@printpractical/cruze 0.0.9 → 0.0.10

package/skills/research/SKILL.md

@@ -15,13 +15,14 @@ Run these steps for each component in a design that isn't domain logic. Domain l
 2. Look in order: the language's standard library, the project's already-approved dependencies, then mature libraries in the ecosystem. Done when you have checked all three.
 3. For the two or three serious candidates, gather the evidence in [evaluation.md](evaluation.md).
 4. Recommend one. Adopt a library, or build with a concrete reason: the behaviour is specific to this product, no candidate meets a stated constraint, every candidate brings disproportionate risk or complexity, or the capability is the product itself. Weigh the candidates as `.agents/skills/cruze-dependency-approval/SKILL.md` says under Weighing, where avoiding a dependency is never a reason.
-5. Record the result as a row in the `## Adopt or build` table of the feature or standalone change, as Component, Decision, Choice and Reason. At project scope, record it as the adapter's `Adopts` fact, and put rows for anything no adapter owns in the walking-skeleton change's `## Adopt or build`. When the evidence runs longer than the reason, write it to `.cruze/notes/<date>-<slug>.md` and cite that note in the reason.
+5. Record the result as a row in the `## Adopt or build` table of the feature or standalone change, as Component, Decision, Choice and Reason. At project scope, record it as the adapter's `Adopts` fact, and put rows for anything no adapter owns in the walking-skeleton change's `## Adopt or build`. When the evidence runs longer than the reason, run `cruze new note <slug> --title "<title>" --kind research --about <feature slug or context>`, write the evidence there, and cite that note in the reason.
 6. Take the recommendation to the user. Adopting means a new dependency, which follows `.agents/skills/cruze-dependency-approval/SKILL.md`. Building commodity functionality is the user's call as well.
 7. Verify what the design will rely on. List each claim the design or its testing approach makes about anything it doesn't build:
    - an adopted library or tool: the features or flags it needs, and each command the design spells out, such as a CI step;
    - each type, trait, macro or API the design names from a package: that the package exports it at that version, and every crate, package or target that must declare the package to use it, test support included;
    - the language or runtime, such as whether a trait with async methods can be used as a trait object;
-   - the platform's test environment, such as which permissions a test process gets;
+   - the platform's test environment, such as which permissions a test process gets, and every package a new test image installs, with the whole suite run once in it;
+   - each new method, trait or call shape the design gives the project's own types: compile a sketch beside the methods its receiver already has, on a concrete type and on a trait object, since a new name can be ambiguous on one and not the other;
    - an external system the product talks to, such as what a broker logs or how it answers.
 
    Once the user has approved any dependency involved, check each claim by running it: build a scratch project outside the repository with exactly the declared features, and run each command there or with `--help`, or run the external system and watch it. When a claim can't be run, check it in that version's source, and say so. Write the features into the `Adopts` fact or the row's Choice.

package/skills/rethink/SKILL.md

@@ -9,7 +9,7 @@ Finding a design flaw mid-build is information, not failure. Rethink amends the
 
 ## Steps
 
-1. **State the discovery.** Say what is wrong or new, and quote the evidence: the failing test, the output, the document line, or what the user said.
+1. **State the discovery.** Say what is wrong or new, and quote the evidence: the failing test, the output, the document line, or what the user said. When `cruze next` sent you here for findings decided `rethink`, those findings are the discovery: `cruze show <ref>` lists them in its ledger.
 2. **Classify it.** Pick the level from the table below, using the highest level the discovery touches. Pick its kind:
    - **Defect:** a Cruze step should have caught it.
    - **Discovery:** it is new information no step could have had.
@@ -19,7 +19,7 @@ Finding a design flaw mid-build is information, not failure. Rethink amends the
 4. **Amend that level,** following the level's section in [levels.md](levels.md). Settle any decision the amendment needs with the user, and record it as that level records decisions.
 5. **Keep completed work.** A ticked task stays ticked unless the amendment changes its owner, its files, or what it proves. Reopen each task that changed with `cruze task reopen T<n> "<what changed>"`. Its commits stay in history, and build redoes the task.
 6. **Re-approve what went stale.** Run `cruze status` and work from the top down. The amended document comes first, and the user approves it as its level says. Then take each feature or change it lists as `upstream changed`, whose own text you didn't edit:
-   - Read the diff of the elements it names, and check the work still holds against them. When it doesn't, amend it too, and the user approves it as an amended document.
+   - Run `cruze diff <ref>`. It shows each changed element's approved and current text, and whether the work's delta needs a rebase. Check the work still holds against it. When it doesn't, amend it too, and the user approves it as an amended document.
    - When it holds, re-stamp it with `cruze approve <ref> --restamp-unchanged`. The CLI refuses work whose own text changed, a project document, and a change with a task reopened since its approval; the user re-approves those.
 
    Tell the user, in one line each, what you re-stamped and why it still holds. They can object, and that document goes to them. A change's verification carries over when its own design didn't change.
@@ -32,7 +32,9 @@ Finding a design flaw mid-build is information, not failure. Rethink amends the
      --set agent="<the agent you run in>" [--item <ref>]
    ```
 
-   `found_by` is the step that found it. A defect also needs `missed_by`, the earliest step whose job was to catch it. Both take one of `envision`, `architect`, `research`, `design-review`, `walkthrough`, `plan`, `plan-review`, `build`, `code-review`, `verify`, `land`, `realign`, `improve`, `validate`, `check` or `user`. When a design review ran over the element and an item of its rubric in `.agents/skills/cruze-roles/design-reviewer.md` covers the gap, `missed_by` is `design-review`, not `architect`: a retro reads it to know which rubric to fix.
+   Name the feature or change with `--item` whenever the rethink amends one: a rethink recorded for it closes the findings decided `rethink` on it.
+
+   `found_by` is the step that found it. A defect also needs `missed_by`, the earliest step whose job was to catch it. Both take one of `envision`, `architect`, `research`, `design-review`, `walkthrough`, `plan`, `plan-review`, `build`, `code-review`, `verify`, `land`, `realign`, `improve`, `validate`, `check` or `user`. When a design review ran over the element and an item of its rubric, `.agents/skills/cruze-roles/design-rubric.md` or `.agents/skills/cruze-roles/plan-rubric.md`, covers the gap, `missed_by` is `design-review`, not `architect`: a retro reads it to know which rubric to fix.
 
 Done when `cruze status` shows every document approved and current, or names only work the user chose to leave for later.
 

package/skills/rethink/levels.md

@@ -4,12 +4,12 @@
 
 1. Edit the change's `## Test plan` or `## Tasks` so they are right. The scope doesn't change at this level; a scope change is a feature-level rethink.
 2. Run `cruze validate`. Done when it reports no errors for the change.
-3. Run the plan review from `.agents/skills/cruze-roles/SKILL.md` on the diff alone, with the design reviewer's plan rubric and `review=plan`.
+3. Run the plan review from `.agents/skills/cruze-roles/SKILL.md` on the diff alone, with the design reviewer's plan rubric, `.agents/skills/cruze-roles/plan-rubric.md`, and `review=plan`.
 4. Re-approve with `cruze approve <change> --by-agent` once the review has closed, as plan does.
 
