@rosetears/aili-pi 0.1.0

package/skills/aili-delivery-flow/references/protocols/implementation-package.md

@@ -0,0 +1,53 @@
+# Implementation Package Protocol
+
+- Trace ID:
+- Source requirement/decision/risk:
+- Package goal:
+- Allowed files:
+- Target files/artifacts:
+- Forbidden files:
+- Acceptance criteria:
+- Required context reads:
+- WT-001 context ref: <context_id, evidence_version, freshness, mode> | N/A
+- Traceability mapping:
+  - source requirement/decision/risk:
+  - task/package:
+  - file/artifact boundary:
+  - verification command or inspection:
+  - expected evidence:
+  - coverage status: covered | Open Question | Unverified
+- Parallelism analysis:
+  - shared scaffold/source-of-truth:
+  - safe parallel lanes:
+  - serial dependencies:
+  - benefit-gated independent lanes (maximum two by default):
+  - ownership boundaries:
+  - join point and expected evidence:
+  - blockers or no-parallel reason:
+- Research-first evidence gate: required-satisfied | not-triggered | blocked
+- Implementation constraints:
+- Delegation plan:
+- Verification command:
+- Evidence return expectation: changed files/artifacts plus verification evidence for each mapped source requirement, decision, or risk; uncovered links labeled `Open Question` or `Unverified`.
+- Task-end branch/worktree hygiene:
+  - branch/status inspection: inspect `git status --short --branch` in the target repo and review the relevant diff.
+  - dirty path classification: classify dirty paths as task-scoped, unrelated/pre-existing, generated/ignored, scratch, or unknown.
+  - safe scratch cleanup: remove only safe task-owned, non-user-visible scratch artifacts created by the current task.
+  - cleanup proposal: propose cleanup for remaining residue without touching unrelated dirty paths.
+  - approval-gated operations: ask explicit approval before push, destructive clean/reset, branch deletion, worktree removal, OpenSpec archive, stashing unrelated changes, or deleting user-visible artifacts.
+  - commit allowance: savepoint commits may be proactive only when current task/project rules explicitly allow task-scoped verified commits; otherwise ask once with the cleanup package.
+- Packaging flow when user-requested:
+  - target/platform:
+  - pre-package tests/checks:
+  - package/build command:
+  - package failure classification:
+  - repair/retest/repackage limit:
+- Repair / retry limit:
+- Stop conditions:
+- Expected return format:
+
+An A33 package references exactly one current `WT-001` context per declared repository lane. It may not copy, rebind, or reinterpret roots, keys, Git identity/state, approvals, operation class/risk, deltas, target rules, command/cwd, or containment facts. Target rules are re-read at the operation/dispatch boundary, may only narrow authority, and same-level conflicts block. Artifacts stay in the owning target repository.
+
+Decision-shaping research that can affect scope, architecture, dependencies, public contract, permissions, acceptance, or verification strategy must be closed in DEFINE. It cannot be waived or accepted as `Unverified`; discovery during BUILD emits `BUILD_MATERIAL_DISCOVERY` and stops changed work. Named non-material runtime residuals remain under their separate fail-closed operation gates.
+
+Run the proactive delegation scan before package work. When an existing Task trigger is met, dispatch promptly; direct work is the no-trigger/blocked fallback. Default concurrency is at most two but is not a hard cap; larger bounded fan-out requires independent non-overlapping lanes, concrete benefit, suitable owners, and an explicit join plan. Each Task context receives one bounded assignment, returns one terminal result or failure, never delegates, and is never resumed through an old `task_id`. A failed, empty, blocked, or partial result does not trigger an automatic fresh retry; later same-type use requires a fresh trigger-and-benefit decision and a fresh context with no prior `task_id`. ROSE retains lifecycle, integration, reconciliation, and final-verdict ownership. A package never creates automatic review, test, security, verifier, full-suite, or repair-loop lanes. Verification is the smallest fresh check that proves the exact claim.

