@ouro.bot/cli 0.1.0-alpha.13 → 0.1.0-alpha.131

package/dist/senses/trust-gate.js

@@ -39,6 +39,9 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const identity_1 = require("../heart/identity");
 const runtime_1 = require("../nerves/runtime");
+const types_1 = require("../mind/friends/types");
+const pending_1 = require("../mind/pending");
+// Canned reply; eventually agents should compose their own first-contact message
 exports.STRANGER_AUTO_REPLY = "I'm sorry, I'm not allowed to talk to strangers";
 function buildExternalKey(provider, externalId, tenantId) {
     return `${provider}:${tenantId ?? ""}:${externalId}`;
@@ -77,16 +80,107 @@ function appendPrimaryNotification(bundleRoot, provider, externalId, tenantId, n
     fs.mkdirSync(inboxDir, { recursive: true });
     fs.appendFileSync(notificationsPath, `${JSON.stringify(payload)}\n`, "utf8");
 }
+function writeInnerPendingNotice(bundleRoot, noticeContent, nowIso) {
+    const innerPendingDir = path.join(bundleRoot, "state", "pending", pending_1.INNER_DIALOG_PENDING.friendId, pending_1.INNER_DIALOG_PENDING.channel, pending_1.INNER_DIALOG_PENDING.key);
+    const fileName = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.json`;
+    const filePath = path.join(innerPendingDir, fileName);
+    const payload = {
+        from: "instinct",
+        content: noticeContent,
+        timestamp: Date.now(),
+        at: nowIso,
+    };
+    fs.mkdirSync(innerPendingDir, { recursive: true });
+    fs.writeFileSync(filePath, JSON.stringify(payload), "utf-8");
+}
 function enforceTrustGate(input) {
+    const { senseType } = input;
+    // Local (CLI) and internal (inner dialog) — always allow
+    if (senseType === "local" || senseType === "internal") {
+        return { allowed: true };
+    }
+    // Closed senses (Teams) — org already gates access, allow all trust levels
+    if (senseType === "closed") {
+        return { allowed: true };
+    }
+    // Open senses (BlueBubbles/iMessage) — enforce trust rules
     const trustLevel = input.friend.trustLevel ?? "friend";
-    if (trustLevel !== "stranger") {
+    // Family and friend — always allow on open
+    if ((0, types_1.isTrustedLevel)(trustLevel)) {
         return { allowed: true };
     }
     const bundleRoot = input.bundleRoot ?? (0, identity_1.getAgentRoot)();
-    const repliesPath = path.join(bundleRoot, "stranger-replies.json");
     const nowIso = (input.now ?? (() => new Date()))().toISOString();
+    // Acquaintance rules
+    if (trustLevel === "acquaintance") {
+        return handleAcquaintance(input, bundleRoot, nowIso);
+    }
+    // Stranger rules (trustLevel === "stranger")
+    return handleStranger(input, bundleRoot, nowIso);
+}
+function handleAcquaintance(input, bundleRoot, nowIso) {
+    const { isGroupChat, groupHasFamilyMember, hasExistingGroupWithFamily } = input;
+    // Group chat with family member present — allow
+    if (isGroupChat && groupHasFamilyMember) {
+        return { allowed: true };
+    }
+    let result;
+    let noticeDetail;
+    if (isGroupChat) {
+        // Group chat without family member — reject silently
+        result = { allowed: false, reason: "acquaintance_group_no_family" };
+        noticeDetail = `acquaintance "${input.friend.name}" messaged in a group chat without a family member present`;
+    }
+    else if (hasExistingGroupWithFamily) {
+        // 1:1 but shares a group with family — redirect
+        result = {
+            allowed: false,
+            reason: "acquaintance_1on1_has_group",
+            autoReply: "Hey! Reach me in our group chat instead.",
+        };
+        noticeDetail = `acquaintance "${input.friend.name}" DMed me directly — redirected to our group chat`;
+    }
+    else {
+        // 1:1, no shared group with family — redirect to any group
+        result = {
+            allowed: false,
+            reason: "acquaintance_1on1_no_group",
+            autoReply: "Hey! Reach me in a group chat instead.",
+        };
+        noticeDetail = `acquaintance "${input.friend.name}" DMed me directly — asked to reach me in a group chat`;
+    }
+    (0, runtime_1.emitNervesEvent)({
+        level: "warn",
+        component: "senses",
+        event: "senses.trust_gate",
+        message: "acquaintance message blocked",
+        meta: {
+            channel: input.channel,
+            provider: input.provider,
+            reason: result.reason,
+        },
+    });
+    try {
+        writeInnerPendingNotice(bundleRoot, noticeDetail, nowIso);
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "senses",
+            event: "senses.trust_gate_error",
+            message: "failed to write inner pending notice",
+            meta: {
+                reason: error instanceof Error ? error.message : String(error),
+            },
+        });
+    }
+    return result;
+}
+function handleStranger(input, bundleRoot, nowIso) {
+    const repliesPath = path.join(bundleRoot, "stranger-replies.json");
     const externalKey = buildExternalKey(input.provider, input.externalId, input.tenantId);
     const state = loadRepliesState(repliesPath);
+    // Subsequent contact — silent drop
     if (state[externalKey]) {
         (0, runtime_1.emitNervesEvent)({
             level: "warn",
@@ -103,6 +197,7 @@ function enforceTrustGate(input) {
             reason: "stranger_silent_drop",
         };
     }
+    // First contact — auto-reply, persist state, notify agent
     state[externalKey] = nowIso;
     try {
         persistRepliesState(repliesPath, state);
@@ -132,6 +227,21 @@ function enforceTrustGate(input) {
             },
         });
     }
+    const noticeDetail = `stranger "${input.friend.name}" tried to reach me via ${input.channel}. Auto-replied once.`;
+    try {
+        writeInnerPendingNotice(bundleRoot, noticeDetail, nowIso);
+    }
+    catch (error) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "senses",
+            event: "senses.trust_gate_error",
+            message: "failed to write inner pending notice",
+            meta: {
+                reason: error instanceof Error ? error.message : String(error),
+            },
+        });
+    }
     (0, runtime_1.emitNervesEvent)({
         level: "warn",
         component: "senses",

