@next-friday/create-app 9.2.1 → 9.3.0

package/templates/base/plugins/sdlc/cursor/skills/sdlc-mode/playbooks/open-pr.md

@@ -0,0 +1,17 @@
+# Open the pull request
+
+Branch from the latest `origin/main`, and open the pull request ready for review. Name the branch as the project's contributing guide says and fill the body from `.github/pull_request_template.md`. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
+
+1. Clean the diff against the default branch. Remove debug output, commented-out code, changes the plan does not name, and comments that add nothing the code does not show.
+2. Do what the project's `AGENTS.md` and `CONTRIBUTING.md` require for this kind of change.
+3. When step 1 or 2 changed a file, run the checks the project's agent instructions name again. When one fails, fix the code and run it again. Commit only when they pass.
+4. Push the branch and open the pull request ready for review, as this playbook's opening paragraph says. When the branch already has a pull request, update that one. Fill the body from `.github/pull_request_template.md`:
+   - what changed and why, with the paths of `intent/<change>/spec.md` and `plan.md` when they exist;
+   - `Closes #<issue>` for each issue that already exists and that the change closes. When there is none, write what the template's own section asks for, and leave it out when the template has no such section.
+   - each check you ran, with its result copied from the output.
+
+   When you cannot open a pull request from this session, say so, give the pushed branch's name, and go on to step 5: the review reads the pushed branch's diff.
+
+5. Go on in the same turn, without asking: follow `playbooks/review.md`.
+
+**Next:** `playbooks/review.md`; an agent; in the same turn, as soon as step 4 is done.

package/templates/base/{.agents/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/playbooks/plan.md

@@ -3,16 +3,16 @@
 This playbook writes the intent. The build plan, `intent/<change>/plan.md`, comes later and is not written here.
 
 1. Let the originator describe the problem in their own words: what they cannot do today, who is affected, what better looks like, and what is out of scope.
-2. Read the code, the docs, and the existing `intent/` folders. Never ask what a file or a command can tell you: the author, for one, is `git config user.name`.
-3. Interview until the originator has said four things: the problem, the outcome, the constraints, and what is out of scope. The problem names who is affected, how often, and a number with its source. The outcome is what the user would see.
+2. Read the code, the docs, and the existing `intent/` folders. Find the rest yourself: the author, for one, is `git config user.name`.
+3. Interview until the originator has said four things: the problem, the outcome, the constraints, and what is out of scope. The outcome is what the user would see.
    - **When all four are already said, go to step 4 in the same turn.**
    - **When one is missing, ask and stop.** Write no draft in that turn. Ask in rounds. Each round holds only questions that do not depend on another question in the same round. Number the questions. Each asks one thing and carries a concrete answer you recommend, worded so "yes" accepts it. A recommended answer is a fact or a choice, such as "Recommended: only the checkout page", never an instruction to the person. When you have no answer to recommend, write "No recommendation" and ask plainly. Wait for the answers, and build the next round on them.
 4. Write `intent/<change>/intent.md` from the template below, where `<change>` is a short kebab-case name. Use exactly the template's five headings. What is out of scope goes under **Proposed outcome**. Anything else that is unknown, unverified, or not yet decided goes under **Open questions**. Write "None" only when nothing is, and never list what the originator already answered. Show the whole draft, and name the file only as `intent/<change>/intent.md`. In plan mode you cannot write the file. Show the draft as the plan, and write the file once it is approved.
 5. **Gate: the originator corrects the draft.** Ask whether it matches what they meant, and revise until they say yes. Commit nothing, push nothing, and open no pull request before that yes. In plan mode, the originator approving the plan is that yes.
-6. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as `AGENTS.md` says for branches and pull requests.
-7. **Gate: the product owner accepts or rejects the intent.** The product owner merges the pull request to accept the intent, or closes it to reject it. You do neither. The file stays `Status: draft.`: never write `Status: accepted.` in this pull request, because the spec's pull request sets it. Report the pull request's URL, keep it green as `.agents/skills/sdlc/playbooks/review.md` says, and wait.
+6. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as the opening paragraph of `playbooks/open-pr.md` says for branches and pull requests.
+7. **Gate: the product owner accepts or rejects the intent.** The product owner merges the pull request to accept the intent, or closes it to reject it. You do neither. The file stays `Status: draft.`: never write `Status: accepted.` in this pull request, because the spec's pull request sets it. Report the pull request's URL, keep it green as `playbooks/review.md` says, and wait.
 
-**Next:** `.agents/skills/sdlc/playbooks/design.md`; an agent; when the product owner has merged the intent's pull request and a person or a job asks for the spec.
+**Next:** `playbooks/design.md`; an agent; when the product owner has merged the intent's pull request and a person or a job asks for the spec.
 
 ## Template
 

package/templates/base/{.agents/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/playbooks/question.md

@@ -1,8 +1,8 @@
 # Question
 
 1. Find the facts: read the files and run read-only commands.
-2. Answer, citing `path:line` or command output for each claim, as the **Write replies a person can check** convention in `AGENTS.md` says.
+2. Answer, stating as a fact only what you opened or ran in this turn.
 3. Write no file, make no commit, push nothing, and post nothing to GitHub or another service.
-4. When the answer shows work worth doing, offer it in one line, such as "Send `/sdlc write an intent for this` to start the change", and stop.
+4. When the answer shows work worth doing, offer it in one line, such as "Send `/sdlc:sdlc-mode write an intent for this` to start the change", and stop.
 
