@next-friday/create-app 9.2.1 → 9.3.1

package/templates/base/{.agents/skills/sdlc → plugins/sdlc/claude-code/skills/sdlc-mode}/playbooks/maintain.md

@@ -2,19 +2,17 @@
 
 This playbook starts from a finding such as an alert, a monitoring ticket, a failing run, or an incident. No one answers questions while it runs.
 
-1. Read the finding the request gives: what was seen, where, when, and its link or log. When the request gives no finding, say so in two lines and stop. When the finding asks for a new capability and reports no fault, say that a person sends it with `/sdlc`, and stop.
-2. Diagnose without changing anything. Read the logs, the code, and the changes merged before the finding. When `bands.yaml` names the tools for the finding's tier, use only those. Write no file outside `intent/`, start no deploy, and act only through a route that `bands.yaml` lists for that tier: `pull_request` is the pull request in step 5, and any other route is a runbook of that name. When the finding names no tier, or the project has no `bands.yaml`, use read-only tools only. When the tier's action is only to log, put the finding in your reply and stop.
-3. Write `intent/<change>/intent.md` from the template in `.agents/skills/sdlc/playbooks/plan.md`. Use exactly the template's five headings.
+1. Read the finding the request gives: what was seen, where, when, and its link or log. When the request gives no finding, say so in two lines and stop. When the finding asks for a new capability and reports no fault, say that a person sends it with `/sdlc:sdlc-mode`, and stop.
+2. Diagnose without changing anything. Read the logs, the code, and the changes merged before the finding. When `bands.yaml` names the tools for the finding's tier, use only those. Write no file outside `intent/`, start no deploy, and act only through a route that `bands.yaml` lists for that tier: `pull_request` is the pull request in step 5, and any other route is a runbook of that name. When the finding names no tier, use read-only tools only. When the tier's action is only to log, put the finding in your reply and stop.
+3. Write `intent/<change>/intent.md` from the template in `playbooks/plan.md`. Use exactly the template's five headings.
    - **Problem:** the anomaly and its evidence: the number, its source, and the time.
    - **Proposed outcome:** what the fixed system does, as its user would see it.
    - **Open questions:** everything the evidence does not settle, including the cause when you could not prove it. Never state a cause you did not verify.
 
-   In the author line, name what started the run, such as "Author: maintain job (alert <link>). Status: draft."
-
 4. Run the confidence check. It is a check, not a person.
    - Start a subagent that has not seen the diagnosis, give it only the finding, the logs and files you read, and `intent.md`, and have it try to disprove the **Problem** section from the evidence. When you cannot start a subagent, read the evidence again from the first line as if someone else wrote the intent.
    - When a claim does not survive, move it under **Open questions**, and say in the pull request that the confidence check failed and on which claim.
-5. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as `AGENTS.md` says for branches and pull requests. Put the evidence and the confidence check's result first in its description, under the template's first heading. When you cannot open a pull request from this session, say so and give the pushed branch's name.
-6. **Gate: the service owner triages the finding.** The service owner merges the pull request to fix the finding now, leaves it open to schedule it, or closes it to dismiss it. A dismissal tunes the bands: the service owner adjusts `bands.yaml` so the same noise raises fewer findings. The service owner asks the product owner to decide a product-facing finding. You do none of these. Report the pull request's URL, keep it green as `.agents/skills/sdlc/playbooks/review.md` says, and wait.
+5. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as the opening paragraph of `playbooks/open-pr.md` says for branches and pull requests. When you cannot open a pull request from this session, say so and give the pushed branch's name.
+6. **Gate: the service owner triages the finding.** The service owner merges the pull request to fix the finding now, leaves it open to schedule it, or closes it to dismiss it. A dismissal tunes the bands: the service owner adjusts `bands.yaml` so the same noise raises fewer findings. The service owner asks the product owner to decide a product-facing finding. You do none of these. Report the pull request's URL, keep it green as `playbooks/review.md` says, and wait.
 
-**Next:** `.agents/skills/sdlc/playbooks/design.md`; an agent; when the service owner has merged the intent's pull request and a person or a job sends `/sdlc` with the intent's path.
+**Next:** `playbooks/design.md`; an agent; when the service owner has merged the intent's pull request and a person or a job sends `/sdlc:sdlc-mode` with the intent's path.

package/templates/base/plugins/sdlc/claude-code/skills/sdlc-mode/playbooks/open-pr.md

@@ -0,0 +1,17 @@
+# Open the pull request
+
+Branch from the latest `origin/main`, and open the pull request ready for review. Name the branch as the project's contributing guide says and fill the body from `.github/pull_request_template.md`. Never merge a pull request: a person merges it with `--squash` after code owner approval, bottom-up for a stack of pull requests.
+
+1. Clean the diff against the default branch. Remove debug output, commented-out code, changes the plan does not name, and comments that add nothing the code does not show.
+2. Do what the project's `AGENTS.md` and `CONTRIBUTING.md` require for this kind of change.
+3. When step 1 or 2 changed a file, run the checks the project's agent instructions name again. When one fails, fix the code and run it again. Commit only when they pass.
+4. Push the branch and open the pull request ready for review, as this playbook's opening paragraph says. When the branch already has a pull request, update that one. Fill the body from `.github/pull_request_template.md`:
+   - what changed and why, with the paths of `intent/<change>/spec.md` and `plan.md` when they exist;
+   - `Closes #<issue>` for each issue that already exists and that the change closes. When there is none, write what the template's own section asks for, and leave it out when the template has no such section.
+   - each check you ran, with its result copied from the output.
+
+   When you cannot open a pull request from this session, say so, give the pushed branch's name, and go on to step 5: the review reads the pushed branch's diff.
+
+5. Go on in the same turn, without asking: follow `playbooks/review.md`.
+
+**Next:** `playbooks/review.md`; an agent; in the same turn, as soon as step 4 is done.

package/templates/base/{.cursor/skills/sdlc → plugins/sdlc/claude-code/skills/sdlc-mode}/playbooks/plan.md

@@ -3,16 +3,16 @@
 This playbook writes the intent. The build plan, `intent/<change>/plan.md`, comes later and is not written here.
 
