@skyf0xx/hedgehog 2.0.13 → 3.0.0

package/src/db/verify.mjs

@@ -0,0 +1,286 @@
+// `hedgehog verify <task-id>` — scope pre-check, then verify_command, then
+// state transition. See hedgehog-persistent-build-graph.md, "Task
+// lifecycle", "`hedgehog verify`", and "Scope enforcement is a hard
+// pre-verification check".
+//
+// Two gates, in order:
+//   1. `git diff --name-only` (working tree) against the task's
+//      scope_globs. Any touched path outside scope refuses to run
+//      verification at all — the task stays `implemented`, no
+//      `verifications` row written. This is a scope violation, not a
+//      failing check.
+//   2. Only once every touched path matches scope does verify_command run.
+//      Exit 0: verifications row (passed) → verified → artifacts recorded
+//      → git commit with commit_message → complete → direct dependents
+//      re-evaluated (a dependent is ready once every dependency is
+//      complete — same check as the readiness SELECT in next.mjs).
+//      Nonzero: verifications row (failed, output retained) → failed,
+//      dependents stay blocked.
+
+import { execSync } from 'node:child_process';
+import { DB_PATH } from './init.mjs';
+
+// The build graph file itself is engine state, written only by this CLI,
+// never by an agent — it's excluded from every task's scope check (and
+// from artifacts/commits), or verify's own writes ahead of the
+// verify_command run would trip the very check it's performing. Covers
+// SQLite's journal/WAL/SHM sidecar files too.
+function isEngineStatePath(path) {
+  return path === DB_PATH || path.startsWith(`${DB_PATH}-`);
+}
+
+// Minimal glob → RegExp, no dependency: `**` matches any path segment
+// span (including zero), `*` matches within one segment, everything else
+// is literal. Matches the scope_globs shapes core.yaml produces, e.g.
+// `packages/db/src/schema/**`, `libs/{module}/repository/**`.
+function globToRegExp(glob) {
+  let pattern = '';
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === '*' && glob[i + 1] === '*') {
+      pattern += '.*';
+      i++;
+      if (glob[i + 1] === '/') i++;
+    } else if (c === '*') {
+      pattern += '[^/]*';
+    } else if ('.+^${}()|[]\\'.includes(c)) {
+      pattern += `\\${c}`;
+    } else {
+      pattern += c;
+    }
+  }
+  return new RegExp(`^${pattern}$`);
+}
+
+function matchesAnyGlob(path, globs) {
+  return globs.some((glob) => globToRegExp(glob).test(path));
+}
+
+// Working-tree diff (relative paths), covers modified, added, deleted,
+// and untracked files — everything the agent could have touched.
+function changedPaths() {
+  const tracked = execSync('git diff --name-only HEAD', { encoding: 'utf8' });
+  const untracked = execSync('git ls-files --others --exclude-standard', {
+    encoding: 'utf8',
+  });
+  const paths = new Set(
+    [...tracked.split('\n'), ...untracked.split('\n')].map((p) => p.trim()).filter(Boolean),
+  );
+  return [...paths].filter((p) => !isEngineStatePath(p));
+}
+
+function loadTask(db, taskId) {
+  return db.prepare('SELECT * FROM tasks WHERE id = ?').get(taskId);
+}
+
+function setTaskStatus(db, taskId, status) {
+  db.prepare('UPDATE tasks SET status = ? WHERE id = ?').run(status, taskId);
+}
+
+const insertVerification = (db) =>
+  db.prepare(`
+    INSERT INTO verifications (task_id, command, exit_code, output, status)
+    VALUES (?, ?, ?, ?, ?)
+  `);
+
+const insertArtifact = (db) =>
+  db.prepare(`
+    INSERT INTO artifacts (task_id, path, kind, commit_sha)
+    VALUES (?, ?, ?, ?)
+  `);
+
