@rosetears/aili-pi 0.1.0

package/skills/aili-delivery-flow/references/build-execution-loop.md

@@ -0,0 +1,113 @@
+# Neutral BUILD Execution Loop
+
+This is the active authority for neutral BUILD package execution. It defines no pseudo execution mode, session identity, native command binding, or extra permission.
+
+## Activation and readiness
+
+`/build` and equivalent natural-language implementation intent enter this same loop. Formal BUILD starts only when exactly one target, current final-test-plan acceptance, a dependency-ready package, verifiable exit criteria, required operation permission, and a valid canonical `CONT-005` envelope are established. Acceptance or vague continuation alone performs zero execution.
+
+When no package is supplied, synthesize the queue from the active accepted contract: current `tasks.md`, specs, design, `test-plan.md`, dependencies, and repository evidence. Generic execution must not assume Package 1–12 or a fixed task count. For `complete-aili-workflow-orchestration` only, the preserved queue is 1→2→5→3→pairwise-disjoint 6/7/8→join→9→10→11→12, with Package 4 complete/history and overlap serialized.
+
+The current A33 host is the Git repository where the user started OpenCode; a non-Git startup root blocks, and AILI never ranks, moves, scans for, or auto-selects another host. Resolve exactly one declared target under current `WT-001` evidence before work. Target rules are re-read at the operation/dispatch boundary, may narrow but never broaden, and same-level conflict blocks.
+
+## Queue contract and lightweight savepoints
+
+Packages preserve identity, dependency order, complete accepted behavior, forbidden scope, pre-action safety gates, traceability, and stop conditions. Direct serial execution needs no lane report. Record ownership/join details only when actual concurrent work has a clear benefit.
+
+For each implementation package defined by the active contract before its completion package:
+
+1. Read the current package/task rows, owning contract sections, target/Git/rules, and affected evidence. Read progress/drift only for resume, deviation, or conflict; do not blanket-hydrate unrelated artifacts.
+2. Implement its complete accepted behavior; scoped work is not a partial patch.
+3. Run a focused test/check only when the changed behavior, risk, package need, or bounded failure diagnosis triggers it; a package boundary alone triggers none.
+4. Record a progress-ledger savepoint with exactly the package identity plus `scope`, `files_changed`, `unresolved_items`, `evidence_state`, and `next_package`.
+5. Continue only when dependencies are ready and no material/safety/budget stop applies.
+
+The savepoint is not a test, review, commit, package approval, closure verdict, or readiness evidence and triggers none automatically. Optional feedback is not a mandatory local code-review/test/security gate. Package 1–12 terminology is history specific to `complete-aili-workflow-orchestration`.
+
+After all active-contract packages/savepoints, ROSE runs the proactive delegation scan, inspects the changed-scope diff and affected requirement/task links, and selects the smallest fresh evidence needed for the exact completion claim. A full matrix or review/test/security capability remains optional and trigger-gated to one concrete gap. Its default concurrency is at most two but is not a hard cap; larger bounded read-only fan-out requires independent non-overlapping units, concrete benefit, suitable owners, and an explicit join plan. One targeted repair/recheck is allowed. Success records `IMPLEMENTED_TARGETED_VERIFIED` and stops BUILD; any remaining blocker is reported without an automatic swarm, broad matrix, fixed multi-cycle loop, commit, push, PR, or SHIP transition. Package 12 is only this umbrella's historical name for that inspection.
+
+## Loop taxonomy
+
+The following names are bounded loop vocabulary, not an automatic sequence. One current intent selects one primary loop; a loop returns any unmet need to ROSE and never invokes another loop itself.
+
+| Inner loop | Trigger | Terminal boundary |
+|---|---|---|
+| question | material ambiguity or explicit grilling | answered, named `Unverified`, or user stop |
+| delta | correction or material feedback | covered, or DEFINE writeback/revalidation |
+| evidence/plan | explicit planning/source request or one material evidence gap | sufficient bounded evidence/plan or blocked/`Unverified` |
+| neutral BUILD | accepted plan plus runnable package | complete package/savepoint or material/safety/budget/cancel stop |
+| review/repair | explicit review or one concrete blocking finding | one targeted repair/recheck, then resolved or blocked/material delta |
+| convergence | a concrete missing traceability link for a completion/SHIP claim | required affected links complete or that claim blocked/`Unverified` |
+
+Exactly four outer profiles select initiation and boundary:
+
+- `turn`: executable one-cycle prompt flow; initialize iteration to one and never silently recurse or convert to objective.
+- `objective`: executable bounded implementation/closeout flow with explicit intent, exit evidence, and valid budgets.
+- `interval`: protocol-only design-owned external/manual timing runbook; no timing registration.
+- `event`: protocol-only design-owned external/manual event runbook; no listener or queue.
+
+Interval/event invoke one existing bounded inner flow when externally/manual triggered; they are not inner loops and do not create a seventh loop.
+
+## Canonical `CONT-005` envelope and budgets
+
+Every executable run and protocol definition references one envelope with `loop_kind`, `trigger`, `trigger_evidence`, `objective`, `accepted_contract`, `change_id`, `success_evidence`, nested `budgets`, `human_gate`, `operation_gate`, `allowed_actions`, `writeback_targets`, `stop_reason`, and `outcome`. Interval/event additionally reference the canonical `ROUTE-007` identity and may add only `external_trigger_source`, `event_classifier`, or `cancellation`.
+
+The nested object contains exactly:
+
+```yaml
+budgets:
+  iteration: { limit: <positive-integer>, consumed: <nonnegative-integer>, remaining: <nonnegative-integer> }
+  time: null | { unit: ms, limit: <positive-integer>, consumed: <nonnegative-integer>, remaining: <nonnegative-integer> }
+  tokens: null | { unit: tokens, accounting_status: active | unavailable | lost, limit: <positive-integer>, consumed: <nonnegative-integer>, remaining: <nonnegative-integer> }
+  review_repair: null | { limit: <positive-integer>, consumed: <nonnegative-integer>, remaining: <nonnegative-integer> }
+```
+
+For each non-null counter, `remaining = max(limit - consumed, 0)`. Zero, negative, fractional, nonnumeric, missing required values, wrong units, invalid statuses, or capability/null mismatches block rather than coerce.
+
+- No configured token budget means explicit `tokens: null` and no token-enforcement claim.
+- A requested token budget without reliable pre-start accounting remains non-null with `accounting_status: unavailable`, `consumed: 0`, and `remaining: limit`; execution blocks before the first action.
+- Midrun accounting loss is valid only after active accounting. Preserve the non-null counter, last actual counters/overshoot, set `accounting_status: lost`, and block before another action.
+- A turn uses iteration `{limit: 1, consumed: 0, remaining: 1}` and `review_repair: null`.
+- Implementation-only package objectives use `review_repair: null`.
+- The direct completion inspection uses `review_repair: null` unless one targeted repair/recheck is needed; that bounded recheck uses exactly `review_repair.limit: 1`. This umbrella historically names the inspection Package 12.
