@rune-kit/rune 2.12.3 → 2.14.0

package/compiler/__tests__/zoom-out-output.test.js

@@ -0,0 +1,112 @@
+/**
+ * Zoom-out output validation — scout v0.4 zoom-out mode produces a 3-layer Mermaid map.
+ *
+ * Validates:
+ *   - Output is parseable Mermaid (graph LR ... or graph TB)
+ *   - L0 (target) node is present and styled as "stuck"
+ *   - L1 cap: max 8 sibling files
+ *   - L2 cap: max 8 caller modules
+ *   - Total nodes never exceed L0 + 16
+ *   - Edge collapse note appears when caps hit
+ */
+
+import assert from 'node:assert';
+import { describe, test } from 'node:test';
+
+function parseMermaid(text) {
+  // Minimal validator — just need to confirm structure
+  const lines = text
+    .split('\n')
+    .map((l) => l.trim())
+    .filter(Boolean);
+  const directive = lines.find((l) => /^graph (LR|TB|RL|BT)/.test(l));
+  if (!directive) return { valid: false, error: 'missing graph directive' };
+
+  const nodes = new Set();
+  const edges = [];
+  for (const line of lines) {
+    if (line.startsWith('graph ') || line.startsWith('classDef ') || line.startsWith('%%')) continue;
+    // Extract node names from edges like "A --> B" or "A -.text.- B"
+    const edgeMatch = line.match(/^(\S+?)(?:\[[^\]]*\])?\s*(?:-->|-\.[^.]*\.-)\s*(\S+?)(?:\[[^\]]*\])?$/);
+    if (edgeMatch) {
+      nodes.add(edgeMatch[1]);
+      nodes.add(edgeMatch[2]);
+      edges.push({ from: edgeMatch[1], to: edgeMatch[2] });
+    }
+  }
+  return { valid: true, nodes: [...nodes], edges };
+}
+
+function buildZoomOutFixture({ targetName, l1Files, l2Modules, edgeCollapseNote = false }) {
+  const lines = ['graph LR', `  ${targetName}[src/auth/login.ts]:::stuck`];
+  for (let i = 0; i < l1Files; i++) {
+    lines.push(`  sibling${i}[siblingFile${i}] -.same-dir.- ${targetName}`);
+  }
+  for (let i = 0; i < l2Modules; i++) {
+    lines.push(`  caller${i}[callerModule${i}] --> ${targetName}`);
+  }
+  if (edgeCollapseNote) {
+    lines.push('  %% showing top 8 by import-frequency (>8 collapsed)');
+  }
+  lines.push('  classDef stuck fill:#ff6b6b');
+  return lines.join('\n');
+}
+
+describe('zoom-out Mermaid output', () => {
+  test('valid output parses', () => {
+    const fixture = buildZoomOutFixture({ targetName: 'target', l1Files: 3, l2Modules: 4 });
+    const parsed = parseMermaid(fixture);
+    assert.strictEqual(parsed.valid, true);
+    assert.ok(parsed.nodes.includes('target'));
+  });
+
+  test('target has classDef stuck', () => {
+    const fixture = buildZoomOutFixture({ targetName: 'target', l1Files: 1, l2Modules: 1 });
+    assert.ok(fixture.includes(':::stuck'));
+    assert.ok(fixture.includes('classDef stuck'));
+  });
+
+  test('respects L1 cap (8 max)', () => {
+    const fixture = buildZoomOutFixture({ targetName: 'target', l1Files: 8, l2Modules: 0 });
+    const parsed = parseMermaid(fixture);
+    const siblingCount = parsed.nodes.filter((n) => n.startsWith('sibling')).length;
+    assert.ok(siblingCount <= 8, `expected <=8 siblings, got ${siblingCount}`);
+  });
+
+  test('respects L2 cap (8 max)', () => {
+    const fixture = buildZoomOutFixture({ targetName: 'target', l1Files: 0, l2Modules: 8 });
+    const parsed = parseMermaid(fixture);
+    const callerCount = parsed.nodes.filter((n) => n.startsWith('caller')).length;
+    assert.ok(callerCount <= 8, `expected <=8 callers, got ${callerCount}`);
+  });
+
+  test('total node cap: target + L1 (8) + L2 (8) = 17 max', () => {
+    const fixture = buildZoomOutFixture({ targetName: 'target', l1Files: 8, l2Modules: 8 });
+    const parsed = parseMermaid(fixture);
+    assert.ok(parsed.nodes.length <= 17, `expected <=17 nodes, got ${parsed.nodes.length}`);
+  });
+
+  test('edge-collapse note included when caps hit', () => {
+    const fixture = buildZoomOutFixture({
+      targetName: 'target',
+      l1Files: 8,
+      l2Modules: 8,
+      edgeCollapseNote: true,
+    });
+    assert.ok(fixture.includes('showing top 8'));
+  });
+
+  test('rejects output without graph directive', () => {
+    const fixture = `target[src/auth/login.ts]
+  caller --> target`;
+    const parsed = parseMermaid(fixture);
+    assert.strictEqual(parsed.valid, false);
+  });
+});
+
+describe('agent.stuck signal name validity', () => {
+  test('agent.stuck conforms to signal naming pattern', () => {
+    const SIGNAL_PATTERN = /^[a-z][a-z0-9]*(\.[a-z][a-z0-9]*)+$/;
+    assert.ok(SIGNAL_PATTERN.test('agent.stuck'));
+  });
+});