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.13",
+  "version": "0.1.0-alpha.131",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
+    "cli": "dist/heart/daemon/ouro-bot-entry.js",
     "ouro": "dist/heart/daemon/ouro-entry.js",
     "ouro.bot": "dist/heart/daemon/ouro-bot-entry.js"
   },
@@ -10,7 +11,8 @@
     "dist/",
     "AdoptionSpecialist.ouro/",
     "subagents/",
-    "assets/"
+    "assets/",
+    "changelog.json"
   ],
   "exports": {
     ".": "./dist/heart/daemon/daemon-cli.js",
@@ -31,15 +33,19 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.78.0",
+    "@azure/identity": "^4.13.0",
     "@microsoft/teams.apps": "^2.0.5",
     "@microsoft/teams.dev": "^2.0.5",
-    "openai": "^6.27.0"
+    "fast-glob": "^3.3.3",
+    "openai": "^6.27.0",
+    "semver": "^7.7.4"
   },
   "repository": {
     "type": "git",
     "url": "https://github.com/ouroborosbot/ouroboros"
   },
   "devDependencies": {
+    "@types/semver": "^7.7.1",
     "@vitest/coverage-v8": "^4.0.18",
     "eslint": "^10.0.2",
     "typescript": "^5.7.0",

package/subagents/README.md

@@ -1,73 +1,7 @@
-# Sub-agents
+# Workflow Skills (Moved)
 
-These are source-of-truth workflow definitions (`work-planner`, `work-doer`, `work-merger`) for planning, execution, and merge. They can be consumed either as Claude sub-agents (`.md` files with YAML frontmatter) or as Codex-style skills (`SKILL.md`).
+The workflow skills (`work-planner`, `work-doer`, `work-merger`) have moved to the shared skills repository:
 