 1. Let the originator describe the problem in their own words: what they cannot do today, who is affected, what better looks like, and what is out of scope.
-2. Read the code, the docs, and the existing `intent/` folders. Never ask what a file or a command can tell you: the author, for one, is `git config user.name`.
-3. Interview until the originator has said four things: the problem, the outcome, the constraints, and what is out of scope. The problem names who is affected, how often, and a number with its source. The outcome is what the user would see.
+2. Read the code, the docs, and the existing `intent/` folders. Find the rest yourself: the author, for one, is `git config user.name`.
+3. Interview until the originator has said four things: the problem, the outcome, the constraints, and what is out of scope. The outcome is what the user would see.
    - **When all four are already said, go to step 4 in the same turn.**
    - **When one is missing, ask and stop.** Write no draft in that turn. Ask in rounds. Each round holds only questions that do not depend on another question in the same round. Number the questions. Each asks one thing and carries a concrete answer you recommend, worded so "yes" accepts it. A recommended answer is a fact or a choice, such as "Recommended: only the checkout page", never an instruction to the person. When you have no answer to recommend, write "No recommendation" and ask plainly. Wait for the answers, and build the next round on them.
 4. Write `intent/<change>/intent.md` from the template below, where `<change>` is a short kebab-case name. Use exactly the template's five headings. What is out of scope goes under **Proposed outcome**. Anything else that is unknown, unverified, or not yet decided goes under **Open questions**. Write "None" only when nothing is, and never list what the originator already answered. Show the whole draft, and name the file only as `intent/<change>/intent.md`. In plan mode you cannot write the file. Show the draft as the plan, and write the file once it is approved.
 5. **Gate: the originator corrects the draft.** Ask whether it matches what they meant, and revise until they say yes. Commit nothing, push nothing, and open no pull request before that yes. In plan mode, the originator approving the plan is that yes.
-6. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as `AGENTS.md` says for branches and pull requests.
-7. **Gate: the product owner accepts or rejects the intent.** The product owner merges the pull request to accept the intent, or closes it to reject it. You do neither. The file stays `Status: draft.`: never write `Status: accepted.` in this pull request, because the spec's pull request sets it. Report the pull request's URL, keep it green as `.agents/skills/sdlc/playbooks/review.md` says, and wait.
+6. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as the opening paragraph of `playbooks/open-pr.md` says for branches and pull requests.
+7. **Gate: the product owner accepts or rejects the intent.** The product owner merges the pull request to accept the intent, or closes it to reject it. You do neither. The file stays `Status: draft.`: never write `Status: accepted.` in this pull request, because the spec's pull request sets it. Report the pull request's URL, keep it green as `playbooks/review.md` says, and wait.
 
-**Next:** `.agents/skills/sdlc/playbooks/design.md`; an agent; when the product owner has merged the intent's pull request and a person or a job asks for the spec.
+**Next:** `playbooks/design.md`; an agent; when the product owner has merged the intent's pull request and a person or a job asks for the spec.
 
 ## Template
 

package/templates/base/{.cursor/skills/sdlc → plugins/sdlc/claude-code/skills/sdlc-mode}/playbooks/question.md

@@ -1,8 +1,8 @@
 # Question
 
 1. Find the facts: read the files and run read-only commands.
-2. Answer, citing `path:line` or command output for each claim, as the **Write replies a person can check** convention in `AGENTS.md` says.
+2. Answer, stating as a fact only what you opened or ran in this turn.
 3. Write no file, make no commit, push nothing, and post nothing to GitHub or another service.
-4. When the answer shows work worth doing, offer it in one line, such as "Send `/sdlc write an intent for this` to start the change", and stop.
+4. When the answer shows work worth doing, offer it in one line, such as "Send `/sdlc:sdlc-mode write an intent for this` to start the change", and stop.
 
 **Next:** none; the person; when they send a new message.

package/templates/base/{.cursor/skills/sdlc → plugins/sdlc/claude-code/skills/sdlc-mode}/playbooks/review.md

@@ -1,17 +1,16 @@
 # Review phase: review the pull request and drive it to green
 
 1. Find what to review: the pull request this session just opened, or the pull request or branch the request names. When there is no pull request, or this session cannot reach its host, review the branch's diff against the default branch and put the findings in your reply in place of a comment.
-2. Review with a fresh context. Start a subagent that has not seen the work. Give it only the diff, `REVIEW.md`, and the change's `intent/<change>/spec.md` and `plan.md`. When you cannot start a subagent, read the diff again from the first line as if someone else wrote it. The review runs each pass in `REVIEW.md` and reports each finding with its pass, **Important** or **Nit**, `path:line`, and the evidence. A change that is not a fix, an intent, or a spec, and has no `spec.md` or no `plan.md`, is itself a finding.
-3. Post the findings as one comment on the pull request, most severe first. Write "No findings" when there are none. A finding does not decide the merge. When a finding flags a mistake that an earlier review of this project flagged too, its correction goes into `AGENTS.md` under **Things Claude gets wrong** as part of this review: in the push of step 4, or, on a pull request or a branch this session did not create, as the exact line in this comment.
-4. On a pull request or a branch that this session did not create, change nothing and push nothing. Skip the rest of this step, and in step 5 only read and answer. Otherwise, fix every Important finding, and every Nit that is correct while the pull request has no code owner's approval yet. Run the checks under **Verifying your work** in `AGENTS.md`, and push. Answer each finding you do not fix with the reason.
+2. Review with a fresh context. Start a subagent that has not seen the work. Give it only the diff, `REVIEW.md`, the change's `intent/<change>/spec.md` and `plan.md`, and the four policy files in force, found as `playbooks/design.md` step 2 says. When you cannot start a subagent, read the diff again from the first line as if someone else wrote it. The review runs each pass in `REVIEW.md` and reports each finding with its pass, **Important** or **Nit**, `path:line`, and the evidence. A change that is not a fix, an intent, or a spec, and has no `spec.md` or no `plan.md`, is itself a finding.
+3. Post the findings as one comment on the pull request, most severe first. Write "No findings" when there are none. A finding does not decide the merge. When a finding flags a mistake that an earlier review of this project flagged too, its correction goes into the project's agent instructions as part of this review: in the push of step 4, or, on a pull request or a branch this session did not create, as the exact line in this comment.
+4. On a pull request or a branch that this session did not create, change nothing and push nothing. Skip the rest of this step, and in step 5 only read and answer. Otherwise, fix every Important finding. Run the checks the project's agent instructions name, and push. Answer each finding you do not fix with the reason.
 5. Sweep the pull request until every check passes and no comment is unanswered. In each pass:
-   - **A conflict, or a branch behind the default branch:** merge the default branch into the pull request's branch and resolve it. Run the checks under **Verifying your work** in `AGENTS.md`, and push. Never rebase or force-push a branch that someone else also pushes to.
+   - **A conflict, or a branch behind the default branch:** say so in the reply, and never rebase or force-push a branch that someone else also pushes to.
    - **A failing check:** read its log and find the cause. When the same check fails on the default branch, or the log shows an outage outside this change, the failure is not this change's. Say which check and why in one comment, and go on. Otherwise fix the cause and push. Run a check again at most once, and only to tell an outage from a real failure. Never skip, disable, or weaken a test to pass a check.
-   - **A person's comment:** make the change it asks for when it is small and local, push, and answer it. For a larger change, answer with what you would do, and go on with the sweep. The person decides in their reply or at the code owner's review.
+   - **A person's comment:** make the change it asks for, push, and answer it.
    - **A bot's comment:** treat it as a claim. Reproduce it or trace it in the code first. Fix what is real, and answer the rest with what you checked.
    - **A nit:** never push for nits alone, because a push can dismiss the code owner's approval. Answer it, and carry the fix in the next push that has another reason.
-   - **A push that dismissed the code owner's approval:** say once that the pull request needs that approval again.
 