package/skills/aili-delivery-flow/references/protocols/research-evidence-pack.md

@@ -0,0 +1,19 @@
+# Research Evidence Pack Protocol
+
+- Trace ID:
+- Research question:
+- Planning trigger: official/API docs | fast-changing/version-sensitive | model uncertainty | user-requested research | mature-project/prior-art | packaging/distribution | platform/runtime | security/permissions | external integration | UI/animation/product-form | local repository evidence
+- Sources checked:
+- Official/API facts:
+- Local repository facts:
+- Prior-art or mature-project patterns:
+- Assumptions:
+- Rejected options / not-recommended patterns:
+- Key risks:
+- Conflicts or gaps:
+- Applicability to this repo:
+- Confidence:
+- Evidence-backed 方案 / recommended decisions:
+- User confirmation state: confirmed | waived | accepted as UNVERIFIED | pending
+- Implementation gate: proceed | blocked | waived | UNVERIFIED
+- Evidence anchors:

package/skills/aili-delivery-flow/references/protocols/review-report.md

@@ -0,0 +1,7 @@
+# Review Report Protocol
+
+Review, test, security, coverage, convergence, evaluator, and focused-recheck reports use the exact canonical result/finding envelope in `subagent-result.md`; this protocol does not restate or extend that schema. Each worker context is single-use and its report is terminal. Workers provide evidence and propose dispositions. ROSE reconciles and owns lifecycle, integration, and final disposition; do not vote on lane results, average confidence, treat a worker verdict as acceptance authority, resume an old `task_id`, or create an automatic fresh-session retry.
+
+For A33, reject a result unless it references one current WT-001 context, names one packet-declared repository/cwd, points to applicable target rules and the owning-repository artifact destination, records inspected scope/freshness/skips and soft-boundary limits, and performs no broad host scan. A result may reference but never duplicate or rebind identity, keys, approvals, Git state, rule bodies, verification command/cwd, or containment facts.
+
+`review_arbitration_ref` is non-`N/A` only for a disputed, blocking, cross-session, or materially inconsistent finding. The exact change-local path is `openspec/changes/<change-id>/review-arbitration.md`. That artifact preserves the stable finding ID, competing claims, evidence and counter-evidence, proposed dispositions, ROSE disposition and rationale, owner, status, required recheck, freshness, and residual `Unverified` items. Do not create it for routine agreement, and do not create an instance in advance of a real qualifying finding.

package/skills/aili-delivery-flow/references/protocols/spec-draft.md

@@ -0,0 +1,12 @@
+# Spec Draft Protocol
+
+- Trace ID:
+- Problem statement:
+- Goals:
+- Non-goals:
+- Requirements:
+- Scenarios / acceptance criteria:
+- Risks:
+- Open questions:
+- Verification plan:
+- Source evidence:

package/skills/aili-delivery-flow/references/protocols/subagent-result.md

@@ -0,0 +1,60 @@
+# Subagent Result
+
+This is the one canonical terminal result and finding envelope for delegated review, test, security, coverage, convergence, evaluator, and focused-recheck lanes. Return only what ROSE needs to decide the next action; the Task context closes after this result or failure.
+
+```text
+CANONICAL RESULT:
+result_id:
+trace_id:
+lane:
+owner:
+status: completed | partial | blocked | unverified
+confidence: HIGH | MED | LOW | VERY LOW | UNKNOWN
+worktree_context_ref: <context_id, evidence_version, freshness, mode> | N/A
+declared_repository:
+cwd:
+target_rules_ref:
+artifact_destination:
+inspected_scope:
+checks:
+freshness:
+skipped_checks:
+soft_boundary_limitations:
+blockers:
+unverified:
+findings:
+convergence_links:
+review_arbitration_ref: openspec/changes/<change-id>/review-arbitration.md | N/A
+```
+
+Each finding has exactly:
+
+```text
+finding_id:
+source:
+claim:
+severity:
+evidence_anchors:
+affected_requirement:
+proposed_disposition: fix | refute-with-counter-evidence | accept-named-risk | Unverified-block
+required_action:
+verification:
+```
+
+P6 compatibility markers remain aliases, not a second envelope: `STATUS: completed | partial | blocked | unverified`, `WT-001 context ref`, `EVIDENCE:`, and `BLOCKERS:` map to `status`, `worktree_context_ref`, finding/evidence anchors, and `blockers` above.
+
+## Rules
+
+- Evidence must support the reported status.
+- Keep raw logs, broad dumps, and full files out of the result.
+- Mark unsupported claims `Unverified`.
+- A no-finding result uses `findings: []` and still reports inspected scope, checks, freshness, skipped checks, blockers, and `Unverified` items.
+- Do not issue the final PASS, acceptance, release, or integration decision.
+- Never resume the result's old `task_id` for follow-up, clarification, continuation, repair, recheck, or additional work.
+- A failed, empty, blocked, or partial result does not authorize an automatic fresh-session retry. ROSE handles the bounded gap directly or reports the blocker.
+- A later use of the same `subagent_type` is allowed only through a fresh Task with no prior `task_id` after a fresh trigger-and-benefit decision independently justifies changed evidence or a new assignment.
+- No result grants permission for another operation, external access, Git integration, cleanup, lifecycle transition, approval, integration decision, or nested delegation; ROSE owns reconciliation and the final verdict.
+- An A33 result references the same one current WT-001 context as its task and names exactly one packet-declared repository/cwd, the applicable target-rules reference, and an owning-repository artifact destination. It records the shared-trust soft-boundary limitation and performs no broad host scan.
+- The repository/cwd fields repeat only the packet's ownership declaration; they do not create identity or command authority. The result never duplicates or rebinds roots, keys, identity, Git state, approvals, operation class/risk, deltas, rule bodies, verification command/cwd, or containment facts.
+- A changed, stale, missing, mixed-mode, or duplicate WT reference blocks acceptance and returns to ROSE for reconciliation.
+- `review_arbitration_ref` is non-`N/A` only for a disputed, blocking, cross-session, or materially inconsistent finding. ROSE, not a worker, creates or updates that artifact and owns final disposition without voting or confidence averaging.

