@ngockhoale/ukit 2.8.0 → 3.0.1

package/src/core/output/index.js

@@ -354,7 +354,7 @@ function buildRecoveryHintSummary(summary, rawPath, { tokensBefore = 0 } = {}) {
 }
 
 // --- tee/ cache bound (BUG-C21-07, FR-006) -----------------------------------
-// Mirror of the bound in templates/.claude/ukit/runtime/output-compression.mjs —
+// Mirror of the bound in template_project/.claude/ukit/runtime/output-compression.mjs —
 // keep the two implementations identical. persistRawOutput wrote one preserved
 // file per compression and nothing ever deleted from tee/. Sweeps are SAMPLED
 // (~1/16 writes, UKIT_TEE_SWEEP_PROBABILITY to force/disable) and BOUNDED

package/src/core/paths.js

@@ -6,7 +6,8 @@ export function buildPathConfig({ packageRoot, projectRoot }) {
     projectRoot,
     manifestPath: path.join(packageRoot, 'manifests', 'platform.full.yaml'),
     userManifestPath: path.join(packageRoot, 'manifests', 'platform.user.yaml'),
-    templatesRoot: path.join(packageRoot, 'templates'),
+    templatesRoot: path.join(packageRoot, 'template_project'),
+    userTemplatesRoot: path.join(packageRoot, 'template_user'),
     ukitRoot: path.join(projectRoot, '.claude', 'ukit', '.ukit'),
     installMetaPath: path.join(projectRoot, '.claude', 'ukit', '.ukit', 'install.json'),
     backupRoot: path.join(projectRoot, '.claude', 'ukit', '.ukit', 'backups'),

package/src/core/runInstallPipeline.js

@@ -274,16 +274,18 @@ async function runUserLayerPass({
     // project install — the whole pass is advisory.
     const userPaths = buildUserPaths({ homeDir });
     userLayer.userRoot = userPaths.userRoot;
-    // pathConfig.userManifestPath is set by buildPathConfig; fall back to the
-    // package layout (templatesRoot's sibling manifests/) for callers that build
-    // pathConfig by hand (tests, embedded runners).
+    // pathConfig.userManifestPath / userTemplatesRoot are set by buildPathConfig;
+    // fall back to the package layout (templatesRoot's siblings manifests/ and
+    // template_user/) for callers that build pathConfig by hand.
     const userManifestPath = pathConfig.userManifestPath
       ?? path.join(pathConfig.templatesRoot, '..', 'manifests', 'platform.user.yaml');
+    const userTemplatesRoot = pathConfig.userTemplatesRoot
+      ?? path.join(pathConfig.templatesRoot, '..', 'template_user');
     const userManifest = await loadManifest(userManifestPath);
     const userPlan = await buildInstallPlan({
       manifest: userManifest,
       stackContext,
-      templatesRoot: pathConfig.templatesRoot,
+      templatesRoot: userTemplatesRoot,
       variables,
       projectRoot: userPaths.userRoot,
       selectedAdapterItemIds,

package/src/core/runtimeConfig.js

@@ -259,6 +259,9 @@ export function buildDefaultRuntimeConfig(overrides = {}) {
     // key treats absence as "off"; stages promote off -> shadow -> canary -> default.
     routing: {
       routeSchema: { stage: 'off' },
+      rigor: { stage: 'off' },
+      fastPath: { stage: 'off' },
+      escalation: { stage: 'off' },
     },
     // SPEC-model-roles: role→tier map injected into delegating-lane route output.
     // Values are tier names or 'inherit-parent' — never raw provider model IDs.
@@ -537,12 +540,16 @@ export function validateRuntimeConfig(config) {
       errors.push('routing must be an object.');
     } else {
       const VALID_ROUTE_STAGES = new Set(['off', 'shadow', 'canary', 'default']);
-      if (config.routing.routeSchema !== undefined) {
-        if (!isPlainObject(config.routing.routeSchema)) {
-          errors.push('routing.routeSchema must be an object.');
-        } else if (config.routing.routeSchema.stage !== undefined
-          && !VALID_ROUTE_STAGES.has(config.routing.routeSchema.stage)) {
-          errors.push(`routing.routeSchema.stage must be one of: ${[...VALID_ROUTE_STAGES].join(', ')}.`);
+      for (const key of ['routeSchema', 'rigor', 'fastPath', 'escalation']) {
+        const stageKey = config.routing[key];
+        if (stageKey === undefined) {
+          continue;
+        }
+        if (!isPlainObject(stageKey)) {
+          errors.push(`routing.${key} must be an object.`);
+        } else if (stageKey.stage !== undefined
+          && !VALID_ROUTE_STAGES.has(stageKey.stage)) {
+          errors.push(`routing.${key}.stage must be one of: ${[...VALID_ROUTE_STAGES].join(', ')}.`);
         }
       }
     }