-6. **Gate: a code owner approves the pull request, and a person merges it.** You never approve it and never merge it. Report the pull request's URL, or the branch's name when there is none, and say it waits only on the code owner. When a new comment or a failing check arrives, go back to step 5. Subscribe to the pull request's events where your tool can. Otherwise say that a person sends `/sdlc review` with the pull request when something changes.
+6. **Gate: a code owner approves the pull request, and a person merges it.** You never approve it and never merge it. Report the pull request's URL, or the branch's name when there is none, and say it waits only on the code owner. When a new comment or a failing check arrives, go back to step 5. Subscribe to the pull request's events where your tool can. Otherwise say that a person sends `/sdlc:sdlc-mode review` with the pull request when something changes.
 
-**Next:** `.agents/skills/sdlc/playbooks/deploy.md`; the project's deploy workflow, or an agent when a person asks; when the pull request is merged.
+**Next:** `playbooks/deploy.md`; the project's deploy workflow, or an agent when a person asks; when the pull request is merged.

package/templates/base/{.claude → plugins/sdlc/claude-code}/skills/security-policy/SKILL.md

@@ -5,8 +5,6 @@ description: Apply the organization's security policy. Use whenever writing or r
 
 # Security policy
 
-Owner: the code owner of this folder in `.github/CODEOWNERS`.
-
 Standard: [OWASP Application Security Verification Standard 5.0.0](https://github.com/OWASP/ASVS/tree/v5.0.0/5.0/en), Level 1. This is the default; the owner replaces or tightens it by editing this file.
 
 ## Rules

package/templates/base/plugins/sdlc/claude-code/skills/setup-sdlc/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: setup-sdlc
+description: Sets the model and reasoning effort for each role from a budget and reports which steps of SETUP.md are done. Run it with /sdlc:setup-sdlc.
+disable-model-invocation: true
+---
+
+# Set up the SDLC
+
+Do these steps in order. Run again with the same answers, the skill writes the same file and redoes no step that is done.
+
+1. **List the models the session offers:** the models it can run or start a subagent on, spelled as the session spells them. When it can list none, ask the person to paste the names and wait. Write no model the session does not offer.
+2. **Read `.agents/sdlc-models.md`** when it exists. Its `budget:` line is the current budget, and a role line whose model is on the list keeps that model.
+3. **Choose each role's model.** A role without a kept model gets its default. A default the session does not offer becomes the offered model of the same family, the newest when there are several. When the family has none, ask about that role in the question of step 4.
+
+   | Role     | Default  | Does                                 |
+   | :------- | :------- | :----------------------------------- |
+   | `build`  | `sonnet` | Writes the change.                   |
+   | `review` | `sonnet` | Reviews the change.                  |
+   | `verify` | `sonnet` | Runs the app and the checks.         |
+   | `evals`  | `haiku`  | Runs the eval cases, which are many. |
+
+4. **Fix the budget,** which is the reasoning effort of every role. When the request names one of the four labels, that is the budget and you ask nothing about it. Otherwise ask one question, through the session's question tool when it has one, with these choices, adding the roles of step 3 that have no model. Name the current budget when the file records one; with no file, say that `large` matches the defaults.
+
+   | Label       | Effort   |
+   | :---------- | :------- |
+   | `unlimited` | `max`    |
+   | `large`     | `xhigh`  |
+   | `medium`    | `high`   |
+   | `small`     | `medium` |
+
+5. **Write `.agents/sdlc-models.md`** as the whole file, overwriting it, in this shape and no other, with a newline after the last line, because the `build` playbook reads the `verify:` line. For the budget `medium` in a session that offers `sonnet` and `haiku`:
+
+   ```markdown
+   # SDLC models
+
+   budget: medium (high)
+   build: sonnet high
+   review: sonnet high
+   verify: sonnet high
+   evals: haiku high
+   ```
+
+6. **Read `SETUP.md`** at the project root. When there is none, say "This project has no `SETUP.md`" and go to step 9. Otherwise decide for each step whether it is done by checking the repository: run the step's **Check** when it only reads files or local git state, and read the files the step names. Report each step as `done`, `not done`, or `a person checks this` when the repository cannot show it, such as a setting on a website, an account, or someone's decision. For example:
+
+   - `1. Project description: done. package.json holds a description.`
+   - `2. Owners: not done. .github/CODEOWNERS still holds the placeholder.`
+   - `3. Repository settings: a person checks this. They live on the host, not in the repository.`
+
+7. **Do the `not done` steps an agent can do:** a step whose whole work is editing a file of the repository with values the repository or the request already gives. Do not redo a `done` step. Do not edit a file the project's rules or agent settings reserve for a person, such as rules, hooks, lint, format, and commit configuration, and the agent settings themselves; list it with the exact new text and the file it goes in. Commit nothing. After each step, run its **Check** again and report the result.
+8. **List the steps a person does outside the repository,** each with who does it, from `SETUP.md`, and the full URL of the page where it is done when `SETUP.md` or the repository names one.
+9. **Write the reply** by the reply rules in `../sdlc-mode/SKILL.md`. After them, in this order: the budget line and the four role lines as written; each step of `SETUP.md` with its state; what you did; what a person does.

package/templates/base/{.agents → plugins/sdlc/claude-code}/skills/ux-policy/SKILL.md

@@ -5,8 +5,6 @@ description: Apply the organization's UX policy. Use whenever writing or reviewi
 
 # UX policy
 
-Owner: the code owner of this folder in `.github/CODEOWNERS`.
-
 Standard: [Web Content Accessibility Guidelines (WCAG) 2.2](https://www.w3.org/TR/WCAG22/), Level AA: the page satisfies all the Level A and Level AA success criteria. This is the default; the owner replaces or tightens it by editing this file.
 
 ## Rules

package/templates/base/plugins/sdlc/cursor/.cursor-plugin/plugin.json

@@ -0,0 +1,10 @@
+{
+  "name": "sdlc",
+  "description": "Runs the software development loop: a skill that matches a request to a playbook and takes it to the next human gate, a help skill, a verifier subagent, and the default policies.",
+  "license": "MIT",
+  "homepage": "https://github.com/next-friday/next-friday-create-app/tree/main/plugins/sdlc",
+  "repository": "https://github.com/next-friday/next-friday-create-app",
+  "skills": "./skills/",
+  "agents": "./agents/",
+  "hooks": "./hooks/hooks.json"
+}

package/templates/base/plugins/sdlc/cursor/agents/verifier.md

@@ -0,0 +1,7 @@
+---
+name: verifier
+description: Runs the app and checks the change works before the session reports done
+readonly: true
+---
+
+Run the checks the project's agent instructions name. Then exercise the changed behavior the way a user reaches it: start the app or run the code, and watch the result. Report what you ran, what you saw, and any behavior that does not match plan.md. Do not fix anything; report only.