 **Next:** none; the person; when they send a new message.

package/templates/base/{.agents/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/playbooks/review.md

@@ -1,17 +1,16 @@
 # Review phase: review the pull request and drive it to green
 
 1. Find what to review: the pull request this session just opened, or the pull request or branch the request names. When there is no pull request, or this session cannot reach its host, review the branch's diff against the default branch and put the findings in your reply in place of a comment.
-2. Review with a fresh context. Start a subagent that has not seen the work. Give it only the diff, `REVIEW.md`, and the change's `intent/<change>/spec.md` and `plan.md`. When you cannot start a subagent, read the diff again from the first line as if someone else wrote it. The review runs each pass in `REVIEW.md` and reports each finding with its pass, **Important** or **Nit**, `path:line`, and the evidence. A change that is not a fix, an intent, or a spec, and has no `spec.md` or no `plan.md`, is itself a finding.
-3. Post the findings as one comment on the pull request, most severe first. Write "No findings" when there are none. A finding does not decide the merge. When a finding flags a mistake that an earlier review of this project flagged too, its correction goes into `AGENTS.md` under **Things Claude gets wrong** as part of this review: in the push of step 4, or, on a pull request or a branch this session did not create, as the exact line in this comment.
-4. On a pull request or a branch that this session did not create, change nothing and push nothing. Skip the rest of this step, and in step 5 only read and answer. Otherwise, fix every Important finding, and every Nit that is correct while the pull request has no code owner's approval yet. Run the checks under **Verifying your work** in `AGENTS.md`, and push. Answer each finding you do not fix with the reason.
+2. Review with a fresh context. Start a subagent that has not seen the work. Give it only the diff, `REVIEW.md`, the change's `intent/<change>/spec.md` and `plan.md`, and the four policy files in force, found as `playbooks/design.md` step 2 says. When you cannot start a subagent, read the diff again from the first line as if someone else wrote it. The review runs each pass in `REVIEW.md` and reports each finding with its pass, **Important** or **Nit**, `path:line`, and the evidence. A change that is not a fix, an intent, or a spec, and has no `spec.md` or no `plan.md`, is itself a finding.
+3. Post the findings as one comment on the pull request, most severe first. Write "No findings" when there are none. A finding does not decide the merge. When a finding flags a mistake that an earlier review of this project flagged too, its correction goes into the project's agent instructions as part of this review: in the push of step 4, or, on a pull request or a branch this session did not create, as the exact line in this comment.
+4. On a pull request or a branch that this session did not create, change nothing and push nothing. Skip the rest of this step, and in step 5 only read and answer. Otherwise, fix every Important finding. Run the checks the project's agent instructions name, and push. Answer each finding you do not fix with the reason.
 5. Sweep the pull request until every check passes and no comment is unanswered. In each pass:
-   - **A conflict, or a branch behind the default branch:** merge the default branch into the pull request's branch and resolve it. Run the checks under **Verifying your work** in `AGENTS.md`, and push. Never rebase or force-push a branch that someone else also pushes to.
+   - **A conflict, or a branch behind the default branch:** say so in the reply, and never rebase or force-push a branch that someone else also pushes to.
    - **A failing check:** read its log and find the cause. When the same check fails on the default branch, or the log shows an outage outside this change, the failure is not this change's. Say which check and why in one comment, and go on. Otherwise fix the cause and push. Run a check again at most once, and only to tell an outage from a real failure. Never skip, disable, or weaken a test to pass a check.
-   - **A person's comment:** make the change it asks for when it is small and local, push, and answer it. For a larger change, answer with what you would do, and go on with the sweep. The person decides in their reply or at the code owner's review.
+   - **A person's comment:** make the change it asks for, push, and answer it.
    - **A bot's comment:** treat it as a claim. Reproduce it or trace it in the code first. Fix what is real, and answer the rest with what you checked.
    - **A nit:** never push for nits alone, because a push can dismiss the code owner's approval. Answer it, and carry the fix in the next push that has another reason.
-   - **A push that dismissed the code owner's approval:** say once that the pull request needs that approval again.
 
-6. **Gate: a code owner approves the pull request, and a person merges it.** You never approve it and never merge it. Report the pull request's URL, or the branch's name when there is none, and say it waits only on the code owner. When a new comment or a failing check arrives, go back to step 5. Subscribe to the pull request's events where your tool can. Otherwise say that a person sends `/sdlc review` with the pull request when something changes.
+6. **Gate: a code owner approves the pull request, and a person merges it.** You never approve it and never merge it. Report the pull request's URL, or the branch's name when there is none, and say it waits only on the code owner. When a new comment or a failing check arrives, go back to step 5. Subscribe to the pull request's events where your tool can. Otherwise say that a person sends `/sdlc:sdlc-mode review` with the pull request when something changes.
 
-**Next:** `.agents/skills/sdlc/playbooks/deploy.md`; the project's deploy workflow, or an agent when a person asks; when the pull request is merged.
+**Next:** `playbooks/deploy.md`; the project's deploy workflow, or an agent when a person asks; when the pull request is merged.

package/templates/base/{.agents → plugins/sdlc/cursor}/skills/security-policy/SKILL.md

@@ -5,8 +5,6 @@ description: Apply the organization's security policy. Use whenever writing or r
 
 # Security policy
 
-Owner: the code owner of this folder in `.github/CODEOWNERS`.
-
 Standard: [OWASP Application Security Verification Standard 5.0.0](https://github.com/OWASP/ASVS/tree/v5.0.0/5.0/en), Level 1. This is the default; the owner replaces or tightens it by editing this file.
 