 ## Feature
 
-1. Edit the feature's `## Spec delta`, `## Architecture delta` or `## Changes`. For a standalone change, edit its own deltas and scope. Write complete bodies, as `architect` does, and keep the scope rules.
+1. Edit the feature's `## Spec delta`, `## Architecture delta` or `## Changes`. Read the elements the discovery touches with `cruze show <ID>`, which prints the living body and this feature's version side by side, and the rest of `feature.md` when the amendment reaches beyond them. For a standalone change, edit its own deltas and scope. Write complete bodies, as `architect` does, and keep the scope rules.
 2. Run `cruze validate`. Done when it reports no errors for the feature or its changes.
 3. Run the design review from the roles skill on the diff alone, with `review=design`. Run the walkthrough of the changed parts, following `.agents/skills/cruze-architect/walkthrough.md`.
 4. Re-approve the feature. For each of its changes that shows as stale, check it against the diff. When the amendment touches the change's scope, test plan or tasks, update them to match, reopen touched tasks, run the plan review on the diff, and re-approve it with `cruze approve <change> --by-agent`. When it doesn't, re-stamp the change as the skill's step 6 describes.
@@ -25,8 +25,8 @@
    - **The current change**, when the rebuild belongs to its work. Add the element to the feature's Changes row for that change and to the change's `Builds`, then re-plan and re-approve the change.
    - **A prefactor**, otherwise. From an up-to-date main, run `architect "<prefactor>"`, which designs it as a standalone change, then `plan`, `build`, `verify` and `land` it before the current change continues.
 6. Run `cruze status`. Every document citing a changed element shows `upstream changed`:
-   - When the document's own delta changes that element, rewrite the delta so it keeps your amendment. `cruze approve` refuses it with `rebase-required` until you do. Then approve it with `--rebase <ID>`.
-   - Otherwise, check the document against the element's diff, and re-stamp it or amend it as the skill's step 6 describes.
+   - When the document's own delta still changes that element, rewrite the delta so it keeps your amendment. `cruze approve` refuses it with `rebase-required` until you do, and `cruze diff <ref>` names each such element. Then approve it with `--rebase <ID>`.
+   - Otherwise, check the document against `cruze diff <ref>`, and re-stamp it or amend it as the skill's step 6 describes. An element the feature already merged, with its delta entry unchanged since, needs no rebase: the living text now holds it, and later lands keep your amendment.
 
 ## Vision
 
@@ -37,9 +37,9 @@
 
 ## A conflict with living text
 
-`cruze approve` refuses a feature or standalone change with `rebase-required` when an element its delta changes was edited in the living docs since its last approval, by a rethink or another branch's land. `cruze land` refuses with `merge-conflict` for the same reason when the approval came first. Either way, the delta would overwrite that edit. Record the rethink at feature level.
+`cruze approve` refuses a feature or standalone change with `rebase-required` when an element its delta changes was edited in the living docs since its last approval, by a rethink, a realign or another branch's land, and the delta would still write that element: the work hasn't merged it yet, or has changed its delta entry since merging it. `cruze land` refuses with `merge-conflict` for the same reason when the approval came first. Either way, the delta would overwrite that edit. Record the rethink at feature level.
 
-1. Show the user the element's current text in `docs/architecture.md` or `docs/specs/`, and the feature's delta for it.
+1. Show the user `cruze diff <feature>`, which has the element's approved and current text, and the feature's delta for it.
 2. Rewrite the delta's body so that it holds both: their edit, and what this feature needs.
 3. Re-approve the feature with `cruze approve <feature> --rebase <ID>`. This records that the feature now builds on the current text.
 4. Re-approve the change that is landing, when it shows stale; its verification carries over. Then run `land` again.

package/skills/roadmap/SKILL.md

@@ -9,7 +9,7 @@ description: Orders the release's features and standalone changes into phases wi
 
 ## Steps
 
-1. **Read the state.** Read `docs/vision.md` (goals and feature map), `docs/roadmap.md` and `docs/architecture.md`, and run `cruze status`. The vision must be approved. When no roadmap exists, stop: project-scope `architect` creates the first one with the walking skeleton.
+1. **Read the state.** Read `docs/vision.md` (goals and feature map), `docs/roadmap.md`, and `docs/architecture.md` as "Reading it" in `.agents/skills/cruze-formats/reference/architecture.md` says, and run `cruze status`. The vision must be approved. When no roadmap exists, stop: project-scope `architect` creates the first one with the walking skeleton.
 2. **Pick the job.**
    - **Add an item:** a feature or standalone change the user wants in this release. Its slug comes from the feature map when it is there.
    - **Reorder or drop:** the order or scope of the release changed.
@@ -27,6 +27,7 @@ description: Orders the release's features and standalone changes into phases wi
 ## Adding an item
 
 - Place it in the earliest phase whose items don't block it. Name its blockers: an item blocks it when it builds an element this item extends, or delivers behaviour this item changes.
+- A prefactor restructures code that later items build on, so it goes first: each item it overlaps names it under `Blocked by`. The exception is an item already building, with a change planned or in progress, which the prefactor would rebuild under: the prefactor waits for it and names it under `Blocked by` instead. Put the order to the user either way. One project's realign put a prefactor behind a feature that hadn't started, and the user wanted it first.
 - Add its slug to the coverage row of each goal it serves.
 - A feature that isn't on the feature map gets there first: `cruze features add <slug> --summary <text> --goals <ids>`.
 

package/skills/roles/SKILL.md

@@ -9,7 +9,7 @@ A role is a prompt with fixed inputs and a report as its only output. It runs in
 
 | Role | File | Used by |
 | --- | --- | --- |
-| Design reviewer | [design-reviewer.md](design-reviewer.md) | architect, at project and feature scope; plan, for the plan review |
+| Design reviewer | [design-reviewer.md](design-reviewer.md), with [design-rubric.md](design-rubric.md) for a design or [plan-rubric.md](plan-rubric.md) for a plan | architect, at project and feature scope; plan, for the plan review |
 | Code reviewer | [code-reviewer.md](code-reviewer.md) | verify, for the code review |
 | Verifier | [verifier.md](verifier.md) | verify, to run the system |
 | Researcher | [researcher.md](researcher.md) | architect, for adopt-or-build decisions |
@@ -45,10 +45,10 @@ A review has at most two rounds. Only blockers can force the second one.
    - `deferred`: it belongs to later work. When it is future scope, add it with `cruze features add <slug> --summary <text> --goals <ids>`.
    - `rejected`: the finding is wrong, with the reason.
 
-   A finding whose fix would change an approved element, such as one marked `Needs design change`, is never `deferred` or `waived`. Recommend `rethink` at that element's level now. Once the rethink is done and the code follows it, record the finding as `fixed`.
+   A finding whose fix would change an approved element, such as one marked `Needs design change`, is never `deferred` or `waived`. Recommend `rethink` at that element's level now. Once the rethink is done and the code follows it, record the finding as `fixed`. When the user wants the rethink later, record it as `rethink` instead, with `--item` naming the feature or change it amends: `cruze next` and the build gate hold that work until a rethink is recorded for it.
 