-## Installation
+**https://github.com/ouroborosbot/ouroboros-skills**
 
-### Claude Code (sub-agents)
-
-Copy or symlink these files into Claude's sub-agent directory:
-
-```bash
-# Claude Code
-cp subagents/*.md ~/.claude/agents/
-# or
-ln -s "$(pwd)"/subagents/*.md ~/.claude/agents/
-```
-
-### Codex / skill-based harnesses
-
-For tools that support skills but not Claude sub-agents, install these as skills:
-
-```bash
-mkdir -p ~/.codex/skills/work-planner ~/.codex/skills/work-doer ~/.codex/skills/work-merger
-
-# Hard-link to keep one source of truth
-ln -f "$(pwd)/subagents/work-planner.md" ~/.codex/skills/work-planner/SKILL.md
-ln -f "$(pwd)/subagents/work-doer.md" ~/.codex/skills/work-doer/SKILL.md
-ln -f "$(pwd)/subagents/work-merger.md" ~/.codex/skills/work-merger/SKILL.md
-```
-
-**Important:** Hard-links break when editors save by replacing the file (new inode). After editing any `subagents/*.md` file, re-run the `ln -f` command for that file to restore the link. You can verify with `stat -f '%i'` — both files should share the same inode.
-
-Optional UI metadata:
-
-```bash
-mkdir -p ~/.codex/skills/work-planner/agents ~/.codex/skills/work-doer/agents ~/.codex/skills/work-merger/agents
-cat > ~/.codex/skills/work-planner/agents/openai.yaml << 'EOF'
-interface:
-  display_name: "Work Planner"
-  short_description: "Create and gate planning/doing task docs"
-  default_prompt: "Use $work-planner to create or update a planning doc, then stop at NEEDS_REVIEW."
-EOF
-cat > ~/.codex/skills/work-doer/agents/openai.yaml << 'EOF'
-interface:
-  display_name: "Work Doer"
-  short_description: "Execute approved doing docs with strict TDD"
-  default_prompt: "Use $work-doer to execute an approved doing doc unit by unit."
-EOF
-cat > ~/.codex/skills/work-merger/agents/openai.yaml << 'EOF'
-interface:
-  display_name: "Work Merger"
-  short_description: "Merge feature branch into main via PR after work-doer completes"
-  default_prompt: "Use $work-merger to merge the current feature branch into main."
-EOF
-```
-
-Restart the harness after install so new skills are discovered.
-
-## Available sub-agents
-
-| File | Purpose |
-|------|---------|
-| `work-planner.md` | Interactive task planner. Generates planning docs through conversation, then converts to doing docs after human approval. |
-| `work-doer.md` | Task executor. Reads a doing doc and works through each unit sequentially with strict TDD. |
-| `work-merger.md` | Sync-and-merge agent. Merges feature branch into main via PR after work-doer completes. Handles conflicts, CI failures, and race conditions. |
-
-## Workflow
-
-1. Human describes a task
-2. Agent invokes **work-planner** to create a planning doc → human approves → planner converts to doing doc
-3. Agent invokes **work-doer** to execute the doing doc unit by unit
-4. Each unit is committed independently with progress tracked in the doing doc
-5. Agent invokes **work-merger** to merge the feature branch into main via PR (fetch, merge, resolve conflicts, CI gate, merge PR, cleanup)
+To install or update these skills, use the **skill-management** skill from that repo. It covers browsing available skills, installing them into your agent's local skills directory, and keeping them up to date.