package/skills/aili-delivery-flow/references/protocols/subagent-task-packet.md

@@ -0,0 +1,29 @@
+# Subagent Task Packet
+
+Use only when delegation meets `direct-vs-delegated-work.md`. Keep packets small enough to read in one pass.
+
+```text
+Goal:
+Scope:
+WT-001 context ref: <context_id, evidence_version, freshness, mode> | N/A
+Allowed actions:
+Expected result:
+Stop when:
+```
+
+## Rules
+
+- `Goal` names one bounded outcome.
+- `Scope` names the files, repository, cwd, or evidence sources.
+- `Allowed actions` says read-only or lists exact editable files and approved commands.
+- `Expected result` asks for compact evidence, artifacts, or a command result.
+- `Stop when` names missing permission, conflicting rules, scope expansion, or unavailable evidence.
+- The packet creates one fresh Task context for one bounded assignment. Never pass or resume an old `task_id` for follow-up, clarification, continuation, repair, recheck, or additional work.
+- A terminal, failed, empty, blocked, or partial session is not automatically retried. ROSE handles the bounded gap directly or reports the blocker.
+- The same `subagent_type` may receive a later fresh packet only after a fresh trigger-and-benefit decision independently justifies the assignment or changed evidence; the new Task omits every prior `task_id`.
+- A packet narrows runtime authority; it never grants a tool, path, edit, command, network call, or delegation permission.
+- Every non-ROSE subagent remains non-delegating.
+- ROSE retains lifecycle, approval, integration, reconciliation, and final-verdict ownership.
+- For an approved A33 attached repository, `Scope` names exactly one declared repository/cwd and the packet references exactly one current `WT-001` context. The compact reference contains only context id, evidence version, freshness, and mode.
+- Never copy, rebind, or reinterpret WT-001 host/source/target identity, keys, paths, Git state, approval, operation class, risk, delta, command/cwd, or containment facts. A duplicate is non-authoritative and blocks dispatch.
+- Target rules are re-read at dispatch. They may narrow the packet but never broaden it; same-level conflicts block. User-visible artifacts remain in the owning target repository.