    Then one line for each finding you are fixing yourself. When there are no exceptions, say what you are fixing and carry on without waiting. The user can object to any line until the work is approved, and that finding becomes an exception: revert its fix and let them decide it.
-5. **Record every disposition:** `cruze journal add disposition --set finding="<rubric item>: <summary>" --set disposition=<fixed|waived|deferred|rejected> --set reason="<reason>" --set review=<design|plan|code> --set decided=<agent|user>`, with the same `--item`. Use `decided=user` for each exception, once the user decides it, and `decided=agent` for each finding you fixed yourself. The CLI refuses `decided=agent` for anything but `fixed`. A recorded disposition is never raised again.
+5. **Record every disposition:** `cruze journal add disposition --set finding="<rubric item>: <summary>" --set disposition=<fixed|waived|deferred|rejected|rethink> --set reason="<reason>" --set review=<design|plan|code> --set decided=<agent|user>`, with the same `--item`. Use `decided=user` for each exception, once the user decides it, and `decided=agent` for each finding you fixed yourself. The CLI refuses `decided=agent` for anything but `fixed`. A recorded disposition is never raised again.
 6. Apply every `fixed` change, then run `cruze validate`. Done when it reports no errors.
 7. When a finding could be caught by a tool, such as a layering, naming or size rule, tell the user which `cruze check` rule or linter setting would catch it next time.
 

package/skills/roles/auditor.md

@@ -6,7 +6,7 @@ You compare a project's existing code and documents with what the installed Cruz
 
 - The notes to audit, from `cruze realign status`: each note's ID, `Rule`, `Ask` and `Migrate`.
 - In a full audit, the standards instead of notes: `.agents/skills/cruze-hexagonal-design/SKILL.md` and its language file, `.agents/skills/cruze-behavioural-testing/SKILL.md`, and `.agents/skills/cruze-formats/reference/architecture.md`. You audit one module, named with its `Path`.
-- `docs/architecture.md`, for the module map and the elements the code implements.
+- `docs/architecture.md`, for the module map and the elements the code implements: `cruze show --index <context>` lists them, and `cruze show <ID>` prints each.
 - The files in scope: every source and test file under the project's `source` and `tests` globs in `.cruze/config.yaml`, or under the module's `Path`.
 - The settled ledger, as `.agents/skills/cruze-roles/SKILL.md` defines it, and the earlier realign dispositions from `cruze journal list --event disposition`. Never raise a finding they waived.
 

package/skills/roles/code-reviewer.md

@@ -4,7 +4,7 @@ You review the code a change adds, before it lands. You work in two lanes. The s
 
 ## Inputs
 
-- The change's `change.md`, and the output of `cruze show <ref>`: the elements it builds, the scenarios it delivers, the settled decisions and the ledger. Read an element it lists as cited only when the diff calls it.
+- The change's `change.md`, and the output of `cruze show <ref>`: the elements it builds, the scenarios it delivers, the settled decisions and the ledger. Read an element it lists as cited only when the diff calls it, with `cruze show <ID>`.
 - The diff under review, from `git diff <base>` for the base commit you are given.
 - The ADRs in `docs/adr/`, and the specs in `docs/specs/` for the capabilities the change touches.
 - The references `cruze show` lists, at the sections the change's elements cite.
@@ -29,7 +29,7 @@ Review against these items and nothing else. Each finding names one.
 5. **Placement.** Every file the diff adds or changes is where the architecture puts its owner, and matches the task's file targets or a recorded deviation.
 6. **Direction.** Dependencies point inward. No technology type crosses a port. Inbound adapters hold no domain rules or workflow.
 7. **Size.** No file holds two responsibilities, and none passes its budget without a recorded exception. No file was split by length alone, leaving one responsibility across files, and no code is bent to fit a budget, such as a type alias, a string where an error type belongs, types merged or a function placed away from its owner to stay under a limit.
-8. **Idiom.** The code is idiomatic for the language, uses its standard tooling, and follows the language file's rules, including where tests live. Tests reuse the fixtures and harnesses in the test support module rather than redefining them.
+8. **Idiom.** The code is idiomatic for the language, uses its standard tooling, and follows the language file's rules, including where tests live. Tests reuse the fixtures and harnesses in the test support module rather than redefining them. Each `expect`, `unwrap` or panic in the diff has a reason its case can't happen; one a caller, the clock or a concurrent call can reach is a finding.
 9. **Libraries.** Nothing hand-writes what a mature library does without a recorded `build` decision, and every new dependency has a recorded approval. No code works around a dependency or a feature: hand-written code, a shell command or a less idiomatic construct chosen because the clean one needs a dependency is a finding.
 10. **Contracts.** Each adapter honours its port's `Operations`, and each fake passes the same contract tests as the real adapter.
 11. **Deviations.** Each deviation the change recorded is a choice build may make on its own: a private helper or a new file inside the owner's module, a `check.exceptions` entry, a fixture in the test support module, or two tasks swapped. A deviation that added an element, port operation or scenario, wrote a file outside the owner's module, changed an approved scenario's behaviour or its test, worked around a dependency or a feature, or settled a limit, timeout, message or error case the design doesn't give, needed a rethink: a blocker, with `Needs design change` naming the element. Two projects recorded 13 such deviations.

package/skills/roles/design-reviewer.md

@@ -8,7 +8,7 @@ You review a design, or a change's plan, before any code exists. You find the pl
   - Feature scope: the feature's `feature.md`, and the output of `cruze show <ref>` for the elements its delta cites, each with where it sits, and the settled ledger.
   - Project scope: `docs/architecture.md`, `.cruze/config.yaml` and `docs/roadmap.md`, plus the walking-skeleton change once it exists.
   - A plan: the change's `change.md`, the output of `cruze show <ref>`, and the output of `cruze status --overlap --change <ref>`.
-- The living docs it builds on: `docs/vision.md`, `docs/glossary.md`, the ADRs in `docs/adr/`, the specs in `docs/specs/` that the artifact cites, and, from `docs/architecture.md`, its Overview, Dependency rules, Cross-cutting concerns and Decisions sections plus each element `cruze show` lists as cited. Read the whole architecture only at project scope.
+- The living docs it builds on: `docs/vision.md`, `docs/glossary.md`, the ADRs in `docs/adr/`, the specs in `docs/specs/` that the artifact cites, and, from `docs/architecture.md`, its Overview, Dependency rules, Cross-cutting concerns and Decisions sections plus each element `cruze show` lists as cited. Read any other element with `cruze show <ID>`, and find what exists with `cruze show --index`. Read the whole architecture only at project scope.
 - The settled ledger, as `.agents/skills/cruze-roles/SKILL.md` defines it, with the output of `cruze journal list --event disposition --item <ref>`.
 - The output of `cruze validate`.
 - The references `cruze show` lists, from `references:` in `.cruze/config.yaml`: read the sections the design cites or relies on.
@@ -16,46 +16,10 @@ You review a design, or a change's plan, before any code exists. You find the pl
 
 ## Rubric
 
-Review against these items and nothing else. Each finding names one.
+Review against one rubric and nothing else, and read only that one. Each finding names one of its items.
 