package/templates/base/plugins/sdlc/cursor/hooks/check-reply-shape.sh

@@ -0,0 +1,53 @@
+#!/bin/sh
+command -v jq > /dev/null || exit 0
+mode=${1:-}
+input=$(cat)
+state_directory=${TMPDIR:-/tmp}/sdlc-reply-shape
+conversation=$(printf '%s' "$input" | jq -r '.conversation_id // ""' | tr -cd 'A-Za-z0-9_-')
+case $mode in
+  save)
+    text=$(printf '%s' "$input" | jq -r '.text // ""')
+    [ -n "$text" ] && [ -n "$conversation" ] || exit 0
+    mkdir -p "$state_directory" && printf '%s' "$text" > "$state_directory/$conversation"
+    exit 0
+    ;;
+  followup)
+    [ -n "$conversation" ] && [ -f "$state_directory/$conversation" ] || exit 0
+    reply=$(cat "$state_directory/$conversation")
+    rm -f "$state_directory/$conversation"
+    [ "$(printf '%s' "$input" | jq -r '"\(.status // "") \(.loop_count // "")"')" = 'completed 0' ] || exit 0
+    ;;
+  *)
+    [ "$(printf '%s' "$input" | jq -r '.stop_hook_active // false')" = true ] && exit 0
+    reply=$(printf '%s' "$input" | jq -r '.last_assistant_message // ""')
+    ;;
+esac
+first=$(printf '%s\n' "$reply" | awk 'NF{print; exit}')
+case $first in '**Request:**'*) ;; *) exit 0 ;; esac
+
+last=$(printf '%s\n' "$reply" | awk 'NF{l=$0} END{print l}')
+request=$(printf '%s\n' "$reply" | grep -m1 '^\*\*Request:\*\*')
+outside_fences=$(printf '%s\n' "$reply" | awk '/^[[:space:]]*(```|~~~)/{f=!f; next} !f')
+outside_urls=$(printf '%s\n' "$outside_fences" | sed -E 's#https?://[^][:space:])>]*# #g')
+outside_code=$(printf '%s\n' "$outside_urls" | tr 'A-Z' 'a-z' \
+  | sed -E 's/`((#|(pr|pull request|issue)s?[[:space:]]+#?)[0-9]+)`/ \1 /g; s/`[^`]*`/ /g' \
+  | sed -E 's/(step|item|number|requirement|rule|point|option|case|line)s?[[:space:]]+#[0-9]+/ /g; s/#[0-9]{6,}/ /g')
+
+number=$(printf '%s\n' "$outside_code" \
+  | grep -Eo '(^|[^[:alnum:]_&#/])#[0-9]+([^[:alnum:]_]|$)|(^|[^[:alnum:]_])(pr|pull request|issue)s?[[:space:]]+#?[0-9]+([^[:alnum:]_.]|\.[^0-9]|\.?$)(of[[:space:]]+(the|this|that|a|an|my|our|your|these|those)[[:space:]])?' \
+  | grep -Ev '[[:space:]]of[[:space:]]' | head -1 | sed -E 's/^[^#[:alnum:]]//; s/[^[:alnum:]]$//')
+problems=
+[ -n "$number" ] && problems="Replace \"$number\" with the full URL of that pull request or issue, or with \"this pull request\". "
+case $last in
+  '**Status:**'*)
+    if printf '%s' "$request" | grep -Eq 'https?://' \
+      && ! printf '%s' "$last" | grep -Eiq 'Next:\**[[:space:]]*[<(]?https?://[^[:space:]]+[[:space:]]*$|no next page'; then
+      problems="${problems}End the **Status:** line with \`Next: <full URL of the page where the person acts next>\`, or say \"no next page\" when none waits. "
+    fi
+    ;;
+  *) problems="${problems}End the reply with a line that starts with **Status:**; nothing may follow it. " ;;
+esac
+
+[ -z "$problems" ] && exit 0
+jq -n --arg mode "$mode" --arg reason "${problems}Send the whole reply again." \
+  'if $mode == "followup" then {followup_message:$reason} else {decision:"block",reason:$reason} end'

package/templates/base/plugins/sdlc/cursor/hooks/hooks.json

@@ -0,0 +1,16 @@
+{
+  "version": 1,
+  "hooks": {
+    "afterAgentResponse": [
+      {
+        "command": "sh \"${CURSOR_PLUGIN_ROOT}/hooks/check-reply-shape.sh\" save"
+      }
+    ],
+    "stop": [
+      {
+        "command": "sh \"${CURSOR_PLUGIN_ROOT}/hooks/check-reply-shape.sh\" followup",
+        "loop_limit": 1
+      }
+    ]
+  }
+}

package/templates/base/{.cursor → plugins/sdlc/cursor}/skills/brand-policy/SKILL.md

@@ -5,8 +5,6 @@ description: Apply the organization's brand policy. Use whenever writing or revi
 
 # Brand policy
 
-Owner: the code owner of this folder in `.github/CODEOWNERS`.
-
 This is the default; the owner adds the brand's names, colours, typefaces, and tone of voice by editing this file.
 
 ## Rules
@@ -14,5 +12,5 @@ This is the default; the owner adds the brand's names, colours, typefaces, and t
 1. A change with no user-visible text, colour, typeface, logo, or message meets this policy; say "Does not apply" and why.
 2. The organization's name, product names, colours, typefaces, and logo files each have one declared source in the project. The spec names that source for every brand value the change shows. When the source does not exist yet, creating it is a requirement of the spec.
 3. No code, style, email, or message the user sees holds a brand value as a literal; each reads it from that source. Project metadata such as `package.json`, `README.md`, and `LICENSE` is outside this rule.
-4. Text the user reads uses one name for one thing and the same words for the same action on every screen, and shows no internal identifier or stack trace.
+4. Text the user reads uses one name for one thing and the same words for the same action on every screen.
 5. A brand value this file does not give, such as an exact colour or a tone of voice, is an area of concern. Never invent one.

package/templates/base/{.claude → plugins/sdlc/cursor}/skills/compliance-policy/SKILL.md

@@ -5,8 +5,6 @@ description: Apply the organization's compliance policy. Use whenever writing or
 
 # Compliance policy
 
-Owner: the code owner of this folder in `.github/CODEOWNERS`.
-
 Standard: the eight basic principles of the [OECD Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data](https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0188) (adopted 1980, revised 2013), paragraphs 7 to 14. This is the default and names no country's law; the owner adds the laws and contracts that bind the organization by editing this file. The points below summarize those paragraphs; the standard's text governs.
 
