@nurix/etna 0.20.37 → 0.20.39

package/data/catalog/rules/frontend.md

@@ -14,18 +14,18 @@ Tailwind v4 + shadcn-based UI conventions for **web** apps — styling, the `@nu
 
 - **Build every UI through the `design` skill** — never hand-roll layouts; the page archetypes, the `design.md` identity system with its token artifact (`design.tokens.css`), and chrome wiring live in the skill.
 - **The brief's stated theme binds** — dark boots dark when the brief says so (recorded in the project's `design.md`); light is the default only when the brief is silent.
-- **`@nurix/components`** is the UI library — import by subpath (`@nurix/components/button`). **Never** `npx shadcn add`, no `components.json` scaffold — consume the prebuilt library (`.tsx`, not `.jsx`). *A recorded deviation from canonical shadcn, where primitives are vendored into `components/ui/` and edited in place: this workspace consumes a published library instead, and vendoring would fork it. Deliberate — the design skill does not "converge" it.*
+- **`@nurix/components`** is the UI library — import by layer-prefixed subpath (`@nurix/components/element/button`). **Never** `npx shadcn add`, no `components.json` scaffold — consume the prebuilt library (`.tsx`, not `.jsx`). *A recorded deviation from canonical shadcn, where primitives are vendored into `components/ui/` and edited in place: this workspace consumes a published library instead, and vendoring would fork it. Deliberate — the design skill does not "converge" it.*
 - Vite: `@tailwindcss/vite` + `@vitejs/plugin-react-swc`. Pin `react` / `react-dom` / `react/jsx-runtime` / `react/jsx-dev-runtime` to the app's single copy via `resolve.alias` — `@nurix/*` ship nested react, and two copies means two hook dispatchers.
 - Tailwind v4 is CSS-only — no `tailwind.config.js`, no PostCSS.
 - **The CSS entry is whatever the manifest names**, not a fixed filename — `globals.css`, `index.css` and `styles.css` are each conventional in different framework guides, so resolve it rather than grep for one. Imports in order: `@import "./fonts.css"` (`@fontsource` registrations) → the project's `design.tokens.css` (derived by the design skill's validator from the `design.md` in the design folder — `packages/common/` at the base of a multi-package workspace, `src/common/` in a single-package repo — **never** hand-edited) → `@import "tailwindcss"` → the library's `styles.css` → the project's `personality.css` (the same validator's `--emit-personality`, compiling the `design.md` traits through `@nurix/components`' own compiler — **never** hand-edited) — then `@theme inline {…}` mapping vars to tokens.
 - **Dark mode is the `.dark` class on the root element**, bound as `@custom-variant dark (&:is(.dark *))` in the CSS entry — **never** a `data-theme` attribute. `@nurix/components` keys its `dark:` variants, its theme toggle, and its toaster on that class and a consumer cannot re-key them, so an app on the attribute renders mixed: its own tokens invert, the library's dark-only chrome stays light. The switcher is three parts — a pre-paint inline script in the HTML shell (a mounted provider runs too late and the page flashes), `color-scheme: light dark`, and the persisted-preference module.
-- Tokens: raw values in `:root:not(.dark)` and `:root.dark` — **both specificity (0,2,0), and that armor is load-bearing.** Tailwind compiles `@theme` into `@layer theme` and any unlayered declaration beats a layered one, so the library's unlayered `:root`/`.dark` defeats an app's `@theme` outright and *ties* a bare `:root`/`.dark`, leaving the winner to import order. Values are then consumed as semantic Tailwind tokens (`bg-card`, `text-foreground`) through an `@theme inline` mapping layer. The library bundles `class-variance-authority`, `clsx`, `tailwind-merge` — don't re-add them.
+- Tokens: raw values in `:root:not(.dark)` and `:root.dark` — **both specificity (0,2,0), and that armor is load-bearing.** Tailwind compiles `@theme` into `@layer theme` and any unlayered declaration beats a layered one, so the library's unlayered `:root`/`.dark` defeats an app's `@theme` outright and *ties* a bare `:root`/`.dark`, leaving the winner to import order. Values are then consumed as semantic Tailwind tokens (`bg-card`, `text-foreground`) through an `@theme inline` mapping layer. The library ships `class-variance-authority` and `cn` (the class merger) as dependencies — don't re-add them.
 - **Never retune a Tailwind scale key `@nurix/components` consumes** — `--text-xs`, `--text-sm`, `--text-base`, `--text-lg`, `--text-xl`, `--text-2xl`. Its components carry raw scale utilities and its stylesheet declares no `font-size`, so those compile against *this app's* `@theme`: redefining `--text-sm` moves every button, menu item and table cell in the library at once, with nothing to report it. Change type by changing ramp tokens.
 - Spacing in 2/4/6/8; `object-cover`; `clip` / `clip-<n>` / `clip-fade` (the library's — they carry `min-width: 0` and `overflow-wrap: anywhere`; **never** `truncate` / `line-clamp-*`, which leave the flex-child overflow bug open); color through tokens — **never** hardcoded hex in components, and **never a literal font size**. The type ramp and the family rules are the design skill's [`references/type-system.md`](../skills/design/references/type-system.md); `text-sm` is a scale step and is fine, `text-[13px]` is a component overruling the system.
 - **Feel comes from the traits, never from literals on a control or collection surface.** `personality.css` compiles `density` / `pace` / `edge` / `depth` into `--density-*`, `--motion-duration-*`, `--radius-scale`, `--elevation-*`, and every library component reads those. App code stays inside the same reach: scanned surfaces pad and gap through the tokens (`p-(--density-pad-md)`, `gap-(--density-gap-md)`), a `transition-*` utility carries **no** `duration-*` class (the library's default transition duration retimes it from `pace`), a repeated-row container carries `data-mode="inline"`, and app animation reads `var(--motion-duration-base)`. A `p-3`, a `duration-200`, or a `rounded-lg` on such a surface silently opts out of the product's feel.
-- **Every rendered time is `<Timestamp>`** (`@nurix/components/element/timestamp`, `format="auto"`), and a live label ticks through `useNow` (`@nurix/components/lib/time`) — one shared interval, never a `setInterval` per row or a hand-rolled relative formatter.
-- **Status colour is the role.** `success`, `warning`, `info` are declared in `design.md` in both themes; the app's `@theme inline` maps its utilities onto the same roles (`--color-success: var(--success)`), and a status dot is `<Chip prefix="dot" color="var(--tone-success)">` — one hue per meaning on every surface.
-- **`cn()` keeps only one of a type role and a colour merged together** — its tailwind-merge tables class `text-h1` / `text-body` / `text-dense` as colours, so `cn("text-h1", "text-foreground")` and `cn("text-h1 text-foreground")` are both `text-foreground`. Keep a role and a colour in a `className` string that never goes through `cn`, or put the colour on the parent.
+- **Every rendered time is `<Timestamp>`** (`@nurix/components/element/timestamp`, which picks relative or absolute per render), and a live label ticks through `useNow` (`@nurix/components/lib/time`) — one shared interval, never a `setInterval` per row or a hand-rolled relative formatter.
+- **Status colour is the role.** `success`, `warning`, `info` are declared in `design.md` in both themes; the app's `@theme inline` maps its utilities onto the same roles (`--color-success: var(--success)`), and a status dot is `<Chip prefix="dot" intent="success">` (`intent` paints from the `--intent-*` tokens; `color` is for stored data colours, never status) — one hue per meaning on every surface.
+- **`cn()` keeps only one of a type role and a colour merged together** — its merge tables class `text-h1` / `text-body` / `text-dense` as colours, so `cn("text-h1", "text-foreground")` and `cn("text-h1 text-foreground")` are both `text-foreground`. Keep a role and a colour in a `className` string that never goes through `cn`, or put the colour on the parent.
 
