as part of this review: in the push of step 4, or, on a pull request or a branch this session did not create, as the exact line in this comment.
-4. On a pull request or a branch that this session did not create, change nothing and push nothing. Skip the rest of this step, and in step 5 only read and answer. Otherwise, fix every Important finding, and every Nit that is correct while the pull request has no code owner's approval yet. Run the checks under **Verifying your work** in `AGENTS.md`, and push. Answer each finding you do not fix with the reason.
+2. Review with a fresh context. Start a subagent that has not seen the work. Give it only the diff, `REVIEW.md`, the change's `intent/<change>/spec.md` and `plan.md`, and the four policy files in force, found as `playbooks/design.md` step 2 says. When you cannot start a subagent, read the diff again from the first line as if someone else wrote it. The review runs each pass in `REVIEW.md` and reports each finding with its pass, **Important** or **Nit**, `path:line`, and the evidence. A change that is not a fix, an intent, or a spec, and has no `spec.md` or no `plan.md`, is itself a finding.
+3. Post the findings as one comment on the pull request, most severe first. Write "No findings" when there are none. A finding does not decide the merge. When a finding flags a mistake that an earlier review of this project flagged too, its correction goes into the project's agent instructions as part of this review: in the push of step 4, or, on a pull request or a branch this session did not create, as the exact line in this comment.
+4. On a pull request or a branch that this session did not create, change nothing and push nothing. Skip the rest of this step, and in step 5 only read and answer. Otherwise, fix every Important finding. Run the checks the project's agent instructions name, and push. Answer each finding you do not fix with the reason.
 5. Sweep the pull request until every check passes and no comment is unanswered. In each pass:
-   - **A conflict, or a branch behind the default branch:** merge the default branch into the pull request's branch and resolve it. Run the checks under **Verifying your work** in `AGENTS.md`, and push. Never rebase or force-push a branch that someone else also pushes to.
+   - **A conflict, or a branch behind the default branch:** say so in the reply, and never rebase or force-push a branch that someone else also pushes to.
    - **A failing check:** read its log and find the cause. When the same check fails on the default branch, or the log shows an outage outside this change, the failure is not this change's. Say which check and why in one comment, and go on. Otherwise fix the cause and push. Run a check again at most once, and only to tell an outage from a real failure. Never skip, disable, or weaken a test to pass a check.
-   - **A person's comment:** make the change it asks for when it is small and local, push, and answer it. For a larger change, answer with what you would do, and go on with the sweep. The person decides in their reply or at the code owner's review.
+   - **A person's comment:** make the change it asks for, push, and answer it.
    - **A bot's comment:** treat it as a claim. Reproduce it or trace it in the code first. Fix what is real, and answer the rest with what you checked.
    - **A nit:** never push for nits alone, because a push can dismiss the code owner's approval. Answer it, and carry the fix in the next push that has another reason.
-   - **A push that dismissed the code owner's approval:** say once that the pull request needs that approval again.
 
-6. **Gate: a code owner approves the pull request, and a person merges it.** You never approve it and never merge it. Report the pull request's URL, or the branch's name when there is none, and say it waits only on the code owner. When a new comment or a failing check arrives, go back to step 5. Subscribe to the pull request's events where your tool can. Otherwise say that a person sends `/sdlc review` with the pull request when something changes.
+6. **Gate: a code owner approves the pull request, and a person merges it.** You never approve it and never merge it. Report the pull request's URL, or the branch's name when there is none, and say it waits only on the code owner. When a new comment or a failing check arrives, go back to step 5. Subscribe to the pull request's events where your tool can. Otherwise say that a person sends `/sdlc:sdlc-mode review` with the pull request when something changes.
 
-**Next:** `.agents/skills/sdlc/playbooks/deploy.md`; the project's deploy workflow, or an agent when a person asks; when the pull request is merged.
+**Next:** `playbooks/deploy.md`; the project's deploy workflow, or an agent when a person asks; when the pull request is merged.

package/templates/base/{.agents → plugins/sdlc/cursor}/skills/security-policy/SKILL.md

@@ -5,8 +5,6 @@ description: Apply the organization's security policy. Use whenever writing or r
 
 # Security policy
 
-Owner: the code owner of this folder in `.github/CODEOWNERS`.
-
 Standard: [OWASP Application Security Verification Standard 5.0.0](https://github.com/OWASP/ASVS/tree/v5.0.0/5.0/en), Level 1. This is the default; the owner replaces or tightens it by editing this file.
 