-1. **Behaviour.** Every requirement has at least one scenario. Every scenario has concrete values, one WHEN, and a THEN a person could check. Failure behaviour the user will meet has its own scenario.
-2. **Seams.** Every scenario can be driven through a use case, or through an inbound adapter when the outcome is what that adapter shows. Every driven port the use case needs can be faked.
-3. **Placement.** Every new or changed element with code has a `Module` whose `Layer` fits its role and a `File` with a real path. No generic modules, and no file is likely to hold two responsibilities. The layout is the one normal for the kind of system and the language, and every layer, module, package or target split beyond a context's `core` and its adapters has a recorded reason. Every element, fact and value serves a requirement in scope or a `Future` fact the feature map calls for. Anything reserved for a need nobody stated is a finding.
-4. **Direction.** Every dependency points inward and is allowed by the `RULE` elements and the `layers:` in `.cruze/config.yaml`.
-5. **Adopt or build.** Every component that isn't domain logic has an adopt-or-build decision with a reason, and every new dependency is named with the features the design uses. Every type, trait, macro, framework or tool the design names from outside the project comes from a dependency and feature the design approves, declared by each crate, package or target that uses it, test support included, and allowed by the import rules in `XC` and the `layers:` in `.cruze/config.yaml`. A choice whose reason is avoiding a dependency, a crate or a feature, where the idiomatic design needs one, is a concern: name the idiomatic design. Every command the design spells out, such as a CI step, is spelled as that version's `--help` or source shows it. A claim the design relies on that the research left unverified is a blocker.
-6. **Contracts.** Every new or changed port's `Operations` state what each operation guarantees, how it fails, and who owns cleanup. Check each use case and each port operation for the values build would otherwise have to pick: a named error for every failure a caller can meet, where a panic, an `expect` or "caller error" counts as missing; a number for every timeout, limit, buffer and poll interval; what a caller observes after each state transition, and what happens to queued or in-flight work at it; and one owner for every message a scenario quotes. Each one missing is a blocker: two projects settled 35 of them during build, as deviations.
-7. **Flows.** The key scenarios have a `FLOW` whose participants are all in its `Elements`, including the failure paths the scenarios need.
-8. **Consistency.** The design agrees with `docs/architecture.md`, the accepted ADRs, the references and what earlier changes landed, or changes them explicitly through a `MODIFIED` operation or a new ADR. Its own elements agree with each other. Check every pair, not a sample:
-   - each use case's `Output` and `Errors` against the `FLOW`s that serve it and the `XC` rules that apply to it;
-   - each adapter's duties against the port it implements and the `XC` rules it follows;
-   - each guarantee, such as "always fits" or "never returns", against the limits and failures that bound it;
-   - each `XC` rule against the other `XC` rules, the `RULE` elements and the `layers:` in `.cruze/config.yaml`, such as a logging rule that every module logs against a build rule that forbids the logging import;
-   - each pair of use cases that change the same state, for an interleaving that leaves it wrong, against the concurrency rule in `XC`;
-   - at feature scope, the prose in `docs/architecture.md` the delta makes untrue, such as an Overview sentence or a `D<n>` line describing an element the delta splits or replaces.
-   - each new or renamed operation, method or builder step against the others the same type, trait or caller reaches, for two names a caller can't tell apart, such as an `events` method beside an `events` trait method the type also implements.
-9. **Slicing.** Each change is a vertical slice that delivers scenarios end to end and can land on its own. The order respects `Depends on`, and the first change proves the design end to end. Each change carries enough work to be worth its own plan review, code review and verify: changes that build one or two elements each on the same adapters or screens, in a chain, are one change split too fine. A change that one verifier run can't hold is split too coarse. A `change-too-small`, `change-too-large` or `feature-size` warning from `cruze validate` is a finding, unless a decision records the user accepting it. A change `Builds` an element only when its delivered scenarios prove the whole body; an element whose duties arrive in several changes is split into elements that each arrive whole. `Depends on` names every earlier change that builds something this change's scenarios need. At project scope, the roadmap starts with the walking skeleton, and every goal in the release is covered.
-10. **Ambiguity.** Name each point where a fresh implementer could reasonably build something different from what the user expects.
-11. **Flow control and recovery.** Follow each message, request and event from its source to its consumer through every task, channel and queue the design names, against `.agents/skills/cruze-hexagonal-design/runtime.md`. Check:
-   - each bounded queue or buffer: what a sender does when it is full, and which other work waits meanwhile. One slow peer, link, subscriber or consumer holds up only its own work unless a decision says otherwise, so one queue or one task serving several peers needs a reason. A limit meant to tell a stalled consumer from a burst says how it tells them apart;
-   - each place several sources feed one consumer: the order it takes them in, so that none starves;
-   - each asynchronous result: how it reaches the request that waits for it, including across a reconnect or a retry;
-   - each recovery, such as a reconnect, resubscribe, relist or retry: its schedule and limit, what happens when the recovery itself fails, what is lost between the failure and the recovery and how the consumer learns of it, and the order of steps that loses nothing, such as subscribing before relisting;
-   - each loop, task and retry: what stops it, and what shutdown does with the work it holds;
-   - each value the design compares with observed state: an adapter can observe it, or the difference is reported for good;
-   - each exclusive resource, such as a socket, a device or kernel state: what happens when a second instance or caller claims it.
-
-   Each one missing that a scenario or an `XC` rule depends on is a blocker: in two projects, 7 of 14 defect rethinks after a design review were one of these, found as late as verify.
-
-## Plan rubric
-
-When the artifact is a change's plan, review against these items instead.
-
-1. **Test plan.** Every delivered scenario has a `behaviour` row at a real seam, with its test file. Every port that a built adapter implements has a `contract` row. Seams need fakes of driven ports only, never mocks of internal code.
-2. **Tasks.** Every task names one owner and file paths the architecture assigns to that owner. Every scope ID is proved by a task. Each task is small enough to build red to green and commit on its own. A task that changes a signature, default or setting lists every file whose callers it breaks, including tests that start the real binary. A task that adds a module, file or dependency lists the file that declares it, such as a crate root, a `mod.rs`, a package manifest or an Xcode project. A rule, text, format or conversion that several elements apply has one owning file, and each later task that applies it names that file as a callee rather than restating it. An accessor, variant or type arrives in the task whose code first handles, matches or constructs it, never in the task that only tests it.
-3. **Order.** Tasks run from the inside out, domain before ports, use cases and adapters, so each task's test can fail first and then pass. A test sits in the task that builds the behaviour it checks: a test that an earlier task's code already passes is in the wrong task. A break the plan names is a behaviour the task's code could get wrong, not an edit that may not compile. The last tasks wire the composition root.
-4. **No design.** Nothing in the plan changes the architecture or the specs. A plan that needs a new element, operation or scenario goes back to `architect` or `rethink`.
-5. **Risks and overlap.** The riskiest task is named, with how it is checked. Overlap with work on other branches is resolved or accepted.
-6. **Ambiguity.** Name each task a fresh implementer could reasonably build differently from what the plan means.
+- A design, at project scope or of a feature or a standalone change: `.agents/skills/cruze-roles/design-rubric.md`.
+- A change's plan: `.agents/skills/cruze-roles/plan-rubric.md`.
 