 ## Rules

package/templates/base/plugins/sdlc/cursor/skills/sdlc-help/SKILL.md

@@ -0,0 +1,23 @@
+---
+name: sdlc-help
+description: Explains how this project's workflow runs and how to use /sdlc:sdlc-mode. It answers and starts no work. Run it with /sdlc:sdlc-help.
+disable-model-invocation: true
+---
+
+# SDLC help
+
+1. When the message asks for work rather than how, open no project file. The whole reply is two lines: this command starts no work; and the message to send instead, which is `/sdlc:sdlc-mode` followed by their own words.
+2. When the topic is unclear, ask one question with these choices: how the workflow runs and starting work, keeping `/sdlc:sdlc-mode` on for a session, fixing a defect in behaviour that already exists, who decides at each gate, a mistake the agent repeats, or company policy.
+3. Read the files the topic points to before you answer. When a file disagrees with the map below, the file is right.
+4. When the person asks about a playbook, a command, or a file that this project does not have, the whole reply is three lines: it does not exist; what exists instead, as one file path; and one message they can send next. Stop there. Do not explain the topic from other files.
+5. Otherwise answer, then give one message the person can send as is, with real words from their question and no blanks to fill in, then list the files the answer came from.
+6. Write the reply by the reply rules in `../sdlc-mode/SKILL.md`.
+
+## Map
+
+- **How the workflow runs, and starting work:** the table in `../sdlc-mode/SKILL.md`.
+- **Keeping `/sdlc:sdlc-mode` on for a session:** a person starts it; nothing routes work into it. How long an invoked skill's text stays in the conversation depends on the agent tool: a person sends `/sdlc:sdlc-mode` again to restore the full text, or uses the agent tool's own way to keep a command active for a session.
+- **Fixing a defect in behaviour that already exists:** `playbooks/fix.md` is the path with no intent and no spec, for a person's request: a plan an engineer accepts, then a failing test, the fix, and a pull request. A finding from a job always starts at intent. Every other change runs intent, spec, plan, then build.
+- **Who decides:** the steps marked **Gate** in the playbooks.
+- **A mistake the agent repeats:** the project's agent instructions.
+- **Company policy:** the policy files, each the project's `.agents/skills/<area>-policy/SKILL.md` when it exists and the plugin's default at `../<area>-policy/SKILL.md` otherwise.

package/templates/base/{.claude/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/SKILL.md

@@ -1,6 +1,6 @@
 ---
-name: sdlc
-description: The front door for work in this project. Matches a request to a playbook and runs it to the next human gate. Run it with /sdlc.
+name: sdlc-mode
+description: The front door for work in this project. Matches a request to a playbook and runs it to the next human gate. Run it with /sdlc:sdlc-mode.
 disable-model-invocation: true
 ---
 
@@ -23,18 +23,29 @@ Do these steps in order.
    | A pull request to open for the current branch                                                                           | Follow [`playbooks/open-pr.md`](playbooks/open-pr.md).                                                                         |
    | Anything else                                                                                                           | Say which of the rows above is closest and why it does not fit, answer what you can as `playbooks/question.md` says, and stop. |
 
-   When a request both asks a question and reports a problem, use `question` and offer `plan` in one line. A problem reported with `/sdlc` is the person's ask for `plan`.
+   When a request both asks a question and reports a problem, use `question` and offer `plan` in one line. A problem reported with `/sdlc:sdlc-mode` is the person's ask for `plan`.
+
+   Do not start work a person did not ask for. When a message reports a problem without asking for work, answer in a few lines and give, on the **Status** line, the message that would start it: `/sdlc:sdlc-mode` followed by their own words.
 
 2. **Open the task list** when the session offers a task-list tool. Its first items are the matched playbook's numbered steps, copied word for word, before any other task. A step you do not do stays in the list with `skip: <reason>`. Use `skip` only for a step you decide never to do. A step marked **Gate** is never skipped. When the session offers no such tool, the steps go in the reply instead, under **Steps**, and are never left out, except for `question`. When a playbook's **Next** line chains another playbook, add that playbook's steps when you start it.
-3. **Do the playbook's steps yourself,** stopping only as `.agents/rules/agent-owned-work.md` says. At a step marked **Gate**, wait for the person it names. When a playbook's **Next** line says an agent runs the next file "in the same turn", read that file and continue without asking; otherwise stop at the Gate. Mark each step done in the task list as you finish it.
+3. **Do the playbook's steps yourself,** stopping only at a step marked **Gate**, or before an action that cannot be undone. At a step marked **Gate**, wait for the person it names. When a playbook's **Next** line says an agent runs the next file "in the same turn", read that file and continue without asking; otherwise stop at the Gate. Mark each step done in the task list as you finish it.
 4. **Write the reply in the shape below.**
 
 ## Reply shape
 
-Write the reply as the **Write replies a person can check** convention in `AGENTS.md` says, even when the message also holds a command, a path, or English technical terms. Only paths, commands, and a draft file's own text stay as they are.
+Write replies a person can check. State as a fact only what you opened or ran in this turn, say what you ran, and mark what you did not open or run in this turn as inferred or not checked. Answer what was asked and stop: never hand the person a check you could run. Send nothing outside the session, such as a message to another session or a service, unless a task step says to.
+
+Name a pull request, an issue, a branch, a workflow run, or a file by its full URL on the host that holds it, never by a number or a bare name. The person often reads the reply on a phone: a URL opens the page with one tap, and a number opens nothing.
+
+When the person writes a number and a repository, build the URL before you write anything else: the repository's URL, then the host's path for the thing, such as `/pull/<number>` for a pull request or `/issues/<number>` for an issue. Use that URL where the person wrote the number, from the **Request** line on. After the first mention you may say "this pull request", with no number.
+
+For example, the person writes "who must approve pull request #7 of https://host.example/acme/shop":
+
+- **Request** line: "**Request:** Who must approve https://host.example/acme/shop/pull/7, and which page to open next."
+- **Status** line: "**Status:** Not checked yet who must approve this pull request. It waits for a code owner. Next: https://host.example/acme/shop/pull/7"
 
 ```markdown
-**Request:** <the goal, the problem it solves, and the smallest change you expect to meet it, in your own words. When you cannot name the smallest change yet, say what you must learn first. For a question, only the question.>
+**Request:** <the goal, the problem it solves, and the smallest change you expect to meet it, in your own words. When you cannot name the smallest change yet, say what you must learn first. For a question, only the question. Where the request holds a number, write the URL you built from it.>
 
 **Steps:** <only when the session has no task-list tool, and never for the `question` playbook. One line for each numbered step of the playbook: `1. <the step, copied word for word>: done | open | skip: <reason>`. When the turn ran more than one playbook, one list for each, under its file name on a line of its own, such as `playbooks/build.md`.>
 
@@ -42,13 +53,13 @@ Write the reply as the **Write replies a person can check** convention in `AGENT
 
 <What the current step produces: the round of questions, or the whole draft. For a question or a request no row fits, the answer.>
 
-**Status:** <what is done, what comes next, and which gate it waits on and for whom.>
+**Status:** <what is done, what comes next, and which gate it waits on and for whom, all on this one line. When there is a page where the person acts next, the line ends with `Next: <its full URL>`, and nothing follows that URL.>
 ```
 
-A step that is not finished is `open`, including one at its Gate.
+The **Status** line is the last line of the reply.
 