+// Direct dependents of `taskId` — same shape as next.mjs's
+// loadDirectDependents, kept local since verify.mjs owns the write side
+// and next.mjs owns the read side of the same query.
+function loadDirectDependents(db, taskId) {
+  return db
+    .prepare(
+      `
+      SELECT t.* FROM tasks t
+      JOIN dependencies d ON d.task_id = t.id
+      WHERE d.depends_on_task_id = ?
+      ORDER BY t.priority, t.id
+    `,
+    )
+    .all(taskId);
+}
+
+// True when every dependency of `taskId` is `complete` — the same
+// condition the readiness SELECT in next.mjs checks, reused here so a
+// dependent is only ever unlocked by the one rule the engine has for
+// readiness.
+function hasNoIncompleteDependency(db, taskId) {
+  const blocker = db
+    .prepare(
+      `
+      SELECT 1 FROM dependencies d
+      JOIN tasks dep ON dep.id = d.depends_on_task_id
+      WHERE d.task_id = ? AND dep.status <> 'complete'
+    `,
+    )
+    .get(taskId);
+  return blocker === undefined;
+}
+
+// Marks `taskId`'s direct dependents `ready` wherever every one of their
+// dependencies (not just this one) is now `complete`. Siblings with other
+// unmet dependencies are left untouched (still `planned`, still blocked).
+function unlockReadyDependents(db, taskId) {
+  const unlocked = [];
+  for (const dependent of loadDirectDependents(db, taskId)) {
+    if (hasNoIncompleteDependency(db, dependent.id)) {
+      setTaskStatus(db, dependent.id, 'ready');
+      unlocked.push(dependent.id);
+    }
+  }
+  return unlocked;
+}
+
+// Marks `intentId` complete once every task compiled from it is
+// `complete`. Completion is terminal bookkeeping, not a cleanup trigger
+// (spec: "Traceability") — the intent's tasks, verifications, and
+// artifacts stay exactly where they are as the provenance trail; the
+// status change only stops `hedgehog plan` from treating it as pending
+// and lets `status`/`next` report the intent honestly.
+function completeIntentIfDone(db, intentId) {
+  const openTask = db
+    .prepare(
+      "SELECT 1 FROM tasks WHERE intent_id = ? AND status <> 'complete'",
+    )
+    .get(intentId);
+  if (openTask !== undefined) return false;
+  db.prepare("UPDATE intents SET status = 'complete' WHERE id = ?").run(intentId);
+  return true;
+}
+
+// Runs `command` via the shell, capturing combined stdout+stderr and exit
+// code without throwing on nonzero exit — a failing verify_command is an
+// expected outcome, not a Node exception.
+function runVerifyCommand(command) {
+  try {
+    const output = execSync(command, { encoding: 'utf8', stdio: 'pipe' });
+    return { exitCode: 0, output };
+  } catch (err) {
+    const output = `${err.stdout ?? ''}${err.stderr ?? ''}` || err.message;
+    return { exitCode: err.status ?? 1, output };
+  }
+}
+
+// Determines created vs modified against HEAD, then stages and commits
+// exactly the task's touched paths with commit_message. Returns the new
+// commit sha.
+//
+// The build graph is committed in the same commit as the work it
+// describes. The spec's "SQLite as build state" requires the DB be
+// committed to git — that's what makes state survive `/clear`, machine
+// moves, and reclone. Committing it here (rather than leaving it dirty
+// for a later hand-commit) keeps the graph and the code it tracks
+// atomic: a checkout of any commit has a build graph that agrees with
+// the tree. The DB is excluded from the *scope check* (it's engine
+// state, not agent output — see isEngineStatePath) but still belongs in
+// the commit.
+function commitTouchedPaths(paths, commitMessage) {