 ## Rules

package/templates/base/plugins/sdlc/cursor/skills/setup-sdlc/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: setup-sdlc
+description: Sets the model and reasoning effort for each role from a budget and reports which steps of SETUP.md are done. Run it with /sdlc:setup-sdlc.
+disable-model-invocation: true
+---
+
+# Set up the SDLC
+
+Do these steps in order. Run again with the same answers, the skill writes the same file and redoes no step that is done.
+
+1. **List the models the session offers:** the models it can run or start a subagent on, spelled as the session spells them. When it can list none, ask the person to paste the names and wait. Write no model the session does not offer.
+2. **Read `.agents/sdlc-models.md`** when it exists. Its `budget:` line is the current budget, and a role line whose model is on the list keeps that model.
+3. **Choose each role's model.** A role without a kept model gets its default. A default the session does not offer becomes the offered model of the same family, the newest when there are several. When the family has none, ask about that role in the question of step 4.
+
+   | Role     | Default  | Does                                 |
+   | :------- | :------- | :----------------------------------- |
+   | `build`  | `sonnet` | Writes the change.                   |
+   | `review` | `sonnet` | Reviews the change.                  |
+   | `verify` | `sonnet` | Runs the app and the checks.         |
+   | `evals`  | `haiku`  | Runs the eval cases, which are many. |
+
+4. **Fix the budget,** which is the reasoning effort of every role. When the request names one of the four labels, that is the budget and you ask nothing about it. Otherwise ask one question, through the session's question tool when it has one, with these choices, adding the roles of step 3 that have no model. Name the current budget when the file records one; with no file, say that `large` matches the defaults.
+
+   | Label       | Effort   |
+   | :---------- | :------- |
+   | `unlimited` | `max`    |
+   | `large`     | `xhigh`  |
+   | `medium`    | `high`   |
+   | `small`     | `medium` |
+
+5. **Write `.agents/sdlc-models.md`** as the whole file, overwriting it, in this shape and no other, with a newline after the last line, because the `build` playbook reads the `verify:` line. For the budget `medium` in a session that offers `sonnet` and `haiku`:
+
+   ```markdown
+   # SDLC models
+
+   budget: medium (high)
+   build: sonnet high
+   review: sonnet high
+   verify: sonnet high
+   evals: haiku high
+   ```
+
+6. **Read `SETUP.md`** at the project root. When there is none, say "This project has no `SETUP.md`" and go to step 9. Otherwise decide for each step whether it is done by checking the repository: run the step's **Check** when it only reads files or local git state, and read the files the step names. Report each step as `done`, `not done`, or `a person checks this` when the repository cannot show it, such as a setting on a website, an account, or someone's decision. For example:
+
+   - `1. Project description: done. package.json holds a description.`
+   - `2. Owners: not done. .github/CODEOWNERS still holds the placeholder.`
+   - `3. Repository settings: a person checks this. They live on the host, not in the repository.`
+
+7. **Do the `not done` steps an agent can do:** a step whose whole work is editing a file of the repository with values the repository or the request already gives. Do not redo a `done` step. Do not edit a file the project's rules or agent settings reserve for a person, such as rules, hooks, lint, format, and commit configuration, and the agent settings themselves; list it with the exact new text and the file it goes in. Commit nothing. After each step, run its **Check** again and report the result.
+8. **List the steps a person does outside the repository,** each with who does it, from `SETUP.md`, and the full URL of the page where it is done when `SETUP.md` or the repository names one.
+9. **Write the reply** by the reply rules in `../sdlc-mode/SKILL.md`. After them, in this order: the budget line and the four role lines as written; each step of `SETUP.md` with its state; what you did; what a person does.

package/templates/base/{.claude → plugins/sdlc/cursor}/skills/ux-policy/SKILL.md

@@ -5,8 +5,6 @@ description: Apply the organization's UX policy. Use whenever writing or reviewi
 
 # UX policy
 
-Owner: the code owner of this folder in `.github/CODEOWNERS`.
-
 Standard: [Web Content Accessibility Guidelines (WCAG) 2.2](https://www.w3.org/TR/WCAG22/), Level AA: the page satisfies all the Level A and Level AA success criteria. This is the default; the owner replaces or tightens it by editing this file.
 
 ## Rules

package/templates/base/scripts/check-plan.ts

@@ -345,7 +345,7 @@ function findSpecProblems(maskedLines: string[], specText: string | undefined):
 }
 
 /**
- * Check one plan against the template in `.agents/skills/sdlc/playbooks/build.md` and the spec beside it.
+ * Check one plan against the template in `playbooks/build.md` of the `sdlc-mode` skill and the spec beside it.
  * @param planText Plan content.
  * @param specText Content of the `spec.md` beside the plan, or undefined when there is none.
  * @param isAcceptanceRequired Whether the branch changes a file outside `intent/`.

package/templates/base/scripts/sync-agent-rules.ts

@@ -6,12 +6,6 @@ type RuleConfig = {
   globs?: string[];
 };
 
-type SubagentConfig = {
-  description: string;
-  readonly?: boolean;
-  tools?: string[];
-};
-
 const sourceDirectory = ".agents/rules";
 const configPath = ".agents/rules.json";
 
@@ -85,10 +79,6 @@ for (const name of configNames) {
 
 const skillSourceDirectory = ".agents/skills";
 const skillDirectories = [".claude/skills", ".cursor/skills"];
-const subagentSourceDirectory = ".agents/agents";
-const subagentConfigPath = ".agents/agents.json";
-const claudeSubagentDirectory = ".claude/agents";
-const cursorSubagentDirectory = ".cursor/agents";
 