package/src/core/sensitiveValueScanner.js

@@ -2,7 +2,7 @@
  * sensitiveValueScanner.js (TASK-036)
  *
  * Shared source-side extraction of the high-confidence secret *value* scanner
- * that lives in templates/.claude/hooks/sensitive-data-guard.sh. One semantic
+ * that lives in template_project/.claude/hooks/sensitive-data-guard.sh. One semantic
  * implementation is consumed by the runtime hook mirror (TASK-038/039) and the
  * PROJECT_IMPORTANT.md renderer (TASK-037).
  *

package/src/core/taskBudgetValidator.js

@@ -27,7 +27,7 @@
 //                               never crash.
 //
 // Parsing is deliberately markdown-light and dependency-free so the validator can be
-// duplicated byte-for-byte into the shipped CLI twin (templates/.claude/ukit/index/
+// duplicated byte-for-byte into the shipped CLI twin (template_project/.claude/ukit/index/
 // task-budget-validator.mjs) without dragging `src/` into user installs.
 
 export const DEFAULT_CRITERIA = Object.freeze({

package/src/core/unattendedDoctor.js

@@ -57,7 +57,7 @@ function execOmpConfigGet(projectRoot, ompPath) {
 
 async function readTemplateDenyMatches() {
   try {
-    const text = await fs.readFile(path.join(PACKAGE_ROOT, 'templates', '.omp', 'config.yml'), 'utf8');
+    const text = await fs.readFile(path.join(PACKAGE_ROOT, 'template_project', '.omp', 'config.yml'), 'utf8');
     const parsed = parse(text.replace(TEMPLATE_PLACEHOLDER_PATTERN, '0'));
     const patterns = parsed?.bash?.patterns;
     if (!Array.isArray(patterns)) return [];

package/src/core/update.js

@@ -21,7 +21,7 @@ const INSTALLED_MARKERS = ['.ukit', '.claude', 'CLAUDE.md', 'AGENTS.md', '.codex
 // signal-ignoring child blocks indefinitely, SIGKILL returns ~immediately with
 // ETIMEDOUT. Direct-child kill only (no process-group tree kill): these are
 // short-lived CLI one-shots; the detached-group TERM→KILL posture stays in
-// templates/.claude/ukit/runtime/hook-process.mjs where hooks need it.
+// template_project/.claude/ukit/runtime/hook-process.mjs where hooks need it.
 export const NPM_QUERY_TIMEOUT_MS = 15_000;
 export const NPM_INSTALL_TIMEOUT_MS = 10 * 60 * 1000;
 const KILL_ON_TIMEOUT = 'SIGKILL';

package/src/index/buildIndex.js

@@ -1910,7 +1910,7 @@ function areBugIndexSnapshotsEqual(previousSnapshot, nextSnapshot) {
  * fell back to the project root when NONE of them existed. Partial matches were
  * the trap: a repo with a top-level `tests/` but its code in `packages/` indexed
  * `tests/` and silently nothing else. UKit's own repo hit exactly that — `src`,
- * `tests` and `manifests` all exist, so `templates/` (the entire shipped payload)
+ * `tests` and `manifests` all exist, so `template_project/` (the entire shipped payload)
  * was never indexed, and three releases shipped features that were dead on
  * arrival because the index kept pointing at `src/` and the hand-maintained
  * `.claude/` dev mirror instead.
@@ -2115,7 +2115,7 @@ async function collectGitTrackedFiles(rootDir, discovery = null) {
       return false;
     }
     // Git already applied the project's own ignore rules, so dot-directories it
-    // still lists are deliberate (UKit's `templates/.claude/**` is force-added).
+    // still lists are deliberate (UKit's `template_project/.claude/**` is force-added).
     // All that is left to defend against is a build directory someone committed.
     return !relativePath.split('/').some((segment) => EXCLUDED_DIR_NAMES.has(segment));
   });