package/dist/heart/daemon/subagent-installer.js

@@ -1,134 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.installSubagentsForAvailableCli = installSubagentsForAvailableCli;
-const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const child_process_1 = require("child_process");
-const runtime_1 = require("../../nerves/runtime");
-function detectCliBinary(binary) {
-    const result = (0, child_process_1.spawnSync)("which", [binary], { encoding: "utf-8" });
-    if (result.status !== 0)
-        return null;
-    const resolved = result.stdout.trim();
-    return resolved.length > 0 ? resolved : null;
-}
-function listSubagentSources(subagentsDir) {
-    if (!fs.existsSync(subagentsDir))
-        return [];
-    return fs.readdirSync(subagentsDir)
-        .filter((name) => name.endsWith(".md"))
-        .filter((name) => name !== "README.md")
-        .map((name) => path.join(subagentsDir, name))
-        .sort((a, b) => a.localeCompare(b));
-}
-function pathExists(target) {
-    try {
-        fs.lstatSync(target);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function ensureSymlink(source, target) {
-    fs.mkdirSync(path.dirname(target), { recursive: true });
-    if (pathExists(target)) {
-        const stats = fs.lstatSync(target);
-        if (stats.isSymbolicLink()) {
-            const linkedPath = fs.readlinkSync(target);
-            if (linkedPath === source)
-                return false;
-        }
-        fs.unlinkSync(target);
-    }
-    fs.symlinkSync(source, target);
-    return true;
-}
-async function installSubagentsForAvailableCli(options = {}) {
-    const repoRoot = options.repoRoot ?? path.resolve(__dirname, "..", "..", "..");
-    const homeDir = options.homeDir ?? os.homedir();
-    const which = options.which ?? detectCliBinary;
-    const subagentsDir = path.join(repoRoot, "subagents");
-    const sources = listSubagentSources(subagentsDir);
-    const notes = [];
-    (0, runtime_1.emitNervesEvent)({
-        component: "daemon",
-        event: "daemon.subagent_install_start",
-        message: "starting subagent auto-install",
-        meta: { sources: sources.length },
-    });
-    if (sources.length === 0) {
-        notes.push(`no subagent files found at ${subagentsDir}`);
-        return { claudeInstalled: 0, codexInstalled: 0, notes };
-    }
-    let claudeInstalled = 0;
-    let codexInstalled = 0;
-    const claudePath = which("claude");
-    if (!claudePath) {
-        notes.push("claude CLI not found; skipping subagent install");
-    }
-    else {
-        const claudeAgentsDir = path.join(homeDir, ".claude", "agents");
-        for (const source of sources) {
-            const target = path.join(claudeAgentsDir, path.basename(source));
-            if (ensureSymlink(source, target)) {
-                claudeInstalled += 1;
-            }
-        }
-    }
-    const codexPath = which("codex");
-    if (!codexPath) {
-        notes.push("codex CLI not found; skipping subagent install");
-    }
-    else {
-        const codexSkillsDir = path.join(homeDir, ".codex", "skills");
-        for (const source of sources) {
-            const skillName = path.basename(source, ".md");
-            const target = path.join(codexSkillsDir, skillName, "SKILL.md");
-            if (ensureSymlink(source, target)) {
-                codexInstalled += 1;
-            }
-        }
-    }
-    (0, runtime_1.emitNervesEvent)({
-        component: "daemon",
-        event: "daemon.subagent_install_end",
-        message: "completed subagent auto-install",
-        meta: { claudeInstalled, codexInstalled, notes: notes.length },
-    });
-    return { claudeInstalled, codexInstalled, notes };
-}