+  const quoted = paths.map((p) => JSON.stringify(p)).join(' ');
+  execSync(`git add -- ${quoted}`, { stdio: 'pipe' });
+  execSync(`git commit -m ${JSON.stringify(commitMessage)}`, { stdio: 'pipe' });
+  return execSync('git rev-parse HEAD', { encoding: 'utf8' }).trim();
+}
+
+// Amends the just-written commit to include the build graph. Run after
+// the DB transaction commits, so the file on disk already reflects this
+// task's completion — staging it earlier would capture a pre-commit
+// snapshot of the graph and defeat the point.
+function commitBuildGraph(commitSha) {
+  try {
+    execSync(`git add -- ${JSON.stringify(DB_PATH)}`, { stdio: 'pipe' });
+    execSync('git commit --amend --no-edit', { stdio: 'pipe' });
+    return execSync('git rev-parse HEAD', { encoding: 'utf8' }).trim();
+  } catch {
+    // The graph failing to commit must not undo verified work — the task
+    // is already complete and its code is already committed.
+    return commitSha;
+  }
+}
+
+function artifactKind(path) {
+  try {
+    execSync(`git cat-file -e HEAD:${JSON.stringify(path)}`, { stdio: 'pipe' });
+    return 'modified';
+  } catch {
+    return 'created';
+  }
+}
+
+// Runs the full verify flow for `taskId`. Returns a result object
+// describing what happened:
+//   { outcome: 'scope_violation', offending: [...] }
+//   { outcome: 'failed', exitCode, output }
+//   { outcome: 'complete', exitCode, output, commitSha, unlocked: [...] }
+export function verifyTask(db, taskId) {
+  const task = loadTask(db, taskId);
+  if (!task) throw new Error(`no such task: ${taskId}`);
+
+  const scopeGlobs = JSON.parse(task.scope_globs);
+  const touched = changedPaths();
+  const offending = touched.filter((path) => !matchesAnyGlob(path, scopeGlobs));
+
+  if (offending.length > 0) {
+    setTaskStatus(db, task.id, 'implemented');
+    return { outcome: 'scope_violation', offending };
+  }
+
+  const { exitCode, output } = runVerifyCommand(task.verify_command);
+  const runInsertVerification = insertVerification(db);
+
+  if (exitCode !== 0) {
+    db.exec('BEGIN');
+    try {
+      runInsertVerification.run(task.id, task.verify_command, exitCode, output, 'failed');
+      setTaskStatus(db, task.id, 'failed');
+      db.exec('COMMIT');
+    } catch (err) {
+      db.exec('ROLLBACK');
+      throw err;
+    }
+    return { outcome: 'failed', exitCode, output };
+  }
+
+  db.exec('BEGIN');
+  let commitSha;
+  let unlocked;
+  let intentComplete;
+  try {
+    runInsertVerification.run(task.id, task.verify_command, exitCode, output, 'passed');
+    setTaskStatus(db, task.id, 'verified');
+
+    const runInsertArtifact = insertArtifact(db);
+    for (const path of touched) {
+      runInsertArtifact.run(task.id, path, artifactKind(path), null);
+    }
+
+    commitSha =
+      touched.length > 0 ? commitTouchedPaths(touched, task.commit_message) : null;
+
+    if (commitSha) {
+      db.prepare('UPDATE artifacts SET commit_sha = ? WHERE task_id = ?').run(
+        commitSha,
+        task.id,
+      );
+    }
+
+    setTaskStatus(db, task.id, 'complete');
+    unlocked = unlockReadyDependents(db, task.id);
+    intentComplete = completeIntentIfDone(db, task.intent_id);
+
+    db.exec('COMMIT');
+  } catch (err) {
+    db.exec('ROLLBACK');
+    throw err;
+  }
+
+  // Only now does the DB file on disk reflect this task's completion, so
+  // this is the first point the graph can be committed truthfully.
+  if (commitSha) commitSha = commitBuildGraph(commitSha);
+
+  return { outcome: 'complete', exitCode, output, commitSha, unlocked, intentComplete };
+}