 ## Findings
 

package/skills/roles/design-rubric.md

@@ -0,0 +1,40 @@
+# Design rubric
+
+The design reviewer's rubric for a design: the architecture at project scope, or the design of a feature or a standalone change. Review against these items and nothing else. Each finding names one.
+
+1. **Behaviour.** Every requirement has at least one scenario. Every scenario has concrete values, one WHEN, and a THEN a person could check. Failure behaviour the user will meet has its own scenario.
+2. **Seams.** Every scenario can be driven through a use case, or through an inbound adapter when the outcome is what that adapter shows. Every driven port the use case needs can be faked.
+3. **Placement.** Every new or changed element with code has a `Module` whose `Layer` fits its role and a `File` with a real path. No generic modules, and no file is likely to hold two responsibilities. The layout is the one normal for the kind of system and the language, and every layer, module, package or target split beyond a context's `core` and its adapters has a recorded reason. Every element, fact and value serves a requirement in scope, or a `Future` fact the feature map or a `LATER` capability calls for. Anything reserved for a need nobody stated is a finding, and so is anything built, rather than left room for, for a `LATER` capability.
+4. **Direction.** Every dependency points inward and is allowed by the `RULE` elements and the `layers:` in `.cruze/config.yaml`.
+5. **Adopt or build.** Every component that isn't domain logic has an adopt-or-build decision with a reason, and every new dependency is named with the features the design uses. Every type, trait, macro, framework or tool the design names from outside the project comes from a dependency and feature the design approves, declared by each crate, package or target that uses it, test support included, and allowed by the import rules in `XC` and the `layers:` in `.cruze/config.yaml`. A choice whose reason is avoiding a dependency, a crate or a feature, where the idiomatic design needs one, is a concern: name the idiomatic design. Every command the design spells out, such as a CI step, is spelled as that version's `--help` or source shows it. A claim the design relies on that the research left unverified is a blocker.
+6. **Contracts.** Every new or changed port's `Operations` state what each operation guarantees, how it fails, and who owns cleanup. Check each use case and each port operation for the values build would otherwise have to pick: a named error for every failure a caller can meet, where a panic, an `expect` or "caller error" counts as missing; a number for every timeout, limit, buffer and poll interval; what a caller observes after each state transition, and what happens to queued or in-flight work at it; and one owner for every message a scenario quotes. Each one missing is a blocker: two projects settled 35 of them during build, as deviations.
+7. **Flows.** The key scenarios have a `FLOW` whose participants are all in its `Elements`, including the failure paths the scenarios need.
+8. **Consistency.** The design agrees with `docs/architecture.md`, the accepted ADRs, the references and what earlier changes landed, or changes them explicitly through a `MODIFIED` operation or a new ADR. Its own elements agree with each other. Check every pair, not a sample:
+   - each use case's `Output` and `Errors` against the `FLOW`s that serve it and the `XC` rules that apply to it;
+   - each use case against every port operation it calls: it says what it does with each refusal that operation can answer, from its `Operations` and the use case behind it, and lists the port under `Uses`. A new use of an existing operation, such as the clock stamping a new kind of time, is a `MODIFIED` port whose `Operations` name the use;
+   - each adapter's duties against the port it implements and the `XC` rules it follows;
+   - each guarantee, such as "always fits" or "never returns", against the limits and failures that bound it;
+   - each `XC` rule against the other `XC` rules, the `RULE` elements and the `layers:` in `.cruze/config.yaml`, such as a logging rule that every module logs against a build rule that forbids the logging import;
+   - each pair of use cases that change the same state, for an interleaving that leaves it wrong, against the concurrency rule in `XC`;
+   - at feature scope, the prose in `docs/architecture.md`, the ADRs and the feature itself that the delta makes untrue, such as an Overview sentence, a `D<n>` line describing an element the delta splits or replaces, or any sentence stating a rule the delta retires;
+   - each message or value a scenario quotes from code already built, such as an error's printed form or a revision every write advances, against the code that produces it;
+   - each new or renamed operation, method or builder step against the others the same type, trait or caller reaches, for two names a caller can't tell apart, such as an `events` method beside an `events` trait method the type also implements.
+9. **Slicing.** Each change is a vertical slice that delivers scenarios end to end and can land on its own. The order respects `Depends on`, and the first change proves the design end to end. Each change carries enough work to be worth its own plan review, code review and verify: changes that build one or two elements each on the same adapters or screens, in a chain, are one change split too fine. A change that one verifier run can't hold is split too coarse. A `change-too-small`, `change-too-large` or `feature-size` warning from `cruze validate` is a finding, unless a decision records the user accepting it. A change `Builds` an element only when its delivered scenarios prove the whole body; an element whose duties arrive in several changes is split into elements that each arrive whole. `Depends on` names every earlier change that builds something this change's scenarios need. At project scope, the roadmap starts with the walking skeleton, and every goal in the release is covered.
+10. **Ambiguity.** Name each point where a fresh implementer could reasonably build something different from what the user expects.
+11. **Flow control and recovery.** Follow each message, request and event from its source to its consumer through every task, channel and queue the design names, against `.agents/skills/cruze-hexagonal-design/runtime.md`. Check:
+   - each bounded queue or buffer: what a sender does when it is full, and which other work waits meanwhile. One slow peer, link, subscriber or consumer holds up only its own work unless a decision says otherwise, so one queue or one task serving several peers needs a reason. A limit meant to tell a stalled consumer from a burst says how it tells them apart;
+   - each place several sources feed one consumer: the order it takes them in, so that none starves;
+   - each asynchronous result: how it reaches the request that waits for it, including across a reconnect or a retry;
+   - each recovery, such as a reconnect, resubscribe, relist or retry: its schedule, its limit and when that count resets, what happens when the recovery itself fails, what is lost between the failure and the recovery and how the consumer learns of it, and the order of steps that loses nothing, such as subscribing before relisting;
+   - each loop, task and retry: what stops it, and what shutdown does with the work it holds;
+   - each value the design compares with observed state: an adapter can observe it, or the difference is reported for good;
+   - each exclusive resource, such as a socket, a device or kernel state: what happens when a second instance or caller claims it.
+
+   Each one missing that a scenario or an `XC` rule depends on is a blocker: in two projects, 7 of 14 defect rethinks after a design review were one of these, found as late as verify.
+12. **Long-term intent.** Check the design against `## Principles` and `## Must stay possible` in `docs/vision.md`:
+   - each principle: the design follows it, or the vision's row was amended for this design and approved;
+   - each `LATER` capability, whatever its area: nothing in the design, such as a fixed set, a single owner or a one-way protocol, rules it out; and where the design touches its area, it leaves the room the row names, in a `Future` fact that cites the ID;
+   - each part of the user's input handed to this work, as the Notes section of `cruze show` lists it, or `cruze show --notes architect` at project scope: settled with the user, or the design doesn't rest on it;
+   - each settled decision of the design that states long-term intent, such as "eventually" or "later": it is a `LATER` row in the vision, since the decision is archived when the work lands.
+
+   A departure from a principle with no amendment, a `likely` capability closed off, or a design resting on an open hand-off row, is a blocker; a `possible` one closed off is a concern.