+- LP templates consume zero. Each external/manual run instantiates all four entries with concrete zeroed counters before execution.
+
+Iteration and non-null review actions preflight one remaining unit, consume exactly one, and never exceed limit. For these discrete counters, `consumed > limit` is corrupted state: block before any action or repair, preserve the observed values for diagnosis, and do not classify the excess as an allowed overshoot. Time/token actions preflight current remaining and any reliable known bound. Only an indivisible observed time/token overshoot preserves actual consumed, sets remaining zero, records exact `overshoot`, stops, and permits no subsequent action. Resume preserves every counter, status, overshoot, and stop condition without reset or evasion.
+
+Terminal outcomes are `complete`, `need-user`, `need-evidence`, `material-delta`, `blocked`, `Unverified`, `cancelled`, or `budget-exhausted`; terminal handling writes applicable formal/sidecar/progress evidence.
+
+## Exact continuation
+
+`continue`, `继续`, `go ahead`, or `继续做` resumes exactly one active authorized envelope only when target, lifecycle phase, accepted authorization, current acceptance/material gates, and remaining canonical budgets are unambiguous. Resume cannot create or broaden authority, select another target, change phase, refresh acceptance, reset counters, or clear a stop state. Otherwise ask exactly one focused target/authorization question and perform no loop, write, mutation, or budget consumption.
+
+A material delta returns to DEFINE. A current no-write/chat-only clause overrides persistence and execution. Combined BUILD+SHIP intent authorizes current BUILD only; later SHIP needs fresh evidence and new intent.
+
+## Protocol-only automation boundary
+
+Formal documentation-only AILI interval/event requests may define or reuse one `LP-INTERVAL-*` or `LP-EVENT-*` body only under the active change's `design.md` `## Loop Protocols`. If that documentation request lacks protocol scope or an external/manual trigger source, ask one focused documentation-protocol question without execution. Protocol definition creates no runtime, listener, scheduler, queue, hook, daemon, or lifecycle permission. Tasks, tests, and context may reference a valid LP ID but not duplicate its body.
+
+Hidden or unrequested AILI self-automation, background lifecycle registration, or execution blocks with zero mutation and zero LP. A request mixing that hidden AILI automation with protocol documentation also creates no LP until the user later restates a documentation-only request.
+
+An explicitly scoped product/repository CI, cron, scheduler, watcher, webhook/listener, queue, daemon, hook, dependency, or auto-retry outcome is eligible through the ordinary/formal classifier and every applicable formal, permission, ownership, verification, credential, persistent-service, external-write, dependency/lockfile, destructive, and exact-operation gate. Automation vocabulary in an ordinary comparison is ordinary; it is neither blanket rejection nor permission. Product automation must not be replaced by an AILI LP, and documentation-only interval/event definitions grant no runtime or lifecycle permission. AILI itself provides no hidden background primitive.
+
+## Native command non-ownership
+
+Ordinary user, package, implementation, and Goal-Driven Verification wording remains valid and does not activate special execution semantics. Successful native `/goal <objective>`, bare `/goal`, and persistent native goal behavior are Stage II / N/A. AILI does not own, imitate, bind, modify, control, or claim those behaviors; `/build` remains neutral package execution.
+
+## Safety and closeout
+
+Pre-action gates remain mandatory for destructive/high-risk operations, dependencies/lockfiles, secrets, Graphify execution, and unsafe runtime behavior. Material DEFINE decisions and one final test-plan acceptance remain user controls; package boundaries add no approval. BUILD success does not preauthorize SHIP. Commit, push, merge, and release each require exact action-specific approval. CI failure reports the failed check, target, and commit/tree evidence and returns to the user without automatic repair, commit, push, merge, or release.
+
+### A33 admission and operation gates
+
+These are static admission/approval requirements only; they do not create, remove, inspect, or authorize a worktree operation.
+
+- Destination is exactly `<session-root>/.worktrees/<repo_key>/<worktree_key>`. The host must ignore the exact prospective destination through root `/.worktrees/`, with no re-inclusion and no tracked destination; otherwise block for an explicit host ignore change.
+- Both keys match `^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$`; empty, dot/dotdot, reserved `.git`/`.worktrees`, separator, absolute, control, newline, NUL, collision, or path-like values block. A safe unique source basename may default only `repo_key`; `worktree_key` is explicit. Never suffix, guess, force, use `-B`, create orphan state, guess a remote, or infer branch/base-ref.
+- Admission requires trusted source/path topology with no tracked `.gitmodules`, mode-160000 gitlink, malformed submodule/superproject relation, or unresolved symlink/junction/mount/path escape. Host, source, and target evidence stay distinct; populated host/source and exact target absent→populated ADD / populated→absent REMOVE `A33Identity` transitions are compared directly. Target rules may narrow only; conflict blocks.
+- Every operation binds explicit branch, base ref, `branch_mode: existing|create`, source `reflog_policy: enabled|disabled`, both keys, source, destination, expiry, and `operation_class: driver_fixture|real`. Existing mode creates no ref/reflog; create mode creates the exact branch ref and only enabled policy creates its exact reflog. Missing enabled reflog, unexpected disabled/existing reflog/ref, or any remove-time branch ref/reflog mutation blocks.
+- PREPARE performs zero add/remove. Every real or fixture ADD has its own fresh exact key/class-bound approval and accepted trusted-code risk. Every later REMOVE has a different fresh exact approval after complete deletion inventory, uses `trusted_code_risk:not_applicable` only for an observed approval, and passes a separate deletion-risk gate. Approval mismatch, reuse, wrong class, wrong key, absent/declined/unavailable risk, or stale/expired/wrong operation has zero effect.
+- ADD may change only the exact declared common-dir admin entry/membership plus its branch-mode/reflog-policy-authorized ref transaction. REMOVE is non-force and may delete only the declared target path/private admin entry/membership while retaining branch ref/reflog. Dirty, unknown, user-visible, ignored, untracked, artifact, locked, wrong-source, wrong-path, or missing target state blocks.
+- Common-dir canonical path identity and every unrelated entry/ref/reflog/config/hook/worktree record, unrelated/prunable state, evidence, and other file remain unchanged. Prune/move/repair/lock/unlock/force/clean/reset/merge/rebase/commit/push/integration/branch deletion and undeclared ref/reflog mutation are outside this gate. Rollback disables routing but preserves worktrees/evidence; removal still needs a new exact approval.
+
+Before non-trivial closeout, inspect `git status --short --branch` and classify dirty paths as task-scoped, unrelated/pre-existing, generated/ignored, scratch, or unknown. Propose cleanup for remaining residue; ask explicit approval before push, destructive clean/reset, branch deletion, worktree removal, OpenSpec archive, stashing unrelated changes, or deleting user-visible artifacts. Savepoint commits may be proactive only when current task/project rules explicitly allow task-scoped verified commits; otherwise ask once with the cleanup package.