 /**
  * List every file under a directory, as paths relative to it.
@@ -106,31 +96,6 @@ function listFiles(directory: string): string[] {
     : [];
 }
 
-/**
- * Render a subagent with the frontmatter fields its tool reads.
- * @param name Subagent name.
- * @param fields Frontmatter fields after `name` and `description`.
- * @param subagent Subagent configuration.
- * @param body Shared subagent body.
- * @returns The subagent file content.
- */
-function renderSubagent(
-  name: string,
-  fields: string[],
-  subagent: SubagentConfig,
-  body: string,
-): string {
-  return [
-    `---`,
-    `name: ${name}`,
-    `description: ${subagent.description}`,
-    ...fields,
-    `---`,
-    ``,
-    body,
-  ].join("\n");
-}
-
 for (const file of listFiles(skillSourceDirectory)) {
   const content = readFileSync(path.join(skillSourceDirectory, file), "utf8");
 
@@ -139,26 +104,6 @@ for (const file of listFiles(skillSourceDirectory)) {
   }
 }
 
-const subagents = existsSync(subagentConfigPath)
-  ? (JSON.parse(readFileSync(subagentConfigPath, "utf8")) as Record<string, SubagentConfig>)
-  : {};
-
-for (const [name, subagent] of Object.entries(subagents)) {
-  const body = readFileSync(path.join(subagentSourceDirectory, `${name}.md`), "utf8");
-  const claudeFields = subagent.tools === undefined ? [] : [`tools: ${subagent.tools.join(", ")}`];
-  const cursorFields = subagent.readonly === undefined ? [] : [`readonly: ${subagent.readonly}`];
-
-  expected.set(
-    path.join(claudeSubagentDirectory, `${name}.md`),
-    renderSubagent(name, claudeFields, subagent, body),
-  );
-
-  expected.set(
-    path.join(cursorSubagentDirectory, `${name}.md`),
-    renderSubagent(name, cursorFields, subagent, body),
-  );
-}
-
 const sharedFiles: Record<string, string[]> = {
   ".agents/mcp.json": [".mcp.json", ".cursor/mcp.json"],
   ".agents/review.md": ["REVIEW.md"],
@@ -180,9 +125,6 @@ const orphans = [
   ...skillDirectories.flatMap(directory =>
     listFiles(directory).map(file => path.join(directory, file)),
   ),
-  ...[claudeSubagentDirectory, cursorSubagentDirectory].flatMap(directory =>
-    listFiles(directory).map(file => path.join(directory, file)),
-  ),
   ...Object.values(sharedFiles)
     .flat()
     .filter(file => existsSync(file)),

package/templates/nestjs/AGENTS.md

@@ -12,7 +12,7 @@ NestJS HTTP API in TypeScript on pnpm and Node.js `>=24.15.0 <25`.
 | End-to-end tests            | `pnpm test:e2e`                                     | `Tests  2 passed (2)`                                    |
 | What `pre-push` runs        | `pnpm check`                                        | exits 0; the last line is `$ tsc -p tsconfig.build.json` |
 | Every check                 | `pnpm verify`                                       | exits 0; the last line is `$ tsc -p tsconfig.build.json` |
-| Render rules after a change | `pnpm rules:sync`                                   | `Synced 67 agent rule files; 0 updated.`                 |
+| Render rules after a change | `pnpm rules:sync`                                   | `Synced 35 agent rule files; 0 updated.`                 |
 
 ## Verifying your work
 
@@ -22,6 +22,8 @@ NestJS HTTP API in TypeScript on pnpm and Node.js `>=24.15.0 <25`.
 
 Run all three before reporting any task complete, and paste the output. `pnpm verify` runs all three.
 
+The `verifier` subagent starts the app with `pnpm start:dev`. It exercises the changed behavior and the two nearest neighboring flows.
+
 ## Architecture
 
 - `src/main.ts` creates the app from `AppModule` on `parsePort(process.env.PORT)` with Nest's `ConsoleLogger`, which writes JSON lines when `NODE_ENV` is `production`.
@@ -32,9 +34,9 @@ Run all three before reporting any task complete, and paste the output. `pnpm ve
 1. **Put unit tests next to the code as `src/**/*.test.ts` and end-to-end tests in `test/` as `*.e2e.test.ts`.** `vitest.config.ts` and `vitest.e2e.config.ts` collect only those patterns.
 2. **Read configuration from environment variables and fail when one is missing**, as `parsePort` does. Document each variable in `.env.example`.
 3. **Log through Nest's `Logger`.** It goes to the `ConsoleLogger` set in `src/main.ts`.
-4. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `.agents/skills/sdlc/playbooks/build.md` describes.
+4. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `playbooks/build.md` of the `sdlc-mode` skill in `plugins/sdlc/claude-code/` describes.
 5. **Start a bug fix with a failing test.** A bug fix has no intent and no spec; its plan, `intent/<short-description>/plan.md`, is accepted by an engineer before any code changes. Reproduce the bug as a test, confirm it fails for the reason you expect, and commit it on a `fix/` branch. Then `.agents/hooks/agent-test-edit-gate.sh` blocks test edits by itself: make the test pass without editing it. On a branch with another name, create `.git/bug-fix-in-progress` first, and delete it once the test passes.
-6. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc` followed by their own words.
+6. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc:sdlc-mode` followed by their own words.
 7. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
 8. **Write replies a person can check.** Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 9. **Run parallel sessions in separate worktrees, on tasks that touch different files.** Start each with `claude --worktree <name>`: a worktree is its own checkout on its own branch. Tasks that share files run in one session, one after another. Start with two or three sessions, and add one only while you can review every stream properly.