package/compiler/adapters/openclaw.js

@@ -7,6 +7,25 @@
  *   .openclaw/rune/skills/*.md           (transformed skill files)
  *
  * Follows the NeuralMemory OpenClaw plugin pattern.
+ *
+ * ARTIFACT CONVENTION (v2.13+):
+ * OpenClaw skills that produce file artifacts (images, reports, data) should
+ * resolve output directory in this fallback order — honored by the Rune script
+ * output contract (see skills/skill-forge Phase 5.25):
+ *
+ *   1. --out-dir <path>                       (explicit caller intent)
+ *   2. <SKILL>_OUT_DIR                        (skill-specific env var)
+ *   3. OPENCLAW_OUTPUT_DIR                    (platform-wide override)
+ *   4. OPENCLAW_AGENT_DIR/artifacts/<skill>   (per-agent scoped default)
+ *   5. OPENCLAW_STATE_DIR/artifacts/<skill>   (state-scoped fallback)
+ *   6. ./.rune/<skill>/                       (project-local default)
+ *
+ * Reference implementations in @rune-pro/media/scripts/:
+ *   - codex_imagen_bridge.mjs (full resolution + 9-tier binary detection)
+ *   - image_optimizer.py (Python equivalent)
+ *
+ * Reference codex-imagen repo (darkamenosa/codex-imagen) documents the
+ * de-facto in-the-wild convention this adapter formalizes.
  */
 
 import { BRANDING_FOOTER } from '../transforms/branding.js';
@@ -67,15 +86,36 @@ export default {
    * @param {object} pluginJson - Rune's .claude-plugin/plugin.json
    * @returns {object} manifest object
    */
-  generateManifest(_skills, pluginJson) {
+  generateManifest(skills, pluginJson) {
     return {
       id: 'rune',
       name: 'Rune',
       kind: 'skills',
-      description:
-        '62-skill mesh for AI coding assistants. Routes all code tasks through specialized skills. 215+ connections, 14 extension packs.',
+      description: `${skills.length}-skill mesh for AI coding assistants. Routes all code tasks through specialized skills. 215+ connections, 14 extension packs.`,
       version: pluginJson.version || '0.0.0',
       skills: ['./skills'],
+      artifactConvention: {
+        outputDirPriority: [
+          '--out-dir <path>',
+          '<SKILL>_OUT_DIR',
+          'OPENCLAW_OUTPUT_DIR',
+          'OPENCLAW_AGENT_DIR/artifacts/<skill>',
+          'OPENCLAW_STATE_DIR/artifacts/<skill>',
+          './.rune/<skill>/',
+        ],
+        outputContract: {
+          stdout: 'one artifact path per line (default) or JSON (--json mode)',
+          stderr: 'diagnostics + warnings',
+          exitCodes: {
+            0: 'success',
+            1: 'execution failed (retryable)',
+            2: 'usage error (bug)',
+            3: 'data-integrity error (halt)',
+            4: 'timeout with partial results (accept)',
+            124: 'timeout with zero results (retry or abort)',
+          },
+        },
+      },
       configSchema: {
         jsonSchema: {
           type: 'object',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rune-kit/rune",
-  "version": "2.12.3",
-  "description": "62-skill mesh for AI coding assistants — runtime auto-discipline via native hooks (Claude/Cursor/Windsurf/Antigravity), 5-layer architecture, 215+ connections, multi-platform compiler.",
+  "version": "2.14.0",
+  "description": "63-skill mesh for AI coding assistants — runtime auto-discipline via native hooks (Claude/Cursor/Windsurf/Antigravity), 5-layer architecture, 215+ connections, multi-platform compiler.",
   "type": "module",
   "bin": {
     "rune": "./compiler/bin/rune.js"