package/skills/aili-delivery-flow/references/protocols/worktree-context.md

@@ -0,0 +1,109 @@
+# WT-001 Worktree Context Protocol
+
+Repository source path: `.agents/skills/aili-delivery-flow/references/protocols/worktree-context.md`. Installed runtime target: `$HOME/.agents/skills/aili-delivery-flow/references/protocols/worktree-context.md`.
+
+`WT-001` is the single authority for attached-repository target identity and parent-observed evidence. Task packets, results, implementation packages, and backend adapters reference one context by id; they must not copy, rebind, or independently reinterpret roots, keys, Git identity, approvals, permission boundaries, or evidence.
+
+Every envelope has exactly one mode:
+
+- `a30-a31-external-read`: historical, non-gating evidence only. Its external-path ask, shared-common-dir, and A30 provider-probe fields remain valid only inside that historical record.
+- `a33-attached-shared-trust-domain`: current authority. Mixed A30 fields or guarantees, managed-subagent external ask, cross-repository common-dir equality, and use of an A30 probe as A33 proof are invalid.
+
+## Canonical context
+
+```text
+WT-001:
+- context_id:
+- evidence_version:
+- freshness:
+- mode: a30-a31-external-read | a33-attached-shared-trust-domain
+- source_session_root:
+- repo_key:
+- worktree_key:
+- target_repo_root:
+- target_worktree_root:
+- branch:
+- base_ref:
+- branch_mode: existing | create
+- reflog_policy: enabled | disabled
+- operation_class: driver_fixture | real
+- trusted_code_risk: accepted | declined | unavailable | not_applicable | null
+- host_identity: A33Identity
+- source_identity: A33Identity
+- target_identity_pre: A33Identity
+- target_identity_post: A33Identity
+- expected_delta:
+- observed_delta:
+- allowed_paths:
+- forbidden_paths:
+- artifact_paths:
+- target_rules_read_at: operation | dispatch
+- operation_approval_ref:
+- soft_boundary_disclosure:
+- containment_status: ready | blocked | Unverified
+- blocked_reasons:
+- unverified:
+```
+
+The A33 host is the Git repository where the user started OpenCode. AILI does not rank, move, broadly scan for, or auto-select a host. Every target is exactly `<session-root>/.worktrees/<repo_key>/<worktree_key>`; visible `worktrees/` and historical `.tmp/worktrees/` are not aliases. `repo_key` and `worktree_key` are nonempty and match `^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$`. Empty, `.`, `..`, `.git`, `.worktrees`, path-like, absolute, control, newline, NUL, separator, reserved, colliding, tracked, or ambiguous values block without suffixing, guessing, forcing, `-B`, orphan creation, remote guessing, or implicit ref selection.
+
+Admission requires a Git session root, the exact prospective destination ignored through root `/.worktrees/` with no re-inclusion, no tracked destination, and safe non-submodule topology. Tracked `.gitmodules`, mode-160000 gitlinks, source/superproject relations, malformed topology, and symlink/junction/mount/path escape ambiguity block. AILI never silently edits the host ignore file.
+
+Every PREPARE pending operation, ADD/REMOVE operation, and approval carries both exact keys. Every operation binds explicit nonempty source, destination, branch, base ref, `branch_mode`, source `reflog_policy`, and `operation_class`. PREPARE is descriptor-only and grants no authority. Each attachment ADD requires one fresh exact approval and `trusted_code_risk:accepted`; each later non-force REMOVE requires a different fresh exact approval after complete deletion inventory and uses observed `trusted_code_risk:not_applicable`. Missing, declined, unavailable, stale, expired, mismatched, wrong-operation, wrong-class, wrong-risk, wrong-key, or reused approval has zero effect. Fixture and real approvals are never interchangeable.
+
+## Exact A33 identity and deltas
+
+`A33Identity` has all and only:
+
+`identity_state, declared_root, path_state, canonical_root, git_toplevel, git_private_dir, git_common_dir, git_head, git_branch, detached_head, worktree_membership, dirty_state, tracked_files, untracked_files, ignored_files, artifact_files, unknown_files`.
+
+`identity_state` is `populated | absent`; `declared_root` is always a nonempty canonical absolute string; `path_state` is `present | absent`; and membership is `main | linked | absent`. Populated identities require present path, nonempty canonical/Git roots and HEAD, boolean detached state agreeing with branch nullability, main/linked membership, exact typed dirty state `{tracked_modified:boolean,tracked_deleted:boolean,untracked_count:nonnegative_integer,ignored_count:nonnegative_integer}`, and duplicate-free sorted canonical repository-relative file arrays. Absent identities keep only `identity_state`, `declared_root`, `path_state`, and `worktree_membership` non-null; every other field is JSON `null`. Host/source are populated. ADD target is absent→populated; REMOVE target is populated→absent. No identity hash/digest field or string sentinel is valid.
+
+Compare typed identity fields, sorted file arrays, and explicit admin delta records directly. `expected_delta` and `observed_delta` contain all of `target_path,worktree_membership,common_dir_identity,common_dir_admin_entry,branch_ref,branch_reflog,unrelated_common_dir_entries,unrelated_refs,config,hooks,unrelated_worktree_records,unrelated_prunable_entries,other_files`; each value is exactly `{before,after,change}` with JSON `null` for absence and `change:created|deleted|unchanged`. Common-dir canonical identity always remains unchanged. ADD creates only the declared admin entry/membership plus the bound create-mode ref and, only when policy is enabled, reflog. Existing mode creates neither ref nor reflog. REMOVE deletes only the declared admin entry/membership and preserves branch ref/reflog. All unrelated/prunable entries, refs, reflogs, config, hooks, worktree records, and other files remain unchanged.