 ## Component Search Order
 

package/data/catalog/rules/pnpm.md

@@ -61,6 +61,6 @@ Every workspace package is scoped **`@nurix/`**; the dot vs. hyphen after the sc
   //registry.npmjs.org/:_authToken=${NPM_READ_TOKEN}
   ```
   The token needs only `Read` on the `nurix` scope. A `403` on install means auth failed — check `npm whoami` (local) or the `NPM_READ_TOKEN` secret (CI). Attempt the install directly — the token authenticates ambiently; don't pre-empt or second-guess it. If it fails, flag it to the user — **never** reach for alternatives, a substitute package, or `npm login` swaps.
-- **Import by subpath, never the barrel** — subpaths tree-shake reliably; the available subpaths are the package's `exports` keys. `import { Button } from "@nurix/components/button";`
-- **Styles** — import a CSS-shipping package's stylesheet **once** at the app entry: `import "@nurix/components/styles.css";`. Unstyled components are almost always a missing styles import. The shipped stylesheet is precompiled — no Tailwind `@source` directive unless consuming source via a workspace link.
+- **Import by subpath, never the barrel** — subpaths tree-shake reliably; the available subpaths are the package's `exports` keys. `import { Button } from "@nurix/components/element/button";`
+- **Styles** — `@import` a CSS-shipping package's stylesheet **once** in the app's CSS entry, after `@import "tailwindcss"`: `@import "@nurix/components/styles.css";` (the full import order is the `frontend` rule's). Unstyled components are almost always a missing styles import. The stylesheet is **not** precompiled — it omits `@import "tailwindcss"` and carries its own `@source` over the package's compiled JS, so the app's Tailwind build generates its utilities: add no `@source` for it, and never `import` it from JS, which compiles it standalone with no theme loaded and fails the build.
 - **CLIs** ship a `bin` — run directly: `npx @nurix/etna@latest` (or `npm install -g`).

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "899bed2c91e6",
+    "fingerprint": "dffbc8593fdd",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/agents/brainstorm.md

@@ -28,8 +28,9 @@ as a failed gate and report it, never as a pass.
 ## The write protocol you enforce
 
 One writer per file. You write `state.md`, `thesis.md`, `forks.md`, `ledger.md`, `fragments/`,
-manifest, and your own sync-log **result** lines. You never write `ops/capture.md` (the
-facilitator's) or sync-log dispatch lines. The user may hand-edit anything: before rewriting any
+manifest, and your own sync-log **result** lines. You never write the facilitator's files — the
+folder, `ops/` and `ops/.gitignore` at bootstrap, `basis/` at intake, `ops/capture.md` — or
+sync-log dispatch lines. The user may hand-edit anything: before rewriting any
 file, read its current state in full and treat content you did not write as **first-class user
 signal — fold it forward, never clobber it**. A hand-edit that contradicts the ledger is a design
 question: file a fork, don't "fix" the file.
@@ -116,7 +117,8 @@ Stop is facilitator-orchestrated because approval belongs to the user; you execu
    what applied and stop — the folder stays visibly unfinished and the user restarts; never
    resume silently from a half-applied state.
 3. **Uselessness test.** Spawn a **fresh, context-free cold reader** — an independent subagent
-   that inherits none of this session's context — whose prompt contains only the allowed-path list
+   on the standard tier (`model: sonnet`, named on the dispatch so it never inherits yours) that
+   inherits none of this session's context — whose prompt contains only the allowed-path list
    (the manifest's destinations — never the session folder) and the instruction to reconstruct the
    design: thesis, commitments, reasoning, declined branches. Grade its reconstruction against the
    ledger and thesis. Gaps → record them in the manifest (`Result: fail`, named gaps), and the fixes

package/data/harnesses/code/codex/agents/brainstorm.toml

@@ -26,8 +26,9 @@ as a failed gate and report it, never as a pass.
 ## The write protocol you enforce
 
 One writer per file. You write `state.md`, `thesis.md`, `forks.md`, `ledger.md`, `fragments/`,
-manifest, and your own sync-log **result** lines. You never write `ops/capture.md` (the
-facilitator's) or sync-log dispatch lines. The user may hand-edit anything: before rewriting any
+manifest, and your own sync-log **result** lines. You never write the facilitator's files — the
+folder, `ops/` and `ops/.gitignore` at bootstrap, `basis/` at intake, `ops/capture.md` — or
+sync-log dispatch lines. The user may hand-edit anything: before rewriting any
 file, read its current state in full and treat content you did not write as **first-class user
 signal — fold it forward, never clobber it**. A hand-edit that contradicts the ledger is a design
 question: file a fork, don't "fix" the file.
@@ -114,7 +115,8 @@ Stop is facilitator-orchestrated because approval belongs to the user; you execu
    what applied and stop — the folder stays visibly unfinished and the user restarts; never
    resume silently from a half-applied state.
 3. **Uselessness test.** Spawn a **fresh, context-free cold reader** — an independent subagent
-   that inherits none of this session's context — whose prompt contains only the allowed-path list
+   on the standard tier (named on the dispatch so it never inherits yours) that
+   inherits none of this session's context — whose prompt contains only the allowed-path list
    (the manifest's destinations — never the session folder) and the instruction to reconstruct the
    design: thesis, commitments, reasoning, declined branches. Grade its reconstruction against the
    ledger and thesis. Gaps → record them in the manifest (`Result: fail`, named gaps), and the fixes

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.20.7",
+  "version": "3.20.9",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -29,5 +29,5 @@
     "origin": "https://cdn.nustack.io",
     "track": "latest"
   },
-  "digest": "068ff439e1f9"
+  "digest": "0e411f901396"
 }

package/data/harnesses/code/hooks/approved-packages.md

@@ -7,7 +7,7 @@ Read by the PreToolUse install gate (`compliance.mjs`) — an off-table install
 | `react` | ^19.2.3 | UI components | — |
 | `vite` | ^8.0.0 | Build tool, dev server | `webpack`, CRA |
 | `tailwindcss` | ^4.3.3 | Styling | `styled-components` |
-| `@nurix/components` | ^0.15.12 | The UI component library — import by subpath | `npx shadcn add`, a `components.json` scaffold |
+| `@nurix/components` | ^2.0.0 | The UI component library — import by subpath; toasts come from its `compound/toast` subpath | `npx shadcn add`, a `components.json` scaffold, `sonner`, `react-toastify` |
 | `@tailwindcss/vite` | ^4.3.3 | Tailwind v4 Vite plugin — 4.3.x is the vite-8 peer line; 4.1.x tops out at vite 7 | `postcss`, `tailwind.config.js` |
 | `@vitejs/plugin-react-swc` | ^4.2.2 | JSX compilation | `@vitejs/plugin-react` |
 | `react-router-dom` | ^7.11.0 | Routing | — |
@@ -19,7 +19,6 @@ Read by the PreToolUse install gate (`compliance.mjs`) — an off-table install
 | `@dnd-kit/core` | ^6.3.1 | Drag and drop | `react-beautiful-dnd` |
 | `@xyflow/react` | ^12.11.0 | Node-based flow charts | `reactflow`, `react-flow-renderer` |
 | `motion` | ^12.23.26 | Animations | `react-spring` |
-| `sonner` | ^2.0.7 | Toast notifications | `react-toastify` |
 | `react-window` | ^2.2.3 | List virtualization | `react-virtualized` |
 | `nanoid` | ^6.0.0 | ID generation | `uuid` — exempt: UUIDv5/v7 database ids per `database.md` |
 | `express` | ^5.2.1 | HTTP server | `fastify`, `koa` |

package/data/harnesses/code/rules/frontend.md

@@ -14,18 +14,18 @@ Tailwind v4 + shadcn-based UI conventions for **web** apps — styling, the `@nu
 
 - **Build every UI through the `design` skill** — never hand-roll layouts; the page archetypes, the `design.md` identity system with its token artifact (`design.tokens.css`), and chrome wiring live in the skill.
 - **The brief's stated theme binds** — dark boots dark when the brief says so (recorded in the project's `design.md`); light is the default only when the brief is silent.
-- **`@nurix/components`** is the UI library — import by subpath (`@nurix/components/button`). **Never** `npx shadcn add`, no `components.json` scaffold — consume the prebuilt library (`.tsx`, not `.jsx`). *A recorded deviation from canonical shadcn, where primitives are vendored into `components/ui/` and edited in place: this workspace consumes a published library instead, and vendoring would fork it. Deliberate — the design skill does not "converge" it.*