package/subagents/work-doer.md

@@ -1,233 +0,0 @@
----
-name: work-doer
-description: Executes doing.md units sequentially with strict TDD. Reads the doing doc, works through each unit, commits after each. Use after planning is complete and doing.md exists.
-model: opus
----
-
-You are a task executor. Read a doing.md file and execute all units sequentially until complete or blocked.
-
-## On Startup
-
-1. **Find doing doc**: Look for `YYYY-MM-DD-HHMM-doing-*.md` in repo root
-2. If multiple found, ask which one
-3. If none found, ask user for location
-4. **Check execution_mode**: Read the doing doc's `Execution Mode` field
-5. **Verify artifacts directory exists**: `{task-name}/` next to `{task-name}.md`
-   - If missing, create it: `mkdir {task-name}`
-6. **Detect resume vs fresh start:**
-   - Count completed units (✅) vs total units
-   - Check git status for uncommitted changes
-
-7. **Announce status clearly:**
-
-**If fresh start (0 units complete):**
-```
-found: YYYY-MM-DD-HHMM-doing-{name}.md
-execution_mode: [pending|spawn|direct]
-artifacts: ./{task-name}/
-status: fresh start
-units: 0/X complete
-starting Unit 0...
-```
-
-**If resuming (some units complete):**
-```
-found: YYYY-MM-DD-HHMM-doing-{name}.md
-execution_mode: [pending|spawn|direct]
-status: RESUMING
-units: Y/X complete (✅ Unit 0, 1a, 1b...)
-uncommitted changes: [yes/no]
-resuming from Unit Z...
-```
-
-**If uncommitted changes detected:**
-```
-⚠️ uncommitted changes found
-recommend: commit or stash before continuing
-proceed anyway? (y/n)
-```
-
----
-
-## Timestamp & Commit Pattern
-
-**All timestamps come from git commits for audit trail.**
-
-To get timestamp for progress log entries:
-```bash
-git log -1 --format="%Y-%m-%d %H:%M"
-```
-
-After any edit to doing doc:
-1. Stage: `git add doing-*.md`
-2. Commit: `git commit -m "docs(doing): <what changed>"`
-3. Get timestamp from git log
-4. Use that timestamp in progress log entry
-
----
-
-## Execution Loop
-
-For each unit in order:
-
-### 1. Announce
-```
-starting Unit Xa: [name]
-```
-
-### 2. Execute (TDD strictly enforced)
-
-**General execution rules:**
-- Save all outputs, logs, and data to `{task-name}/` artifacts directory
-- If execution_mode is `pending`, wait for user approval before starting each unit
-- If execution_mode is `spawn`, spawn a sub-agent for each unit
-- If execution_mode is `direct`, proceed immediately
-
-**For test units (Xa):**
-1. Write failing tests for the feature
-2. Run tests — **must FAIL (red)**
-3. If tests pass immediately, something is wrong — investigate
-4. Commit: `git commit -m "test(scope): Unit Xa - [description]"`
-5. Push
-
-**For implementation units (Xb):**
-1. Write minimal code to make tests pass
-2. **Do NOT modify tests** — implementation must satisfy existing tests
-3. Run tests — **must PASS (green)**
-4. **Run the build** (e.g. `npm run build`, `cargo build`, `go build`) — the project must compile with no errors. Tests alone are not sufficient (test runners may handle imports/modules differently than the real compiler).
-5. No warnings allowed
-6. Commit: `git commit -m "feat(scope): Unit Xb - [description]"`
-7. Push
-
-**For verify/refactor units (Xc):**
-1. Run coverage report
-2. **Must be 100% on new code** — if not, add tests
-3. Check edge cases: null, empty, boundary values
-4. Check all error paths tested
-5. Refactor if needed, keep tests green
-6. **Run the build** — verify the project compiles clean
-7. Commit: `git commit -m "refactor(scope): Unit Xc - [description]"` (if changes made)
-8. Push
-
-**For non-coding units:**
-1. Complete work as described
-2. Produce specified output
-3. Verify acceptance criteria
-4. Commit relevant files
-5. Push
-
-### 3. Update doing.md
-- Change unit status: `⬜` → `✅`
-- Update `Completion Criteria` checkboxes that are now satisfied by this unit's evidence
-- Commit: `git commit -m "docs(doing): complete Unit Xa"`
-- Get timestamp: `git log -1 --format="%Y-%m-%d %H:%M"`
-- Add progress log entry with that timestamp:
-  ```
-  - 2026-02-03 14:25 Unit Xa complete: [brief summary]