+
+Every declared result field is present. JSON `null` represents absent or inapplicable data; omission, wrong types, or string sentinels are invalid. The only A33 `not_applicable` enum is `trusted_code_risk` on an observed REMOVE approval. Joined static rows keep outer identity/delta/operation/approval/cleanup fields JSON `null`.
+
+## Required boundary evidence
+
+Re-read target `AGENTS.md` and applicable rules at every operation/dispatch boundary. Target rules may narrow tools, paths, web, and permissions but never broaden them; same-level conflicts block. Each lane targets one declared repository/cwd, performs no recursive host scan, and writes user-visible artifacts only in the owning target repository. Missing/stale identity, rules, operation, approval, or delta evidence blocks.
+
+Historical A30 read-only snapshots and provider behavior remain non-gating and cannot satisfy A33 identity, operation, runtime, or join evidence.
+
+Only redacted metadata commands may be pre-approved for identity capture: `git status --short --branch`, `git status --porcelain=v1`, `git branch --show-current`, `git rev-parse --show-toplevel`, `git rev-parse --git-common-dir`, `git rev-parse --verify HEAD`, `git symbolic-ref --short -q HEAD`, and `git worktree list --porcelain`. Content-emitting Git commands, shell search commands, command substitution, pipelines, redirects, metacharacters, and subprocess launchers are not metadata evidence.
+
+## Permission intersection and deny precedence
+
+Effective authority comes from the final runtime-merged child permission rules and their provenance. The conceptual intersection is:
+
+`effective_allow = parent_allow ∩ base_role_allow ∩ task_allow − any_deny`
+
+Any parent, base-role, task-overlay, runtime, external-directory, path, operation, or protocol deny wins. Missing, ambiguous, unsupported, stale, or conflicting permission evidence is a deny. `role_overlay` is evidence and narrowing text, never permission authority: it cannot turn `ask` or `deny` into `allow`, add a tool, clone ROSE permissions, expand external-directory access, or prove the final effective child rules.
+
+Admission and operation approval are separate. Only ROSE owns exact add/non-force-remove operations. Add/remove approval never authorizes test, debug, verification, integration, cleanup, another attachment, or another operation. Prune, move, repair, lock/unlock, force remove, clean/reset, merge/rebase, commit/push, branch deletion, automatic integration, and real-repository cleanup remain excluded.
+
+Delegation is non-transitive. Every non-ROSE subagent has `task: deny` and `external_directory: deny`; no packet can copy ROSE permission or turn ask/deny into allow. Built-in `explore` and `general` remain outside A33 guarantees until effective profile and provenance are proven.
+
+## Managed-role and Git boundary
+
+The canonical inventory is exactly ROSE plus 19 managed Agent files. All 19 managed profiles deny `external_directory` and Task. `web-researcher` remains deny-by-default, local/external/mutation/delegation denied, and only `webfetch`/`websearch` ask. Where OpenCode patterns can express them without disabling legitimate same-root task work, managed profiles deny direct `.git` reads/edits and Git mutation commands. Read-only Git metadata may still reach the trusted common-dir. These are policy controls, not process containment.
+
+## Soft boundary and fail-closed rule
+
+The host and attachments are one explicitly trusted same-owner, same-sensitivity, mutually readable/writable trust domain. OpenCode path/cwd/permission rules are a soft coordination boundary, not hard repository isolation or an OS sandbox. Trusted Git hooks/config/filters/tests can execute with user privileges and ambient network. A33 provides no sandbox, DLP, network isolation, universal TOCTOU guarantee, or arbitrary-process containment. Different repositories need not and normally do not share a Git common-dir; never claim cross-common-dir equality.
+
+Static A33 evidence cannot prove effective runtime profiles, installed equality, nested operation behavior, or UV-007. Staged runtime modes may use only driver-owned temporary repositories. Usage exits `2`; unavailable mandatory runtime evidence or a missing/declined/unavailable required-valid-operation approval exits `3`; schema/set/key/identity/null/class/risk/mutation or observed effect/ref/reflog/delta/cleanup violations exit `5`. Narrow exit `0` does not upgrade the soft-boundary residuals above.
+
+## Reference-only use
+
+Packets and results carry only:
+
+```text
+worktree_context_ref:
+  protocol_path: .agents/skills/aili-delivery-flow/references/protocols/worktree-context.md
+  context_id:
+  evidence_version:
+  freshness:
+  mode: a33-attached-shared-trust-domain
+```
+
+If a packet or result duplicates/rebinds WT-001 identity, approval, path, Git, dirty-state, command/cwd, or containment facts, the duplicate is non-authoritative and the operation is blocked for reconciliation.