package/src/db/why.mjs

@@ -0,0 +1,97 @@
+// `hedgehog why <path>` — walks artifacts → tasks → task_requirements →
+// requirements → intents for a given file path, printing the full
+// provenance chain. See hedgehog-persistent-build-graph.md,
+// "Traceability": artifact → task (with its verification) → requirement
+// → intent.
+
+function loadArtifacts(db, path) {
+  return db
+    .prepare('SELECT * FROM artifacts WHERE path = ? ORDER BY id')
+    .all(path);
+}
+
+function loadTask(db, taskId) {
+  return db.prepare('SELECT * FROM tasks WHERE id = ?').get(taskId);
+}
+
+// Most recent verification for the task — the one that proved the
+// artifact, per "Traceability"'s "verified: pnpm nx test db, exit 0".
+function loadLatestVerification(db, taskId) {
+  return db
+    .prepare(
+      `
+      SELECT * FROM verifications
+      WHERE task_id = ?
+      ORDER BY id DESC
+      LIMIT 1
+    `,
+    )
+    .get(taskId);
+}
+
+function loadTaskRequirements(db, taskId) {
+  return db
+    .prepare(
+      `
+      SELECT r.* FROM requirements r
+      JOIN task_requirements tr ON tr.requirement_id = r.id
+      WHERE tr.task_id = ?
+    `,
+    )
+    .all(taskId);
+}
+
+function loadIntent(db, intentId) {
+  return db.prepare('SELECT * FROM intents WHERE id = ?').get(intentId);
+}
+
+// Walks the chain for one artifact row: its task, that task's latest
+// verification, the requirements it satisfies, and their owning intent.
+function traceArtifact(db, artifact) {
+  const task = loadTask(db, artifact.task_id);
+  const verification = task ? loadLatestVerification(db, task.id) : null;
+  const requirements = task ? loadTaskRequirements(db, task.id) : [];
+  const intent = task ? loadIntent(db, task.intent_id) : null;
+  return { artifact, task, verification, requirements, intent };
+}
+
+// Returns the full provenance chain for `path`: one entry per artifacts
+// row (a path can be touched by more than one task across its history),
+// each carrying its task, latest verification, requirements, and intent.
+// Empty array when the path has never been recorded as an artifact.
+export function whyPath(db, path) {
+  return loadArtifacts(db, path).map((artifact) => traceArtifact(db, artifact));
+}
+
+function formatVerification(verification) {
+  if (!verification) return '(no verification recorded)';
+  return `${verification.command} — exit ${verification.exit_code}, ${verification.status}`;
+}
+
+// Renders whyPath()'s chain into the artifact → task → requirement →
+// intent shape from the spec's "Traceability" diagram.
+export function formatWhy(path, chain) {
+  if (chain.length === 0) {
+    return `${path}\n  (no artifact recorded for this path)`;
+  }
+
+  const lines = [];
+  lines.push(path);
+  for (const { task, verification, requirements, intent } of chain) {
+    lines.push(`  ↑ artifact of`);
+    lines.push(`${task.id}  (verified: ${formatVerification(verification)})`);
+    if (requirements.length === 0) {
+      lines.push(`  ↑ satisfies`);
+      lines.push(`(no requirements linked)`);
+    } else {
+      for (const req of requirements) {
+        lines.push(`  ↑ satisfies`);
+        lines.push(`requirement: "${req.statement}"`);
+      }
+    }
+    lines.push(`  ↑ of`);
+    lines.push(`intent: ${intent.id}`);
+  }
+
+  return lines.join('\n');
+}

package/src/golden-cores/full-stack-app/core.yaml

@@ -0,0 +1,41 @@
+# Shipped core definition for full-stack-app. Layer order, scope, and
+# verify commands are the same shape src/skills/hedgehog-loop's Domain
+# Module step tables describe in prose — this file is their data form.
+# {module} is filled in by the compiler with the domain module name a
+# task is generated for.
+id: full-stack-app
+layers:
+  - id: schema
+    scope: ["packages/db/src/schema/**"]
+    verify: "pnpm nx test db && pnpm typecheck"
+    commit: "feat({module}): schema"
+  - id: contract
+    depends_on: schema
+    scope: ["packages/contracts/src/**"]
+    verify: "pnpm nx test contracts && pnpm typecheck"
+    commit: "feat({module}): contract"
+  - id: repository
+    depends_on: contract
+    scope: ["libs/{module}/repository/**"]
+    verify: "pnpm nx test {module}-repository"
+    commit: "feat({module}): repository"
+  - id: service
+    depends_on: repository
+    scope: ["libs/{module}/service/**"]
+    verify: "pnpm nx test {module}-service"
+    commit: "feat({module}): service"
+  - id: controller
+    depends_on: service
+    scope: ["apps/api/**"]
+    verify: "pnpm nx test api"
+    commit: "feat({module}): api"
+  - id: hook
+    depends_on: controller
+    scope: ["packages/hooks/src/**"]
+    verify: "pnpm nx test hooks && pnpm typecheck"
+    commit: "feat({module}): hooks"
+  - id: screen
+    depends_on: hook
+    scope: ["apps/web/**", "apps/mobile/**"]
+    verify: "pnpm nx test web && pnpm nx test mobile"
+    commit: "feat({module}): screen-web"