package/skills/adversary/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: adversary
-description: Pre-implementation red-team analysis. Challenges plans before code is written — finds edge cases, security holes, scalability bottlenecks, error propagation risks, and integration conflicts. Catches flaws at plan time (10x cheaper than post-implementation).
+description: "Pre-implementation red-team analysis. Use when a plan is high-risk, critical path, or expensive to reverse. Challenges plans before code is written — finds edge cases, security holes, scalability bottlenecks, error propagation risks, and integration conflicts. Catches flaws at plan time (10x cheaper than post-implementation)."
 metadata:
   author: runedev
   version: "0.1.0"

package/skills/audit/SKILL.md

@@ -30,6 +30,7 @@ Comprehensive project health audit across 8 dimensions (7 project + 1 mesh analy
 - `dependency-doctor` (L3): Phase 1 — vulnerability scan and outdated dependency check
 - `sentinel` (L2): Phase 2 — security audit (OWASP Top 10, secrets, config)
 - `autopsy` (L2): Phase 3 — code quality and complexity assessment
+- `improve-architecture` (L2): Phase 3.5 — architecture sub-score (depth / leverage / locality across top modules)
 - `perf` (L2): Phase 4 — performance regression check
 - `db` (L2): Phase 5 — database health dimension (schema, migrations, indexes)
 - `journal` (L3): record audit date, overall score, and verdict

package/skills/autopsy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: autopsy
-description: Full codebase health assessment. Analyzes complexity, dependencies, dead code, tech debt, and git hotspots. Produces a health score and rescue plan.
+description: Full codebase health assessment. Use when diagnosing project health or starting a rescue workflow on legacy code. Analyzes complexity, dependencies, dead code, tech debt, and git hotspots. Produces a health score and rescue plan.
 metadata:
   author: runedev
   version: "0.4.0"

package/skills/ba/SKILL.md

@@ -3,11 +3,12 @@ name: ba
 description: Business Analyst agent. Deeply understands user requirements before any planning or coding begins. Asks probing questions, identifies hidden requirements, maps stakeholders, defines scope boundaries, and produces a structured Requirements Document that plan and cook consume.
 metadata:
   author: runedev
-  version: "0.7.0"
+  version: "0.11.0"
   layer: L2
   model: opus
   group: creation
   tools: "Read, Glob, Grep"
+  emit: outofscope.match
 ---
 
 # ba
@@ -16,6 +17,8 @@ metadata:
 
 Business Analyst agent — the ROOT FIX for "Claude works a lot but produces nothing." BA forces deep understanding of WHAT to build before any code is written. It asks probing questions, identifies hidden requirements, maps stakeholders, defines scope boundaries, and produces a structured Requirements Document.
 
+> Wrong requirements shipped correctly is the most expensive bug. BA's job is to prevent it — measure clarity (Step 2.5), measure completeness (Step 3.5), and measure cross-dimension consistency (Step 3.6) before handoff.
+
 <HARD-GATE>
 BA produces WHAT, not HOW. Never write code. Never plan implementation.
 Output is a Requirements Document → hand off to rune:plan for implementation planning.
@@ -70,6 +73,58 @@ If Refactor → light version (Step 1 + Step 4 only). Skip Steps 2, 2.5, 3, 5, 6
 
 If existing codebase → invoke `rune:scout` for context before proceeding.
 