+- **`@nurix/components`** is the UI library — import by layer-prefixed subpath (`@nurix/components/element/button`). **Never** `npx shadcn add`, no `components.json` scaffold — consume the prebuilt library (`.tsx`, not `.jsx`). *A recorded deviation from canonical shadcn, where primitives are vendored into `components/ui/` and edited in place: this workspace consumes a published library instead, and vendoring would fork it. Deliberate — the design skill does not "converge" it.*
 - Vite: `@tailwindcss/vite` + `@vitejs/plugin-react-swc`. Pin `react` / `react-dom` / `react/jsx-runtime` / `react/jsx-dev-runtime` to the app's single copy via `resolve.alias` — `@nurix/*` ship nested react, and two copies means two hook dispatchers.
 - Tailwind v4 is CSS-only — no `tailwind.config.js`, no PostCSS.
 - **The CSS entry is whatever the manifest names**, not a fixed filename — `globals.css`, `index.css` and `styles.css` are each conventional in different framework guides, so resolve it rather than grep for one. Imports in order: `@import "./fonts.css"` (`@fontsource` registrations) → the project's `design.tokens.css` (derived by the design skill's validator from the `design.md` in the design folder — `packages/common/` at the base of a multi-package workspace, `src/common/` in a single-package repo — **never** hand-edited) → `@import "tailwindcss"` → the library's `styles.css` → the project's `personality.css` (the same validator's `--emit-personality`, compiling the `design.md` traits through `@nurix/components`' own compiler — **never** hand-edited) — then `@theme inline {…}` mapping vars to tokens.
 - **Dark mode is the `.dark` class on the root element**, bound as `@custom-variant dark (&:is(.dark *))` in the CSS entry — **never** a `data-theme` attribute. `@nurix/components` keys its `dark:` variants, its theme toggle, and its toaster on that class and a consumer cannot re-key them, so an app on the attribute renders mixed: its own tokens invert, the library's dark-only chrome stays light. The switcher is three parts — a pre-paint inline script in the HTML shell (a mounted provider runs too late and the page flashes), `color-scheme: light dark`, and the persisted-preference module.
-- Tokens: raw values in `:root:not(.dark)` and `:root.dark` — **both specificity (0,2,0), and that armor is load-bearing.** Tailwind compiles `@theme` into `@layer theme` and any unlayered declaration beats a layered one, so the library's unlayered `:root`/`.dark` defeats an app's `@theme` outright and *ties* a bare `:root`/`.dark`, leaving the winner to import order. Values are then consumed as semantic Tailwind tokens (`bg-card`, `text-foreground`) through an `@theme inline` mapping layer. The library bundles `class-variance-authority`, `clsx`, `tailwind-merge` — don't re-add them.
+- Tokens: raw values in `:root:not(.dark)` and `:root.dark` — **both specificity (0,2,0), and that armor is load-bearing.** Tailwind compiles `@theme` into `@layer theme` and any unlayered declaration beats a layered one, so the library's unlayered `:root`/`.dark` defeats an app's `@theme` outright and *ties* a bare `:root`/`.dark`, leaving the winner to import order. Values are then consumed as semantic Tailwind tokens (`bg-card`, `text-foreground`) through an `@theme inline` mapping layer. The library ships `class-variance-authority` and `cn` (the class merger) as dependencies — don't re-add them.
 - **Never retune a Tailwind scale key `@nurix/components` consumes** — `--text-xs`, `--text-sm`, `--text-base`, `--text-lg`, `--text-xl`, `--text-2xl`. Its components carry raw scale utilities and its stylesheet declares no `font-size`, so those compile against *this app's* `@theme`: redefining `--text-sm` moves every button, menu item and table cell in the library at once, with nothing to report it. Change type by changing ramp tokens.
 - Spacing in 2/4/6/8; `object-cover`; `clip` / `clip-<n>` / `clip-fade` (the library's — they carry `min-width: 0` and `overflow-wrap: anywhere`; **never** `truncate` / `line-clamp-*`, which leave the flex-child overflow bug open); color through tokens — **never** hardcoded hex in components, and **never a literal font size**. The type ramp and the family rules are the design skill's [`references/type-system.md`](../skills/design/references/type-system.md); `text-sm` is a scale step and is fine, `text-[13px]` is a component overruling the system.
 - **Feel comes from the traits, never from literals on a control or collection surface.** `personality.css` compiles `density` / `pace` / `edge` / `depth` into `--density-*`, `--motion-duration-*`, `--radius-scale`, `--elevation-*`, and every library component reads those. App code stays inside the same reach: scanned surfaces pad and gap through the tokens (`p-(--density-pad-md)`, `gap-(--density-gap-md)`), a `transition-*` utility carries **no** `duration-*` class (the library's default transition duration retimes it from `pace`), a repeated-row container carries `data-mode="inline"`, and app animation reads `var(--motion-duration-base)`. A `p-3`, a `duration-200`, or a `rounded-lg` on such a surface silently opts out of the product's feel.
-- **Every rendered time is `<Timestamp>`** (`@nurix/components/element/timestamp`, `format="auto"`), and a live label ticks through `useNow` (`@nurix/components/lib/time`) — one shared interval, never a `setInterval` per row or a hand-rolled relative formatter.
-- **Status colour is the role.** `success`, `warning`, `info` are declared in `design.md` in both themes; the app's `@theme inline` maps its utilities onto the same roles (`--color-success: var(--success)`), and a status dot is `<Chip prefix="dot" color="var(--tone-success)">` — one hue per meaning on every surface.
-- **`cn()` keeps only one of a type role and a colour merged together** — its tailwind-merge tables class `text-h1` / `text-body` / `text-dense` as colours, so `cn("text-h1", "text-foreground")` and `cn("text-h1 text-foreground")` are both `text-foreground`. Keep a role and a colour in a `className` string that never goes through `cn`, or put the colour on the parent.
+- **Every rendered time is `<Timestamp>`** (`@nurix/components/element/timestamp`, which picks relative or absolute per render), and a live label ticks through `useNow` (`@nurix/components/lib/time`) — one shared interval, never a `setInterval` per row or a hand-rolled relative formatter.
+- **Status colour is the role.** `success`, `warning`, `info` are declared in `design.md` in both themes; the app's `@theme inline` maps its utilities onto the same roles (`--color-success: var(--success)`), and a status dot is `<Chip prefix="dot" intent="success">` (`intent` paints from the `--intent-*` tokens; `color` is for stored data colours, never status) — one hue per meaning on every surface.
+- **`cn()` keeps only one of a type role and a colour merged together** — its merge tables class `text-h1` / `text-body` / `text-dense` as colours, so `cn("text-h1", "text-foreground")` and `cn("text-h1 text-foreground")` are both `text-foreground`. Keep a role and a colour in a `className` string that never goes through `cn`, or put the colour on the parent.
 
 ## Component Search Order
 

package/data/harnesses/code/rules/pnpm.md

@@ -61,6 +61,6 @@ Every workspace package is scoped **`@nurix/`**; the dot vs. hyphen after the sc
   //registry.npmjs.org/:_authToken=${NPM_READ_TOKEN}
   ```
   The token needs only `Read` on the `nurix` scope. A `403` on install means auth failed — check `npm whoami` (local) or the `NPM_READ_TOKEN` secret (CI). Attempt the install directly — the token authenticates ambiently; don't pre-empt or second-guess it. If it fails, flag it to the user — **never** reach for alternatives, a substitute package, or `npm login` swaps.
-- **Import by subpath, never the barrel** — subpaths tree-shake reliably; the available subpaths are the package's `exports` keys. `import { Button } from "@nurix/components/button";`
-- **Styles** — import a CSS-shipping package's stylesheet **once** at the app entry: `import "@nurix/components/styles.css";`. Unstyled components are almost always a missing styles import. The shipped stylesheet is precompiled — no Tailwind `@source` directive unless consuming source via a workspace link.
+- **Import by subpath, never the barrel** — subpaths tree-shake reliably; the available subpaths are the package's `exports` keys. `import { Button } from "@nurix/components/element/button";`
+- **Styles** — `@import` a CSS-shipping package's stylesheet **once** in the app's CSS entry, after `@import "tailwindcss"`: `@import "@nurix/components/styles.css";` (the full import order is the `frontend` rule's). Unstyled components are almost always a missing styles import. The stylesheet is **not** precompiled — it omits `@import "tailwindcss"` and carries its own `@source` over the package's compiled JS, so the app's Tailwind build generates its utilities: add no `@source` for it, and never `import` it from JS, which compiles it standalone with no theme loaded and fails the build.
 - **CLIs** ship a `bin` — run directly: `npx @nurix/etna@latest` (or `npm install -g`).