package/src/golden-cores/landing-page/core.yaml

@@ -0,0 +1,41 @@
+# Shipped core definition for landing-page. A linear chain, no module
+# axis — the degenerate case of the layer graph (spec: MVP scope item 5).
+# Each phase groups the rows of src/skills/hedgehog-landing-loop's Chain
+# Method table that share one agent context and one commit:
+#   brief    — planning intake's mined subject statement (Phase 0)
+#   feeling  — Strategist/Brand Anthropologist/Psychologist/Perfumer (landing-strategist)
+#   tokens   — Ingredient Director/Copywriter/Systems Designer/Signature Element (landing-systems)
+#   sequence — Sequencer, Headline, per-section Copywriter (landing-sequencer, landing-headline-writer, landing-copywriter)
+#   artifact — Critic + Builder (landing-critic, landing-builder)
+#
+# feeling, tokens, and sequence each write their own chain-record file
+# (same pattern "brief" already uses) as the artifact hedgehog verify
+# checks for — a test -s only proves the file was written, not that the
+# judgment inside it is sound; that judgment stays landing-critic's job
+# at the artifact layer, unchanged.
+id: landing-page
+layers:
+  - id: brief
+    scope: [".hedgehog/chain/00-brief.md"]
+    verify: "test -s .hedgehog/chain/00-brief.md"
+    commit: "chore(planning): intake"
+  - id: feeling
+    depends_on: brief
+    scope: [".hedgehog/chain/01-feeling.md"]
+    verify: "test -s .hedgehog/chain/01-feeling.md"
+    commit: "feat(landing): strategy"
+  - id: tokens
+    depends_on: feeling
+    scope: [".hedgehog/chain/02-tokens.md", "src/styles/global.css"]
+    verify: "test -s .hedgehog/chain/02-tokens.md"
+    commit: "feat(landing): systems"
+  - id: sequence
+    depends_on: tokens
+    scope: [".hedgehog/chain/03-sequence.md"]
+    verify: "test -s .hedgehog/chain/03-sequence.md"
+    commit: "feat(landing): sequence"
+  - id: artifact
+    depends_on: sequence
+    scope: ["src/**"]
+    verify: "pnpm build"
+    commit: "feat(landing): build"

package/src/skills/conventional-commits/SKILL.md

@@ -42,7 +42,7 @@ Run in parallel:
 - `git diff` (unstaged)
 - `git diff --staged` (anything pre-staged)
 - `git log -10 --oneline` to confirm the project's existing commit style
-- Check `TODO.md` for which steps/modules are in flight
+- Run `hedgehog status` for which steps/modules are in flight
 
 Read every changed file's diff fully. You cannot group changes you
 haven't read.

package/src/skills/hedgehog-bootstrap/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: hedgehog-bootstrap
-description: Use once, at the start of a new Hedgehog project, to land the core workspace and scaffold whichever add-ons (Auth, Queue, Mobile) planning intake turned on (TODO.md's Add-ons block). Runs when the `bootstrap` agent runs, which `planner` invokes automatically after Confirm & Lock. Scoped to project scaffolding; per-module work runs through the `hedgehog-loop` skill, one step at a time.
+description: Use once, at the start of a new Hedgehog project, to land the core workspace and scaffold whichever add-ons (Auth, Queue, Mobile) planning intake turned on (`.hedgehog/addons.yaml`). Runs when the `bootstrap` agent runs, which `planner` invokes automatically after Confirm & Lock. Scoped to project scaffolding; per-module work runs through the `hedgehog-loop` skill, one step at a time.
 ---
 
 # Hedgehog Bootstrap
@@ -10,8 +10,9 @@ whichever named add-ons (Auth, Queue, Mobile) planning intake's scope
 boundary (`planner`, running BMAD-METHOD's planning shelf then mining it
 — see that agent) actually calls for. This is Phase 2 (Scaffold) of the
 overall bootstrap sequence — Phase 0 (BMAD elicitation) and Phase 1
-(mining into `TODO.md`) already closed by the time this skill runs. After
-this closes, `hedgehog-loop` takes over per module, one step at a time.
+(mining into the build graph and `.hedgehog/addons.yaml`) already closed
+by the time this skill runs. After this closes, `hedgehog-loop` takes
+over per module, one step at a time.
 This skill touches no domain modules — no schema, no contract, nothing
 under `libs/<module>/`. That's Phase A, started fresh after Bootstrap
 closes.
@@ -72,10 +73,10 @@ Bootstrap runs — not a per-project hand-edit after landing core.
 ### Add-ons (scaffolded only when planning intake calls for them)
 
 Each row is independent — on or off per project, decided at planning
-intake's Confirm & Lock (`planner`) and recorded in `TODO.md`'s
-`## Add-ons` block. Turning one on inserts its Bootstrap step(s) into the
-sequence below; turning it off means that step is skipped entirely, not
-stubbed or partially wired.
+intake's Confirm & Lock (`planner`) and recorded in
+`.hedgehog/addons.yaml`. Turning one on inserts its Bootstrap step(s)
+into the sequence below; turning it off means that step is skipped
+entirely, not stubbed or partially wired.
 
 | Add-on | Trigger (from planning intake scope) | Adds |
 |---|---|---|
@@ -137,28 +138,27 @@ bar doesn't get the seam at all — see the Add-ons table above.
 