package/src/index/impactCatalog.js

@@ -24,11 +24,11 @@ const SHARED_IMPACT_PATTERNS = [
     label: 'shared-token-runtime',
   },
   {
-    regex: /^templates\/\.claude\/hooks\//,
+    regex: /^template_project\/\.claude\/hooks\//,
     label: 'installed-hook-runtime',
   },
   {
-    regex: /^templates\/\.claude\/ukit\//,
+    regex: /^template_project\/\.claude\/ukit\//,
     label: 'installed-helper-runtime',
   },
   {
@@ -36,7 +36,7 @@ const SHARED_IMPACT_PATTERNS = [
     label: 'install-manifest',
   },
   {
-    regex: /^templates\//,
+    regex: /^template_project\//,
     label: 'published-template-surface',
   },
 ];
@@ -44,47 +44,47 @@ const SHARED_IMPACT_PATTERNS = [
 const MIRROR_PAIRS = [
   {
     source: 'src/index/buildIndex.js',
-    mirror: 'templates/.claude/ukit/index/lib/index-core.mjs',
+    mirror: 'template_project/.claude/ukit/index/lib/index-core.mjs',
     reason: 'installed index-core mirror embeds source index behavior',
   },
   {
     source: 'src/index/queryIndex.js',
-    mirror: 'templates/.claude/ukit/index/lib/index-core.mjs',
+    mirror: 'template_project/.claude/ukit/index/lib/index-core.mjs',
     reason: 'installed index-core mirror embeds source query behavior',
   },
   {
     source: 'src/index/resolveContext.js',
-    mirror: 'templates/.claude/ukit/index/lib/index-core.mjs',
+    mirror: 'template_project/.claude/ukit/index/lib/index-core.mjs',
     reason: 'installed index-core mirror embeds context resolution behavior',
   },
   {
     source: 'src/index/verificationPlan.js',
-    mirror: 'templates/.claude/ukit/index/lib/index-core.mjs',
+    mirror: 'template_project/.claude/ukit/index/lib/index-core.mjs',
     reason: 'installed index-core mirror embeds verification planning behavior',
   },
   {
     source: 'src/index/taskRouting.js',
-    mirror: 'templates/.claude/ukit/index/route-task.mjs',
+    mirror: 'template_project/.claude/ukit/index/route-task.mjs',
     reason: 'installed route-task helper mirrors source task routing behavior',
   },
   {
     source: 'src/index/routeCatalog.js',
-    mirror: 'templates/.claude/ukit/index/route-catalog.mjs',
+    mirror: 'template_project/.claude/ukit/index/route-catalog.mjs',
     reason: 'installed route catalog must match source route catalog',
   },
   {
     source: 'src/core/output/index.js',
-    mirror: 'templates/.claude/ukit/runtime/output-compression.mjs',
+    mirror: 'template_project/.claude/ukit/runtime/output-compression.mjs',
     reason: 'source output compression runtime should stay aligned with installed hook runtime',
   },
   {
     source: 'src/core/token/index.js',
-    mirror: 'templates/.claude/ukit/runtime/token-utils.mjs',
+    mirror: 'template_project/.claude/ukit/runtime/token-utils.mjs',
     reason: 'source token runtime should stay aligned with installed token utilities',
   },
   {
     source: 'src/core/compact/threshold.js',
-    mirror: 'templates/.claude/ukit/runtime/compact-threshold.mjs',
+    mirror: 'template_project/.claude/ukit/runtime/compact-threshold.mjs',
     reason: 'source compact threshold runtime should stay aligned with installed compact threshold hook',
   },
 ];

package/src/index/taskRouting.js

@@ -18,7 +18,7 @@ import { resolvePlaybook } from '../core/userPlaybooks.js';
 // --- v3 route-side advisory blocks (docs/pstack/SPEC-playbook-todo.md, ------------------
 // SPEC-principle-index.md, SPEC-model-roles.md). All three are additive stdout text —
 // they never change mode selection. Static text is byte-stable for prompt-cache reuse.
-// Mirrored literally in templates/.claude/ukit/index/route-task.mjs (parity-locked by
+// Mirrored literally in template_project/.claude/ukit/index/route-task.mjs (parity-locked by
 // tests/consistency/executionContractSync.test.js).
 