-A reply that ends before a **Gate** step says which step stopped it and why. "Waiting for an instruction" is not a reason.
+A step that is not finished is `open`, including one at its Gate.
 
-When the evidence shows that the change cannot be made in this project, say so under **Request**. In the `plan` playbook, the first round then asks the one question that settles where the change belongs.
+A reply that ends before a **Gate** step says which step stopped it and why.
 
-"new task" starts again at step 1. "don't change anything" keeps the session on `question`.
+When the evidence shows that the change cannot be made in this project, say so under **Request**.

package/templates/base/plugins/sdlc/cursor/skills/sdlc-mode/playbooks/build.md

@@ -0,0 +1,46 @@
+# Build phase: plan, then implement
+
+This playbook turns a merged spec into a plan the engineer accepts, and then into working code.
+
+1. Find the change: the `intent/<change>/` folder whose `spec.md` or `plan.md` the request names. Its `spec.md` must be on the default branch beside its `intent.md`. In each case below, say only that, in two or three lines, and stop: write no file.
+   - The request names no change, or the folder has no `spec.md` on any branch: list each `intent/*/` on the default branch that has a `spec.md` and no `plan.md`, or say that there is none.
+   - The spec exists only on another branch: say that the spec is not merged yet, and name that branch.
+   - `intent/<change>/plan.md` is already on the default branch: say that the plan is merged, name the file, and say that the change is built only when each requirement of `spec.md` is checked against the tree.
+
+   When the request is a bug fix with no spec, none of these cases applies: follow `playbooks/fix.md` instead.
+
+2. When `intent/<change>/plan.md` exists on a branch that is not merged, check out that branch. When the request says the plan is accepted, go to step 6. Otherwise show that plan and go to step 5.
+3. Read `intent.md`, `spec.md`, the four policies, found as `playbooks/design.md` step 2 says, and the code the change touches. Start from the accepted spec, in the agent tool's plan mode when it has one, and give the plan the change's `intent.md` and `spec.md`. Then interview the engineer until they have said four things: the files the change touches, the order of the work, the tests that prove it, and each option they rule out.
+   - **When all four are already said, in the request or in the files, go to step 4 in the same turn.**
+   - **When one is missing, ask and stop.** Write no plan in that turn. Ask in rounds, as step 3 of `playbooks/plan.md` does: numbered questions, each with a recommended answer or "No recommendation". Wait for the answers, and build the next round on them.
+4. Write the plan from the template below. Use exactly the template's headings. An engineer who has never seen this conversation must be able to implement the change from the plan alone.
+   - **Files that change:** every file, marked new, changed, or deleted, with one line on what it does afterwards.
+   - **Order of work:** numbered steps. Each ends with the check that proves it.
+   - **Risks:** what the change could break, which step is the riskiest, and each option you chose not to take and why.
+   - **Proof:** the tests and commands that show every requirement of the spec is met, by requirement number, and the test or review step for each policy requirement the spec cites.
+
+   Show the whole plan and name the file only as `intent/<change>/plan.md`. In plan mode you cannot write the file. Show the plan as the plan.
+
+5. **Gate: the engineer accepts the plan.** Ask whether an engineer could build from it, and for their GitHub handle when you cannot read it. Revise until they say yes. Change no code and commit nothing before that yes. In plan mode, approving the plan is that yes. When the spec classes the change as higher risk, say that a tech lead or an architect accepts the plan with the engineer.
+6. Create the branch as `playbooks/open-pr.md` says, unless step 2 checked one out. Set the plan's `Accepted by:` line, under its title, to the handle of the engineer who said yes in step 5 or whom the request names, and commit `intent/<change>/plan.md` before any other change. In that commit, set the spec's status line to `Status: accepted.`, because its pull request is merged.
+7. Implement the plan in its order. After each step, run the check that proves it and fix what fails. For a bug fix, follow `playbooks/fix.md` steps 7 and 8: commit the failing test on a `fix/` branch, and the gate then blocks test edits. When the work departs from the plan, change `plan.md` in the same commit. When the change meets the last requirement of `spec.md`, set `Status: done.` in `intent.md` and `spec.md`.
+8. Run every check the project's agent instructions name and keep the output. Every check must pass: fix the code, and never skip, delete, or weaken a test. Then run the `verifier` subagent and fix what it reports. Start it on the model that `.agents/sdlc-models.md` names after `verify:`, at the effort on that line when the session can set one; when you cannot start a subagent, do what `../../../agents/verifier.md`, relative to this playbook, says yourself. For UI work, when the session has a browser tool, also close the loop with a visual check: start the app, give the browser tool the page and the mock the spec or the request names, screenshot, compare, and adjust, and repeat until it matches; two or three rounds is normal. When a check cannot run in this session, say which one and why, and never report it as passed.
+9. Go on in the same turn, without asking: follow `playbooks/open-pr.md`, and then `playbooks/review.md`. Pushing the branch and opening the pull request are part of this task.
+
+**Next:** `playbooks/open-pr.md`; an agent; in the same turn, as soon as step 8 passes.
+
+## Template
+
+```markdown
+# Plan: <title>
+
+Accepted by: @<engineer>.
+
+## Files that change
+
+## Order of work
+
+## Risks
+
+## Proof
+```

package/templates/base/{.agents/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/playbooks/deploy.md

@@ -2,8 +2,8 @@
 
 1. Find the commit: the full SHA on the default branch that the request names, or the latest commit there. Read its CI run. When a check failed or is still running, say which one in two lines and stop. When you cannot read the CI run from this session, say so and carry on with the commit marked as not verified.
 2. Read how this project deploys: the deploy section of `README.md` and `.github/workflows/deploy.yml`, or the release workflow under `.github/workflows/` when the project releases that way. When the project has no deploy workflow, or deploying is switched off, say so in two lines and stop. When you cannot tell whether deploying is switched on, say so and carry on.
-3. Report where the commit is. For each environment, in the order the project promotes them, say whether this commit is deployed there, and give the deployment's link or the output that shows it. Read production only from the deploy workflow's run history, never with a command that names the production environment. Where you cannot read an environment, write "not read" and why.
-4. Promote the commit to an environment before production only when the request asks for that environment. Do it the way `README.md` says, one environment at a time, and read the health check after each. When a deployment fails, stop: report the failing step and its log, and promote no further. When the request names production, by any name such as `prod`, go to step 5. When it names an environment the project does not have, say so and list the ones it has.
-5. **Gate: the release manager authorizes production.** Never start a production deployment, run a command that names the production environment, or push a release tag. Report the commit's SHA, the environments it has passed, the checks' results, and the exact action the release manager takes to promote it. When the request is to return production to an earlier commit, and the project has `runbooks/rollback-deploy.md`, report that runbook's command with the earlier commit's SHA as that exact action; the release manager runs it. Then wait.
+3. Report where the commit is. For each environment, in the order the project promotes them, say whether this commit is deployed there, and give the deployment's link or the output that shows it. Where you cannot read an environment, write "not read" and why.
+4. Promote the commit to an environment before production only when the request asks for that environment. Do it the way `README.md` says, one environment at a time. When a deployment fails, stop: report the failing step and its log, and promote no further. When the request names production, by any name such as `prod`, go to step 5. When it names an environment the project does not have, say so and list the ones it has.
+5. **Gate: the release manager authorizes production.** Never start a production deployment, run a command that names the production environment, or push a release tag. Report the commit's SHA, the environments it has passed, the checks' results, and the exact action the release manager takes to promote it. Then wait.
 