+### Step 1.5 — Out-of-Scope Match Check
+
+Before any elicitation, check whether the request matches a concept previously rejected.
+
+1. `Glob` `.out-of-scope/*.md` — if directory absent, skip silently.
+2. For each file, parse YAML frontmatter (`concept`, `aliases`).
+3. Build a token map (lowercased, split on `-` and whitespace).
+4. Tokenize the user's request the same way.
+5. Compute lexical overlap per concept; keep the top match's `confidence` (0.0–1.0).
+
+**Action by confidence**:
+
+| Confidence | Verdict | Action |
+|------------|---------|--------|
+| ≥ 0.8 | exact-match | Surface to user: *"This matches a prior rejection (`.out-of-scope/<slug>.md`) — closed because [body's "Why out of scope" first sentence]. Do you still feel the same way?"* Pause for user response before continuing. |
+| 0.5 – 0.79 | similar | Mention inline: *"This is similar to a prior rejection (`<slug>`). Would you like to review it before we proceed?"* Continue regardless of answer. |
+| < 0.5 | no-match | Continue silently, no user-facing mention. |
+
+Emit `outofscope.match` signal with `{concept, confidence, verdict}` so downstream skills (cook, plan) inherit the context.
+
+If verdict is exact-match AND user says "yes I still want it" → record their override reason in the Requirements Document `## Risks` section AND mark `priority_to_revisit: high` in the existing `.out-of-scope/<slug>.md` (do NOT delete the file). The override forces the candidate up the revisit ladder; it doesn't erase the prior decision.
+
+If verdict is exact-match AND user accepts the prior rejection → end the BA session with a one-line summary referencing the file. No further questions.
+
+Format reference: [references/out-of-scope-format.md](references/out-of-scope-format.md).
+
+### Step 2.0 — Explore-First Pre-Check (HARD-GATE)
+
+Before emitting ANY of the 5 elicitation questions, run the 4-item pre-check on each intended question:
+
+1. Is the answer in `package.json` / `pyproject.toml` / `Cargo.toml` / `go.mod` / `pom.xml`?
+2. Is the answer in `README.md` / `CLAUDE.md` / `docs/`?
+3. Is it inferable from file extensions, directory structure, or config files?
+4. Has the user answered it earlier in this conversation?
+
+<HARD-GATE>
+For every question Q the agent intends to ask, there MUST be prior tool-call evidence in the same session:
+- At least 1 Read / Glob / Grep related to Q's domain, OR
+- Explicit declaration: "Q cannot be answered from project artifacts because [specific reason]."
+Without one of these, Q is BLOCKED — re-route to inference.
+</HARD-GATE>
+
+The gate is "tried to infer" — not "must succeed in inferring." If the file genuinely doesn't have the answer, the attempt itself is the gate.
+
+Cache inferred answers in the requirements doc:
+```
+**Inferred from package.json**: TypeScript 5.4, Next.js 14.2, React 18.3
+**Inferred from .github/workflows/**: CI runs on PRs targeting main
+```
+
+Worked examples + edge cases: [references/explore-first.md](references/explore-first.md).
+
 ### Step 2 — Requirement Elicitation (the "5 Questions")
 