 // SPEC-playbook-todo §2.1: numbered step lists the model copies verbatim into its todo
@@ -155,6 +155,29 @@ export const ROUTE_INTENT_KINDS = new Set(['informational', 'delivery', 'mutatio
 export const ROUTE_MUTABILITIES = new Set(['read-only', 'mutating', 'mixed']);
 export const ROUTE_RIGOR_LEVELS = new Set(['R0', 'R1', 'R2', 'R3', 'R4']);
 export const ROUTE_MODEL_TIERS = new Set(['lite', 'code', 'smart']);
+export const ROUTE_RISK_FLOORS = new Set(['none', 'high-risk']);
+// SPEC §5 FR-003: fixed table order — codes are emitted and printed in this order.
+// The first six raise the floor to 'high-risk'; the last two are informational only.
+export const ROUTE_RISK_REASON_CODES = Object.freeze([
+  'security-sensitive',
+  'shared-impact',
+  'public-contract',
+  'schema-change',
+  'destructive-action',
+  'cross-engine',
+  'established-precedent',
+  'explicit-local-target',
+]);
+const ROUTE_RISK_FLOOR_RAISING_CODES = new Set(ROUTE_RISK_REASON_CODES.slice(0, 6));
+const ROUTE_RISK_ENGINES = ['claude code', 'codex', 'omp'];
+
+// FR-004 (M01.3'): Fast Path eligibility vocabulary. The suppressed list is fixed
+// text per SPEC — deliberately not configurable. Reasons are the informational
+// risk codes (the last two ROUTE_RISK_REASON_CODES entries) present on the route.
+const FAST_PATH_MODES = new Set(['tiny-fix', 'local-fix']);
+const FAST_PATH_SUPPRESSED = Object.freeze(['design', 'smart', 'subagents', 'broad-verify']);
+const FAST_PATH_REASON_CODES = new Set(ROUTE_RISK_REASON_CODES.slice(6));
+
 // 'informational' is a real router emission (no completion contract) even though it is
 // not part of the seven-lane EXECUTION_MODE_ORDER ladder.
 export const ROUTE_EXECUTION_MODES = [...EXECUTION_MODE_ORDER, 'informational'];
@@ -169,6 +192,132 @@ export function resolveRouteSchemaStage(config = null) {
   return ROUTE_SCHEMA_STAGES.has(stage) ? stage : 'off';
 }
 
+// FR-002: generic stage resolver — every routing.<key>.stage shares the same
+// absent/malformed → 'off' contract. resolveRouteSchemaStage stays as the
+// routeSchema-specific spelling of this helper.
+export function resolveRouteStage(config = null, key) {
+  const stage = config?.routing?.[key]?.stage;
+  return ROUTE_SCHEMA_STAGES.has(stage) ? stage : 'off';
+}
+
+// FR-003 (M01.2'): derive the additive riskFloor from hard signals. Codes are
+// collected in ROUTE_RISK_REASON_CODES table order; the floor is 'high-risk' iff
+// any of the first six (floor-raising) codes fired — informational codes never
+// raise it. Detectors read the normalized signal text (same source the mode
+// ladder uses) plus the raw target path and context preview.
+export function deriveRiskFloor({
+  promptText = '',
+  commandText = '',
+  targetFile = null,
+  executionMode = null,
+  activeSkillIds = [],
+  contextPreview = null,
+} = {}) {
+  const signalText = buildRouteSignalText(promptText, commandText);
+  const target = String(targetFile || '');
+  const skillIds = Array.isArray(activeSkillIds) ? activeSkillIds : [];
+  const codes = [];
+  if (
+    /\b(auth|security|token|permission|secret|credential|password|vulnerab|exploit|xss|injection)\b/i.test(signalText)
+    || skillIds.includes('discover-security')
+  ) {
+    codes.push('security-sensitive');
+  }
+  if (isSharedImpactFile(targetFile) || executionMode === 'shared-edit' || executionMode === 'map-impact') {
+    codes.push('shared-impact');
+  }
+  if (
+    /(^|\/)(package\.json|manifests\/|.*\.d\.ts$|(^|\/)api\/|openapi|swagger)/i.test(target)