package/skills/aili-delivery-flow/references/build-goal-mode.md

@@ -0,0 +1,3 @@
+# Historical migration pointer
+
+This retired compatibility filename is not active authority. Use `build-execution-loop.md` for the current neutral BUILD execution contract. New references, checkers, and ownership catalogs must not depend on this file.

package/skills/aili-delivery-flow/references/direct-vs-delegated-work.md

@@ -0,0 +1,38 @@
+# Direct vs Delegated Work
+
+ROSE retains integration and final-verdict ownership. Delegation is the proactive execution path whenever an existing trigger is met; direct work is the fallback when no trigger applies or delegation is concretely blocked.
+
+## Proactive scan
+
+Run a proactive delegation scan at the start of every non-trivial intent and whenever changed evidence exposes a new work split. Evaluate the triggers before ROSE performs the same evidence gathering or implementation directly. A user request for frequent or aggressive subagent use remains a routing preference across the current intent, but every `subagent.dispatch` operation still needs one bounded eligible assignment and current permission.
+
+## Use `subagent.dispatch` only when
+
+At least one condition is true:
+
+- the user explicitly requests a subagent;
+- a specialist owns a capability ROSE cannot perform directly;
+- broad search or noisy output would materially pollute the main context;
+- at least two independent units can run concurrently with clear wall-clock or context benefit.
+
+When any condition is true, dispatch is the default action unless units overlap, have an unresolved dependency, lack permission or ownership, or cost more than their concrete wall-clock/context benefit. Record the reason internally when an eligible-looking task stays direct. Otherwise ROSE reads, edits, and verifies directly. A non-trivial or multi-file task does not by itself require delegation.
+
+## Dispatch shape
+
+- One current intent has at most one auxiliary capability. Default dispatch concurrency is at most two, but this is not a hard cap. ROSE may choose a larger bounded fan-out when it can name every independent non-overlapping unit, concrete benefit, specialist owner, and join plan.
+- When multiple independent units are ready, launch them together rather than serializing avoidably.
+- Parallel units must have independent inputs and non-overlapping writes.
+- If units overlap or depend on one another, run them sequentially or keep the work direct.
+- Do not automatically add review, test, security, coverage, or convergence lanes.
+- Subagents never delegate and never own the final verdict.
+- A skill or subagent returns its bounded result/need to ROSE and cannot invoke another process skill or continue through a prior context.
+
+Use the compact packet and result contracts in `protocols/subagent-task-packet.md` and `protocols/subagent-result.md`. A packet narrows scope but never expands effective permissions.
+
+## Separate gates
+
+Delegation routing does not waive lifecycle, branch/status, secrets, high-risk, destructive, dependency, schema, public API, auth/security, external-operation, Git/release, A33, or verification gates. Safe in-scope local reads, edits, diagnostics, and focused checks are not approval events.
+
+## Completion
+
+ROSE inspects the final changed files and runs the smallest check that proves the requested claim. Unsupported claims remain `Unverified`.