-**Next:** `.agents/skills/sdlc/playbooks/maintain.md`; a job or a person; when monitoring or a ticket reports a finding in production.
+**Next:** `playbooks/maintain.md`; a job or a person; when monitoring or a ticket reports a finding in production.

package/templates/base/{.cursor/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/playbooks/design.md

@@ -6,18 +6,18 @@ This playbook turns a merged intent into the requirements and design spec.
    - The request names no intent, or the file does not exist on any branch: list each `intent/*/intent.md` on the default branch that has no `spec.md`, or say that there is none.
    - The file exists only on another branch: say that the intent is not merged yet, and name that branch.
    - `spec.md` already exists: say so and name the file.
-2. Read the four policies, every time, before you write: `.agents/skills/brand-policy/SKILL.md`, `.agents/skills/security-policy/SKILL.md`, `.agents/skills/compliance-policy/SKILL.md`, and `.agents/skills/ux-policy/SKILL.md`. Then read the code and the docs the change touches.
+2. Read the four policies, every time, before you write: for each of `brand`, `security`, `compliance`, and `ux`, read the project's `.agents/skills/<area>-policy/SKILL.md` when it exists, and the plugin's default at `../../<area>-policy/SKILL.md`, relative to this playbook, otherwise. Then read the code and the docs the change touches.
 3. Write `intent/<change>/spec.md` from the template below. Use exactly the template's headings.
-   - **Request:** under the status line, quote the words of the request that started this spec. End the line with the template's "Skills at" sentence; its commit is the output of `git log -1 --format=%h -- .agents/skills`.
+   - **Request:** under the status line, quote the words of the request that started this spec.
    - **Requirements:** numbered. Each one states a result a test or a reader can check.
    - **Design:** how the change fits the existing code: the files that change, and what each one does afterwards.
    - **Policies:** one line for each of the four policies. State which rules of that policy the change must meet, each as a requirement number, or write "Does not apply" and why.
-   - **Areas of concern:** a policy rule the change cannot meet, two policies that contradict, or a decision the files do not settle. Give each one a number, the policy it comes from, and that policy's owner from `.github/CODEOWNERS`. When `.github/CODEOWNERS` names no owner for a policy's folder, write "no owner in `.github/CODEOWNERS`" in place of the owner. Add one area of concern that says so. Write "None" only when there are none.
+   - **Areas of concern:** a policy rule the change cannot meet, two policies that contradict, or a decision the files do not settle. Give each one a number and the policy it comes from. Write "None" only when there are none.
    - **Open questions:** each open question from `intent.md`, answered with its evidence or carried forward. Write "None" only when the intent has none.
-4. Commit `spec.md` on a new branch. In the same commit, set the intent's status line to `Status: accepted.`, because its pull request is merged. Push the branch, and open a pull request ready for review, as `AGENTS.md` says for branches and pull requests. Put the areas of concern first in the pull request's description, under the template's first heading. When you cannot open a pull request from this session, say so and give the pushed branch's name.
-5. **Gate: the product owner reviews the spec.** The product owner resolves each area of concern with its policy owner, then merges the pull request to accept the spec, or closes it to reject it. For a change the spec classes as higher risk, the product owner consults a tech lead before accepting. You do none of these. The spec stays `Status: draft.`: never write `Status: accepted.` in this pull request, because the plan's commit sets it. Report the pull request's URL, keep it green as `.agents/skills/sdlc/playbooks/review.md` says, and wait.
+4. Commit `spec.md` on a new branch. In the same commit, set the intent's status line to `Status: accepted.`, because its pull request is merged. Push the branch, and open a pull request ready for review, as the opening paragraph of `playbooks/open-pr.md` says for branches and pull requests. When you cannot open a pull request from this session, say so and give the pushed branch's name.
+5. **Gate: the product owner reviews the spec.** The product owner resolves each area of concern with its policy owner, then merges the pull request to accept the spec, or closes it to reject it. For a change the spec classes as higher risk, the product owner consults a tech lead before accepting. You do none of these. The spec stays `Status: draft.`: never write `Status: accepted.` in this pull request, because the plan's commit sets it. Report the pull request's URL, keep it green as `playbooks/review.md` says, and wait.
 
-**Next:** `.agents/skills/sdlc/playbooks/build.md`; an engineer with an agent; when the product owner has merged the spec's pull request and the engineer sends `/sdlc build` with the spec's path.
+**Next:** `playbooks/build.md`; an engineer with an agent; when the product owner has merged the spec's pull request and the engineer sends `/sdlc:sdlc-mode build` with the spec's path.
 
 ## Template
 
@@ -26,7 +26,7 @@ This playbook turns a merged intent into the requirements and design spec.
 
 From `intent/<change>/intent.md`. Status: draft.
 
-Request: "<the words of the request that started this spec>". Skills at `<commit>`.
+Request: "<the words of the request that started this spec>".
 
 ## Requirements
 

package/templates/base/{.agents/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/playbooks/fix.md

@@ -2,10 +2,10 @@
 
 This playbook takes a defect in behaviour that already exists to a pull request. It has no intent and no spec: its plan is the only file it adds under `intent/`.
 
-1. Decide that the request qualifies. It qualifies only when the request is a defect in behaviour that already exists, and the fix adds no new behaviour and no new dependency and changes no schema and no public interface. When a condition fails, say which one in two lines and follow `.agents/skills/sdlc/playbooks/plan.md` instead.
+1. Decide that the request qualifies. It qualifies only when the request is a defect in behaviour that already exists, and the fix adds no new behaviour and no new dependency and changes no schema and no public interface. When a condition fails, say which one in two lines and follow `playbooks/plan.md` instead.
 2. Reproduce the defect yourself by running the code, and keep the output. Ask the person only when you can name the specific reason you cannot reach it, such as a credential or a service this session cannot use.
 3. Find the cause from what running the code shows. List the candidate causes, rule each out with a command or an observation, and never guess. Name the one cause the evidence leaves. When it leaves none, or more than one, say so and ask for what is missing.
-4. Write the plan from the template in `.agents/skills/sdlc/playbooks/build.md`. The title is `# Plan: <title> (fix)`. Use exactly the template's four headings, and keep the plan short. Name the file `intent/<short-description>/plan.md`; the folder holds only this file.
+4. Write the plan from the template in `playbooks/build.md`. The title is `# Plan: <title> (fix)`. Use exactly the template's four headings, and keep the plan short. Name the file `intent/<short-description>/plan.md`; the folder holds only this file.
    - **Files that change:** every file, marked new, changed, or deleted, with one line on what it does afterwards.
    - **Order of work:** the cause and the evidence for it, then numbered steps. Each ends with the check that proves it.
    - **Risks:** what the fix could break, and each option you chose not to take and why.
@@ -14,10 +14,10 @@ This playbook takes a defect in behaviour that already exists to a pull request.
    Show the whole plan and name the file only as `intent/<short-description>/plan.md`. In plan mode you cannot write the file. Show the plan as the plan.
 