+    || /\b(public api|breaking change|api contract|semver)\b/i.test(signalText)
+  ) {
+    codes.push('public-contract');
+  }
+  if (
+    /(^|\/)(migrations?|db|database|prisma|schema)/i.test(target)
+    || /\b(migration|migrate|schema|alter table|add column|drop column)\b/i.test(signalText)
+  ) {
+    codes.push('schema-change');
+  }
+  if (/\b(delete|drop|truncate|destroy|wipe|uninstall|rm -rf|purge)\b/i.test(signalText)) {
+    codes.push('destructive-action');
+  }
+  const engineHits = ROUTE_RISK_ENGINES.filter(
+    (name) => new RegExp(`\\b${name}\\b`, 'i').test(signalText),
+  ).length;
+  if (
+    /\bcross[- ]engine\b|\ball engines\b/i.test(signalText)
+    || engineHits >= 2
+    || /^template_project\/\.(claude|codex|omp)\//i.test(target)
+  ) {
+    codes.push('cross-engine');
+  }
+  if ((contextPreview?.analogFiles?.length ?? 0) > 0 || (contextPreview?.styleFiles?.length ?? 0) > 0) {
+    codes.push('established-precedent');
+  }
+  if (target && !isSharedImpactFile(targetFile)) {
+    codes.push('explicit-local-target');
+  }
+  return {
+    floor: codes.some((code) => ROUTE_RISK_FLOOR_RAISING_CODES.has(code)) ? 'high-risk' : 'none',
+    codes,
+  };
+}
+
+// Route-line segment (FR-003): on 'high-risk' only the floor-raising codes print;
+// on 'none' the informational codes do. Empty list → no segment at all.
+function formatRiskFloorSegment(riskFloor = null) {
+  if (!riskFloor) {
+    return null;
+  }
+  const printed = riskFloor.floor === 'high-risk'
+    ? riskFloor.codes.filter((code) => ROUTE_RISK_FLOOR_RAISING_CODES.has(code))
+    : riskFloor.codes;
+  return printed.length > 0 ? `risk=${riskFloor.floor}(${printed.join(',')})` : null;
+}
+
+// FR-004 (M01.3'): Fast Path eligibility predicate. Returns null when no riskFloor
+// was supplied — eligibility must never be derived without the floor check, so a
+// missing floor means "not computed", not "none". Eligible iff the lane is
+// tiny-fix/local-fix, exactly one local target is known, the floor is 'none',
+// a bounded verification path exists (targeted commands or the tiny-fix
+// 'minimal-or-targeted' contract policy), and the target is not shared-impact.
+export function deriveFastPath({
+  executionMode = null,
+  targetFile = null,
+  riskFloor = null,
+  verificationRecommendation = null,
+  contextPreview = null,
+} = {}) {
+  if (!riskFloor) {
+    return null;
+  }
+  const reasons = (riskFloor.codes ?? []).filter((code) => FAST_PATH_REASON_CODES.has(code));
+  const hasLocalTarget = Boolean(targetFile) || contextPreview?.primaryTargets?.length === 1;
+  const hasBoundedVerification = (verificationRecommendation?.commands?.length ?? 0) > 0
+    || buildExecutionContract(executionMode)?.verificationPolicy === 'minimal-or-targeted';
+  const eligible = FAST_PATH_MODES.has(executionMode)
+    && hasLocalTarget
+    && riskFloor.floor === 'none'
+    && hasBoundedVerification
+    && !isSharedImpactFile(targetFile);
+  return {
+    eligible,
+    suppressed: eligible ? [...FAST_PATH_SUPPRESSED] : [],
+    reasons,
+  };
+}
+
+// Route-line segment (FR-004): emitted only for eligible routes — ineligible
+// routes keep the routeSummary.fastPath field for telemetry but stay silent.
+function formatFastPathSegment(fastPath = null) {
+  if (!fastPath?.eligible) {
+    return null;
+  }
+  const reasons = fastPath.reasons?.length ? ` (${fastPath.reasons.join(',')})` : '';
+  return `fastPath=on | suppress: ${FAST_PATH_SUPPRESSED.join(',')}${reasons}`;
+}
+
+
 