package/skills/aili-delivery-flow/references/implementation-packages.md

@@ -0,0 +1,54 @@
+# Implementation Packages
+
+An implementation package is the unit that BUILD may execute.
+
+BUILD may receive a package explicitly from the user or synthesize an ordered package queue from approved ready artifacts. A `/build` invocation against a single ready target is enough approval to synthesize this queue; missing manual package text is not a stop condition.
+
+## Required Fields
+
+- goal and acceptance criteria;
+- allowed files or scoped likely edit surface;
+- forbidden scope;
+- source artifacts and evidence;
+- traceability mapping from source requirement, decision, or risk to task/package, target files or artifacts, verification command or inspection, and expected evidence or `Unverified` status;
+- parallelism decision only when the package contains at least two independent units with a clear wall-clock or context benefit;
+- implementation owner selected through the proactive delegation scan, with direct ROSE work as the no-trigger/blocked fallback;
+- expected claim-matched evidence; the canonical verification owner selects the actual smallest check;
+- final inspection relevance, Task-trigger evidence, or the concrete no-dispatch reason;
+- objective iteration budget and the optional one-recheck limit when a targeted repair is actually required;
+- rollback or pause condition;
+- context/progress ledger placement when applicable;
+- whether commits are allowed;
+- task-end branch/worktree hygiene expectation for non-trivial closeout;
+- packaging target/platform and package command when the user requested a packaged deliverable.
+
+## Rules
+
+- When no explicit package is supplied, synthesize packages from the highest-priority available artifacts: `tasks.md`, specs, design notes, `test-plan.md`, command arguments, and repository evidence.
+- Each synthesized package names goal and acceptance criteria, likely edit surface, forbidden scope, evidence source, traceability mapping, direct owner or justified auxiliary capability, expected evidence, rollback/pause conditions, ledger handling, and commit allowance. It does not create a package approval or mandatory package-local test.
+- For formal changes, every package must map each covered requirement, decision, or risk to the package task, file/artifact boundary, and verification/evidence target. If any link cannot be established, label it `Open Question` before dispatch when a decision is missing, or `Unverified` when evidence cannot yet prove coverage.
+- Package implementation targets complete accepted behavior inside the package scope. `Surgical` or scoped means no unrelated changes, not artificially tiny or partial patches.
+- When two or more independent units have a clear wall-clock or context benefit, state the safe parallel split, dependencies, owners, and join point, then dispatch the eligible lanes. Otherwise work directly and serially without ceremony.
+- Preserve already separated package or lane boundaries unless dependency, ownership overlap, verification coupling, high-risk gating, failed/missing evidence, or explicit current user direction justifies merging or serializing them. Keep the boundary visible even when execution becomes serial.
+- A delegated package uses the compact packet contract: goal, scope, allowed actions, expected result, and stop condition. Permissions remain those of the selected Agent; packet text never grants tools.
+- An A33 attached-target package names one approved target repository/cwd and references current `WT-001` evidence without duplicating or rebinding Git identity or operation approval. All managed subagents remain external-directory denied. A30 packet/overlay fields are historical compatibility notes, not current authority.
+- Preserve dependency order. Prefer dynamic increments that can be implemented completely and remain independently traceable/reviewable; use verifiability, conflict-free ownership, and clean handoff as sizing boundaries rather than fixed file counts.
+- Run the proactive delegation scan before package execution. Explicit user request, required specialist capability, materially noisy context, or independent units with clear benefit dispatches Task unless overlap, dependency, permission, ownership, or negative-benefit evidence blocks it. Default concurrency is at most two but is not a hard cap; larger bounded fan-out requires independent non-overlapping units, concrete benefit, suitable owners, and an explicit join plan. ROSE remains responsible for integration, progress-ledger writes, and final judgment.
+- Keep packages independently reviewable where practical.
+- Do not combine unrelated feature, harness, install, and documentation work unless explicitly approved.
+- Every package finishes complete accepted behavior and a lightweight savepoint; optional package-local feedback does not substitute for final direct inspection. Package 1–12 naming is historical to `complete-aili-workflow-orchestration`, not a generic queue shape.
+- Final quality starts with the proactive delegation scan: an eligible concrete gap dispatches its auxiliary capability, while no-trigger/blocked work remains direct. ROSE inspects the final diff and affected links, selects the smallest claim-matched check, and allows one targeted repair/recheck.
+- If the user requested packaging, run the claim-matched checks before packaging, repair an in-scope failure once, run the package/build command as separate evidence, and report any remaining blocker. External publishing, signing, credentials, dependency changes, or destructive cleanup retain exact approvals.
+- Workers return compact reports/evidence only. They do not write `progress.txt` and do not issue final PASS/FAIL/`Unverified` judgments. Their report must preserve the package traceability mapping by naming changed files/artifacts and verification evidence for each covered requirement, decision, or risk.
+- For non-trivial package closeout, inspect branch/status, classify dirty paths as task-scoped, unrelated/pre-existing, generated/ignored, scratch, or unknown, remove only safe task-owned non-user-visible scratch artifacts, and ask explicit approval before push, destructive clean/reset, branch deletion, worktree removal, OpenSpec archive, stashing unrelated changes, or deleting user-visible artifacts.
+- Pause if the package requires new dependencies, lockfile changes, schema changes, public API/auth/security changes, forbidden files, broader scope than approved, signing/notarization credentials, external access/publishing, secret handling, destructive cleanup, or unsupported platform assumptions.
+
+## Autonomous Queue Exit Criteria
+
+Continue through the queue until one of these is true:
+
+- The accepted scoped queue is completely implemented/savepointed and ROSE has completed the final inspection, including any trigger-eligible delegated evidence and one permitted targeted recheck;
+- a stop condition requires explicit user approval;
+- a package is blocked by missing target/readiness evidence, unverifiable accepted behavior, or exhausted canonical objective budgets;
+- the target repository root cannot be canonicalized inside the current workspace or allowed external directories;
+- the user interrupts or narrows the goal.