 ## Rules

package/templates/base/plugins/sdlc/cursor/skills/setup-sdlc/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: setup-sdlc
+description: Sets the model and reasoning effort for each role from a budget and reports which steps of SETUP.md are done. Run it with /sdlc:setup-sdlc.
+disable-model-invocation: true
+---
+
+# Set up the SDLC
+
+Do these steps in order. Run again with the same answers, the skill writes the same file and redoes no step that is done.
+
+1. **List the models the session offers:** the models it can run or start a subagent on, spelled as the session spells them. When it can list none, ask the person to paste the names and wait. Write no model the session does not offer.
+2. **Read `.agents/sdlc-models.md`** when it exists. Its `budget:` line is the current budget, and a role line whose model is on the list keeps that model.
+3. **Choose each role's model.** A role without a kept model gets its default. A default the session does not offer becomes the offered model of the same family, the newest when there are several. When the family has none, ask about that role in the question of step 4.
+
+   | Role     | Default  | Does                                 |
+   | :------- | :------- | :----------------------------------- |
+   | `build`  | `sonnet` | Writes the change.                   |
+   | `review` | `sonnet` | Reviews the change.                  |
+   | `verify` | `sonnet` | Runs the app and the checks.         |
+   | `evals`  | `haiku`  | Runs the eval cases, which are many. |
+
+4. **Fix the budget,** which is the reasoning effort of every role. When the request names one of the four labels, that is the budget and you ask nothing about it. Otherwise ask one question, through the session's question tool when it has one, with these choices, adding the roles of step 3 that have no model. Name the current budget when the file records one; with no file, say that `large` matches the defaults.
+
+   | Label       | Effort   |
+   | :---------- | :------- |
+   | `unlimited` | `max`    |
+   | `large`     | `xhigh`  |
+   | `medium`    | `high`   |
+   | `small`     | `medium` |
+
+5. **Write `.agents/sdlc-models.md`** as the whole file, overwriting it, in this shape and no other, with a newline after the last line, because the `build` playbook reads the `verify:` line. For the budget `medium` in a session that offers `sonnet` and `haiku`:
+
+   ```markdown
+   # SDLC models
+
+   budget: medium (high)
+   build: sonnet high
+   review: sonnet high
+   verify: sonnet high
+   evals: haiku high
+   ```
+
+6. **Read `SETUP.md`** at the project root. When there is none, say "This project has no `SETUP.md`" and go to step 9. Otherwise decide for each step whether it is done by checking the repository: run the step's **Check** when it only reads files or local git state, and read the files the step names. Report each step as `done`, `not done`, or `a person checks this` when the repository cannot show it, such as a setting on a website, an account, or someone's decision. For example:
+
+   - `1. Project description: done. package.json holds a description.`
+   - `2. Owners: not done. .github/CODEOWNERS still holds the placeholder.`
+   - `3. Repository settings: a person checks this. They live on the host, not in the repository.`
+
+7. **Do the `not done` steps an agent can do:** a step whose whole work is editing a file of the repository with values the repository or the request already gives. Do not redo a `done` step. Do not edit a file the project's rules or agent settings reserve for a person, such as rules, hooks, lint, format, and commit configuration, and the agent settings themselves; list it with the exact new text and the file it goes in. Commit nothing. After each step, run its **Check** again and report the result.
+8. **List the steps a person does outside the repository,** each with who does it, from `SETUP.md`, and the full URL of the page where it is done when `SETUP.md` or the repository names one.
+9. **Write the reply** by the reply rules in `../sdlc-mode/SKILL.md`. After them, in this order: the budget line and the four role lines as written; each step of `SETUP.md` with its state; what you did; what a person does.

package/templates/base/{.claude → plugins/sdlc/cursor}/skills/ux-policy/SKILL.md

@@ -5,8 +5,6 @@ description: Apply the organization's UX policy. Use whenever writing or reviewi
 
 # UX policy
 
-Owner: the code owner of this folder in `.github/CODEOWNERS`.
-
 Standard: [Web Content Accessibility Guidelines (WCAG) 2.2](https://www.w3.org/TR/WCAG22/), Level AA: the page satisfies all the Level A and Level AA success criteria. This is the default; the owner replaces or tightens it by editing this file.
 