 // A bare delivery command ("push this to git", "đẩy bộ này lên git") performs no
 // repository mutation the ledger could ever receipt. With no edit/review/debug/build
@@ -232,6 +381,7 @@ function buildResolvedRouteFields({
   executionMode = null,
   executionContract = null,
   completionState = null,
+  riskFloor = null,
 } = {}) {
   const signalText = buildRouteSignalText(routingContext.promptText, routingContext.commandText);
   const deliveryOnly = isDeliveryOnlyRequest({
@@ -254,13 +404,14 @@ function buildResolvedRouteFields({
     execution: {
       mode: executionMode,
       rigor: null,
+      riskFloor: riskFloor?.floor ?? null,
       phase: null,
       contractVersion: ROUTE_CONTRACT_VERSION,
       modelTier: executionContract?.modelTier ?? MODEL_TIER_BY_CONTRACT[executionMode] ?? null,
     },
     evidence: {
       observations: [],
-      riskSignals: [],
+      riskSignals: riskFloor?.codes ?? [],
       activationReasons: [],
       suppressionReasons: [],
       completionRequirements: unique(completionState?.missingEvidence ?? []),
@@ -268,7 +419,13 @@ function buildResolvedRouteFields({
     ceremonyBudget: {
       policyVersion: ROUTE_CONTRACT_VERSION,
       rigor: null,
-      limits: {},
+      limits: riskFloor
+        ? Object.fromEntries(
+            ['maxReadPasses', 'maxContextPulls', 'maxReadPassesBeforeReassess']
+              .filter((key) => typeof executionContract?.[key] === 'number')
+              .map((key) => [key, executionContract[key]]),
+          )
+        : {},
       consumed: {},
       exceptions: [],
     },
@@ -324,6 +481,9 @@ export function validateResolvedRoute(route = null) {
     if (route.execution.rigor !== null && !ROUTE_RIGOR_LEVELS.has(route.execution.rigor)) {
       errors.push(`execution.rigor must be null or one of: ${[...ROUTE_RIGOR_LEVELS].join(', ')}.`);
     }
+    if (route.execution.riskFloor !== null && !ROUTE_RISK_FLOORS.has(route.execution.riskFloor)) {
+      errors.push(`execution.riskFloor must be null or one of: ${[...ROUTE_RISK_FLOORS].join(', ')}.`);
+    }
     if (route.execution.contractVersion !== ROUTE_CONTRACT_VERSION) {
       errors.push(`execution.contractVersion must be ${ROUTE_CONTRACT_VERSION}.`);
     }
@@ -339,6 +499,12 @@ export function validateResolvedRoute(route = null) {
         errors.push(`evidence.${key} must be an array.`);
       }
     }
+    if (Array.isArray(route.evidence.riskSignals)
+      && route.evidence.riskSignals.some(
+        (code) => typeof code !== 'string' || !ROUTE_RISK_REASON_CODES.includes(code),
+      )) {
+      errors.push(`evidence.riskSignals entries must be one of: ${ROUTE_RISK_REASON_CODES.join(', ')}.`);
+    }
   }
   if (!isObject(route.ceremonyBudget)) {
     errors.push('ceremonyBudget must be an object.');
@@ -667,6 +833,42 @@ export function buildRouteSummary({
     nextActionType: nextAction?.type ?? null,
     completionState,
   });
+  // FR-003 (M01.2'): riskFloor is a top-level additive field emitted whenever ANY
+  // of rigor/fastPath/escalation stages is on — fastPath/escalation consumers read
+  // it even when routeSchema is off. All three off → absent, byte-identical route.
+  const riskStageOn = ['rigor', 'fastPath', 'escalation']
+    .some((key) => resolveRouteStage(runtimeConfig, key) !== 'off');
+  const riskFloor = riskStageOn
+    ? deriveRiskFloor({
+        promptText: routingContext.promptText,
+        commandText: routingContext.commandText,
+        targetFile: routingContext.targetFile ?? null,
+        executionMode,
+        activeSkillIds: activeSkills.map((entry) => entry.id),
+        contextPreview: contextRecommendation?.preview ?? null,
+      })
+    : null;
+  const riskSegment = formatRiskFloorSegment(riskFloor);
+  // FR-004 (M01.3'): fastPath is emitted whenever its own stage is on — the field
+  // is always set then (eligible or not) so telemetry/harness can read it; the
+  // route-line segment prints only for eligible routes.
+  const fastPathStage = resolveRouteStage(runtimeConfig, 'fastPath');
+  const fastPath = fastPathStage !== 'off'
+    ? {
+        eligible: false,
+        suppressed: [],
+        reasons: [],
+        ...deriveFastPath({
+          executionMode,
+          targetFile: routingContext.targetFile ?? null,
+          riskFloor,
+          verificationRecommendation,
+          contextPreview: contextRecommendation?.preview ?? null,
+        }),
+        stage: fastPathStage,
+      }
+    : null;
+  const fastPathSegment = formatFastPathSegment(fastPath);
   const resolvedRouteFields = routeSchemaStage !== 'off'
     ? buildResolvedRouteFields({
         routingContext,
@@ -674,6 +876,7 @@ export function buildRouteSummary({
         executionMode,
         executionContract,
         completionState,
+        riskFloor,
       })
     : null;
   const helperHint = compactHelperHint(
@@ -716,6 +919,8 @@ export function buildRouteSummary({
     formatCompactSegment('tests', relatedTests),
     formatCompactSegment('styles', styleFiles),
     editGuardHint ? `editGuard=${editGuardHint}` : null,
+    riskSegment,
+    fastPathSegment,
     delegationRecommendation?.hint ? `delegate=${delegationRecommendation.hint}` : null,
     policyMode ? `policy=${policyMode}` : null,
     workflowPolicyName ? `workflow=${workflowPolicyName}` : null,
@@ -737,6 +942,10 @@ export function buildRouteSummary({
     completionState,
     // M01.1 additive C01 groups — present only when routing.routeSchema.stage != "off".
     ...(resolvedRouteFields ?? {}),
+    // FR-003 additive top-level field — present only when a risk stage is on.
+    ...(riskFloor ? { riskFloor } : {}),
+    // FR-004 additive top-level field — present only when fastPath stage is on.
+    ...(fastPath ? { fastPath } : {}),
     continuationState,
     autonomyLevel,
     continuousExecution,
@@ -864,7 +1073,7 @@ function deriveExecutionScores({
 // asking for an explanation, not a repository change. Routing it to an investigation or
 // edit lane fabricates write/verification debt the completion gate then enforces against an
 // answer turn. Kept byte-equivalent to the shipped copies in
-// templates/.claude/ukit/index/route-task.mjs and templates/.claude/hooks/skill-router.sh;
+// template_project/.claude/ukit/index/route-task.mjs and template_project/.claude/hooks/skill-router.sh;
 // this is the canonical copy those are mirror-tested against. It deliberately ignores
 // targetFile: an edit order phrased as a question is caught by implementWords below, while a
 // pure targeted question ("how does X work?") is still just a question.