package/data/harnesses/code/skills/boundary/references/packs/build-config-runtime.md

@@ -27,7 +27,7 @@ Load when: the touch list exhibits `package.json` (deps, `exports`, scripts, `pa
 **Safe change:** Declare every imported package in the importer's own `package.json` (workspace siblings as `"@nurix/x": "workspace:*"`); never widen `public-hoist-pattern` to fix a missing-module error — add the dep; verify with a fresh `pnpm install` on a clean clone.
 
 ## package-exports-subpath-map — HIGH · rendezvous-string
-**Contract:** Consumers' import specifiers (`@nurix/components/button`) must match literal keys in the package's `exports` map; the `files` allowlist and `types` conditions must cover the same paths.
+**Contract:** Consumers' import specifiers (`@nurix/components/element/button`) must match literal keys in the package's `exports` map; the `files` allowlist and `types` conditions must cover the same paths.
 **Detect:** `"exports"` and `"files"` in `package.json`, `from ['"]@nurix/[^'"]+/`, `"moduleResolution"` in `tsconfig.json`
 **Ships green, breaks:** Any subpath not mapped in `exports` throws `ERR_PACKAGE_PATH_NOT_EXPORTED` at runtime — and tsc under `moduleResolution: "node10"` ignores `exports` entirely, so types resolve while Node throws (use `"bundler"`/`"nodenext"` to make tsc see the real contract); adding a new component file without an `exports` entry publishes fine and breaks every consumer import; a built `dist/` path referenced by `exports` but missing from the `files` allowlist installs cleanly and fails only on first import of the published tarball.
 **Safe change:** Add the `exports` subpath (with `types` condition first in each condition block) in the same change as the new file; confirm `files` includes everything `exports` references; check the shipped surface with `npm pack --dry-run`; treat removing/renaming an exports key as a breaking change for all consumers.