 Ask exactly 5 probing questions, ONE AT A TIME (not all at once):
@@ -195,6 +250,23 @@ Clarity Score: [100 - ambiguity]%
   Status: ACCEPTABLE (ambiguity 23%) — proceeding with noted gaps
 ```
 
+### Step 2.6 — CONTEXT.md Cross-Reference Gate
+
+After elicitation, before hidden-requirement discovery, scan the user's answers for assertions about *current behavior* — phrasings like "the system X", "the code does X", "we already X", "right now it X".
+
+For each such assertion:
+
+1. `Grep` the codebase for evidence (function names, route handlers, schema definitions matching the asserted behavior).
+2. Compare grep results to the user's claim.
+
+| Outcome | Action |
+|---------|--------|
+| Grep confirms claim | Proceed; record term in CONTEXT.md if domain-relevant |
+| Grep contradicts claim | <HARD-GATE>Surface the conflict immediately. *"You said the system does X, but the code path I see does Y. Which is canonical?"* Pause until resolved.</HARD-GATE> |
+| Grep returns nothing | Note as unverified; ask user for the file/function name; do not record in CONTEXT.md until verified |
+
+This gate prevents the agent from silently transcribing user-asserted behavior that contradicts code — a common source of "the docs say X but the code does Y" drift.
+
 ### Step 3 — Hidden Requirement Discovery
 
 After the 5 questions, analyze for requirements the user DIDN'T mention:
@@ -243,6 +315,53 @@ When presenting options, alternatives, or scope decisions to the user, rate each
 **Anti-pattern**: "Choose B — it covers 90% of the value with less code." → If A is only 70 lines more, choose A. The last 10% is where production bugs hide.
 
 
+### Step 3.6 — Logic Consistency Check
+
+After ambiguity + completeness pass, scan for **cross-dimension contradictions**. Ambiguity measures CLARITY of each dimension in isolation; this step measures CONSISTENCY across dimensions. A perfectly clear requirement can still contradict itself.
+
+#### Checks
+
+Run each, label verdict 🟢 pass / 🟡 warn / 🔴 fail:
+
+| # | Check | 🔴 Fail | 🟢 Pass |
+|---|-------|---------|---------|
+| 1 | Every Acceptance Criterion traces to a User Story | AC orphaned | 1:N mapping clear |
+| 2 | Every Business Rule (Q5) is enforced in an AC or Exception Flow | Rule has no enforcement path | Rule → specific AC or exception |
+| 3 | Scope IN ∩ Scope OUT = ∅ | Direct overlap in phrasing | Sets disjoint |
+| 4 | Every user-story flow has a terminal state | State loop without exit condition | Terminal state explicit |
+| 5 | Dependencies (Step 4) ⊂ Constraints acknowledged (Q5) | Dependency never mentioned in constraints | All deps covered |
+| 6 | NFRs measurable against at least one AC | NFR has no test hook | Every NFR → testable AC |
+| 7 | Hidden requirements (Step 3) resolved in/out | Silent inclusion | User confirmed inclusion or exclusion |
+| 0 | Prior rejection check (Step 1.5) — exact-match resolved with explicit override or session ended | Silent re-litigation of rejected concept | User chose: override (priority bumped) OR accept prior decision (session ends) |
+
+#### Output Format
+
+```
+Logic Consistency Report:
+  1. AC → User Story:      🟢 all AC trace to US-1 or US-2
+  2. Business rule → AC:   🟡 "no duplicate emails" cited — exception flow missing
+  3. Scope disjoint:       🟢
+  4. Terminal states:      🟢
+  5. Deps in constraints:  🔴 "PostgreSQL 15" missing from Q5 answer
+  6. NFR measurable:       🟢
+  7. Hidden reqs resolved: 🟢
+
+Verdict: 1 🔴, 1 🟡, 5 🟢 → BLOCK handoff until 🔴 fixed
+```
+
+#### Gate Rule
+
+| Result | Action |
+|--------|--------|
+| 0 🔴 | Proceed to Step 4 — 🟡 warnings become "Risks" in Requirements Doc |
+| 1-2 🔴 | BLOCK — ask targeted question or re-scope to resolve each 🔴 |
+| 3+ 🔴 | Scrap Steps 2-3 and restart — requirements structurally incoherent |
+
+<HARD-GATE>
+NEVER hand off to plan with unresolved 🔴. Ambiguity ≤ 40% does not imply consistency — they are orthogonal gates.
+If user pushes "just build it" with 🔴 present, respond: "Contradiction in [dimension]: [specific conflict]. One clarification fixes this: [targeted question]"
+</HARD-GATE>
+
 ### Step 4 — Scope Definition
 
 Based on all gathered information, produce:
@@ -330,9 +449,19 @@ For product-oriented requirements (Feature Request, Integration, Greenfield), ge
 - Every tier includes "Risk if skipped" — makes trade-offs explicit
 - Skip this step for Bug Fix and Refactor types (no strategic dimension)
 
-### Step 7 — Requirements Document
+### Step 7 — Artifact Triad
 
-Produce structured output and hand off to `plan`:
+Produce three structured artifacts — not one prose doc. Plan consumes all three; each answers a different question.
+
+| Artifact | Question Answered | Consumer |
+|----------|-------------------|----------|
+| `requirements.md` | WHAT to build and WHY | plan, cook |
+| `requirements.mermaid` | WHAT does the flow look like visually | plan, design, review |
+| `tasks.md` | WHAT work layers exist | plan (as task backbone, not from scratch) |
+
+#### Artifact 1: requirements.md
+
+Structured document combining Steps 1-6.5. Save to `.rune/features/<feature-name>/requirements.md`:
 
 ```markdown
 # Requirements Document: [Feature Name]
@@ -350,11 +479,8 @@ Created: [date] | BA Session: [summary]
 