package/src/render/instructionRenderer.js

@@ -173,11 +173,11 @@ export function renderAll(layout, sourceTexts, varsByResolve = {}) {
 }
 
 const SOURCE_FILES = {
-  core: 'templates/instructions/core.md',
-  'overlay:claude': 'templates/instructions/overlays/claude.md',
-  'overlay:agents': 'templates/instructions/overlays/agents.md',
-  'overlay:omp-rules': 'templates/instructions/overlays/omp-rules.md',
-  'overlay:repo': 'templates/instructions/overlays/repo.md',
+  core: 'template_project/instructions/core.md',
+  'overlay:claude': 'template_project/instructions/overlays/claude.md',
+  'overlay:agents': 'template_project/instructions/overlays/agents.md',
+  'overlay:omp-rules': 'template_project/instructions/overlays/omp-rules.md',
+  'overlay:repo': 'template_project/instructions/overlays/repo.md',
 };
 
 /**
@@ -187,10 +187,10 @@ const SOURCE_FILES = {
 export async function renderInstructionsFromDisk({ repoRoot, write = true } = {}) {
   const abs = (p) => path.join(repoRoot, p);
   const layout = YAML.parse(
-    fs.readFileSync(abs('templates/instructions/layout.yaml'), 'utf8'),
+    fs.readFileSync(abs('template_project/instructions/layout.yaml'), 'utf8'),
   );
   const repoVars =
-    YAML.parse(fs.readFileSync(abs('templates/instructions/repo-vars.yaml'), 'utf8')) || {};
+    YAML.parse(fs.readFileSync(abs('template_project/instructions/repo-vars.yaml'), 'utf8')) || {};
   const pkg = JSON.parse(fs.readFileSync(abs('package.json'), 'utf8'));
 
   const sourceTexts = {};

package/src/skill/auditSkill.js

@@ -23,7 +23,7 @@ export async function initSkillAudit({ rootDir = process.cwd(), skillName } = {}
   const auditDir = getAuditDir(rootDir, skillName);
   await fs.mkdir(auditDir, { recursive: true });
 
-  const templateSourceDir = path.join(rootDir, 'templates/.claude/skills/skill-quality');
+  const templateSourceDir = path.join(rootDir, 'template_project/.claude/skills/skill-quality');
   const copied = [];
   const skipped = [];
 

package/{templates → template_project}/.claude/agents/handoff-planner.md

@@ -76,7 +76,7 @@ verification — link both files' `## Discussion` threads.
 
 ## Phase 0.5 — Write SPEC.md
 
-Write `docs/AI_HANDOFF/SPEC.md` from the template at `templates/docs/AI_HANDOFF/SPEC.md`
+Write `docs/AI_HANDOFF/SPEC.md` from the template at `template_project/docs/AI_HANDOFF/SPEC.md`
 (15 sections). The spec is the contract executors implement against — concrete enough that
 nothing is guessed: exact paths, module and API names, schemas, validation rules,
 permissions, empty/error states, migration behavior, test expectations. Every section is
@@ -135,7 +135,7 @@ Use `_TEMPLATE.md` structure (from pre-read context or file).
 | Dependencies | `TASK-xxx` or `none` — wave order is inferred from this |
 | Test Cases | Type \| Test Name \| Expected — ≥1 happy + ≥2 edge cases of different kinds |
 | Test Files | Exact test file paths to create/modify |
-| Verification Commands | Runnable shell commands — MUST include the project's lint/typecheck command if one exists (see §5 rule above). Apply the "Test selection" resolution order from docs/AI_HANDOFF/RULES.md: `src/`/`scripts/` targets → the `tests` array in `.cache/index/tests-map.json`; `templates/.claude/**`/`.claude/**` targets → path convention (hooks → `tests/hooks/` + `tests/handoff/cycle*/`; manifest/settings → `tests/manifest/`; runtime `.mjs` mirrors → `tests/core/*Parity*` + `tests/index/`); if both resolve to fewer than one test file the task MUST fall back to `yarn test:release-core` — never the full suite by default, never an empty selection |
+| Verification Commands | Runnable shell commands — MUST include the project's lint/typecheck command if one exists (see §5 rule above). Apply the "Test selection" resolution order from docs/AI_HANDOFF/RULES.md: `src/`/`scripts/` targets → the `tests` array in `.cache/index/tests-map.json`; `template_project/.claude/**`/`.claude/**` targets → path convention (hooks → `tests/hooks/` + `tests/handoff/cycle*/`; manifest/settings → `tests/manifest/`; runtime `.mjs` mirrors → `tests/core/*Parity*` + `tests/index/`); if both resolve to fewer than one test file the task MUST fall back to `yarn test:release-core` — never the full suite by default, never an empty selection |
 | Acceptance Criteria | Verifiable checklist |
 