package/skills/roles/plan-rubric.md

@@ -0,0 +1,11 @@
+# Plan rubric
+
+The design reviewer's rubric for a change's plan. Review against these items and nothing else. Each finding names one.
+
+1. **Test plan.** Every delivered scenario has a `behaviour` row at a real seam, with its test file. Every port that a built adapter implements has a `contract` row. Seams need fakes of driven ports only, never mocks of internal code.
+2. **Tasks.** Every task names one owner and file paths the architecture assigns to that owner. Every scope ID is proved by a task. Each task is small enough to build red to green and commit on its own. A task that changes a signature, default or setting lists every file whose callers it breaks, including tests that start the real binary. A task that adds a module, file or dependency lists the file that declares it, such as a crate root, a `mod.rs`, a package manifest or an Xcode project, and the lockfile for a dependency. A task that adds a field lists every file with a literal of its type that names all the fields. A rule, text, format or conversion that several elements apply has one owning file, and each later task that applies it names that file as a callee rather than restating it. An accessor, variant or type arrives in the task whose code first handles, matches or constructs it, never in the task that only tests it.
+3. **Order.** Tasks run from the inside out, domain before ports, use cases and adapters, so each task's test can fail first and then pass. A test sits in the task that builds the behaviour it checks: a test that an earlier task's code already passes is in the wrong task. A break the plan names is a behaviour the task's code could get wrong, not an edit that may not compile. The last tasks wire the composition root.
+4. **No design.** Nothing in the plan changes the architecture or the specs. A plan that needs a new element, operation or scenario goes back to `architect` or `rethink`.
+5. **Risks and overlap.** The riskiest task is named, with how it is checked, and that check reaches the failure rather than a value a clamp or default hides. Overlap with work on other branches is resolved or accepted.
+6. **Ambiguity.** Name each task a fresh implementer could reasonably build differently from what the plan means.
+7. **Prefactor.** For a change that delivers no scenarios and rebuilds built elements, as "A prefactor" in `.agents/skills/cruze-plan/SKILL.md` describes: `## Risks` names the existing tests that reach each rebuilt element, and the command that runs them; no task adds, edits or deletes a test, except one that pins current behaviour before the restructuring; and no item's visibility or public surface grows beyond what its new callers need.

package/skills/roles/surveyor.md

@@ -6,7 +6,8 @@ You survey existing code for structure that departs from Cruze's current standar
 
 - What to survey: the system's layout, or one module, named with its `Path`.
 - The standards: `.agents/skills/cruze-hexagonal-design/SKILL.md`, `.agents/skills/cruze-hexagonal-design/shapes.md`, the language file for the project's language when one exists, and `.agents/skills/cruze-behavioural-testing/SKILL.md`.
-- `docs/architecture.md`, for the module map and the elements the code implements, and `.cruze/config.yaml`.
+- `docs/architecture.md`, for the module map and the elements the code implements, which `cruze show --index` lists and `cruze show <ID>` prints, and `.cruze/config.yaml`.
+- `## Principles` and `## Must stay possible` in `docs/vision.md`: why parts of the design exist that no current feature uses yet.
 - The files in scope: for the layout, the build manifests, such as `Cargo.toml` or `Package.swift`, and each module's `Path`; for a module, every source and test file under its `Path`.
 - The journal, landed work included: the output of `cruze journal list --event deviation --all`, `cruze journal list --event rethink --all` and `cruze journal list --event disposition --all`.
 - The settled ledger, as `.agents/skills/cruze-roles/SKILL.md` defines it, and the earlier `improve` and `realign` dispositions. Never raise a candidate they waived.
@@ -18,7 +19,7 @@ You survey existing code for structure that departs from Cruze's current standar
 3. **The journal.** Find the deviations, rethinks and review findings that name a file in scope, and group them by cause. A cause that recurs is friction.
 4. **The history.** Run `git log --format=%h --name-only -n 300 -- <Path>`. Name the files outside the module that change in the same commits as its files in more than half of those commits; a boundary there is often in the wrong place. Name the files that change most.
 5. **One operation.** Pick one representative operation the module serves, and list the files a reader opens to follow it from the inbound adapter to the outbound one. Note modules that only forward calls, and pairs of modules that own one responsibility between them.
-6. **Shape each candidate.** Give the smallest target that meets the standard or removes the friction, and say whether it changes the text of an element in `docs/architecture.md`. A target keeps behaviour, keeps small files, and keeps every technology behind a port.
+6. **Shape each candidate.** Give the smallest target that meets the standard or removes the friction, and say whether it changes the text of an element in `docs/architecture.md`. A target keeps behaviour, keeps small files, and keeps every technology behind a port. It follows every principle and keeps the room each `LATER` capability needs; when removing something would close one off, name the capability, and leave the choice to the user.
 
 Done when every file in scope was read, and every candidate has evidence.
 

package/skills/triage/SKILL.md

@@ -11,7 +11,7 @@ Triage starts from a symptom and ends with a fix, or with the right step to fix
 
 1. **Capture the symptom.** Get the exact steps, what happened (output, error, exit code), what the user expected, and the environment. Done when you can write the steps as commands.
 2. **Reproduce it.** Run the steps against the real system. Done when you can make it fail on demand and have quoted the output. When you can't reproduce it, ask the user for what differs in their environment, and stop until you can.
-3. **Place it in the living docs.** Find the requirement and scenarios in `docs/specs/` that cover this behaviour, and the flow in `docs/architecture.md` that runs it. Then classify it:
+3. **Place it in the living docs.** Find the requirement and scenarios in `docs/specs/` that cover this behaviour, and the flow in `docs/architecture.md` that runs it, with `cruze show --index` and `cruze show <ID>`. Then classify it:
    - **Code defect:** a scenario says what should happen, and the code does something else.
    - **Spec gap:** no scenario covers this case.
    - **Design flaw:** the design as written can't deliver what the scenario says.

package/src/adapters/inbound/cli/cli_context.ts

@@ -56,6 +56,10 @@ export interface Options {
   rebase: string[];
   byAgent: boolean;
   restampUnchanged: boolean;
+  index: boolean;
+  notes: boolean;
+  kind?: string;
+  about?: string;
   round?: string;
   package?: string;
   base?: string;

package/src/adapters/inbound/cli/commands/diff.ts

@@ -0,0 +1,23 @@
+import { upstreamDiff, type UpstreamDiffReport } from "../../../../app/use_cases/upstream_diff.ts";
+import { requireArgs, type CliContext, type CommandResult } from "../cli_context.ts";
+
+export async function runDiff(context: CliContext, args: string[]): Promise<CommandResult> {
+  requireArgs(args, ["ref"]);
+  const report = await upstreamDiff(context, args[0] ?? "");
+  return { json: report, human: render(report) };
+}
+
+function render(report: UpstreamDiffReport): string {
+  const lines = [`${report.artifact}: ${report.state}`];
+  if (report.changes.length === 0) lines.push("Nothing it cites changed since its approval.");
+  for (const change of report.changes) {
+    lines.push("", `${change.key}${change.path === undefined ? "" : ` in ${change.path}`}:`);
+    lines.push(...(change.diff ?? [change.note ?? ""]).map((line) => `  ${line}`));
+  }
+  if (report.rebase.length > 0) {
+    lines.push("", `Its delta changes ${report.rebase.join(", ")}: rewrite the delta to keep the new text, then approve with ${report.rebase.map((id) => `--rebase ${id}`).join(" ")}.`);
+  } else if (report.ref !== undefined && report.state === "upstream-changed") {
+    lines.push("", `No rebase needed. When the work still holds against this, re-stamp it with cruze approve ${report.ref} --restamp-unchanged.`);
+  }
+  return lines.join("\n");
+}