 ## Scope
 ### In Scope
-[from Step 4]
 ### Out of Scope
-[from Step 4]
 ### Assumptions
-[from Step 4]
 
 ## Non-Functional Requirements
 [from Step 6]
@@ -368,101 +494,119 @@ Created: [date] | BA Session: [summary]
 ## Strategic Recommendations
 [from Step 6.5 — skip for Bug Fix/Refactor]
 
-### Quick Win (0-30 days)
-- **Action**: [specific deliverable]
-- **Resources**: [effort estimate]
-- **Expected Impact**: [measurable outcome]
-
-### Differentiation (1-3 months)
-- **Action**: [...]
-- **Resources**: [...]
-- **Expected Impact**: [...]
-
-### Long-term Moat (6-12 months)
-- **Action**: [...]
-- **Resources**: [...]
-- **Expected Impact**: [...]
+## Logic Consistency Report
+[from Step 3.6 — verbatim, for audit trail]
 
 ## Next Step
-→ Hand off to rune:plan for implementation planning
+→ Hand off to rune:plan (consumes all 3 artifacts)
 ```
 
-Save to `.rune/features/<feature-name>/requirements.md`
+#### Artifact 2: requirements.mermaid
 
-## Output Format
+Auto-generate from User Stories. Save to `.rune/features/<feature-name>/requirements.mermaid`.
+
+**Sequence diagram** (primary happy path from US-1):
 
+```mermaid
+sequenceDiagram
+  actor User
+  participant System
+  participant Database
+  User->>System: [action from US-1]
+  System->>Database: [read/write from AC-1.1]
+  Database-->>System: [response]
+  System-->>User: [result from AC-1.1]
 ```
-# Requirements Document: [Feature Name]
-Created: [date] | BA Session: [summary]
 
-## Context
-[Problem statement — 2-3 sentences]
+**State machine** (only if any User Story implies state):
 
-## Stakeholders
-- Primary user: [who, technical level, workflow context]
-- Affected systems: [existing services, databases, APIs]
+```mermaid
+stateDiagram-v2
+  [*] --> initial
+  initial --> processing: [trigger from AC]
+  processing --> success: [happy path AC]
+  processing --> failed: [error AC]
+  success --> [*]
+  failed --> initial: retry
+```
 
-## User Stories
-US-1: As a [persona], I want to [action] so that [benefit]
-  AC-1.1: GIVEN [context] WHEN [action] THEN [result]
-  AC-1.2: GIVEN [error case] WHEN [action] THEN [error handling]
+Skip state machine if feature is stateless (simple CRUD with no lifecycle). Sequence is always produced.
 
-## Scope
-### In Scope
-- [feature/behavior 1]
-- [feature/behavior 2]
-### Out of Scope
-- [explicitly excluded 1]
-### Assumptions
-- [assumption — risk if wrong]
+#### Artifact 3: tasks.md
 
-## Non-Functional Requirements
-| NFR | Requirement | Measurement |
-|-----|-------------|-------------|
-| [Performance/Security/etc.] | [specific target] | [how to verify] |
+Pre-broken implementation tasks by layer. Plan refines this backbone, does not create from scratch. Save to `.rune/features/<feature-name>/tasks.md`:
 
-## Dependencies
-- [API/service/library]: [status — available/needs setup]
+```markdown
+# Implementation Tasks: [Feature Name]
+
+## Data Layer
+- [ ] Schema — [tables/models from AC]
+- [ ] Migration up + down
+- [ ] Seed/fixtures if tests need them
+
+## Logic Layer
+- [ ] [each Q5 Business Rule → one task]
+- [ ] Validation for [each AC error case]
+- [ ] State transitions from requirements.mermaid (if present)
+
+## Interface Layer (API / UI)
+- [ ] [each User Story → one endpoint or UI component]
+- [ ] Contract schema from AC (request/response)
+- [ ] Error handling for [each AC error]
+
+## Test Layer
+- [ ] Unit: [each business rule → one test]
+- [ ] Integration: [each AC happy path]
+- [ ] Regression: [each AC error case]
+
+## NFR Verification
+- [ ] [each NFR from Step 6 → one measurement task]
+```
 