package/templates/nestjs/CONTRIBUTING.md

@@ -38,7 +38,6 @@ Run the narrowest check that covers the change while you work. Git hooks run the
 - **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. CodeQL, dependency-review, and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change endpoints. CI runs it on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% line coverage on changed lines in `src/`, except `main.ts` and `*.module.ts`, which hold only wiring. Keep logic out of them, as `src/port.ts` does for `main.ts`. CI does not gate branch coverage, because NestJS decorators emit metadata branches that never run.
-- **Agent evals:** run `pnpm evals:run` after you change `AGENTS.md`, a skill under `.agents/skills/`, or a hook under `.agents/hooks/`, and add a case name to run one case. It runs the cases in `.agents/skill-evals/` with Claude Code on your own Claude login, so it spends your Claude usage, and it is not part of `pnpm verify`.
 
 Run `pnpm verify` for repository changes.
 

package/templates/nestjs/package.json

@@ -20,7 +20,6 @@
     "depcruise": "depcruise --config .dependency-cruiser.json src test eslint.config.ts vitest.config.ts vitest.e2e.config.ts",
     "dev:build": "tsc -p tsconfig.build.json --watch --preserveWatchOutput",
     "dev:serve": "node --env-file-if-exists=.env --watch dist/main.js",
-    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",

package/templates/nextjs/AGENTS.md

@@ -12,7 +12,7 @@ Next.js App Router web app with React and Tailwind CSS, in TypeScript on pnpm an
 | End-to-end tests                   | `pnpm test:e2e`                                             | `1 passed (5.6s)`                                                            |
 | What `pre-push` runs               | `pnpm check`                                                | exits 0; the last output is the route table of `next build` with `ƒ /health` |
 | Every check except `pnpm test:e2e` | `pnpm verify`                                               | exits 0; the last output is the route table of `next build` with `ƒ /health` |
-| Render rules after a change        | `pnpm rules:sync`                                           | `Synced 69 agent rule files; 0 updated.`                                     |
+| Render rules after a change        | `pnpm rules:sync`                                           | `Synced 37 agent rule files; 0 updated.`                                     |
 
 ## Verifying your work
 
@@ -22,6 +22,8 @@ Next.js App Router web app with React and Tailwind CSS, in TypeScript on pnpm an
 
 Run all three before reporting any task complete, and paste the output. `pnpm verify` runs all three.
 
+The `verifier` subagent starts the app with `pnpm dev`. It exercises the changed behavior and the two nearest neighboring flows.
+
 ## Architecture
 
 - Routes live in `app/`. `app/health/route.ts` serves `/health`.
@@ -32,9 +34,9 @@ Run all three before reporting any task complete, and paste the output. `pnpm ve
 1. **Put unit tests next to the code as `app/**/*.test.{ts,tsx}` and Playwright end-to-end tests in `test/` as `*.e2e.test.ts`.** Vitest collects only the first pattern.
 2. **Component tests need a DOM test environment, and Vitest runs in Node.js.** Add that environment with the first component test.
 3. **Read configuration from environment variables and fail when one is missing.** Document each variable in `.env.example`.
-4. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `.agents/skills/sdlc/playbooks/build.md` describes.
+4. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `playbooks/build.md` of the `sdlc-mode` skill in `plugins/sdlc/claude-code/` describes.
 5. **Start a bug fix with a failing test.** A bug fix has no intent and no spec; its plan, `intent/<short-description>/plan.md`, is accepted by an engineer before any code changes. Reproduce the bug as a test, confirm it fails for the reason you expect, and commit it on a `fix/` branch. Then `.agents/hooks/agent-test-edit-gate.sh` blocks test edits by itself: make the test pass without editing it. On a branch with another name, create `.git/bug-fix-in-progress` first, and delete it once the test passes.
-6. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc` followed by their own words.
+6. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc:sdlc-mode` followed by their own words.
 7. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
 8. **Write replies a person can check.** Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 9. **Run parallel sessions in separate worktrees, on tasks that touch different files.** Start each with `claude --worktree <name>`: a worktree is its own checkout on its own branch. Tasks that share files run in one session, one after another. Start with two or three sessions, and add one only while you can review every stream properly.

package/templates/nextjs/CONTRIBUTING.md

@@ -38,7 +38,6 @@ Run the narrowest check that covers the change while you work. Git hooks run the
 - **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. CodeQL, dependency-review, and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change pages. It starts the development server unless one is already running. Run `pnpm exec playwright install chromium` once before the first run. CI runs it against the production build on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% branch coverage on changed lines in `app/`, except `layout.tsx`.
-- **Agent evals:** run `pnpm evals:run` after you change `AGENTS.md`, a skill under `.agents/skills/`, or a hook under `.agents/hooks/`, and add a case name to run one case. It runs the cases in `.agents/skill-evals/` with Claude Code on your own Claude login, so it spends your Claude usage, and it is not part of `pnpm verify`.
 