package/data/harnesses/code/skills/brainstorm/README.md

@@ -1,54 +1,27 @@
-# Brainstorm — process, not archive
+# Brainstorm
 
-A Claude Code skill that is a **thinking partner for designing large-scale software changes**.
-The session's product is the repo's living documentation: the conversation helps the user think
-correctly, the record stays readable at any pause, and the session ends with a harvest so
-complete that the session folder is useless — it moves to history and the user deletes or
-commits it.
+A thinking partner for a large-scale software change. The session's product is the repository's living documentation: the conversation helps the user think correctly, the working surface reads well at any pause, and the stop pipeline harvests the session so completely that its folder is redundant. The folder then moves to history, and the user deletes or commits it.
 
-> Spec (single source of truth): `docs/skills/brainstorm/` in the etna repo. The etna
-> copy of this skill (`skills/brainstorm/`) is canonical; the user-level path
-> `~/.claude/skills/brainstorm/` is a symlink to it.
+The design, its reasons and its evidence live in `docs/skills/brainstorm/` in the etna repo.
 
-## The architecture — one capability, two seats
-
-Prose obligations decay in the conversing seat: an audit of real sessions finds the same rules
-dying in every one, the successful ones included. So the capability is split:
+## One capability, two seats
 
 | Seat | Component | Owns |
 | --- | --- | --- |
-| Conversation (main loop) | `SKILL.md` — the facilitator | The dialogue, the basis gate, the moves, one write: appending everything to `ops/capture.md` |
-| Paper (dispatched agent) | `agents/brainstorm.md` — the twin, pinned strong tier | Every working-surface file: distilling ops into pillars, recomposing the thesis whole, the semantic audits, the harvest |
-| Integrity (script) | `scripts/detector.mjs` | Mechanical checks with stable rule IDs; blocks the manifest and the move while gates fail |
-| Quality (authoring-time) | `evals/` (never ships) | Session-replay scenarios, the two-agent audit, contrastive facilitation |
-
-Every twin dispatch is paired-logged in `ops/sync-log.md` — the facilitator writes the dispatch
-line, the twin writes the result — so reconciliation is observable, never asserted.
-
-## The session lifecycle
-
-- **`/brainstorm start`**
-  1. Basis gate — a document, a prior session folder in any format, or a brain dump.
-  2. Bootstrap `docs/research/{topic}-brainstorm/` — `ops/` untracked; the twin writes the surface.
-  3. Converse — dump, interview, probe, blindspot, converge — steerable in plain language.
-  4. "Let me read" anytime — compose on demand, read the thesis, come back.
-- **`/brainstorm stop`**
-  1. Converge → manifest → **one** user approval → apply → uselessness test.
-  2. The folder moves to `docs/history/brainstorms/{topic}/` — the completion marker.
-  3. The user decides: delete or commit.
-
-The working surface: `thesis.md` (claim → argument → what changed, recomposed whole, stamped),
-`forks.md` (open questions with close conditions — the only convergence currency), `ledger.md`
-(commitments: Decision / Why / How to apply / Resolves, declined options inline with re-evaluate
-conditions), `state.md` (anchor + the aspect map), `basis/`, `fragments/` (harvest-native,
-drafted in destination format), and untracked `ops/` (raw capture + sync log; deleted at stop).
+| Conversation (main loop) | `SKILL.md`, the facilitator | the dialogue, the basis gate, the moves, the per-turn capture into `ops/capture.md`, the sync-log dispatch lines |
+| Paper (dispatched agent) | the `brainstorm` agent, the twin, pinned to a strong tier | every working-surface file: distillation, the whole-thesis recompose, the semantic audits, the harvest |
+| Integrity (script) | `scripts/detector.mjs` | mechanical checks with stable rule ids, blocking the manifest and the move while they fail |
+| Quality (authoring time) | `evals/`, never shipped | activation and behaviour cases, session-replay scenarios, the two-agent audit |
 
 ## Files
 
-- `SKILL.md` — the facilitator hub
-- `references/doctrine.md` — thesis / forces / forks / commitments / consequences epistemics
-- `references/session-schema.md` — the single format authority (what the detector enforces)
-- `references/harvest.md` — the stop pipeline and routing map
-- `scripts/detector.mjs` — the rule registry (`node detector.mjs <folder> [--gate=…] [--json]`)
-- `scripts/fixtures/` — contrastive fixtures + runner (authoring-time; never ships)
-- `evals/` — session-replay + audit harness (authoring-time; never ships)
+| Path | Holds |
+| --- | --- |
+| `SKILL.md` | the facilitator hub: re-anchor, commands, write ownership, capture, moves, dispatch, questions, promises |
+| `references/entry.md` | `/brainstorm start`: lookup, basis gate, bootstrap, intake, aspect map, orientation |
+| `references/doctrine.md` | the epistemics of the surface, shared by both seats, with the capture-and-converge field lessons |
+| `references/session-schema.md` | the on-disk contract the detector parses, and its rule table |
+| `references/harvest.md` | `/brainstorm stop`: the pipeline, the routing map, the apply field lessons |
+| `scripts/detector.mjs` | the rule registry: `node detector.mjs <folder> [--gate=session\|manifest\|move] [--json]` |
+| `scripts/fixtures/` | contrastive fixtures and their runner, `node scripts/fixtures/run-fixtures.mjs` |
+| `evals/` | `activation.json`, `evals.json`, the replay driver and its scenarios |

package/data/harnesses/code/skills/brainstorm/SKILL.md

@@ -1,192 +1,124 @@
 ---
 name: brainstorm
-description: "Use when starting or stopping a large-scale design brainstorm via `/brainstorm start | stop` — never on phrases like 'let's plan' or 'let's design'. Thinking-partner session; entry needs a basis (reference doc, prior session, or brain dump); drip-sized asks are redirected."
+description: "Use when the user types `/brainstorm start` or `/brainstorm stop` to run a thinking-partner session on a large-scale change, from a basis (a reference doc, a prior session folder, a brain dump) to a harvest into the living docs. Never on 'let's plan' or 'let's design'; small asks are redirected."
 ---
 
 # Brainstorm
 
-Help the user think correctly about a large-scale change, in a record that reads well at any
-pause, and end with a harvest so complete the session folder is useless. You are the
-**facilitator** — the conversation seat of a capability split across two seats:
+A thinking partner for a large-scale change. You are the **facilitator**: you hold the conversation, and your job is to help the user think correctly. The `brainstorm` agent, the **twin**, owns the paper: it writes the working surface, recomposes the thesis, audits it and drives the harvest. `scripts/detector.mjs` owns mechanical integrity. The session's product is the repository's living documentation; the session folder under `docs/research/{topic}-brainstorm/` is scaffolding, and the design assumes it is deleted once the harvest passes.
 