 ## Before running
 
-Confirm planning intake already happened — a scope boundary and domain
-vocabulary should exist (`planner` produces these from BMAD's planning
-shelf), **and** `TODO.md` should carry an explicit `## Add-ons` block
-recording which add-ons (Auth, Queue, Mobile) are on for this project. No
-scope boundary yet, or a `TODO.md` with no `## Add-ons` block: stop and
-point to `planner` rather than guessing which add-ons apply.
+Confirm planning intake already happened — intent records should exist in
+the build graph (`hedgehog status`) and `.hedgehog/addons.yaml` should
+exist, recording which add-ons (Auth, Queue, Mobile) are on for this
+project. No intents yet, or no `.hedgehog/addons.yaml`: stop and point to
+`planner` rather than guessing which add-ons apply.
 
 Run `hedgehog-bootstrap-full-stack-app-core` first, unconditionally, if it hasn't
-already landed core (check `TODO.md`'s Bootstrap section, or `nx.json`
-at the repo root). That skill has its own re-run guard and Docker check
-— don't duplicate those here.
+already landed core (check the commit log, or `nx.json` at the repo
+root). That skill has its own re-run guard and Docker check — don't
+duplicate those here.
 
 ## Steps (run in sequence, one commit per step that actually runs)
 
 ### 1. `packages/auth` — Better Auth config *(Auth add-on only)*
 
 Skip this step entirely if Auth isn't on for this project (check
-`TODO.md`'s `## Add-ons` block) — don't scaffold a credential store with
-no login anywhere in scope. If skipped, check its
-`TODO.md` line off as skipped-and-confirmed (per the `bootstrap` agent's
-handling of conditional steps), same treatment as an out-of-scope
-`apps/mobile`.
+`.hedgehog/addons.yaml`) — don't scaffold a credential store with no
+login anywhere in scope. If skipped, say so plainly (per the `bootstrap`
+agent's handling of conditional steps) and move on — `.hedgehog/addons.yaml`'s
+`auth.on: false` entry is already the durable record, nothing further to
+write — same treatment as an out-of-scope `apps/mobile`.
 
 ```bash
 npx nx g @nx/js:lib packages/auth --bundler=none --unitTestRunner=vitest
@@ -187,18 +187,18 @@ Commit: `feat(auth): better auth config + global guard`
 ### 2. `apps/worker` — BullMQ seam (Redis, no consumers yet) *(Queue add-on only)*
 
 Skip this step entirely if Queue isn't on for this project (check
-`TODO.md`'s `## Add-ons` block) — no operation in scope is long-running,
+`.hedgehog/addons.yaml`) — no operation in scope is long-running,
 retried, or fanned out, so there's nothing for a queue to seam in for. If
-skipped, check its `TODO.md` line off as
-skipped-and-confirmed, same treatment as an out-of-scope `apps/mobile`.
+skipped, say so plainly and move on — same treatment as an out-of-scope
+`apps/mobile`.
 
 ```bash
 npx nx g @nx/node:app apps/worker
 pnpm add bullmq ioredis
 ```
 
-Add a `redis` service to the root `docker-compose.yml`
-`hedgehog-bootstrap-full-stack-app-core` landed (Postgres-only until now) and
+Add a `redis` service to the root `docker-compose.yml` that
+`hedgehog-bootstrap-full-stack-app-core` landed (Postgres-only) and
 `REDIS_URL: z.string().url()` to `packages/config/env.schema.ts` (it
 doesn't exist in the core schema), plus a matching `REDIS_URL=` line in
 the root `.env.example` pointing at that same `docker-compose.yml`
@@ -232,10 +232,9 @@ Commit: `feat(worker): bullmq seam, no consumers`
 ### 3. `apps/mobile` — Expo shell *(Mobile add-on only)*
 
 Skip this step entirely if Mobile isn't on for this project (check
-`TODO.md`'s `## Add-ons` block) — don't scaffold speculative infra. If
-skipped, check its `TODO.md` line off as skipped-and-confirmed, not left
-dangling for a future run to wonder about — same pattern as Auth (step 1)
-and Queue (step 2) when their add-on is off.
+`.hedgehog/addons.yaml`) — don't scaffold speculative infra. If skipped,
+say so plainly and move on — same pattern as Auth (step 1) and Queue
+(step 2) when their add-on is off.
 