 Run `pnpm verify` for repository changes.
 

package/templates/nextjs/package.json

@@ -17,7 +17,6 @@
     "clean": "rm -rf .next coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json app test eslint.config.ts next.config.ts playwright.config.ts postcss.config.mjs vitest.config.ts",
     "dev": "next dev",
-    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",

package/templates/nodejs/AGENTS.md

@@ -12,7 +12,7 @@ TypeScript HTTP service on `node:http`, without a framework, on pnpm and Node.js
 | Unit tests                  | `pnpm test`, or `pnpm test:coverage`                | `Tests  15 passed (15)`                                                                              |
 | What `pre-push` runs        | `pnpm check`                                        | exits 0; the last line is `$ tsc -p tsconfig.build.json`                                             |
 | Every check                 | `pnpm verify`                                       | exits 0; the last line is `$ tsc -p tsconfig.build.json`                                             |
-| Render rules after a change | `pnpm rules:sync`                                   | `Synced 67 agent rule files; 0 updated.`                                                             |
+| Render rules after a change | `pnpm rules:sync`                                   | `Synced 35 agent rule files; 0 updated.`                                                             |
 
 ## Verifying your work
 
@@ -22,6 +22,8 @@ TypeScript HTTP service on `node:http`, without a framework, on pnpm and Node.js
 
 Run all three before reporting any task complete, and paste the output. `pnpm verify` runs all three.
 
+The `verifier` subagent starts the app with `pnpm start:dev`. It exercises the changed behavior and the two nearest neighboring flows.
+
 ## Architecture
 
 - `src/main.ts` starts `createAppServer()` from `src/server.ts` on `parsePort(process.env.PORT)`, and on `SIGTERM` or `SIGINT` stops accepting connections and closes any left after 10 seconds.
@@ -31,9 +33,9 @@ Run all three before reporting any task complete, and paste the output. `pnpm ve
 
 1. **Put tests next to the code as `src/**/*.test.ts`.** Vitest collects only that pattern.
 2. **Read configuration from environment variables and fail when one is missing**, as `parsePort` does. Document each variable in `.env.example`; `pnpm start` and `pnpm start:dev` load `.env`.
-3. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `.agents/skills/sdlc/playbooks/build.md` describes.
+3. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `playbooks/build.md` of the `sdlc-mode` skill in `plugins/sdlc/claude-code/` describes.
 4. **Start a bug fix with a failing test.** A bug fix has no intent and no spec; its plan, `intent/<short-description>/plan.md`, is accepted by an engineer before any code changes. Reproduce the bug as a test, confirm it fails for the reason you expect, and commit it on a `fix/` branch. Then `.agents/hooks/agent-test-edit-gate.sh` blocks test edits by itself: make the test pass without editing it. On a branch with another name, create `.git/bug-fix-in-progress` first, and delete it once the test passes.
-5. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc` followed by their own words.
+5. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc:sdlc-mode` followed by their own words.
 6. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
 7. **Write replies a person can check.** Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 8. **Run parallel sessions in separate worktrees, on tasks that touch different files.** Start each with `claude --worktree <name>`: a worktree is its own checkout on its own branch. Tasks that share files run in one session, one after another. Start with two or three sessions, and add one only while you can review every stream properly.

package/templates/nodejs/CONTRIBUTING.md

@@ -37,7 +37,6 @@ Run the narrowest check that covers the change while you work. Git hooks run the
 
 - **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. CodeQL, dependency-review, and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **Coverage:** CI requires 95% line coverage on changed lines in `src/`, except `main.ts`, which starts the server and handles the shutdown signals. Keep other logic out of it, as `src/port.ts` and `src/server.ts` do.
-- **Agent evals:** run `pnpm evals:run` after you change `AGENTS.md`, a skill under `.agents/skills/`, or a hook under `.agents/hooks/`, and add a case name to run one case. It runs the cases in `.agents/skill-evals/` with Claude Code on your own Claude login, so it spends your Claude usage, and it is not part of `pnpm verify`.
 
 Run `pnpm verify` for repository changes.
 

package/templates/nodejs/package.json

@@ -16,7 +16,6 @@
     "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf dist coverage .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json src eslint.config.ts vitest.config.ts",
-    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",

package/templates/payload/.agents/review.md

@@ -6,7 +6,7 @@ Run three passes and tag each finding with its pass:
 
 - Bugs: logic errors, broken edge cases, subtle regressions
 - Security: injection risks, authentication gaps, PII in logs
-- Compliance: the change matches spec.md, plan.md and the design principles that the four policies in `.agents/skills/` state; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
+- Compliance: the change matches spec.md, plan.md and the design principles that the policies in force state, each the project's own `.agents/skills/<area>-policy/SKILL.md` or else the `sdlc` plugin's default; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
 
 ## What Important means here
 

package/templates/payload/AGENTS.md

@@ -14,7 +14,7 @@ Payload CMS on Next.js App Router and PostgreSQL, in TypeScript on pnpm and Node
 | Create a migration                 | `pnpm migrate:create <name>`                               | `INFO: Migration created at` the new file under `migrations/`, then `INFO: Done.`                                            |
 | What `pre-push` runs               | `pnpm check`                                               | exits 0; the last output is the route table of `next build` with `ƒ /health`                                                 |
 | Every check except `pnpm test:e2e` | `pnpm verify`                                              | exits 0; the last output is the route table of `next build` with `ƒ /health`                                                 |
-| Render rules after a change        | `pnpm rules:sync`                                          | `Synced 69 agent rule files; 0 updated.`                                                                                     |
+| Render rules after a change        | `pnpm rules:sync`                                          | `Synced 37 agent rule files; 0 updated.`                                                                                     |
 
 ## Verifying your work
 
@@ -24,6 +24,8 @@ Payload CMS on Next.js App Router and PostgreSQL, in TypeScript on pnpm and Node
 
 Run all three before reporting any task complete, and paste the output. `pnpm verify` runs all three.
 