 ## Rules

package/templates/base/scripts/check-agent-gates.ts

@@ -13,6 +13,18 @@ type GateCase = {
   releaseApproval?: string;
 };
 
+const repositoryVariables = execFileSync("git", ["rev-parse", "--local-env-vars"], {
+  encoding: "utf8",
+}).split("\n");
+
+const childEnvironment = {
+  ...process.env,
+};
+
+for (const name of repositoryVariables) {
+  delete childEnvironment[name];
+}
+
 const shellGate = ".agents/hooks/agent-shell-gate.sh";
 const constitutionGate = ".cursor/hooks/agent-constitution-gate.sh";
 const mcpGate = ".agents/hooks/agent-mcp-gate.sh";
@@ -343,6 +355,7 @@ function createRepository(branch: string, committedFiles: string[]): string {
         ...gitArguments,
       ],
       {
+        env: childEnvironment,
         stdio: "ignore",
       },
     );
@@ -546,7 +559,7 @@ const cases: GateCase[] = [
 const failures = cases.filter(gateCase => {
   const result = spawnSync(gateCase.gate, {
     env: {
-      ...process.env,
+      ...childEnvironment,
       CLAUDE_PROJECT_DIR: gateCase.projectDirectory ?? process.cwd(),
       CURSOR_PROJECT_DIR: gateCase.projectDirectory ?? process.cwd(),
       RELEASE_APPROVAL: gateCase.releaseApproval,

package/templates/base/scripts/check-plan.ts

@@ -345,7 +345,7 @@ function findSpecProblems(maskedLines: string[], specText: string | undefined):
 }
 
 /**
- * Check one plan against the template in `.agents/skills/sdlc/playbooks/build.md` and the spec beside it.
+ * Check one plan against the template in `playbooks/build.md` of the `sdlc-mode` skill and the spec beside it.
  * @param planText Plan content.
  * @param specText Content of the `spec.md` beside the plan, or undefined when there is none.
  * @param isAcceptanceRequired Whether the branch changes a file outside `intent/`.

package/templates/base/scripts/sync-agent-rules.ts

@@ -6,12 +6,6 @@ type RuleConfig = {
   globs?: string[];
 };
 
-type SubagentConfig = {
-  description: string;
-  readonly?: boolean;
-  tools?: string[];
-};
-
 const sourceDirectory = ".agents/rules";
 const configPath = ".agents/rules.json";
 
@@ -85,10 +79,6 @@ for (const name of configNames) {
 
 const skillSourceDirectory = ".agents/skills";
 const skillDirectories = [".claude/skills", ".cursor/skills"];
-const subagentSourceDirectory = ".agents/agents";
-const subagentConfigPath = ".agents/agents.json";
-const claudeSubagentDirectory = ".claude/agents";
-const cursorSubagentDirectory = ".cursor/agents";
 
 /**
  * List every file under a directory, as paths relative to it.
@@ -106,31 +96,6 @@ function listFiles(directory: string): string[] {
     : [];
 }
 
-/**
- * Render a subagent with the frontmatter fields its tool reads.
- * @param name Subagent name.
- * @param fields Frontmatter fields after `name` and `description`.
- * @param subagent Subagent configuration.
- * @param body Shared subagent body.
- * @returns The subagent file content.
- */
-function renderSubagent(
-  name: string,
-  fields: string[],
-  subagent: SubagentConfig,
-  body: string,
-): string {
-  return [
-    `---`,
-    `name: ${name}`,
-    `description: ${subagent.description}`,
-    ...fields,
-    `---`,
-    ``,
-    body,
-  ].join("\n");
-}
-
 for (const file of listFiles(skillSourceDirectory)) {
   const content = readFileSync(path.join(skillSourceDirectory, file), "utf8");
 
@@ -139,26 +104,6 @@ for (const file of listFiles(skillSourceDirectory)) {
   }
 }
 