package/skills/aili-delivery-flow/references/lifecycle.md

@@ -0,0 +1,127 @@
+# Delivery Lifecycle
+
+AILI delivery has four public modes. The mode gate is mandatory even when a backend contains tasks that appear ready to execute.
+
+## Ordinary / Formal / Material Classifier
+
+Commands and equivalent natural-language intent use the same semantic classifier and evidence record. A request is `ordinary` only when **all** are true: it seeks one bounded outcome; changes no accepted contract, public API, schema/data model, auth/permission/security, dependency/lockfile, destructive operation, release/deployment, scope/task/acceptance/risk/implemented behavior, architecture, or cross-package durable criterion; is likely completable in the current session with focused verification; and needs no multiple independent packages, cross-session work, or formal review/test/security acceptance. File count, text length, and estimated time are not authority.
+
+Any explicit formal spec/change/plan or implementation DEFINE, material change listed above, sensitive named decision, multi-package/cross-session/formal-acceptance need, or architecture/data/cross-package decision is `formal/material`. Lifecycle words used only for explanation, comparison, translation, or status remain ordinary lexical near misses. A material clause wins conflicting “only analyze/do not formalize” wording; a separate explicit no-write/chat-only clause still prevents persistence.
+
+Record route, class, decisive evidence, active/resolved change identity, unresolved ambiguity, and next gate. Ask one decision-changing question only when one answer controls class or identity. On the first hard trigger in an ordinary thread, escalate exactly once and create/reuse one OpenSpec change; preserve history and reuse it for later material deltas.
+
+## Startup Git Host and Repository Targets
+
+For current A33 routing, the user selects the host by starting OpenCode in that Git repository. A non-Git startup root blocks. AILI never ranks, moves, broadly scans for, or auto-selects a host. Each lane targets exactly one declared repository/cwd under its current `WT-001` evidence; target rules may narrow but never broaden, a same-level conflict blocks, and user-visible artifacts remain in the owning target repository. Historical A30/A31 external-read routing remains history only.
+
+An attachment is admitted only at exact `<session-root>/.worktrees/<repo_key>/<worktree_key>` when the exact prospective destination is ignored by root `/.worktrees/` with no re-inclusion or tracked content; both keys satisfy `^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$` and are non-reserved/path-safe; no path/key/branch/worktree collision exists; source/path/submodule topology is trusted and unambiguous; host/source/target identity evidence is distinct; and branch, base ref, `branch_mode:existing|create`, and source `reflog_policy:enabled|disabled` are explicit. Failure blocks without suffix, guess, force, `-B`, orphan, remote guess, implicit ref, or silent ignore edit.
+
+Admission is not operation authority. PREPARE performs no add/remove. Every real or `driver_fixture` ADD and later non-force REMOVE requires its own fresh exact operation/key/class-bound approval. ADD additionally requires accepted trusted-code risk; an observed REMOVE uses `trusted_code_risk:not_applicable` only under a separate complete deletion-inventory/risk gate. Target rules are re-read at the operation/dispatch boundary and may narrow only. Common-dir path identity and unrelated/prunable state must remain unchanged; only the exact declared admin entry/membership and branch-mode/reflog-policy-authorized ADD ref transaction may change, while REMOVE retains branch ref/reflog. Rollback preserves worktrees/evidence and grants no removal authority.
+
+## Lifecycle Hydration Gate
+
+Hydration is mode-, dependency-, and event-directed:
+
+- new DEFINE reads the resolved change identity plus dependencies and evidence needed for the next artifact;
+- DEFINE continuation reads the changed artifact and direct dependents; progress/drift only when resume, deviation, or conflict makes them relevant;
+- BUILD start/resume reads the accepted final-test-plan gate, current tasks/package and owning contract sections, target/Git/rules, and affected verification;
+- SHIP reads the implemented diff/tree, current BUILD evidence, explicit target, and only affected/stale risk, integration, packaging, or release owners;
+- ordinary continuation reads the current request and directly relevant files; it performs no formal hydration unless formal work is explicitly resumed or changed.
+
+Re-read every file written by ROSE once before using it as durable evidence. A user correction, write, hook, content/config/dependency/toolchain/target event, or conflict invalidates that evidence and its dependents only. Phase movement, elapsed time, file presence, or generic `continue` never forces all artifacts to be re-read.
+
+When an A33 boundary is actually involved, revalidate the canonical user-selected Git startup host and current permissions. For every declared attachment, separately revalidate exact `repo_key`/`worktree_key`, current target canonical root/toplevel/private-dir/common-dir/HEAD/branch/membership, dirty and tracked/untracked/ignored/artifact/unknown file state, applicable target rules, owning-repository artifact destinations, and current applicable `WT-001` host/source/target identity evidence. Never require cross-repository common-dir equality or reuse one attachment's evidence for another. Idea capsules/inbox, legacy `implementation-notes.html`, packets, handoff, memory, checkpoints, stale chat summaries, old logs, DCP/compression state, and task checkboxes remain navigation or migration evidence only; none establishes contract, runtime binding, authorization, operation approval, completion, or freshness.
+
+Ordinary one-turn/report-only work that neither opens nor uses memory and has no formal long-running/resume/context-loss boundary writes no memory start/end receipt. Named formal continuity events or actual current-task memory use require the applicable scoped checkpoint/completion receipt, which remains non-authoritative. Handoff likewise requires explicit user intent or an already accepted lifecycle trigger, uses a repository-local redacted reference-first artifact, and promotes no durable memory by default. For A33, handoff/checkpoint records owning-repository destinations and preserved rollback worktree/evidence references; every later ADD or non-force REMOVE requires a new exact operation/key/class-bound approval and no continuity artifact broadens access.
+
+## Optional Capability Gates
+
+Run the proactive delegation scan across commands and natural-language routes. When an existing Task trigger is met, dispatch before duplicating that assignment directly; direct work is the fallback when no trigger is met or delegation is concretely blocked. Do not create a parallelism report, ownership table, research chain, or stress-test merely because work has multiple steps, files, artifacts, or packages.
+
+- Dispatch concurrent tools or Task when actual independent units have clear wall-clock/context benefit or a concrete capability gap. One auxiliary capability defaults to at most two contexts, but this is not a hard cap; ROSE chooses any larger bounded fan-out only for independent non-overlapping units with concrete benefit, suitable owners, and an explicit join plan. Otherwise work directly without user-facing ceremony.
+- Look up only the missing source class capable of changing a material decision: current repository evidence for local facts, official/current evidence for a version-sensitive question, or mature prior art on explicit request or a named design gap. Do not run all classes automatically. Incorporation creates no scheme/research/plan approval; unresolved material evidence still blocks final acceptance.
+- Run one bounded `strategy-stress-test` only on explicit intent or a named material loophole in a concrete artifact. Otherwise inspect and repair the owning artifact directly.