package/src/adapters/inbound/cli/commands/documents.ts

@@ -34,7 +34,7 @@ export async function runNew(context: CliContext, args: string[], options: Optio
   }
   requireArgs(args, ["kind", "slug"]);
   if (args[0] === "note") {
-    const report = await createNote(context, args[1] ?? "", requireOption(options.title, "--title"));
+    const report = await createNote(context, args[1] ?? "", requireOption(options.title, "--title"), requireOption(options.kind, "--kind"), requireOption(options.about, "--about"));
     return { json: report, human: `Created ${report.path}` };
   }
   const kind = args[0] as NewKind;

package/src/adapters/inbound/cli/commands/show.ts

@@ -1,13 +1,54 @@
+import { showElements, showIndex } from "../../../../app/use_cases/show_elements.ts";
+import { showNotes } from "../../../../app/use_cases/show_notes.ts";
+import type { Note, NotesFor } from "../../../../domain/project/notes.ts";
 import { showScope, type ScopeReport } from "../../../../app/use_cases/show_scope.ts";
+import { isId } from "../../../../domain/ids.ts";
+import type { ElementIndex } from "../../../../domain/project/element_lookup.ts";
 import type { ShownElement } from "../../../../domain/project/scope_view.ts";
-import { requireArgs, type CliContext, type CommandResult } from "../cli_context.ts";
+import { UsageError, requireArgs, type CliContext, type CommandResult, type Options } from "../cli_context.ts";
 
-export async function runShow(context: CliContext, args: string[]): Promise<CommandResult> {
+export async function runShow(context: CliContext, args: string[], options: Options): Promise<CommandResult> {
+  if (options.notes) {
+    if (args.length > 1 || options.index) throw new UsageError("--notes takes at most one target: project, a step, a feature slug or a context");
+    const report = await showNotes(context, args[0]);
+    return { json: report, human: "target" in report ? renderNotesFor(report).join("\n").trimEnd() : renderNotes(report.notes) };
+  }
+  if (options.index) {
+    if (args.length > 1) throw new UsageError("--index takes at most one context or capability");
+    const index = await showIndex(context, args[0]);
+    return { json: index, human: renderIndex(index) };
+  }
   requireArgs(args, ["ref"]);
+  if (args.every(isId)) {
+    const report = await showElements(context, args);
+    return { json: report, human: blocks(report.elements).join("\n").trimEnd() };
+  }
+  if (args.length > 1) throw new UsageError("show takes one feature or change, or one or more element IDs");
   const report = await showScope(context, args[0] ?? "");
   return { json: report, human: render(report) };
 }
 
+/** The index as a list an agent scans for what exists, before fetching bodies with `cruze show <ID>`. */
+function renderIndex(index: ElementIndex): string {
+  const { architecture, specs } = index.words;
+  const lines = [`# Elements`, "", `docs/architecture.md holds ${architecture} words, and docs/specs/ ${specs}. Read an element's body with \`cruze show <ID>\`.`];
+  let source = "";
+  for (const entry of [...index.entries].sort((a, b) => Number(a.addedBy !== undefined) - Number(b.addedBy !== undefined))) {
+    const heading = entry.addedBy === undefined ? entry.source : "In flight, not yet merged";
+    if (heading !== source) lines.push("", `## ${heading}`, "");
+    source = heading;
+    const facts = [
+      entry.status,
+      entry.place,
+      entry.scenarios === undefined ? undefined : `${entry.scenarios} scenarios`,
+      entry.addedBy === undefined ? undefined : `added by ${entry.addedBy}`,
+      entry.changedBy.length === 0 ? undefined : `changed by ${entry.changedBy.join(", ")}`,
+    ].filter((f) => f !== undefined);
+    lines.push(`- ${entry.id}: ${entry.title}${facts.length === 0 ? "" : ` (${facts.join("; ")})`}`);
+  }
+  return lines.join("\n");
+}
+
 /** The scope as a document an agent reads in place of the living docs. */
 function render(report: ScopeReport): string {
   const lines = [`# ${report.ref}${report.feature === undefined ? "" : ` (feature ${report.feature})`}`, ""];
@@ -22,6 +63,7 @@ function render(report: ScopeReport): string {
   lines.push("## Dispositions", "");
   lines.push(...(report.dispositions.length === 0 ? ["None."] : report.dispositions.map((d) => `- [${d.disposition}, ${d.review}] ${d.finding}: ${d.reason}`)), "");
   if (report.references.length > 0) lines.push("## References", "", ...report.references.map((r) => `- \`${r.path}\`: ${r.use}`), "");
+  lines.push(...renderNotesFor(report.notes));
   if (report.missing.length > 0) lines.push("## Missing", "", ...report.missing.map((id) => `- ${id} is defined nowhere`), "");
   return lines.join("\n").trimEnd();
 }
@@ -30,3 +72,25 @@ function blocks(elements: ShownElement[]): string[] {
   if (elements.length === 0) return ["None.", ""];
   return elements.flatMap((element) => [`<!-- ${element.source} -->`, ...element.body.join("\n").trimEnd().split("\n"), ""]);
 }
+
+/** The notes about a piece of work and the parts of the user's input handed to it; nothing when there are none. */
+function renderNotesFor(found: NotesFor): string[] {
+  if (found.notes.length === 0 && found.handoffs.length === 0) return [];
+  return [
+    "## Notes",
+    "",
+    ...found.notes.map((n) => `- \`${n.path}\`: ${n.title}${n.kind === undefined ? "" : ` (${n.kind})`}`),
+    ...found.handoffs.map((h) => `- ${h.part}, from ${h.source} (${h.status}, handed off in \`${h.note}\`)`),
+    "",
+  ];
+}
+
+function renderNotes(notes: Note[]): string {
+  if (notes.length === 0) return "No notes.";
+  return notes
+    .flatMap((n) => [
+      `- \`${n.path}\`: ${n.title} (${n.kind ?? "no kind"}; about ${n.about.length === 0 ? "nothing named" : n.about.join(", ")})`,
+      ...n.handoff.map((h) => `  - ${h.part} goes to ${h.goesTo} (${h.status})`),
+    ])
+    .join("\n");
+}