-const subagents = existsSync(subagentConfigPath)
-  ? (JSON.parse(readFileSync(subagentConfigPath, "utf8")) as Record<string, SubagentConfig>)
-  : {};
-
-for (const [name, subagent] of Object.entries(subagents)) {
-  const body = readFileSync(path.join(subagentSourceDirectory, `${name}.md`), "utf8");
-  const claudeFields = subagent.tools === undefined ? [] : [`tools: ${subagent.tools.join(", ")}`];
-  const cursorFields = subagent.readonly === undefined ? [] : [`readonly: ${subagent.readonly}`];
-
-  expected.set(
-    path.join(claudeSubagentDirectory, `${name}.md`),
-    renderSubagent(name, claudeFields, subagent, body),
-  );
-
-  expected.set(
-    path.join(cursorSubagentDirectory, `${name}.md`),
-    renderSubagent(name, cursorFields, subagent, body),
-  );
-}
-
 const sharedFiles: Record<string, string[]> = {
   ".agents/mcp.json": [".mcp.json", ".cursor/mcp.json"],
   ".agents/review.md": ["REVIEW.md"],
@@ -180,9 +125,6 @@ const orphans = [
   ...skillDirectories.flatMap(directory =>
     listFiles(directory).map(file => path.join(directory, file)),
   ),
-  ...[claudeSubagentDirectory, cursorSubagentDirectory].flatMap(directory =>
-    listFiles(directory).map(file => path.join(directory, file)),
-  ),
   ...Object.values(sharedFiles)
     .flat()
     .filter(file => existsSync(file)),

package/templates/nestjs/AGENTS.md

@@ -12,7 +12,7 @@ NestJS HTTP API in TypeScript on pnpm and Node.js `>=24.15.0 <25`.
 | End-to-end tests            | `pnpm test:e2e`                                     | `Tests  2 passed (2)`                                    |
 | What `pre-push` runs        | `pnpm check`                                        | exits 0; the last line is `$ tsc -p tsconfig.build.json` |
 | Every check                 | `pnpm verify`                                       | exits 0; the last line is `$ tsc -p tsconfig.build.json` |
-| Render rules after a change | `pnpm rules:sync`                                   | `Synced 67 agent rule files; 0 updated.`                 |
+| Render rules after a change | `pnpm rules:sync`                                   | `Synced 35 agent rule files; 0 updated.`                 |
 
 ## Verifying your work
 
@@ -22,6 +22,8 @@ NestJS HTTP API in TypeScript on pnpm and Node.js `>=24.15.0 <25`.
 
 Run all three before reporting any task complete, and paste the output. `pnpm verify` runs all three.
 
+The `verifier` subagent starts the app with `pnpm start:dev`. It exercises the changed behavior and the two nearest neighboring flows.
+
 ## Architecture
 
 - `src/main.ts` creates the app from `AppModule` on `parsePort(process.env.PORT)` with Nest's `ConsoleLogger`, which writes JSON lines when `NODE_ENV` is `production`.
@@ -32,11 +34,11 @@ Run all three before reporting any task complete, and paste the output. `pnpm ve
 1. **Put unit tests next to the code as `src/**/*.test.ts` and end-to-end tests in `test/` as `*.e2e.test.ts`.** `vitest.config.ts` and `vitest.e2e.config.ts` collect only those patterns.
 2. **Read configuration from environment variables and fail when one is missing**, as `parsePort` does. Document each variable in `.env.example`.
 3. **Log through Nest's `Logger`.** It goes to the `ConsoleLogger` set in `src/main.ts`.
-4. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `.agents/skills/sdlc/playbooks/build.md` describes.
+4. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `playbooks/build.md` of the `sdlc-mode` skill in `plugins/sdlc/claude-code/` describes.
 5. **Start a bug fix with a failing test.** A bug fix has no intent and no spec; its plan, `intent/<short-description>/plan.md`, is accepted by an engineer before any code changes. Reproduce the bug as a test, confirm it fails for the reason you expect, and commit it on a `fix/` branch. Then `.agents/hooks/agent-test-edit-gate.sh` blocks test edits by itself: make the test pass without editing it. On a branch with another name, create `.git/bug-fix-in-progress` first, and delete it once the test passes.
-6. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc` followed by their own words.
+6. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc:sdlc-mode` followed by their own words.
 7. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
-8. **Write replies a person can check.** Reply in the language the person wrote in. Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
+8. **Write replies a person can check.** Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 9. **Run parallel sessions in separate worktrees, on tasks that touch different files.** Start each with `claude --worktree <name>`: a worktree is its own checkout on its own branch. Tasks that share files run in one session, one after another. Start with two or three sessions, and add one only while you can review every stream properly.
 