-| Seat | Owns | Writes |
-| --- | --- | --- |
-| **You** (this skill, main loop) | the conversation; dispatching the twin at gates and relaying its reports | `ops/capture.md` every turn, the sync-log dispatch lines, the basis at intake — **nothing else** |
-| **The twin** (the `brainstorm` agent, pinned strong tier) | the paper: distilling ops into the working surface, recomposing the thesis whole, audits, the harvest | every other file in the folder |
-| **The detector** (`scripts/detector.mjs`, run by the twin) | mechanical integrity | — |
+## Re-anchor whenever you lack the conversation
 
-**Never write the working surface yourself** — prose obligations decay in the conversing seat, and
-the split exists to keep them out of it.
+Resuming a parked session, a new sitting, and a context that was compacted mid-session are one procedure. The folder plus its capture is the session's whole memory, so re-entry is a read, never a reconstruction:
 
-Load each reference at its moment and read it in full — **never skim to save context**; this skill
-is sized by completeness:
+1. Find the active folder: `docs/research/*-brainstorm/` whose `state.md` reads `Status: open` (or `stopping`).
+2. Read `state.md` in full (posture line, aspect map) and the last ten entries of `ops/capture.md`.
+3. Dispatch the twin (§ Dispatching the twin): gate `start` for a resume or a new sitting, gate `on-demand` after compaction; scope `re-brief + freshness audit`.
+4. Relay its report, tell the user in two lines where the session stands, and continue in the posture `state.md` names.
 
-| Reference | Load when |
+## Commands
+
+Only these two commands enter or leave a session. The user decides when to converge and when to stop; you never close a session on your own reading of it.
+
+| Input | Do |
+| --- | --- |
+| `/brainstorm start`, a matching folder is open under `docs/research/` | Re-anchor (above) |
+| `/brainstorm start`, anything else | Read `references/entry.md` in full and run it |
+| `/brainstorm stop` | Read `references/harvest.md` in full and run it |
+| Any other turn while a session is open | The conduct below |
+
+## Who writes what
+
+| Writer | Writes |
+| --- | --- |
+| You | the folder, `ops/` and `ops/.gitignore` at bootstrap; `basis/` at intake; `ops/capture.md` every turn; the **dispatch** line of every `ops/sync-log.md` pair |
+| The twin | every other file: `state.md`, `thesis.md`, `forks.md`, `ledger.md`, `fragments/`, `ops/manifest.md`, the **result** line of every sync-log pair |
+| The user | anything; the twin folds a hand-edit forward as first-class signal |
+
+**Never write a surface file yourself, not even to fix a typo.** Filing, recomposition and hygiene are exactly the duties that decayed when the conversing seat held them, and a second writer on a file breaks the twin's diff against its own last compose. A correction you want goes into the capture; the twin applies it at the next dispatch.
+
+## Every turn: capture
+
+Append one entry to `ops/capture.md` per turn that carries anything session-relevant: `### T<n> · <UTC datetime>` (stamp from `date -u +%Y-%m-%dT%H:%MZ`), then the substance, both sides, labelled by speaker. The bar is the lowest one; anything that matters to the session goes in, distilled by the twin later:
+
+- what the user said that matters, with their own phrasing where the phrasing is the point;
+- your causal diagnoses ("the leak is X because Y");
+- informed rejections: the option, who rejected it, and why;
+- definitions of every term the session starts leaning on;
+- the reasoning chain behind any recommendation you make;
+- residue: asides, ideas mentioned in passing, things not pursued.
+
+**Your own substance is the class that leaks.** Conclusions survive in every record; the diagnoses, rejections, definitions and reasoning chains you produce are what an audited session lost, so capture them in the turn they arise. Never distil or reorganise the capture; distillation is the twin's.
+
+## Moves
+
+Five moves set who drives and how much gets asked. There is no mode field and no trigger word: any phrasing that implies a move triggers it ("I want to converge" converges), and the first time each fires, name it in one line. A session opens in dump or interview; the other three are mid-session moves.
+
+| Move | You do |
 | --- | --- |
-| `references/doctrine.md` | judging what a turn's substance *is* (force, fork, commitment), or how to word what you capture |
-| `references/session-schema.md` | bootstrapping a session, or interpreting detector or twin output |
-| `references/harvest.md` | at `stop`, before orchestrating the pipeline |
+| **Dump** | The user drives. Ask nothing mid-stream; reflect the shape, contradictions and implications back as they land, never sit silent |
+| **Interview** | You drive, in batches of two or three questions on one aspect, derived from the basis and the surface, never from a template or to fill an empty file |
+| **Probe** | Challenge flaws, edge cases and conflicts with the tech or domain fragment; capture each finding without demanding its resolution |
+| **Blindspot** | Dispatched, never conversed: the twin cold-reads the surface and returns at most five gated findings as forks; relay them in prose |
+| **Converge** | Burn forks down to decisions or explicit parks; each resolution carries its why and how it applies, each park a destination |
+
+Self-initiate a blindspot pass when the frame settles: an aspect closes, a converge burst lands, or a recompose materially changes the thesis. Widen the next reconcile dispatch's scope to `reconcile + blindspot`; it takes no conversational control, and its findings arrive as forks the user may ignore.
+
+If you cannot say in one line whether something is a fork, a decision or residue, or how a decision records what it declined, read `references/doctrine.md`.
+
+## Dispatching the twin
+
+| Gate | When |
+| --- | --- |
+| `start` | after the intake at entry; on resume or a new sitting |
+| `on-demand` | the user asks to read or sync ("let me read", "sync up", "what's open?"); after compaction; or the capture has outrun the surface: by default eight entries since the last reconciled sync, sooner when a converge burst lands |
+| `pause` | the user parks the session |
+| `stop` | each leg of the stop pipeline (`references/harvest.md`) |
+
+1. Append the dispatch line to `ops/sync-log.md` **before** dispatching: `S<n> | gate: <gate> | dispatched: <UTC datetime> | scope: <scope>`. Never write the result line; the pair is only evidence when two authors wrote it.
+2. Dispatch the `brainstorm` agent on the **strong tier** its definition pins (Opus on Anthropic; the flagship model at high reasoning effort on OpenAI), and name that model on the dispatch itself, so a runtime that ignores the pin cannot hand the twin the session's model. Distillation, recomposition and harvest are the capability-sensitive work; the pin keeps their quality independent of your tier.
+3. Brief it self-contained: the absolute session-folder path, the gate, the scope, the sync id, and the skill's own path so it finds `scripts/detector.mjs` and these references.
+4. Keep one dispatch in flight. Keep conversing while it runs, except at `start`, `pause`, the stop legs, and "let me read", which wait for the result.
+5. At the next turn break, relay its one-line report (edits · new forks · open · untouched aspects), what the recompose changed in the thesis, and any fork it raised, in prose. That line is the only convergence pressure the skill applies. Tell a `failed` result plainly and re-run it at the next gate.
 