-  ```
-
-### 4. Context management
-- Run `/compact` between units if context growing large
-- Each unit should be independent
-- Re-read files if you need prior context
-
-### 5. Continue to next unit
-
----
-
-## Code Coverage Requirements
-
-**MANDATORY: 100% coverage on all new code.**
-
-Before marking any implementation unit complete:
-1. Run coverage report
-2. Verify 100% on new/modified files
-3. No `[ExcludeFromCodeCoverage]` or equivalent on new code
-4. All branches covered (if/else, switch, try/catch)
-5. All error paths have tests
-6. If coverage < 100%, add tests before proceeding
-
----
-
-## TDD Requirements
-
-**Strict TDD — no exceptions:**
-
-1. **Tests first**: Write failing tests BEFORE any implementation
-2. **Red**: Run tests, confirm they FAIL
-3. **Green**: Write minimal code to pass
-4. **Refactor**: Clean up, tests stay green
-5. **Never skip**: No implementation without failing test first
-6. **Never modify tests to pass**: Implementation satisfies tests, not vice versa
-
----
-
-## Blocker Handling
-
-**For simple fixes or test failures:**
-1. **Spawn sub-agent immediately** — don't ask, just do it
-2. Sub-agent analyzes error, fixes issue, commits, pushes
-3. Sub-agent reports back when done
-4. Continue with next unit
-
-**For actual blockers (requirements unclear, external dependency, design decision needed):**
-1. Mark unit as `❌ Blocked` in doing.md
-2. Commit: `git commit -m "docs(doing): Unit Xa blocked"`
-3. Get timestamp from git
-4. Add progress log entry with error details
-5. Output:
-   ```
-   ❌ blocked on Unit Xa
-   error: [description]
-   tried: [what you attempted]
-   need: [what would help]
-   ```
-6. **STOP** — do not proceed until user resolves
-
-**Rule of thumb:**
-- Code error / test failure → spawn sub-agent
-- Requirement unclear / need user input → mark blocked and stop
-
----
-
-## Completion
-
-When all units are `✅`:
-1. Run full test suite one final time
-2. Verify all tests pass, no warnings
-3. Mark all satisfied `Completion Criteria` checkboxes in doing doc as `[x]`
-4. If `Planning:` doc path exists, sync its `Completion Criteria` checkboxes to `[x]` based on final evidence
-5. Update doing.md Status to `done`
-6. Commit: `git commit -m "docs(doing): all units complete"`
-7. Get timestamp from git
-8. Add final progress log entry
-9. Output:
-   ```
-   ✅ all units complete
-   tests: [X passing]
-   coverage: [X%]
-   status: done
-   ```
-
----
-
-## Rules
-
-1. **File naming**: Expect `YYYY-MM-DD-HHMM-doing-{name}.md` format
-2. **Artifacts directory**: Use `{task-name}/` for all outputs, logs, data
-3. **Execution mode**: Honor `pending | spawn | direct` from doing doc
-4. **TDD strictly enforced** — tests before implementation, always
-5. **100% coverage** — no exceptions, no exclude attributes
-6. **Atomic commits** — one logical unit per commit, push after each
-7. **Timestamps from git** — `git log -1 --format="%Y-%m-%d %H:%M"`
-8. **Push after each unit phase complete**
-9. **Update doing.md after each unit** — status and progress log
-10. **Spawn sub-agents for fixes** — don't ask, just do it
-11. **Update docs immediately** — when decisions made, commit right away
-12. **Stop on actual blocker** — unclear requirements or need user input
-13. **/compact proactively** — preserve context between units
-14. **No warnings** — treat warnings as errors
-15. **Run full test suite** — before marking unit complete, not just new tests
-16. **Always compile** — run the project's build command after every implementation/refactor unit. Tests passing is necessary but not sufficient.
-17. **Checklist hygiene is mandatory** — keep doing/planning `Completion Criteria` checklists synchronized with verified completion evidence.
-18. **Verify APIs before importing** — before writing `import { Foo } from './bar'`, use `grep` or `read_file` to confirm `Foo` is actually exported from that module. Never assume an export exists — always check the source first. This prevents wasted cycles on "module has no exported member" errors.