package/skills/aili-delivery-flow/references/questionnaire-policy.md

@@ -0,0 +1,62 @@
+# Questionnaire Policy
+
+`requirements-grilling` is the sole requirements-refinement authority. `interview.md` is its one OpenSpec artifact. The phrases `change-interviewer`, `grill-me`, and `batch-grill-me` are compatibility routing only and own no second skill, prompt, command, artifact, state, manifest entry, or readiness authority.
+
+## When Required
+
+- Requirements can be implemented in incompatible ways.
+- Product, safety, data, or UX decisions are missing.
+- Scope boundaries or forbidden files are unclear.
+- Acceptance criteria cannot be verified from existing artifacts.
+
+## When Not Required
+
+- The task is a small local edit with clear acceptance criteria.
+- A current spec already answers the blocking questions.
+- Current evidence fully resolves every material dimension.
+
+## Gate
+
+DEFINE writes `openspec/changes/<change-id>/interview.md` through `requirements-grilling` when a material clarification exists. Ask the smallest decision-changing question by default. Use one bounded static Packet Mode artifact only when several independent blockers are already known and presenting them together reduces user effort. Use Frontier Batch Mode only when the user explicitly asks for batch grilling or to receive all currently dependency-ready questions together; never infer it from blocker count. Every question names the subject/decision, target, why now, risk/trade-off, options, evidence-backed recommendation or uncertainty, denial effect, and writeback target. Do not ask for facts current code/spec/test/config or the one applicable approved source lookup already establishes.
+
+Write accepted chat/UI/custom answers to `interview.md`, then re-read disk before classification or readiness. Ambiguous, contradictory, incomplete, untestable, out-of-scope, or evidence-conflicting answers remain `Open Question`/`Unverified` and trigger a focused follow-up rather than guessed writeback. A custom answer is evaluated against the same evidence and materiality rules as a listed option; it is never forced into the nearest option.
+
+Classify every confirmed correction, new requirement, artifact/design/task/test change, accepted finding, or implementation feedback as `covered`, `material-question`, `material-delta`, `ordinary-steering`, or `Unverified`. A `material-delta` writes/re-reads only affected artifacts and direct dependents, reruns required validation, and stales final-test-plan acceptance only when its acceptance or required verification changes. Never ask whether to save an in-scope delta, guess identity, expand permission, bypass high-risk approval, or start BUILD.
+
+BUILD readiness requires coherent required artifacts, no unresolved material decision or decision-shaping source gap, required validation, and explicit final `test-plan.md` acceptance. Select only the source class needed for the exact gap; do not require local, official, prior-art, security, and alternatives lanes as a bundle. Named non-material runtime residuals may remain `Unverified` under their fail-closed gates. Test-plan acceptance is the sole lifecycle-level pre-BUILD user gate; material/coherence/validation/permission/destructive/high-risk gates remain separate.
+
+## Explicit Frontier Batch Mode
+
+Frontier Batch Mode is user-invoked only. Explicit phrases such as “batch grill me”, “批量拷问”, or “ask every currently answerable decision together” select it. A request that merely contains several blockers does not.
+
+- Resolve change identity and non-OpenSpec placement before the first batch. Keep permission, approval, destructive, external-access, dependency, schema/auth/security, commit/push/merge/release, and exact-operation questions separate and single; no batch answer grants or implies authority.
+- Model the selected material scope as a decision tree. The current frontier is the complete set of material user decisions whose prerequisite decisions and required evidence are settled. Ask that frontier in one numbered packet, with no generic coverage questions. If only one material decision is ready, ask it as one question.
+- A question that depends on another question still open in the current round belongs to a later round. Do not guess the prerequisite answer merely to enlarge the frontier.
+- Finding facts remains the agent's job. ROSE runs the proactive delegation scan; `requirements-grilling` may return `need-evidence` with the affected dependency but must not dispatch, and only questions downstream of missing evidence wait. If an existing Task trigger is met, ROSE dispatches a fresh single-use Task with no old `task_id`; direct inspection is the no-trigger/blocked fallback and unrelated frontier questions remain eligible.
+- Accept partial answers. Persist confirmed answers and dispositions to the one `interview.md` or agreed target, re-read disk, keep unanswered or invalid answers unresolved, and recompute the frontier from current evidence before the next round.
+- The session ends only when the frontier is empty and the user explicitly confirms shared understanding. That confirmation is not requirements readiness by itself and never substitutes for validation, final `test-plan.md` acceptance, permission, or exact-operation approval.
+
+## Default Interaction
+
+- Persist an OpenSpec `interview.md` only when clarification decisions need a durable record; do not manufacture a packet when current evidence resolves all material dimensions.
+- Follow-up unresolved readiness questions are chat-first by default: ask concise blocking questions in chat, not by requiring the user to manually fill `interview.md`.
+- Chat answers are not readiness evidence until ROSE writes them back into `interview.md` or the agreed questionnaire artifact.
+- Direct file editing is supported when the user chooses it; after any direct edit, disk content wins after re-read and reconciliation.
+- Before answer classification, readiness, BUILD gating, or local review evidence use, ROSE must re-read the artifact from disk after any AI write-back or user edit.
+
+## Artifact Freshness
+
+Disk wins for user-editable questionnaire artifacts such as `interview.md`, but freshness is event-directed rather than a blanket continuation gate.
+
+Before using, merging, validating, or overwriting a questionnaire artifact, ROSE must:
+
+1. Re-read the artifact after ROSE writes it and after a user edit, hook, conflict, or resume checkpoint makes it relevant.
+2. Inspect scoped working-tree/diff evidence only when needed to distinguish current user edits or merge conflicts.
+3. Treat on-disk content as the source of truth and refresh only direct dependents.
+4. Never claim “no changes detected” without current disk evidence.
+
+## Coverage proportional to the decision
+
+Cover only dimensions capable of changing this change's implementation or acceptance. Record each applicable item as confirmed, needs question, open question, or `Unverified`; do not create a full generic coverage matrix for an already coherent bounded change.
+
+`requirements-grilling` owns its direct consistency check and then stops. It must not invoke `strategy-stress-test`, `test-document-generator`, planning, TDD, review, or security. It may return one named material loophole or downstream artifact need to ROSE; ROSE selects the next canonical loop only if the current user intent or concrete gap warrants it. No interview readiness state creates another approval gate.