+The `verifier` subagent starts the app with `pnpm dev`, which needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`. It exercises the changed behavior and the two nearest neighboring flows.
+
 ## Architecture
 
 - `src/payload.config.ts` wires the collections in `src/collections/` to PostgreSQL. The site lives in `src/app/(frontend)/`, and `src/app/health/route.ts` serves `/health`. `next.config.ts` builds `output: "standalone"` and leaves Cache Components off.
@@ -35,9 +37,9 @@ Run all three before reporting any task complete, and paste the output. `pnpm ve
 2. **Put unit tests next to the code as `src/**/*.test.{ts,tsx}` and Playwright end-to-end tests in `test/` as `*.e2e.test.ts`.** Vitest collects only the first pattern.
 3. **Component tests need a DOM test environment, and Vitest runs in Node.js.** Add that environment with the first component test.
 4. **Read configuration through `requireEnvironment` in `src/environment.ts`.** Document each variable in `.env.example`.
-5. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `.agents/skills/sdlc/playbooks/build.md` describes.
+5. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `playbooks/build.md` of the `sdlc-mode` skill in `plugins/sdlc/claude-code/` describes.
 6. **Start a bug fix with a failing test.** A bug fix has no intent and no spec; its plan, `intent/<short-description>/plan.md`, is accepted by an engineer before any code changes. Reproduce the bug as a test, confirm it fails for the reason you expect, and commit it on a `fix/` branch. Then `.agents/hooks/agent-test-edit-gate.sh` blocks test edits by itself: make the test pass without editing it. On a branch with another name, create `.git/bug-fix-in-progress` first, and delete it once the test passes.
-7. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc` followed by their own words.
+7. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc:sdlc-mode` followed by their own words.
 8. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
 9. **Write replies a person can check.** Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 10. **Run parallel sessions in separate worktrees, on tasks that touch different files.** Start each with `claude --worktree <name>`: a worktree is its own checkout on its own branch. Tasks that share files run in one session, one after another. Start with two or three sessions, and add one only while you can review every stream properly.

package/templates/payload/CONTRIBUTING.md

@@ -39,7 +39,6 @@ Run the narrowest check that covers the change while you work. Git hooks run the
 - **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. CodeQL, dependency-review, and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change pages or the admin panel. It starts the development server unless one is already running, and needs `DATABASE_URL` and `PAYLOAD_SECRET` from `.env`. Run `pnpm exec playwright install chromium` once before the first run. CI runs it against the production build and a PostgreSQL service on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% branch coverage on changed lines in `src/`, except layouts, the Payload config, and generated files.
-- **Agent evals:** run `pnpm evals:run` after you change `AGENTS.md`, a skill under `.agents/skills/`, or a hook under `.agents/hooks/`, and add a case name to run one case. It runs the cases in `.agents/skill-evals/` with Claude Code on your own Claude login, so it spends your Claude usage, and it is not part of `pnpm verify`.
 
 Run `pnpm verify` for repository changes.
 

package/templates/payload/REVIEW.md

@@ -6,7 +6,7 @@ Run three passes and tag each finding with its pass:
 
 - Bugs: logic errors, broken edge cases, subtle regressions
 - Security: injection risks, authentication gaps, PII in logs
-- Compliance: the change matches spec.md, plan.md and the design principles that the four policies in `.agents/skills/` state; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
+- Compliance: the change matches spec.md, plan.md and the design principles that the policies in force state, each the project's own `.agents/skills/<area>-policy/SKILL.md` or else the `sdlc` plugin's default; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
 
 ## What Important means here
 

package/templates/payload/package.json

@@ -17,7 +17,6 @@
     "clean": "rm -rf .next coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json src test eslint.config.ts next.config.ts playwright.config.ts vitest.config.ts",
     "dev": "next dev",
-    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",

package/templates/turborepo/.agents/review.md

@@ -6,7 +6,7 @@ Run three passes and tag each finding with its pass:
 
 - Bugs: logic errors, broken edge cases, subtle regressions
 - Security: injection risks, authentication gaps, PII in logs
-- Compliance: the change matches spec.md, plan.md and the design principles that the four policies in `.agents/skills/` state; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
+- Compliance: the change matches spec.md, plan.md and the design principles that the policies in force state, each the project's own `.agents/skills/<area>-policy/SKILL.md` or else the `sdlc` plugin's default; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
 
 ## What Important means here
 

package/templates/turborepo/AGENTS.md

@@ -15,7 +15,7 @@ Turborepo workspace in TypeScript on pnpm and Node.js `>=24.22.1 <25`. `apps/app
 | Create a migration                 | `pnpm migrate:create <name>`                                                               | `INFO: Migration created at` the new file under `migrations/`, then `INFO: Done.`                                            |
 | What `pre-push` runs               | `pnpm check`                                                                               | exits 0; the output ends with the summary `Tasks:    2 successful, 2 total`                                                  |
 | Every check except `pnpm test:e2e` | `pnpm verify`                                                                              | exits 0; the output ends with the summary `Tasks:    2 successful, 2 total`                                                  |
-| Render rules after a change        | `pnpm rules:sync`                                                                          | `Synced 69 agent rule files; 0 updated.`                                                                                     |
+| Render rules after a change        | `pnpm rules:sync`                                                                          | `Synced 37 agent rule files; 0 updated.`                                                                                     |
 
 ## Verifying your work
 
@@ -25,6 +25,8 @@ Turborepo workspace in TypeScript on pnpm and Node.js `>=24.22.1 <25`. `apps/app
 
 Run all three before reporting any task complete, and paste the output. `pnpm verify` runs all three.
 