 5. **Gate: the engineer accepts the plan.** Ask whether an engineer could fix the defect from it, and for their GitHub handle when you cannot read it. Revise until they say yes. Change no code and commit nothing before that yes. In plan mode, approving the plan is that yes.
-6. Create the branch `fix/<short-description>` as `AGENTS.md` says. Set the plan's `Accepted by:` line, under its title, to the handle of the engineer who said yes in step 5, and commit `intent/<short-description>/plan.md` as the first commit.
+6. Create the branch `fix/<short-description>` as `playbooks/open-pr.md` says. Set the plan's `Accepted by:` line, under its title, to the handle of the engineer who said yes in step 5, and commit `intent/<short-description>/plan.md` as the first commit.
 7. Reproduce the defect as a test. Run it and check that it fails for the reason the cause gives. Commit the failing test before any fix.
-8. Make the test pass without editing it. On a `fix/` branch, `.agents/hooks/agent-test-edit-gate.sh` blocks test edits once the failing test is committed. On a branch with another name, create `.git/bug-fix-in-progress` first, and delete it once the test passes.
-9. Run every check under **Verifying your work** in `AGENTS.md`. Keep the output. When one fails, fix the code, and never skip, delete, or weaken a test. When a check cannot run in this session, say which one and why, and never report it as passed.
-10. Go on in the same turn, without asking. Follow `.agents/skills/sdlc/playbooks/open-pr.md`, and then `.agents/skills/sdlc/playbooks/review.md`.
+8. Make the test pass without editing it.
+9. Run every check the project's agent instructions name. Keep the output. When one fails, fix the code, and never skip, delete, or weaken a test. When a check cannot run in this session, say which one and why, and never report it as passed.
+10. Go on in the same turn, without asking. Follow `playbooks/open-pr.md`, and then `playbooks/review.md`.
 
-**Next:** `.agents/skills/sdlc/playbooks/open-pr.md`; an agent; in the same turn, as soon as step 9 passes.
+**Next:** `playbooks/open-pr.md`; an agent; in the same turn, as soon as step 9 passes.

package/templates/base/{.cursor/skills/sdlc → plugins/sdlc/cursor/skills/sdlc-mode}/playbooks/maintain.md

@@ -2,19 +2,17 @@
 
 This playbook starts from a finding such as an alert, a monitoring ticket, a failing run, or an incident. No one answers questions while it runs.
 
-1. Read the finding the request gives: what was seen, where, when, and its link or log. When the request gives no finding, say so in two lines and stop. When the finding asks for a new capability and reports no fault, say that a person sends it with `/sdlc`, and stop.
-2. Diagnose without changing anything. Read the logs, the code, and the changes merged before the finding. When `bands.yaml` names the tools for the finding's tier, use only those. Write no file outside `intent/`, start no deploy, and act only through a route that `bands.yaml` lists for that tier: `pull_request` is the pull request in step 5, and any other route is a runbook of that name. When the finding names no tier, or the project has no `bands.yaml`, use read-only tools only. When the tier's action is only to log, put the finding in your reply and stop.
-3. Write `intent/<change>/intent.md` from the template in `.agents/skills/sdlc/playbooks/plan.md`. Use exactly the template's five headings.
+1. Read the finding the request gives: what was seen, where, when, and its link or log. When the request gives no finding, say so in two lines and stop. When the finding asks for a new capability and reports no fault, say that a person sends it with `/sdlc:sdlc-mode`, and stop.
+2. Diagnose without changing anything. Read the logs, the code, and the changes merged before the finding. When `bands.yaml` names the tools for the finding's tier, use only those. Write no file outside `intent/`, start no deploy, and act only through a route that `bands.yaml` lists for that tier: `pull_request` is the pull request in step 5, and any other route is a runbook of that name. When the finding names no tier, use read-only tools only. When the tier's action is only to log, put the finding in your reply and stop.
+3. Write `intent/<change>/intent.md` from the template in `playbooks/plan.md`. Use exactly the template's five headings.
    - **Problem:** the anomaly and its evidence: the number, its source, and the time.
    - **Proposed outcome:** what the fixed system does, as its user would see it.
    - **Open questions:** everything the evidence does not settle, including the cause when you could not prove it. Never state a cause you did not verify.
 
-   In the author line, name what started the run, such as "Author: maintain job (alert <link>). Status: draft."
-
 4. Run the confidence check. It is a check, not a person.
    - Start a subagent that has not seen the diagnosis, give it only the finding, the logs and files you read, and `intent.md`, and have it try to disprove the **Problem** section from the evidence. When you cannot start a subagent, read the evidence again from the first line as if someone else wrote the intent.
    - When a claim does not survive, move it under **Open questions**, and say in the pull request that the confidence check failed and on which claim.
-5. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as `AGENTS.md` says for branches and pull requests. Put the evidence and the confidence check's result first in its description, under the template's first heading. When you cannot open a pull request from this session, say so and give the pushed branch's name.
-6. **Gate: the service owner triages the finding.** The service owner merges the pull request to fix the finding now, leaves it open to schedule it, or closes it to dismiss it. A dismissal tunes the bands: the service owner adjusts `bands.yaml` so the same noise raises fewer findings. The service owner asks the product owner to decide a product-facing finding. You do none of these. Report the pull request's URL, keep it green as `.agents/skills/sdlc/playbooks/review.md` says, and wait.
+5. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as the opening paragraph of `playbooks/open-pr.md` says for branches and pull requests. When you cannot open a pull request from this session, say so and give the pushed branch's name.
+6. **Gate: the service owner triages the finding.** The service owner merges the pull request to fix the finding now, leaves it open to schedule it, or closes it to dismiss it. A dismissal tunes the bands: the service owner adjusts `bands.yaml` so the same noise raises fewer findings. The service owner asks the product owner to decide a product-facing finding. You do none of these. Report the pull request's URL, keep it green as `playbooks/review.md` says, and wait.
 
-**Next:** `.agents/skills/sdlc/playbooks/design.md`; an agent; when the service owner has merged the intent's pull request and a person or a job sends `/sdlc` with the intent's path.
+**Next:** `playbooks/design.md`; an agent; when the service owner has merged the intent's pull request and a person or a job sends `/sdlc:sdlc-mode` with the intent's path.