+- User-requested packaging: packaging is a delivery step after claim-matched checks, not a substitute for them. Confirm a materially ambiguous target/platform, run the selected focused verification, allow at most one in-scope targeted repair/recheck/repackage, and report the artifact path or blocker. Pause for signing/notarization credentials, dependency or lockfile changes, external publishing, destructive cleanup, secret handling, or unsupported platform assumptions unless explicitly approved.
+
+## IDEATE
+
+Use when the idea is unclear, broad, or competing options exist.
+
+- Inputs: user goal, constraints, existing context.
+- Actions: run the proactive delegation scan, explore alternatives, identify assumptions, and collect evidence needs. Under `direct-vs-delegated-work.md`, explicit request or clear specialist, noisy-context, or independent-parallel benefit dispatches Task promptly; work directly only when no trigger applies or delegation is concretely blocked. When a candidate idea should be preserved without formalizing a change, write a lightweight idea capsule or update backend-neutral `ideas/workflow-inbox.md` if artifact placement is allowed.
+- Outputs: idea brief, option list, open questions, recommended next mode, and optional idea capsule or `ideas/workflow-inbox.md` update.
+- Hard stop: no production code or harness file edits.
+- Do not create a formal OpenSpec proposal by default during pure IDEATE; DEFINE promotes only selected ideas into backend-specific change artifacts.
+- Writing an IDEATE capsule/inbox entry does not write requirement memory unless the user also states a safe, scoped fact that independently satisfies the memory gate.
+
+## DEFINE
+
+Use when the goal is plausible but not ready to implement.
+
+- Inputs: current goal, relevant issue/spec/code/docs evidence, and only prior artifacts required by the next dependency.
+- Actions: create/reuse one OpenSpec change by scope; ask one identity question and write nothing if genuinely ambiguous. Follow current OpenSpec instruction/status dependencies and write/re-read each applicable artifact once. Route material clarification to `requirements-grilling`/`interview.md` and test-plan generation to `test-document-generator`; neither auto-invokes another process skill. Close only decision-shaping source gaps before final acceptance and run strict validation. Do not ask per-artifact persistence questions.
+- Outputs: confirmed scope, unresolved questions, confirmed decisions, rejected options, test traceability, artifacts created/updated, and build-readiness status: `READY` or `BLOCKED`. A named non-material runtime residual may remain `Unverified` under a fail-closed runtime/operation gate, but waiver or accepted-`Unverified` wording is not a readiness alternative.
+- Hard stop: do not implement until artifacts are coherent and strictly valid, no material product question or decision-shaping research gap remains, and the user explicitly accepts the final `test-plan.md`. A waiver or accepted-`Unverified` label cannot clear a material research gap. This is the sole mandatory lifecycle approval; permission/risk/destructive-operation gates remain separate.
+- Continuity default: after identity resolves, write and re-read applicable OpenSpec artifacts without per-artifact or per-fact prompts. If multiple plausible changes remain, ask exactly one change-identity question and write nothing until resolved.
+
+## BUILD
+
+Use only on explicit command or equivalent natural-language implementation intent for the resolved accepted change. BUILD is neutral bounded package execution. Final test-plan acceptance alone is zero execution.
+
+- Inputs: one ready target, current accepted final `test-plan.md`, current tasks/package and owning contract sections, target rules/state, acceptance criteria, forbidden scope, and affected verification path. Read progress or bounded drift only when resume/deviation/conflict makes it relevant. Named non-material runtime residuals remain `Unverified` under separate fail-closed gates.
+- Actions: apply the directed hydration set; confirm exact locality/contracts or diagnose one bounded failure. Open-ended exploration and mature-prior-art research block in BUILD. Resolve the declared target without selecting another host; synthesize the ordered queue from the accepted contract; implement complete scoped packages in dependency order; record lightweight savepoints; and trigger no package test, review, commit, or approval merely at a boundary. ROSE then inspects the final changed scope and affected links and selects the smallest completion check. Use one auxiliary capability only for a concrete gap, permit at most one targeted repair/recheck, and stop without automatic swarm, broad matrix, commit, push, PR, or SHIP transition. Success records `IMPLEMENTED_TARGETED_VERIFIED`. This umbrella's Package 12 name is historical, not a generic requirement.
+- Outputs: target and outer profile, active-contract package queue, progress-ledger savepoints, completed/blocked packages, changed files/artifacts mapped to requirements/decisions/risks, canonical envelope/budget state, minimal completion evidence when reached, branch/worktree hygiene, residual risks, and traceability gaps labeled `Open Question` or `Unverified`.
+- Hard stop: pause on ambiguous or missing target, missing current research closure or final-test-plan acceptance/readiness evidence, target repository outside the declared/allowed scope, scope expansion, forbidden file edits, high-risk operations requiring explicit approval, unverifiable acceptance criteria, exhausted canonical objective budgets, or an unresolved blocker after the one permitted targeted repair/recheck. A discovery changing scope, architecture, dependency, public contract, permissions, acceptance, or verification strategy is `BUILD_MATERIAL_DISCOVERY`: record the discovery and affected artifacts, stop before changed work, and return to DEFINE writeback/re-read/strict validation and renewed final acceptance. Optional specialist evidence is never a prerequisite unless a concrete capability gap made that specialist necessary. No waiver or other artifact approval substitutes for final test-plan acceptance. Do not pause solely because the user omitted a manual implementation package; synthesize the queue instead.
+
+### Natural continuation and compound ordering
+
+- Resume wording (`continue`, `继续`, `go ahead`, `继续做`) resumes exactly one active authorized envelope when target, exact phase, current acceptance/material gates, and remaining budget are unambiguous. Preserve consumed counters, token accounting state, overshoot, and stop state. Resume cannot broaden authorization, reset budget, change phase/target, or refresh acceptance; otherwise ask exactly one target/authorization question and do no loop/write/mutation.
+- A material acceptance/verification change returns to DEFINE, writes/re-reads/revalidates affected artifacts, and stales prior acceptance when the final acceptance contract changes. It never resumes BUILD.
+- Same-turn acceptance plus BUILD persists/classifies the answer in `interview.md`, updates the final test-plan gate/checklist, re-reads both, then runs strict validation and target/package/permission/verification/budget checks before any execution. No test execution-ledger row appears before BUILD actually starts.
+- Explicit no-write/chat-only overrides formal writeback and both compounds for the current turn: return a blocked/`Unverified` preview; preserve pending state; perform zero persistence, acceptance, execution, mutation, ledger entry, or budget consumption.
+- “Implement and then ship” authorizes current-phase BUILD only. Later SHIP needs fresh evidence and new explicit intent.
+
+### Formal interval/event protocol routing and identity
+