-## The one habit that is yours: capture
+**"Let me read"** is a designed pause: dispatch a compose, say it takes a couple of minutes, point the user at `thesis.md`, and resume when they come back.
 
-Append to `ops/capture.md` **every turn**, both sides, at the lowest bar — raw notes, not prose:
+## Questions
 
-- what the user said that matters;
-- your own substance — causal diagnoses, informed rejections of options you presented,
-  definitions, reasoning chains behind recommendations;
-- residue you judge not worth filing.
+Structured questions (the `AskUserQuestion` tool, or a numbered pick list) appear at four sites only: the intake batch, interview batches, converge picks, and the stop approvals. Everywhere else, prose.
 
-Stamp each turn per the schema (`### T# · <ISO datetime>`). **Never distill here** — distillation is
-the twin's. Reasoning that lives only in the chat when the twin next dispatches has leaked. The
-folder plus ops is the session's whole memory, which is what makes every re-entry cheap.
+- **One pick per question, recommendation first**, related questions batched in one message.
+- **After about five structured batches, converge with defaults.** Draft the simplest answer for every remaining fork, show the list once, and let the user name exceptions; past that point new lines of inquiry are overthinking on the user's time. Override: the user asks for the forks one by one, and then each comes as one pick, recommendation first.
+- **Standing approval:** "don't seek any more approvals, I'll look at the final diffs" holds for the rest of the session, gap rounds included. Proceed on your recommendations, commit nothing, delete nothing, and leave every file for review.
+
+You stop for three things, and everything else proceeds on a default you state: what only the user knows (the idea itself, its scope, the sitting), the harvest manifest approval (it writes into canonical documents), and the delete-or-commit choice at the end (it destroys or publishes the record).
+
+## Promises
+
+- **No production code while a session is open.** Illustrative snippets live in the session folder; the session designs, it does not implement. Asked for production code, offer a sketch inside the folder, or `/brainstorm stop` first.
+- **No silent rewrite.** Every recompose of the user's thesis is reported at the next turn break with what moved.
+- **No canonical write unapproved.** Every harvest write, gap rounds included, follows an approved manifest.
+- **Capture stays out of git.** `ops/` is gitignored from bootstrap and deleted at the move.
+- **Plain English.** Name items by what they are; an id (`F3`, `D2`) rides in parentheses only where traceability needs it.
+
+## What this skill is NOT
+
+| Request | Goes to |
+| --- | --- |
+| "Let's plan", "let's design", "how should we build X" with no `/brainstorm start` | Not a session. The root policy file may *offer* one when work is large or contradicts a recorded pillar; never enter on your own |
+| A drip-sized ask: a one-line fix, a rename, one component's tweak | Redirect: too small for a session; do the work directly. Open a session only if the user insists |
+| Refining or stress-testing an existing plan file ("interview me", "poke holes in my plan") | the `interview` skill |
+| Writing for an audience: a memo, deck, exec update | the `writing` skill |
+| Authoring or editing a doc, LLD or plan outside a harvest | the `documentation` skill |
+| Migrating or resuming a session folder in an older format | Not supported; such a folder enters only as the basis of a fresh session |
 
-## `start`
+## Load triggers
 
-Find sessions by their folders — **no index keeps a row per session**. Active sessions are
-`docs/research/*-brainstorm/`, harvested ones `docs/history/brainstorms/*/`; the folder name is the
-topic and each `thesis.md` heading its subject.
+Read every triggered reference in full. This skill is sized by completeness: nothing in a reference is optional, skimmable or summarised elsewhere.
 