 Missing any field → `needs_breakdown`. Never mark incomplete tasks `ready`.

package/{templates → template_project}/.claude/commands/ukit/handoff-create.md

@@ -70,7 +70,7 @@ The planner agent does the following (use Step 1 summary — do NOT re-read file
    ```
 
 3. Write `docs/AI_HANDOFF/SPEC.md` — the detailed implementation spec (BẮT BUỘC before tasks).
-   Follow `docs/AI_HANDOFF/SPEC.md`'s template sections (or `templates/docs/AI_HANDOFF/SPEC.md`
+   Follow `docs/AI_HANDOFF/SPEC.md`'s template sections (or `template_project/docs/AI_HANDOFF/SPEC.md`
    on a fresh tree): problem/context, goals, non-goals, user journeys, functional requirements
    with Given/When/Then + error cases, fullstack scope (backend, schema/migrations, API
    contract, UI+state, integration, security, performance, observability, deploy/rollback),

package/{templates → template_project}/.claude/commands/ukit/handoff-fullstack.md

@@ -222,7 +222,7 @@ The planner agent does the following (use P1 summary — do NOT re-read files):
    ```
 
 3. **Write `docs/AI_HANDOFF/SPEC.md`** — the detailed implementation spec, from
-   `templates/docs/AI_HANDOFF/SPEC.md`'s section list (or RULES.md §Spec). It must be
+   `template_project/docs/AI_HANDOFF/SPEC.md`'s section list (or RULES.md §Spec). It must be
    concrete enough that an executor implements without guessing: exact paths, module and
    API names, schemas, validation rules, permissions, empty/error states, migration
    behavior, and test expectations — every applicable section filled, open questions

package/{templates → template_project}/.claude/hooks/handoff-model-guard.sh

@@ -238,7 +238,7 @@ if (toolName === 'Write' || toolName === 'Edit') {
           const specText = await fsp.readFile(specPath, 'utf8');
           let templateText = null;
           try {
-            templateText = await fsp.readFile(path.join(projectRoot, 'templates/docs/AI_HANDOFF/SPEC.md'), 'utf8');
+            templateText = await fsp.readFile(path.join(projectRoot, 'template_project/docs/AI_HANDOFF/SPEC.md'), 'utf8');
           } catch {}
           specOk = specText.length > 500 && specText !== templateText;
         } catch {}

package/{templates → template_project}/.claude/hooks/skill-router.sh

@@ -2235,10 +2235,10 @@ setTimeout(() => process.exit(0), HOOK_DEADLINE_MS).unref();
     /^src\/index\//,
     /^src\/core\/(runInstallPipeline|applyPlan|buildPlan|diffPlan|metadata|migrateLegacy|uninstall|runtimeConfig|runtimePaths)\.js$/,
     /^src\/core\/(output|token|compact)\//,
-    /^templates\/\.claude\/hooks\//,
-    /^templates\/\.claude\/ukit\//,
+    /^template_project\/\.claude\/hooks\//,
+    /^template_project\/\.claude\/ukit\//,
     /^manifests\/platform\.full\.yaml$/,
-    /^templates\//,
+    /^template_project\//,
   ];
 
   function isSharedImpactFile(filePath) {

package/{templates → template_project}/.claude/skills/skill-quality/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: skill-quality
-description: Use when creating or editing a UKit template skill/agent (templates/.claude/skills or templates/.claude/agents), before shipping the change, to pressure-test compliance and trigger accuracy. Maintainer-only.
+description: Use when creating or editing a UKit template skill/agent (template_project/.claude/skills or template_project/.claude/agents), before shipping the change, to pressure-test compliance and trigger accuracy. Maintainer-only.
 ---
 
 # Skill Quality