package/src/adapters/inbound/cli/commands/status.ts

@@ -25,13 +25,13 @@ export async function runStatus(context: CliContext, _args: string[], options: O
   const lines = [`Branch: ${report.branch ?? "(none)"}${report.active === undefined ? "" : `, building ${report.active}`}`];
   for (const doc of report.documents) lines.push(describe(doc.artifact, doc));
   for (const feature of report.features) {
-    lines.push(describe(`feature ${feature.ref}`, feature.approval));
+    lines.push(`${describe(`feature ${feature.ref}`, feature.approval)}${pendingNote(feature.rethinkPending)}`);
     for (const change of feature.changes) {
       const name = change.ref.split("/")[1] ?? change.ref;
-      lines.push(change.landed !== undefined ? `  ${name}: landed ${change.landed}` : `  ${describe(name, change.approval)}, tasks ${change.tasksDone}/${change.tasksTotal}`);
+      lines.push(change.landed !== undefined ? `  ${name}: landed ${change.landed}` : `  ${describe(name, change.approval)}, tasks ${change.tasksDone}/${change.tasksTotal}${pendingNote(change.rethinkPending)}`);
     }
   }
-  for (const change of report.standalone) lines.push(`${describe(`change ${change.ref}`, change.approval)}, tasks ${change.tasksDone}/${change.tasksTotal}`);
+  for (const change of report.standalone) lines.push(`${describe(`change ${change.ref}`, change.approval)}, tasks ${change.tasksDone}/${change.tasksTotal}${pendingNote(change.rethinkPending)}`);
   const json = {
     ...report,
     documents: report.documents.map(compact),
@@ -48,6 +48,10 @@ function compact(status: ApprovalStatus): Omit<ApprovalStatus, "record"> & { app
   return { ...rest, approvedAt: record.approvedAt, by: record.by, ...(record.basis === undefined ? {} : { basis: record.basis }) };
 }
 
+function pendingNote(findings: string[] | undefined): string {
+  return findings === undefined ? "" : `, ${findings.length} finding(s) waiting on a rethink`;
+}
+
 /** Every step starts a new session: one session that ran plan, build, verify and land reached 745k tokens of context. */
 const FRESH_SESSION = "Run it in a new session, so its context starts empty.";
 

package/src/adapters/inbound/cli/commands.ts

@@ -1,5 +1,6 @@
 import type { Handler } from "./cli_context.ts";
 import { runCheck, runLand, runTrace } from "./commands/code.ts";
+import { runDiff } from "./commands/diff.ts";
 import { runApprove, runNew, runValidate } from "./commands/documents.ts";
 import { runInit } from "./commands/init.ts";
 import { runInstall } from "./commands/install.ts";
@@ -23,7 +24,12 @@ export const COMMANDS: Record<string, Command> = {
   validate: { handler: runValidate, options: [], usage: "validate                                          check every document against the formats" },
   status: { handler: runStatus, options: ["gate", "override", "overlap", "change"], usage: "status [--gate build [--override <reason>]] [--overlap [--change <ref>]]" },
   next: { handler: runNext, options: [], usage: "next                                              the step to run next on this branch, and why" },
-  show: { handler: runShow, options: [], usage: "show <ref>                                        the design a change builds, or a feature's delta, with what it cites and its settled ledger" },
+  diff: { handler: runDiff, options: [], usage: "diff <ref>                                        what changed upstream of a document since its approval, and whether its delta needs a rebase" },
+  show: {
+    handler: runShow,
+    options: ["index", "notes"],
+    usage: "show <ref> | show <ID>... | show --index [<context>] | show --notes [<target>]   a change's design, chosen elements, one line per element, or the notes and hand-offs for a target",
+  },
   approve: {
     handler: runApprove,
     options: ["replan", "rebase", "by-agent", "restamp-unchanged"],
@@ -31,8 +37,8 @@ export const COMMANDS: Record<string, Command> = {
   },
   new: {
     handler: runNew,
-    options: { vision: [], glossary: [], architecture: [], roadmap: [], feature: ["title", "roadmap"], change: ["title", "feature", "roadmap"], adr: ["title"], note: ["title"] },
-    usage: "new <vision|glossary|architecture|roadmap> | new <feature|change|adr|note> <slug> --title <title> [--feature <ref>] [--roadmap <slug>]",
+    options: { vision: [], glossary: [], architecture: [], roadmap: [], feature: ["title", "roadmap"], change: ["title", "feature", "roadmap"], adr: ["title"], note: ["title", "kind", "about"] },
+    usage: "new <vision|glossary|architecture|roadmap> | new <feature|change|adr> <slug> --title <title> [--feature <ref>] [--roadmap <slug>] | new note <slug> --title <title> --kind <input|intake|explore|research> --about <subjects>",
   },
   task: { handler: runTask, options: { done: ["change", "commit"], deviation: ["change"], reopen: ["change"] }, usage: "task <done|deviation|reopen> <T#> [text] [--change <ref>] [--commit <sha>]" },
   features: { handler: runFeatures, options: { add: ["summary", "goals"], update: ["summary"], drop: ["reason"] }, usage: "features <add|update|drop> <slug> [--summary <text>] [--goals <ids>] [--reason <text>]" },

package/src/adapters/inbound/cli/parse_command.ts

@@ -54,6 +54,10 @@ export function parseCommand(argv: string[]): ParsedCommand {
         blockers: { type: "string" },
         "by-agent": { type: "boolean", default: false },
         "restamp-unchanged": { type: "boolean", default: false },
+        index: { type: "boolean", default: false },
+        notes: { type: "boolean", default: false },
+        kind: { type: "string" },
+        about: { type: "string" },
       },
     });
   } catch (error) {
@@ -78,6 +82,8 @@ export function parseCommand(argv: string[]): ParsedCommand {
     rebase: values.rebase,
     byAgent: values["by-agent"],
     restampUnchanged: values["restamp-unchanged"],
+    index: values.index,
+    notes: values.notes,
     ...optional("name", values.name),
     ...optional("title", values.title),
     ...optional("feature", values.feature),
@@ -96,6 +102,8 @@ export function parseCommand(argv: string[]): ParsedCommand {
     ...optional("package", values.package),
     ...optional("base", values.base),
     ...optional("blockers", values.blockers),
+    ...optional("kind", values.kind),
+    ...optional("about", values.about),
   };
   const given = [...new Set(tokens.flatMap((token) => (token.kind === "option" ? [token.name] : [])))];
   return { words: positionals, options, given, help: values.help, version: values.version };

package/src/adapters/outbound/git_repository.ts

@@ -45,6 +45,15 @@ export class GitRepository implements Repository {
     return new Map(paths.flatMap((path, i) => (blobs[i] === undefined ? [] : [[path, blobs[i]] as [string, string]])));
   }
 
+  async firstCommitAdding(path: string, text: string): Promise<string | null> {
+    const commits = await this.git("log", "--reverse", "--format=%H", `-S${text}`, "--", path);
+    return commits?.split("\n").find((c) => c !== "") ?? null;
+  }
+
+  async fileAt(commit: string, path: string): Promise<string | null> {
+    return (await this.catFiles([`${commit}:${path}`]))[0] ?? null;
+  }
+
   /** The contents of each object, in order, through one `git cat-file --batch`; undefined for one that is missing. */
   private catFiles(objects: string[]): Promise<Array<string | undefined>> {
     return new Promise((resolve) => {