 ## Things Claude gets wrong

package/templates/nestjs/CONTRIBUTING.md

@@ -38,7 +38,6 @@ Run the narrowest check that covers the change while you work. Git hooks run the
 - **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. CodeQL, dependency-review, and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change endpoints. CI runs it on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% line coverage on changed lines in `src/`, except `main.ts` and `*.module.ts`, which hold only wiring. Keep logic out of them, as `src/port.ts` does for `main.ts`. CI does not gate branch coverage, because NestJS decorators emit metadata branches that never run.
-- **Agent evals:** run `pnpm evals:run` after you change `AGENTS.md`, a skill under `.agents/skills/`, or a hook under `.agents/hooks/`, and add a case name to run one case. It runs the cases in `.agents/skill-evals/` with Claude Code on your own Claude login, so it spends your Claude usage, and it is not part of `pnpm verify`.
 
 Run `pnpm verify` for repository changes.
 

package/templates/nestjs/package.json

@@ -20,7 +20,6 @@
     "depcruise": "depcruise --config .dependency-cruiser.json src test eslint.config.ts vitest.config.ts vitest.e2e.config.ts",
     "dev:build": "tsc -p tsconfig.build.json --watch --preserveWatchOutput",
     "dev:serve": "node --env-file-if-exists=.env --watch dist/main.js",
-    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
@@ -48,24 +47,24 @@
     "verify:static": "pnpm rules:check && pnpm gates:check && pnpm plan:check && pnpm bands:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {
-    "@nestjs/common": "12.3.2",
-    "@nestjs/core": "12.3.2",
-    "@nestjs/platform-express": "12.3.2",
+    "@nestjs/common": "12.3.3",
+    "@nestjs/core": "12.3.3",
+    "@nestjs/platform-express": "12.3.3",
     "@nestjs/terminus": "12.1.0",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2"
   },
   "devDependencies": {
     "@commitlint/cli": "21.2.4",
-    "@nestjs/testing": "12.3.2",
+    "@nestjs/testing": "12.3.3",
     "@next-friday/commitlint-config-friday": "4.0.0",
     "@next-friday/eslint-config-friday": "5.1.0",
     "@next-friday/prettier-config-friday": "4.0.0",
     "@swc/core": "1.16.22",
     "@types/node": "26.6.6",
     "@types/supertest": "7.2.1",
-    "@vitest/coverage-v8": "5.0.5",
-    "dependency-cruiser": "18.7.1",
+    "@vitest/coverage-v8": "5.1.0",
+    "dependency-cruiser": "18.7.2",
     "editorconfig-checker": "7.0.0",
     "eslint": "10.14.0",
     "fast-check": "4.10.2",
@@ -77,7 +76,7 @@
     "sort-package-json": "4.1.0",
     "supertest": "7.3.1",
     "typescript": "7.0.2",
-    "vitest": "5.0.5",
+    "vitest": "5.1.0",
     "yaml": "2.9.1"
   },
   "packageManager": "pnpm@12.6.0+sha512.3ef68f951cb111ac204b4a5a16f0b2ddf0da56a96e0413e81d855d9f0b55ef926714709028e1cd00c405c2c5fb7b9e8ec4dc46777c805d0373c2f2ff00fd20ec",

package/templates/nextjs/AGENTS.md

@@ -12,7 +12,7 @@ Next.js App Router web app with React and Tailwind CSS, in TypeScript on pnpm an
 | End-to-end tests                   | `pnpm test:e2e`                                             | `1 passed (5.6s)`                                                            |
 | What `pre-push` runs               | `pnpm check`                                                | exits 0; the last output is the route table of `next build` with `ƒ /health` |
 | Every check except `pnpm test:e2e` | `pnpm verify`                                               | exits 0; the last output is the route table of `next build` with `ƒ /health` |
-| Render rules after a change        | `pnpm rules:sync`                                           | `Synced 69 agent rule files; 0 updated.`                                     |
+| Render rules after a change        | `pnpm rules:sync`                                           | `Synced 37 agent rule files; 0 updated.`                                     |
 
 ## Verifying your work
 
@@ -22,6 +22,8 @@ Next.js App Router web app with React and Tailwind CSS, in TypeScript on pnpm an
 
 Run all three before reporting any task complete, and paste the output. `pnpm verify` runs all three.
 