 ```bash
 npx nx g @nx/expo:app apps/mobile
@@ -278,23 +277,21 @@ A per-app override request signals to fix the base config at the source.
 
 ## After Bootstrap
 
-Update `TODO.md`: check off every add-on line now built or explicitly
-skipped (core's four lines are already checked by
-`hedgehog-bootstrap-full-stack-app-core`). Leave Phase A/B sections as-is (per-module,
-filled in by `planner` during planning intake or when new scope enters play).
-Hand off to `hedgehog-loop` — from here, every domain module goes
-through Phase A steps 1–5(a) one at a time, gated by lefthook, each its
-own commit.
+Once every `on` add-on in `.hedgehog/addons.yaml` has its commit landed
+(core's commit already landed via
+`hedgehog-bootstrap-full-stack-app-core`), hand off to `hedgehog-loop` —
+from here, every domain module goes through Phase A layers one at a
+time via `hedgehog next`/`hedgehog verify`, each its own commit.
 
 ## Constraints
 
 - Run `hedgehog-bootstrap-full-stack-app-core` first, unconditionally, before any step
   in this file — never scaffold an add-on against a core that hasn't
   landed and verified clean.
-- Add-on steps (Auth, Queue, Mobile) run only if `TODO.md`'s `## Add-ons`
-  block (written by `planner` at planning intake) turns that add-on on —
-  check off its `TODO.md` line as skipped-and-confirmed otherwise, don't
-  leave it dangling.
+- Add-on steps (Auth, Queue, Mobile) run only if `.hedgehog/addons.yaml`
+  (written by `planner` at planning intake) turns that add-on on — say so
+  plainly and skip otherwise, don't leave it ambiguous whether the step
+  was considered.
 - Don't add domain schema, contracts, or any `libs/<module>/*` content —
   that's Phase A, started after Bootstrap, one module at a time.
 - Don't deviate from the package/library choices above, for whichever

package/src/skills/hedgehog-bootstrap-full-stack-app-core/SKILL.md

@@ -17,9 +17,9 @@ calls this skill first, unconditionally, then continues with its own
 add-on steps (Auth, Queue, Mobile) — those genuinely vary per project
 and stay live.
 
-This skill has no per-project decisions to make: no `TODO.md` Add-ons
-dependency, no Add-ons check, nothing to ask. Core is identical on every
-Hedgehog project.
+This skill has no per-project decisions to make: no Add-ons dependency,
+no Add-ons check, nothing to ask. Core is identical on every Hedgehog
+project.
 
 ## What lands
 
@@ -142,13 +142,9 @@ Homebrew-installed shadow.
 feat(config): workspace + shared config
 ```
 
-One commit for all of core, landed as a verified copy.
-
-### 7. `TODO.md`'s core lines
-
-The four core Bootstrap lines ship pre-checked in the `TODO.md` template.
-If step 3's fallback copy ran, check them now. Leave every add-on line
-(Auth/Queue/Mobile) untouched; `hedgehog-bootstrap` owns those.
+One commit for all of core, landed as a verified copy. That commit
+existing is the record that core landed — `bootstrap` checks for it via
+the commit log, not a checklist line.
 
 ## Known issues baked into the full-stack-app core
 
@@ -249,8 +245,8 @@ not here.
 
 - Run once per project, always as `hedgehog-bootstrap`'s first move —
   never invoked on its own by a user.
-- No add-on awareness. If a check here ever seems to need `TODO.md`'s
-  `## Add-ons` block, that check belongs in `hedgehog-bootstrap`
+- No add-on awareness. If a check here ever seems to need
+  `.hedgehog/addons.yaml`, that check belongs in `hedgehog-bootstrap`
   instead — this skill's whole point is being identical across every
   project.
 - Don't hand-edit any file this step lands to work around a verification