+An explicit formal **documentation-only** request for an external/manual AILI interval or event protocol routes to DEFINE. Missing documentation scope or external/manual trigger details cause one focused documentation-protocol question with zero execution. A request for AILI itself to execute, register, or run that lifecycle protocol is not ambiguous documentation: block it with zero mutation and zero LP. Store or reuse one stable `LP-INTERVAL-NNN` or `LP-EVENT-NNN` body only under the active change's `design.md` `## Loop Protocols`; tasks/test-plan/context may reference its ID but never duplicate the body. Ordinary discussion writes no LP. Missing/duplicate IDs or duplicate bodies block validation. Explicit product/repository automation remains governed by the following paragraph instead of this protocol-only block.
+
+Hidden or unrequested AILI self-automation/background lifecycle registration or execution remains blocked with zero mutation and zero LP. A mixed hidden-automation plus protocol-documentation request also creates no LP until later documentation-only restatement. Explicitly scoped product/repository CI, cron, scheduler, watcher, webhook/listener, queue, daemon, hook, dependency, or auto-retry remains eligible through the ordinary/formal classifier and every applicable high-risk, dependency/lockfile, permission, external-write, credential, persistent-service, destructive, ownership, verification, and exact-operation gate; do not replace it with an AILI LP or reject it merely because automation nouns appear. Vocabulary-only comparisons remain ordinary. Documentation-only AILI interval/event requests may define the design-owned external/manual LP but create no runtime or lifecycle permission. A current no-write override still wins.
+
+`ROUTE-007` identity handling is single-authority behavior:
+
+1. Every body persists exactly `profile`, `change_id`, `scope_id`, `trigger_source_id`, and `identity_key`; profile is `interval|event`, change ID is current, slugs are stable lower-kebab-case, and project-relative POSIX paths are case-preserving with no absolute root, backslash, `.` or `..` segment.
+2. Eligible natural-language/raw user text is normalized to NFC, trimmed, and has internal ASCII whitespace collapsed before slug resolution; path resolution uses NFC while preserving case. Resolve synonyms once to explicit IDs. Controls, newline, and NUL reject before serialization. Ambiguity asks once and writes nothing. Canonically equivalent composed/decomposed natural input therefore reuses one identity.
+3. Persisted/already-structured identity is never repaired in place. Its key must be raw-NFC UTF-8 compact JSON (`ensure_ascii=false`) of the first four fields in exact order with no insignificant whitespace. Alternate non-control `\uXXXX`, decomposed Unicode, controls/newline/NUL, field reordering, JSON whitespace, or field/key mismatch is corruption and hard-blocks without write.
+4. One valid identical key reuses its LP. A distinct key re-reads `design.md` immediately before allocation and uses the maximum existing suffix for that profile plus one with at least three digits; gaps and retired IDs are never reused.
+5. A clean candidate-ID race permits one immediate re-read/max-plus-one recompute; a second race blocks without write. Duplicate identity keys, duplicate IDs/bodies, malformed identity, or conflicting bodies are corruption—not races—and hard-block immediately without allocation/recompute/retry/write.
+
+The byte oracle for fields `event`, `complete-aili-workflow-orchestration`, `docs/设计/Review.md`, `ci-failure` is exactly raw-NFC `{"profile":"event","change_id":"complete-aili-workflow-orchestration","scope_id":"docs/设计/Review.md","trigger_source_id":"ci-failure"}`. Its UTF-8 hexadecimal bytes are `7b 22 70 72 6f 66 69 6c 65 22 3a 22 65 76 65 6e 74 22 2c 22 63 68 61 6e 67 65 5f 69 64 22 3a 22 63 6f 6d 70 6c 65 74 65 2d 61 69 6c 69 2d 77 6f 72 6b 66 6c 6f 77 2d 6f 72 63 68 65 73 74 72 61 74 69 6f 6e 22 2c 22 73 63 6f 70 65 5f 69 64 22 3a 22 64 6f 63 73 2f e8 ae be e8 ae a1 2f 52 65 76 69 65 77 2e 6d 64 22 2c 22 74 72 69 67 67 65 72 5f 73 6f 75 72 63 65 5f 69 64 22 3a 22 63 69 2d 66 61 69 6c 75 72 65 22 7d`.
+
+## SHIP
+
+Use only after BUILD records `IMPLEMENTED_TARGETED_VERIFIED` and a fresh explicit SHIP intent requests handoff, merge, release, or closeout.
+
+Natural-language SHIP requires explicit review/repair/closeout intent for an implemented change plus current implementation evidence. DEFINE artifacts, final-plan acceptance, direct generated-adapter output, and earlier combined BUILD/SHIP wording are insufficient.
+
+## Generated Direct Adapter Boundary
+
+AILI guarantees only IDEATE, DEFINE, BUILD, and SHIP, selected by command or equivalent natural language. Current generated `.opencode` `/opsx-*`, apply/continue/archive, and `openspec-*` adapters remain unchanged external direct routes. Never route/recommend AILI users to them, hand-edit/wrap/suppress/prevent them, or treat their direct result as AILI acceptance/readiness/verification/convergence/closeout evidence. A later AILI route establishes its own current state. Adapter integration/control is Phase II.
+
+- Inputs: implemented diff/tree, current `IMPLEMENTED_TARGETED_VERIFIED` evidence, explicit SHIP target, and closeout claim. Read `context.md`, `progress.txt`, bounded `drift-log.md`, or legacy migration evidence only when the directed SHIP dependency set requires it.
+- Actions: require fresh explicit SHIP intent; apply the directed SHIP read set; reuse BUILD evidence that still covers the exact content/tree, target, config, dependencies, toolchain, hooks, and merge result; refresh only stale, scope-affected, risk-triggered, integration, packaging, release, merge-result, or target-specific evidence. Phase/time and unchanged transport do not stale evidence. A review/test/security or matrix capability is optional only for one concrete affected claim. Run task-end branch/worktree hygiene for non-trivial closeout and prepare closeout.
+- Outputs: BUILD gate status, release-blocker audit target and finding classifications, spec coverage check summary, release-readiness summary, final evidence or compact evidence packs, branch/worktree hygiene status, closeout report, archive/sync/memory/PR/release next steps when approved. Ambiguous "archive" or "归档" requests require target confirmation before compression or file writes.
+- Hard stop: do not claim ready without claim-matched fresh evidence and resolved blocking findings. Commit, push, merge, and release each need exact action-specific approval. CI failure reports the failed check, target, and commit/tree evidence and stops for user decision; never auto-repair, commit, push, merge, or release. Preserve explicit `Open Question` / `Unverified` items.
+
+## Task-End Branch/Worktree Hygiene Gate
+
+For non-trivial BUILD and SHIP closeout, inspect `git status --short --branch` in the target repository and classify dirty paths as task-scoped, unrelated/pre-existing, generated/ignored, scratch, or unknown. Remove only safe task-owned, non-user-visible scratch artifacts created by the current task. Propose cleanup for remaining residue, and ask explicit approval before push, destructive clean/reset, branch deletion, worktree removal, OpenSpec archive, stashing unrelated changes, or deleting user-visible artifacts. Savepoint commits may be proactive only when current task/project rules explicitly allow task-scoped verified commits; otherwise ask once with the cleanup package.
+
+## Change Revision Decision
+
+When bugs or adjustments appear after a lifecycle pass:
+
+- Same intent, overlapping scope, and not archived: update the current change, add repair tasks, and update `test-plan.md` defect/fix coverage.
+- Additional in-scope implementation requested after BUILD: return to the bounded BUILD owner for the changed scope and a newly selected claim-matched check.
+- Same scope after SHIP but before archive: repair the current change and rerun only the checks selected for the affected claim.
+- Archived, merged, or released: create a new fix change and reference the source change instead of rewriting history.
+- Workflow, command, skill, memory, subagent, installer, or tool-policy defect: return the defect to ROSE; diagnosis and any later approved evolution are separate bounded loops, never a skill-to-skill auto-chain.