-## Risks
-- [risk]: [mitigation strategy]
+Derivation rules:
+- 1 User Story → ≥1 Interface task
+- 1 Business Rule → 1 Logic task + 1 Unit test task
+- 1 AC → ≥1 Test task (happy path + error)
+- 1 NFR → 1 NFR Verification task
 
-## Decision Classification
+#### Handoff
 
-| Category | Meaning | Example |
-|----------|---------|---------|
-| **Decisions** (locked) | User confirmed — agent MUST follow | "Use PostgreSQL, not MongoDB" |
-| **Discretion** (agent decides) | User trusts agent judgment | "Pick the best validation library" |
-| **Deferred** (out of scope) | Explicitly NOT this task | "Mobile app — future phase" |
+Emit signal to `plan` with paths to all three artifacts. Plan MUST read all three before producing phase files — the triad is the contract.
 
-Plan gates on Decision compliance — Discretion items don't need approval.
+### Step 7.5 — Glossary Sharpen (CONTEXT.md update)
 
-## Strategic Recommendations
-[Skip for Bug Fix/Refactor]
+After the artifact triad is saved, append/update the project glossary `CONTEXT.md` with any domain terms that were sharpened during this session.
 
-### Quick Win (0-30 days)
-- **Action**: [immediate deliverable]
-- **Resources**: [effort + dependencies]
-- **Expected Impact**: [measurable KPI]
-- **Risk if skipped**: [consequence]
+1. Determine glossary location:
+   - If `CONTEXT-MAP.md` exists at root → multi-context; pick the right per-context CONTEXT.md
+   - Else if root `CONTEXT.md` exists → use it
+   - Else if any term needs recording → create root `CONTEXT.md` lazily
+   - Else → skip silently (no-op when no terms emerged)
+2. For each new term, add a row to the **Language** table (term, definition, aliases-to-avoid, status).
+3. For each user-asserted relationship, add to the **Relationships** section.
+4. For each ambiguity surfaced during elicitation, add to **Flagged ambiguities**.
 
-### Differentiation (1-3 months)
-- **Action**: [competitive advantage work]
-- **Resources**: [...]
-- **Expected Impact**: [...]
-- **Risk if skipped**: [...]
+**Conflict gate** — if a new term has ≥0.7 token overlap with an existing one, surface to user (merge / rename / keep distinct). NEVER silently re-define an existing term.
 
-### Long-term Moat (6-12 months)
-- **Action**: [defensible position work]
-- **Resources**: [...]
-- **Expected Impact**: [...]
-- **Risk if skipped**: [...]
+Format reference: [references/context-md-format.md](references/context-md-format.md).
 
-## Next Step
-→ Hand off to rune:plan for implementation planning
-```
+## Output Format
+
+Triad of artifacts under `.rune/features/<feature-name>/`:
+
+| File | Template Reference |
+|------|-------------------|
+| `requirements.md` | Step 7 Artifact 1 |
+| `requirements.mermaid` | Step 7 Artifact 2 (sequence + optional state machine) |
+| `tasks.md` | Step 7 Artifact 3 (Data / Logic / Interface / Test / NFR layers) |
 
-Saved to `.rune/features/<feature-name>/requirements.md`
+Inside `requirements.md` the **Decision Classification** table MUST appear verbatim — plan gates on Decision compliance, Discretion items skip approval:
+
+| Category | Meaning | Example |
+|----------|---------|---------|
+| **Decisions** (locked) | User confirmed — agent MUST follow | "Use PostgreSQL, not MongoDB" |
+| **Discretion** (agent decides) | User trusts agent judgment | "Pick the best validation library" |
+| **Deferred** (out of scope) | Explicitly NOT this task | "Mobile app — future phase" |
 
 ## Constraints
 
@@ -482,9 +626,10 @@ Saved to `.rune/features/<feature-name>/requirements.md`
 | Artifact | Format | Location |
 |----------|--------|----------|
 | Requirements document | Markdown | `.rune/features/<feature-name>/requirements.md` |
-| User stories with acceptance criteria | Markdown (GIVEN/WHEN/THEN) | inline + requirements.md |
-| Scope definition (in/out/assumptions) | Markdown sections | requirements.md |
-| Non-functional requirements table | Markdown table | requirements.md |
+| Visual model | Mermaid (sequence + optional state machine) | `.rune/features/<feature-name>/requirements.mermaid` |
+| Implementation task backbone | Markdown checklist by layer | `.rune/features/<feature-name>/tasks.md` |
+| Logic Consistency Report | Markdown section | Embedded in requirements.md |
+| Ambiguity + Completeness scores | Markdown display blocks | Embedded in requirements.md |
 