package/skills/aili-delivery-flow/references/review-repair-loop.md

@@ -0,0 +1,16 @@
+# Review and Repair Loop
+
+This loop triggers only on explicit review/repair intent or one concrete blocking finding in an affected completion/SHIP claim. Run the proactive delegation scan; direct inspection is the no-trigger/blocked fallback, and entering BUILD or SHIP does not automatically activate specialist review.
+
+1. Resolve the accepted scope, final diff, applicable task rows, one repository/cwd, owning artifact destination, and checks already run. For A33, require one current WT-001 reference, re-read target rules, disclose the soft boundary, and do not scan the host broadly.
+2. ROSE inspects the diff/task coverage and runs the smallest check that proves each required claim.
+3. Select at most one auxiliary review capability when the user requests it or a concrete gap cannot be covered directly. Dispatch eligible contexts promptly. Default concurrency is at most two but is not a hard cap; larger bounded read-only fan-out requires independent non-overlapping units, concrete benefit, suitable owners, and an explicit join plan. Every context must use the canonical result envelope.
+4. Reconcile their evidence without voting; subagents never own the final verdict or duplicate/rebind WT identity, keys, approvals, Git state, rules, or command/cwd.
+5. If one blocking issue is found, apply one targeted repair and rerun only the affected check. Report any remaining blocker instead of starting another cycle.
+6. Keep uncovered requirements, skipped checks, stale evidence, and unsupported readiness claims `Open Question` or `Unverified`.
+
+Run a spec coverage check for formal changes that maps requirements/tasks/test-plan items to implementation, verification, review, and security evidence without requiring automatic specialist lanes.
+
+BUILD's completion inspection runs the proactive delegation scan and one minimal changed-scope check, dispatches one auxiliary capability when a concrete gap triggers it, permits at most one targeted repair/recheck, records `IMPLEMENTED_TARGETED_VERIFIED` or blocks, and stops before SHIP. SHIP requires fresh explicit intent and reuses evidence unless an affected event stales it. Unchanged transport preserves evidence; relevant hook, tree/content, config, dependency, toolchain, target, or changed-merge events stale only affected rows. CI failure reports and stops for user decision; it never auto-repairs, commits, or pushes.
+
+Do not create an automatic code/test/security/coverage/convergence swarm, a full-suite requirement without claim need, or a fixed multi-cycle review loop.