package/skills/aili-delivery-flow/references/protocols/acceptance-test-plan.md

@@ -0,0 +1,18 @@
+# Acceptance Test Plan Protocol
+
+- Trace ID:
+- Scope under test:
+- Requirements covered:
+- Traceability matrix:
+  - requirement/decision/risk:
+  - task/package:
+  - file/artifact:
+  - verification command or inspection:
+  - evidence:
+  - coverage status: planned | covered | Open Question | Unverified
+- Test cases:
+- Negative cases:
+- Commands/manual checks:
+- Evidence to collect:
+- Out-of-scope checks:
+- Open Questions / Unverified risks:

package/skills/aili-delivery-flow/references/protocols/alignment-questionnaire.md

@@ -0,0 +1,10 @@
+# Alignment Questionnaire Protocol
+
+- Trace ID:
+- Decision needed:
+- Why it matters:
+- Options:
+- Default recommendation:
+- Blocking status:
+- User answer:
+- Impact on spec/tests/tasks:

package/skills/aili-delivery-flow/references/protocols/closeout-report.md

@@ -0,0 +1,101 @@
+# Closeout Report Protocol
+
+Use this protocol for the repository-local Markdown document required by SHIP. Write the report body in Chinese unless the active contract explicitly requests another language.
+
+Default locations:
+
+- OpenSpec-backed change: `openspec/changes/<change-id>/ship-closeout.md`
+- Non-OpenSpec change: ask for a repository-local path before the final verdict if no approved path exists
+
+# SHIP Closeout Report
+
+## 1. 元信息
+
+- Trace ID:
+- Outcome: pass | blocked | needs-review
+- Mode / backend:
+- Closeout document path:
+- Completed scope:
+- Changed files:
+- BUILD gate status:
+- Branch/worktree hygiene status:
+- Approval/archive status:
+
+## 2. 变更摘要
+
+- 本次提案/变更实际完成了什么：
+- 明确未覆盖或未纳入范围的内容：
+- 与原始 proposal / spec / task 的偏差：
+
+## 3. 已实现行为
+
+- 新增、修改或移除的用户可见行为：
+- 内部工作流、配置、权限、数据或接口行为变化：
+- 回滚或恢复方式（如适用）：
+
+## 4. 对既有功能的影响
+
+- 可能受影响的既有功能：
+- 已确认不受影响的功能及证据：
+- 影响范围证据锚点：
+
+## 5. 风险评估
+
+### 5.1 回归风险
+
+- 风险：
+- 证据 / 缓解：
+
+### 5.2 兼容性风险
+
+- 风险：
+- 证据 / 缓解：
+
+### 5.3 安全 / 权限风险
+
+- 风险：
+- 证据 / 缓解：
+
+### 5.4 工作流 / 数据丢失 / 运维风险
+
+- 风险：
+- 证据 / 缓解：
+
+## 6. Release-blocker audit
+
+- Target / scope:
+- Fresh evidence:
+- Compact evidence packs:
+- Blocking findings:
+- Important findings:
+- Accepted-risk findings:
+- Out-of-scope findings:
+- `Unverified` items:
+
+## 7. 分支 / 工作区清理门
+
+- Branch/status inspected:
+- Dirty path classification（task-scoped / unrelated-pre-existing / generated-ignored / scratch / unknown）:
+- Safe task-owned scratch removed:
+- Cleanup proposed / approval required:
+
+## 8. 验证证据
+
+- Verification run:
+- Evidence anchors:
+- Raw evidence access / rerun commands（prefer rerun commands; redact/exclude secrets and do not create raw artifacts without explicit approval）:
+- 未运行的检查及原因：
+- 证据新鲜度说明：
+
+## 9. 剩余风险与未验证项
+
+- Remaining risks:
+- `Unverified` items:
+- 需要人工确认的问题：
+
+## 10. 建议与下一步
+
+- Recommendation: archive | needs repair | needs more verification | accepted risk
+- Follow-up package:
+- Memory writeback receipt:
+- Next steps:

package/skills/aili-delivery-flow/references/protocols/compact-evidence-pack.md

@@ -0,0 +1,46 @@
+# Compact Evidence Pack Protocol
+
+Repository source path: `.agents/skills/aili-delivery-flow/references/protocols/compact-evidence-pack.md`. Installed runtime target: `$HOME/.agents/skills/aili-delivery-flow/references/protocols/compact-evidence-pack.md`.
+
+Use a compact evidence pack when evidence is noisy, long, broad, multi-source, or otherwise too bulky for a concise BUILD/SHIP report, memory writeback, or subagent result. Compression is not proof by itself; every pack must preserve a source, result, and a rerun path or safe raw-artifact path when raw evidence is needed.
+
+```text
+Compact evidence pack:
+- Evidence id:
+- Source: command / file inspection / subagent trace / artifact path
+- Scope: files, directories, package, or workflow area covered
+- Freshness: fresh / stale / rerun-needed / unverified
+- Result: pass / fail / partial / blocked / not-run
+- Exit code: <code or N/A>
+- Key observations:
+  - <fact with anchor>
+- Key failure excerpt:
+  - <minimal relevant error lines, or N/A>
+- Raw evidence access: rerun command / repository-local artifact path / unavailable with reason
+- Unverified items:
+  - <item or N/A>
+```
+
+## When required
+
+Use a compact evidence pack for:
+
+- verbose test, build, lint, typecheck, CI, or shell output;
+- failed commands with long logs;
+- broad search, grep, diff, or repository-scout evidence;
+- multi-package or multi-review reconciliation;
+- SHIP closeout evidence that would otherwise paste raw logs or long dumps.
+
+Short successful checks may be reported directly when the command, scope, result, and remaining `Unverified` items are clear without the full pack shape.
+
+## Raw evidence rules
+
+- Do not paste full raw logs, long grep dumps, long diffs, or full file contents into final reports, memory, or subagent results by default.
+- Include only the minimal key failure excerpt needed for action.
+- If raw evidence must be user-visible, the active contract or project rules must name a repository-local placement. For OpenSpec changes, use `openspec/changes/<change-id>/evidence/` only when explicitly approved or required by the task packet.
+- If raw evidence is available only in tool output, record the rerun command instead of inventing an artifact path.
+- Redact or exclude secrets, credentials, cookies, tokens, private keys, and production-sensitive data.
+
+## Final-report rule
+
+BUILD and SHIP reports must cite compact evidence for noisy evidence claims, list skipped checks and remaining `Unverified` items, and avoid complete logs unless the user explicitly requests them and the content has been checked as safe to show.

package/skills/aili-delivery-flow/references/protocols/idea-brief.md

@@ -0,0 +1,10 @@
+# Idea Brief Protocol
+
+- Trace ID:
+- User goal:
+- Current context:
+- Candidate directions:
+- Constraints and non-goals:
+- Unknowns:
+- Recommended next mode: IDEATE | DEFINE
+- Evidence pointers: