@rasensio/aidlc-content 1.21.0 → 1.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rasensio/aidlc-content",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/skills/04-roadmap.md

@@ -141,10 +141,13 @@ Move the item to `hold/` and append the `history` entry. Dropping is an explicit
 
 Optional, opt-in, and inert until a `roadmap.sync` section exists in `.aidlc/config.yaml`. When a user asks how the roadmap can be visible to people who will not clone the repo, or how it can appear where their team already triages, the answer is `aidlc roadmap sync` — see `docs/roadmap.md`.
 
-Three things to know before you offer it:
+Four things to know before you offer it:
 
 - It is a **projection, not sync**. Disk stays the source of truth; nothing is written back to disk, so no item gains a `remote:` field and no flow above changes. The link lives on the issue as a marker carrying the item `id`.
 - **`inbox/` and `hold/` are not projected by default**, because an untriaged idea and a parked one are not decisions anybody has published. Do not widen that list on a user's behalf.
 - **Every write needs consent.** Suggest `aidlc roadmap sync --dry-run` first, always. It prints the plan, names the target repository, and touches nothing.
+- **The issue body carries the whole item** — its frontmatter facts, its prose, and links to its file and to the items it names — inside a region marked `<!-- aidlc-body:begin -->` … `<!-- aidlc-body:end -->`, regenerated on every sync. Text outside that region is preserved, so a note added to an issue description survives. When somebody asks why a projected issue is out of date, the answer is that a sync has not run since the item changed, not that the body is frozen.
+
+Editing an item's body is therefore a publishing act on a repo with `roadmap.sync` configured. That is not a reason to hesitate, but it is a reason not to paste anything into an item you would not put on the tracker. Item prose is sanitized on the way out — HTML comments removed, `@name` and `#123` made inert — so no sync notifies anybody; secrets are not sanitized, and never were. If a user's braindump contains credentials, the existing hard rule applies: flag it and leave them out of the file.
 
 `aidlc roadmap import <issue-url>` is the opposite direction, and it is one-shot: it writes one `inbox/` item with the issue linked and its executive summary left as `Not yet decided.`, which is then a normal triage. Nothing reconciles afterwards.