+The `verifier` subagent starts the app with `pnpm dev`, which needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`. It exercises the changed behavior and the two nearest neighboring flows.
+
 ## Architecture
 
 - Root scripts run lint, format, Knip, and the agent checks once for the workspace, and hand `build`, `test`, `typecheck`, and `depcruise` to Turborepo for each app. `TURBO_FILTER` narrows them; the default is every app.
@@ -37,9 +39,9 @@ Run all three before reporting any task complete, and paste the output. `pnpm ve
 2. **Put unit tests next to the code and Playwright end-to-end tests in `apps/app/test/` and `apps/backoffice/test/` as `*.e2e.test.ts`.** Vitest collects `apps/app/app/**/*.test.{ts,tsx}` and `apps/backoffice/src/**/*.test.{ts,tsx}`.
 3. **Component tests need a DOM test environment, and Vitest runs in Node.js.** Add that environment with the first component test.
 4. **Read backoffice configuration through `requireEnvironment` in `apps/backoffice/src/environment.ts`.** Document each variable in `.env.example`.
-5. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `.agents/skills/sdlc/playbooks/build.md` describes.
+5. **Start from the accepted spec, in plan mode** (Cursor: Plan Mode). Give the plan the change's `intent/<change>/intent.md` and `spec.md`. Commit the approved plan as `intent/<change>/plan.md` with an `Accepted by:` line naming the engineer, as `playbooks/build.md` of the `sdlc-mode` skill in `plugins/sdlc/claude-code/` describes.
 6. **Start a bug fix with a failing test.** A bug fix has no intent and no spec; its plan, `intent/<short-description>/plan.md`, is accepted by an engineer before any code changes. Reproduce the bug as a test, confirm it fails for the reason you expect, and commit it on a `fix/` branch. Then `.agents/hooks/agent-test-edit-gate.sh` blocks test edits by itself: make the test pass without editing it. On a branch with another name, create `.git/bug-fix-in-progress` first, and delete it once the test passes.
-7. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc` followed by their own words.
+7. **Do not start work a person did not ask for.** When a message reports a problem without asking for work, answer in a few lines and end with the message that would start it: `/sdlc:sdlc-mode` followed by their own words.
 8. **Branch from the latest `origin/main`, and open the pull request ready for review.** Name the branch `<type>/<short-description>` and fill the body from `.github/pull_request_template.md`. `.github/workflows/ci.yml` runs full verification only on a pull request that is not a draft. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
 9. **Write replies a person can check.** Write paths from the project root, such as `README.md:12`, never from the machine's root. State as a fact only what you opened or ran in this turn, and say what you ran; mark anything else as inferred or not checked. Answer what was asked and stop: leave out tools, services, and steps the request does not need, and never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
 10. **Run parallel sessions in separate worktrees, on tasks that touch different files.** Start each with `claude --worktree <name>`: a worktree is its own checkout on its own branch. Tasks that share files run in one session, one after another. Start with two or three sessions, and add one only while you can review every stream properly.

package/templates/turborepo/CONTRIBUTING.md

@@ -40,7 +40,6 @@ Run the narrowest check that covers the change while you work. Git hooks run the
 - **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. CodeQL, dependency-review, and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change pages or the admin panel. It builds both apps first, then starts both development servers unless they are already running. The build and the backoffice need `DATABASE_URL`, `PAYLOAD_SECRET`, and `APP_URL` from `.env`. Run `pnpm --filter ./apps/app exec playwright install chromium` once before the first run. CI runs it against the production build and a PostgreSQL service on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% branch coverage on changed lines in `apps/app/app/` and `apps/backoffice/src/`, except layouts, the Payload config, and generated files.
-- **Agent evals:** run `pnpm evals:run` after you change `AGENTS.md`, a skill under `.agents/skills/`, or a hook under `.agents/hooks/`, and add a case name to run one case. It runs the cases in `.agents/skill-evals/` with Claude Code on your own Claude login, so it spends your Claude usage, and it is not part of `pnpm verify`.
 
 Run `pnpm verify` for repository changes.
 

package/templates/turborepo/REVIEW.md

@@ -6,7 +6,7 @@ Run three passes and tag each finding with its pass:
 
 - Bugs: logic errors, broken edge cases, subtle regressions
 - Security: injection risks, authentication gaps, PII in logs
-- Compliance: the change matches spec.md, plan.md and the design principles that the four policies in `.agents/skills/` state; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
+- Compliance: the change matches spec.md, plan.md and the design principles that the policies in force state, each the project's own `.agents/skills/<area>-policy/SKILL.md` or else the `sdlc` plugin's default; flag a plan.md that has no `Accepted by:` line and a change that makes `AGENTS.md` outdated
 
 ## What Important means here
 

package/templates/turborepo/package.json

@@ -17,7 +17,6 @@
     "clean": "rm -rf apps/app/.next apps/app/coverage apps/backoffice/.next apps/backoffice/coverage .turbo coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "turbo run depcruise $TURBO_FILTER",
     "dev": "turbo run dev --filter=./apps/*",
-    "evals:run": "node scripts/run-agent-evals.ts",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
     "gates:check": "node scripts/check-agent-gates.ts",

package/templates/base/.agents/agents.json

@@ -1,7 +0,0 @@
-{
-  "verifier": {
-    "description": "Runs the app and checks the change works before the session reports done",
-    "readonly": true,
-    "tools": ["Bash", "Read"]
-  }
-}