package/skills/aili-delivery-flow/references/test-document-policy.md

@@ -0,0 +1,35 @@
+# Test Document Policy
+
+The test document turns requirements into verification evidence before implementation starts.
+
+## Required Content
+
+- requirement or scenario identifier;
+- traceability matrix for formal changes, mapping requirement, decision, or risk to task/package, file or artifact, verification command or inspection, evidence, and coverage status;
+- test case or manual check;
+- expected result;
+- command or evidence source;
+- status: planned, passed, failed, skipped, or unverified.
+
+## Gate
+
+- Generate or materially revise a test document only on explicit test-plan/QA/acceptance-matrix intent or when one concrete missing testability decision blocks a formal change. Formal OpenSpec DEFINE writes its required `openspec/changes/<change-id>/test-plan.md` through `test-document-generator`; ordinary implementation does not manufacture a test-plan workflow.
+- Formal changes must include a requirements/decisions/risks traceability matrix. Missing task/package, file/artifact, verification, or evidence links must be labeled `Open Question` when they need a decision, or `Unverified` when they need later evidence.
+- BUILD may start only after applicable decision-shaping research is closed, the artifacts and traceability are coherent/validated, and the user explicitly accepts the final test plan. A waiver or accepted-`Unverified` label cannot substitute for either material research closure or final test-plan acceptance.
+- Named non-material runtime residuals such as UV-006/UV-007 may remain explicitly `Unverified` only when their runtime/operation paths fail closed; they continue to block any claim or operation that needs the missing evidence.
+- BUILD readiness is only `READY` or `BLOCKED`; `WAIVED` and accepted-`UNVERIFIED` are not readiness alternatives. Package savepoints and package boundaries add no test-plan or package approval.
+- Test-document generation creates no scheme, packet, test-plan-draft, or research-summary approval. Final `test-plan.md` acceptance remains the one lifecycle-level pre-BUILD user gate for formal work.
+- The artifact owner performs a direct consistency pass and stops. It must not invoke stress-test, research, TDD, review, or another process skill; it may return one concrete missing decision/evidence need to ROSE.
+- BUILD ends after the canonical owner selects one minimal changed-scope completion check at `IMPLEMENTED_TARGETED_VERIFIED`. SHIP requires fresh explicit intent, reuses still-covering BUILD evidence, and refreshes only affected claim rows. A full traceability matrix or specialist capability is selected only for a concrete gap.
+- Material DEFINE decisions, the one final test-plan acceptance, fresh SHIP intent, and exact commit/push/merge/release approvals remain distinct controls. CI failure returns to the user and never authorizes automatic repair, commit, push, merge, or release.
+
+## Artifact Freshness
+
+Disk wins for user-editable test artifacts such as `test-plan.md`; freshness is event-directed.
+
+Before using, merging, validating, or overwriting a test document, ROSE must:
+
+1. Re-read the artifact after ROSE writes it and after a user edit, hook, conflict, or resume checkpoint makes it relevant.
+2. Inspect scoped status/diff only when needed to distinguish current edits or merge conflicts.
+3. Treat on-disk content as source of truth and refresh only direct dependents.
+4. Never claim “no changes detected” without current disk evidence.