 ## Sharp Edges
 
@@ -508,6 +653,18 @@ Known failure modes for this skill. Check these before declaring done.
 | Skipping ambiguity scoring because "user seems clear" | HIGH | Always compute the score — perceived clarity ≠ measured clarity. The formula catches gaps humans miss |
 | Tiered recommendations too vague ("improve things") | MEDIUM | Each tier needs specific Action + measurable Expected Impact. "Build better UX" → "Reduce checkout steps from 5 to 3, targeting 15% conversion lift" |
 | All three tiers have same resources/effort | MEDIUM | Quick Win should be low-effort. If all tiers need "2 engineers, 3 months" → re-scope Quick Win to something achievable in 1 sprint |
+| Skipping Logic Consistency check because ambiguity is low | CRITICAL | Step 3.6 HARD-GATE: clarity ≠ consistency. A 90% clarity spec can still contain pairwise contradictions (scope IN/OUT overlap, rules with no enforcement, orphan ACs) |
+| Handing off to plan with unresolved 🔴 consistency fails | CRITICAL | Step 3.6 gate: 1+ 🔴 = BLOCK. 🟡 allowed only when logged as Risk in requirements.md |
+| Producing only requirements.md, skipping mermaid and tasks.md | HIGH | Step 7 is a triad — plan's contract expects all 3. Sequence diagram is always produced; state machine only if stateful; tasks.md always produced |
+| Mermaid diagram unrelated to actual user stories (decorative only) | MEDIUM | Sequence must trace AC-1.1 of US-1; state machine nodes must map to state-bearing ACs. Auditable by pattern-match |
+| tasks.md as flat list instead of layered | MEDIUM | Derivation rules enforce 1 US → Interface task, 1 rule → Logic + Unit test, 1 AC → Test task, 1 NFR → verification. Skipping layers loses plan's backbone structure |
+| Re-litigating a previously rejected concept without surfacing it | HIGH | Step 1.5 HARD-GATE: scan `.out-of-scope/` first; exact match (≥0.8) MUST be surfaced before elicitation begins |
+| Skipping Step 1.5 because `.out-of-scope/` directory looks empty | MEDIUM | Empty directory is silent-skip OK; directory absent entirely is silent-skip OK; never skip due to "I don't think this matches anything" — let the matcher decide |
+| User asserts behavior; agent records user's version without grep verification | HIGH | Step 2.6 HARD-GATE: every "the system does X" assertion gets grep'd; conflicts surface to user before recording |
+| Silently re-defining an existing CONTEXT.md term | HIGH | Step 7.5 conflict gate: ≥0.7 overlap → user chooses merge/rename/keep-distinct |
+| Auto-creating an empty CONTEXT.md when no terms emerged | LOW | Lazy creation rule: only write when there's a non-trivial term to record |
+| Asking inferable questions ("what stack are you using?") without first checking package.json | HIGH | Step 2.0 HARD-GATE — every question requires prior tool-call evidence (Read/Glob/Grep) or explicit unavailability declaration |
+| Re-asking a question already answered earlier in the conversation | MEDIUM | Step 2.0 check 4 — cache and reuse, never re-ask |
 
 ## Done When
 
@@ -518,8 +675,10 @@ Known failure modes for this skill. Check these before declaring done.
 - Scope defined (in/out/assumptions/dependencies)
 - User stories with testable acceptance criteria produced
 - Non-functional requirements assessed (relevant ones only)
+- Logic Consistency Report produced — 0 🔴 before handoff (🟡 logged as Risks)
 - Tiered recommendations generated (Quick Win / Differentiation / Moat) — skip for Bug Fix/Refactor
-- Requirements Document saved to `.rune/features/<name>/requirements.md`
+- Artifact triad saved: `requirements.md` + `requirements.mermaid` + `tasks.md`
+- Out-of-scope match check completed (verdict logged: no-match | similar | exact-match-overridden | exact-match-accepted)
 - Handed off to `plan` for implementation planning
 
 ## Cost Profile