+The `verifier` subagent starts the app with `pnpm dev`. It exercises the changed behavior and the two nearest neighboring flows.
+
 ## Architecture
 
 - Routes live in `app/`. `app/health/route.ts` serves `/health`.
@@ -32,11 +34,11 @@ Run all three before reporting any task complete, and paste the output. `pnpm ve
 1. **Put unit tests next to the code as `app/**/*.test.{ts,tsx}` and Playwright end-to-end tests in `test/` as `*.e2e.test.ts`.** Vitest collects only the first pattern.
 2. **Component tests need a DOM test environment, and Vitest runs in Node.js.** Add that environment with the first component test.
 3. **Read configuration from environment variables and fail when one is missing.** Document each variable in `.env.example`.
-4. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `.agents/skills/sdlc/playbooks/build.md` describes.
+4. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `playbooks/build.md` of the `sdlc-mode` skill in `plugins/sdlc/claude-code/` describes.
 5. **Start a bug fix with a failing test.** A bug fix has no intent and no spec; its plan, `intent/<short-description>/plan.md`, is accepted by an engineer before any code changes. Reproduce the bug as a test, confirm it fails for the reason you expect, and commit it on a `fix/` branch. Then `.agents/hooks/agent-test-edit-gate.sh` blocks test edits by itself: make the test pass without editing it. On a branch with another name, create `.git/bug-fix-in-progress` first, and delete it once the test passes.
-6. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc` followed by their own words.
+6. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc:sdlc-mode` followed by their own words.
 7. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
-8. **Write replies a person can check.** Reply in the language the person wrote in. Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
+8. **Write replies a person can check.** Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 9. **Run parallel sessions in separate worktrees, on tasks that touch different files.** Start each with `claude --worktree <name>`: a worktree is its own checkout on its own branch. Tasks that share files run in one session, one after another. Start with two or three sessions, and add one only while you can review every stream properly.
 
 ## Things Claude gets wrong

package/templates/nextjs/CONTRIBUTING.md

@@ -38,7 +38,6 @@ Run the narrowest check that covers the change while you work. Git hooks run the
 - **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. CodeQL, dependency-review, and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change pages. It starts the development server unless one is already running. Run `pnpm exec playwright install chromium` once before the first run. CI runs it against the production build on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% branch coverage on changed lines in `app/`, except `layout.tsx`.
-- **Agent evals:** run `pnpm evals:run` after you change `AGENTS.md`, a skill under `.agents/skills/`, or a hook under `.agents/hooks/`, and add a case name to run one case. It runs the cases in `.agents/skill-evals/` with Claude Code on your own Claude login, so it spends your Claude usage, and it is not part of `pnpm verify`.
 
 Run `pnpm verify` for repository changes.
 