-| Topic matches | Do |
+| Reference | Read when |
 | --- | --- |
-| an active session | resume it (Re-entry, below) |
-| a harvested session, or a session folder in another format | offer it **as a basis** for a fresh session |
-| nothing | open a new session |
-
-**1 · The entry gate.** A session needs substance. Ask for a **basis**, now:
-
-- a reference document (path or URL);
-- a prior session folder, in any format — ingested exactly like a PRD: copied into `basis/`,
-  frozen, distilled; **never** operated on in place, **never** migrated;
-- a one-shot brain dump in prose.
-
-Drip-sized input (a bug fix, one button): say this skill is the wrong tool, and do not open the
-session unless the user explicitly overrides. No basis, no session.
-
-**2 · Bootstrap.**
-
-1. Name the folder `docs/research/{topic}-brainstorm/` (kebab slug); confirm it in one line.
-2. Create `ops/` holding a `.gitignore` containing `*`, `ops/capture.md`, and `ops/sync-log.md`.
-3. Copy the basis into `basis/`. Add no index row — the folder is the session's entry.
-4. Write the sync-log dispatch line and dispatch the twin (gate: start) to write the initial
-   surface. **Never scaffold** `state.md`, `thesis.md`, `forks.md`, or `ledger.md` yourself.
-
-**3 · Calibrate and frame.**
-
-1. Distill the basis first — it seeds everything.
-2. Calibrate from the living docs (the ownership index, recent decision records, any
-   open-questions doc), so your questions match this repo, not a template.
-3. Ask one `AskUserQuestion` batch:
-   - **sitting** — single sprint (the default, and the shape that succeeds) or explicitly multi;
-   - **execution reality** — greenfield, brownfield, or hybrid; a migration gotcha found at plan
-     time is found too late;
-   - **where the idea is now** — fully in their head → dump; half-formed → interview.
-4. Propose the **aspect map** — the thinking dimensions for *this* idea, derived from the basis,
-   from no fixed list. The user edits it; it lives in `state.md`.
-
-**4 · Orient.** In 3–4 lines, written for a first-time user: how the session works (you talk, the
-folder keeps everything), the steering verbs in plain words, "let me read" (pause and read the
-thesis anytime), and what `stop` does (converge → your approval → harvest → the folder moves and
-you choose delete or commit). Then begin — **always in dump or interview**; probe and converge are
-mid-session moves, never starting postures.
-
-## The moves
-
-Five user-steerable moves set who drives and how much gets asked. There is no `MODE:` field, no
-switch ceremony, and no sanctioned trigger word: **any phrasing that implies a move triggers it**
-("I want to poke holes" → probe; "what am I missing?" → blindspot; "let's decide" → converge). The
-first time each move fires, name what you are doing in one line. When the signals call for a
-switch (the user monologues mid-interview; every probe answer is "haven't thought about it"), offer
-it once — never seize it.
-
-- **dump** — the user drives. Ask no questions mid-stream. Reflect back the shape, contradictions,
-  and implications as they land — that reflection is the active listening; **never sit silent**.
-- **interview** — you drive. `AskUserQuestion` batches of 2–3, one aspect at a time. Derive the
-  questions from the basis and the current surface — **never** from a template inventory, and
-  **never** interview to fill empty files.
-- **probe** — you challenge: flaws, edge cases, conflicts with the tech or domain fragment. Note
-  each finding in ops and move on; **never** demand resolution mid-probe.
-- **blindspot** — the hunt for unknown unknowns, **dispatched, never conversed**: you co-built the
-  frame, so the outside view belongs to the twin.
-  1. Dispatch the twin (gate: on demand, scope: blindspot) to cold-read the whole surface against
-     the thesis's stated goal. Its quality gate kills any candidate not grounded in this folder,
-     material to the design, new, and answerable; at most five survivors return, each already
-     filed as a fork.
-  2. Relay survivors in prose — finding → why it is material here → what answering it would
-     change — **never** as a question barrage: the user engages what matters, and converge burns
-     the rest down later. Zero survivors is one relay line; **never** manufacture findings.
-  3. Self-initiate a pass, without offering, whenever the frame settles — an aspect closes, a
-     converge burst lands, the thesis materially recomposes — by widening a reconcile dispatch's
-     scope. A user-only trigger makes coverage depend on the user remembering to ask.
-- **converge** — burn forks down to commitments or explicit parks, with `AskUserQuestion` for
-  picks. Each resolution carries Why and How to apply; you capture it, the twin files it.
-
-## Twin dispatches — the gates
-
-Dispatch at **start** (bootstrap), **on demand** (below), **pause**, and **stop** — **one dispatch in
-flight at a time**.
-
-1. Before each dispatch, write its line to `ops/sync-log.md`
-   (`S# | gate: <g> | dispatched: <ts> | scope: <s>`). The twin appends the result; the pairing
-   keeps reconciliation observable instead of asserted.
-2. At the next turn break, relay the twin's one-line report ("4 edits · 2 new forks · 6 open ·
-   untouched: risks") plus what the recompose changed — a rewrite of the user's thinking is
-   **never** silent. The report is the only ambient convergence pressure this skill applies.
-3. On a `failed` result, tell the user plainly and re-dispatch at the next gate.
-
-**On demand** means the user asks ("let me read", "sync up", "what's open?"), or you judge the
-capture has outrun the surface meaningfully. **"Let me read"** is a designed-for pause, not an
-interruption: dispatch a compose (say honestly it takes a couple of minutes), point the user at
-`thesis.md` — claim → argument → what changed, stamped — and resume when they return.
-
-## Re-entry — resume, or context loss
-
-Re-entry is a read, not a reconstruction. It covers three triggers identically: resuming a parked
-session, a new sitting, and **losing conversational context mid-session (compaction)** — finding
-yourself mid-session without memory of it means running this procedure; nothing you "remembered"
-matters.
-
-1. Re-read this hub, `state.md` (posture line first), and the tail of `ops/capture.md`.
-2. Dispatch the twin (gate: on demand) for a re-brief and freshness audit.
-
-While a session folder exists, read `state.md` at the start of every turn.
-
-## `stop` — the fixed pipeline
-
-Read `references/harvest.md` first. The pipeline **always** runs — a stop *is* convergence plus
-harvest. You orchestrate; the twin executes each leg.
-
-1. **Converge** — resolve every open fork now, or park it explicitly with a destination
-   (mini-converge in conversation; the scope-guard trio in `harvest.md` disambiguates parks). If no
-   blindspot round has run this session, offer one first, once — an unknown unknown found after
-   commitments freeze is the expensive kind.
-2. **Final sync and manifest** — dispatch the twin (gate: stop). It builds the manifest only when
-   the detector's manifest gate is clean; relay anything blocking.
-3. **One approval** — present the manifest via `AskUserQuestion`. Gap rounds re-enter here: every
-   write to canonical docs is user-approved, **no exceptions**.
-4. **Apply → uselessness test → move** — the twin's legs; relay the results. Harvest fails loud: a
-   partial apply leaves the folder visibly unfinished in `docs/research/` and the user restarts the
-   stop — **never** resume silently.
-5. **The offer** — after the move to `docs/history/brainstorms/{topic}/`, ask via
-   `AskUserQuestion`: **delete the folder, or commit it**. The user decides; the design assumes
-   deletion.
-
-## Conduct — holds for the whole session
-
-1. **Speak plain English; codes live in files.** Name every item by what it is, with the code in
-   parentheses only where traceability needs it ("…the timeout question (F2)"). **Never** lead with
-   a bare `F3`/`D7`.
-2. **No production code outside the session folder while it is open.** Illustrative snippets live
-   in the folder. Asked for production code, offer a sketch inside the folder, or `/brainstorm stop`
-   first.
-3. **`AskUserQuestion` at exactly four sites:** the intake frame batch, interview batches, converge
-   picks, and the stop approvals (manifest; delete-or-commit). Everywhere else, prose.
-4. **Suggested, never seized.** Moves, abstractions, probes — one offer each; accept refusal
-   without re-litigating. The one exemption is a self-initiated blindspot dispatch: it takes no
-   conversational control, and its findings arrive as forks the user may ignore.
-5. **Nothing lives only in the transcript.** What is not in the folder or in ops does not exist.
-   Flaws, gaps, and contradictions reach the twin as capture; the twin turns them into forks, the
-   only convergence currency.
-6. **The user decides when to converge and when to stop.** Distance-to-coherent is visible in every
-   relayed twin report; **never** say "let's decide now."
-7. **Only `/brainstorm start` and `/brainstorm stop` enter or leave a session.** No
-   auto-invocation, ever.
+| `references/entry.md` | `/brainstorm start` with no open matching folder |
+| `references/doctrine.md` | the first capture of a session; whenever you cannot say in one line how a fork, decision, decline or thesis is shaped |
+| `references/session-schema.md` | bootstrap; writing a capture entry or dispatch line you are unsure of; relaying a detector finding |
+| `references/harvest.md` | `/brainstorm stop`; any question about where session content lands |