package/templates/nextjs/package.json

@@ -17,7 +17,6 @@
     "clean": "rm -rf .next coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json app test eslint.config.ts next.config.ts playwright.config.ts postcss.config.mjs vitest.config.ts",
     "dev": "next dev",
-    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",
@@ -42,7 +41,7 @@
     "verify:static": "pnpm rules:check && pnpm gates:check && pnpm plan:check && pnpm bands:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {
-    "next": "16.4.3",
+    "next": "16.4.5",
     "react": "19.3.1",
     "react-dom": "19.3.1"
   },
@@ -51,15 +50,15 @@
     "@next-friday/commitlint-config-friday": "4.0.0",
     "@next-friday/eslint-config-friday": "5.1.0",
     "@next-friday/prettier-config-friday": "4.0.0",
-    "@next/eslint-plugin-next": "16.4.3",
+    "@next/eslint-plugin-next": "16.4.5",
     "@playwright/test": "1.64.1",
     "@swc/core": "1.16.22",
-    "@tailwindcss/postcss": "4.3.3",
+    "@tailwindcss/postcss": "4.3.4",
     "@types/node": "26.6.6",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
-    "@vitest/coverage-v8": "5.0.5",
-    "dependency-cruiser": "18.7.1",
+    "@vitest/coverage-v8": "5.1.0",
+    "dependency-cruiser": "18.7.2",
     "editorconfig-checker": "7.0.0",
     "eslint": "10.14.0",
     "husky": "9.1.7",
@@ -69,9 +68,9 @@
     "prettier": "3.9.10",
     "prettier-plugin-tailwindcss": "0.8.1",
     "sort-package-json": "4.1.0",
-    "tailwindcss": "4.3.3",
+    "tailwindcss": "4.3.4",
     "typescript": "7.0.2",
-    "vitest": "5.0.5",
+    "vitest": "5.1.0",
     "yaml": "2.9.1"
   },
   "packageManager": "pnpm@12.6.0+sha512.3ef68f951cb111ac204b4a5a16f0b2ddf0da56a96e0413e81d855d9f0b55ef926714709028e1cd00c405c2c5fb7b9e8ec4dc46777c805d0373c2f2ff00fd20ec",

package/templates/nodejs/AGENTS.md

@@ -12,7 +12,7 @@ TypeScript HTTP service on `node:http`, without a framework, on pnpm and Node.js
 | Unit tests                  | `pnpm test`, or `pnpm test:coverage`                | `Tests  15 passed (15)`                                                                              |
 | What `pre-push` runs        | `pnpm check`                                        | exits 0; the last line is `$ tsc -p tsconfig.build.json`                                             |
 | Every check                 | `pnpm verify`                                       | exits 0; the last line is `$ tsc -p tsconfig.build.json`                                             |
-| Render rules after a change | `pnpm rules:sync`                                   | `Synced 67 agent rule files; 0 updated.`                                                             |
+| Render rules after a change | `pnpm rules:sync`                                   | `Synced 35 agent rule files; 0 updated.`                                                             |
 
 ## Verifying your work
 
@@ -22,6 +22,8 @@ TypeScript HTTP service on `node:http`, without a framework, on pnpm and Node.js
 
 Run all three before reporting any task complete, and paste the output. `pnpm verify` runs all three.
 
+The `verifier` subagent starts the app with `pnpm start:dev`. It exercises the changed behavior and the two nearest neighboring flows.
+
 ## Architecture
 
 - `src/main.ts` starts `createAppServer()` from `src/server.ts` on `parsePort(process.env.PORT)`, and on `SIGTERM` or `SIGINT` stops accepting connections and closes any left after 10 seconds.
@@ -31,11 +33,11 @@ Run all three before reporting any task complete, and paste the output. `pnpm ve
 
 1. **Put tests next to the code as `src/**/*.test.ts`.** Vitest collects only that pattern.
 2. **Read configuration from environment variables and fail when one is missing**, as `parsePort` does. Document each variable in `.env.example`; `pnpm start` and `pnpm start:dev` load `.env`.
-3. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `.agents/skills/sdlc/playbooks/build.md` describes.
+3. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `playbooks/build.md` of the `sdlc-mode` skill in `plugins/sdlc/claude-code/` describes.
 4. **Start a bug fix with a failing test.** A bug fix has no intent and no spec; its plan, `intent/<short-description>/plan.md`, is accepted by an engineer before any code changes. Reproduce the bug as a test, confirm it fails for the reason you expect, and commit it on a `fix/` branch. Then `.agents/hooks/agent-test-edit-gate.sh` blocks test edits by itself: make the test pass without editing it. On a branch with another name, create `.git/bug-fix-in-progress` first, and delete it once the test passes.
-5. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc` followed by their own words.
+5. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc:sdlc-mode` followed by their own words.
 6. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
-7. **Write replies a person can check.** Reply in the language the person wrote in. Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
+7. **Write replies a person can check.** Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 8. **Run parallel sessions in separate worktrees, on tasks that touch different files.** Start each with `claude --worktree <name>`: a worktree is its own checkout on its own branch. Tasks that share files run in one session, one after another. Start with two or three sessions, and add one only while you can review every stream properly.
 
 ## Things Claude gets wrong