@stdd/plugin 0.9.2 → 0.10.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "stdd",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "description": "Native STDD workflow skills and lifecycle context",
   "author": {
     "name": "Azamat Almazbek uulu"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "stdd",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "description": "Native STDD workflow skills and lifecycle context for Codex",
   "author": {
     "name": "Azamat Almazbek uulu"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stdd/plugin",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "description": "Universal STDD workflow skills and lifecycle integration for Codex, Claude Code, and Pi",
   "type": "module",
   "license": "MIT",

package/runtime/adapters/README.md

@@ -104,18 +104,7 @@ the extension queues one corrective follow-up model turn and then fails open;
 it never creates an unbounded continuation loop. A conflicting user-owned
 `.pi/extensions/stdd.js` is not overwritten.
 
-## CI
-
-CI adapters only transport provider state into portable CLI commands:
-
-- GitHub writes `.github/workflows/stdd.yml`;
-- GitLab writes `.gitlab/stdd.gitlab-ci.yml`; same-project MRs authenticate
-  with `CI_JOB_TOKEN`, while a fork source project must be on the target's
-  CI job-token allowlist. A trusted controlled fork may instead provide a
-  masked and hidden `STDD_GITLAB_READ_API_TOKEN` scoped to target-project
-  `read_api`; target secrets must never be exposed to untrusted fork code;
-- generic prints the `check` and `check-pr` command contract without writing
-  provider configuration.
+## Adapter composition and renderer tokens
 
 The public SDK exposes the built-in adapter registry and render functions so
 other packages can add a host without importing `cli/` internals.
@@ -137,6 +126,15 @@ capabilities (`subagents` on, `crossCli` off). Its planning skill names
 `--via subagent`; it never names a cross-CLI reviewer, emits a renderer token,
 or falls back to manual self-review.
 
+## CI
+
+Adapters compile playbooks for agents; they do not write CI. A provider
+workflow is infrastructure the repository owns, and stdd generates none of it.
+The contract a job composes is `stdd check .` over the checkout and the live
+review description piped to `stdd check-pr - --base <ref>`; see the `## CI`
+section of `method/reference-integration.md` for the three things a
+hand-written job has to get right.
+
 ## Plugin distribution
 
 `plugins/stdd/` is one generated distribution for Codex, Claude Code, and Pi.

package/runtime/cli/check.mjs

@@ -529,7 +529,7 @@ export async function doctor(targetDir, readinessOnly = false) {
 				report(
 					false,
 					`.github/workflows/${file} validates the frozen event payload body — ` +
-						"body edits will not be re-checked; see stdd init --ci github",
+						"body edits will not be re-checked; fetch it live from the API instead",
 				);
 			}
 		}

package/runtime/cli/generated-files.mjs

@@ -5,7 +5,6 @@ import { fileURLToPath } from "node:url";
 import {
 	AGENT_ADAPTERS,
 	assertSemanticVersion,
-	CI_ADAPTERS,
 	getAgentAdapter,
 	renderAgentInstructions,
 } from "../sdk/adapters.mjs";
@@ -27,7 +26,6 @@ import { MANIFEST_HASH_PATTERN } from "./state-validation.mjs";
 export const PKG_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 export const VERSION = JSON.parse(fs.readFileSync(path.join(PKG_ROOT, "package.json"), "utf8")).version;
 export const KNOWN_TOOLS = Object.keys(AGENT_ADAPTERS);
-export const KNOWN_CI = Object.keys(CI_ADAPTERS);
 export const KNOWN_CAPABILITIES = Object.keys(DEFAULT_CONFIG.capabilities);
 export const CLEANUP_JOURNAL_REL = ".stdd/cleanup-transaction.json";
 const SHIPPED_PLAYBOOK_FILES = new Set(
@@ -79,14 +77,30 @@ export function validateAdapterSelection(field, values, known, { nonEmpty = fals
 	return [...values];
 }
 
+// `ci` is a retired key, not a required one: installs made before provider CI
+// adapters were removed still carry it, and rejecting their manifest would
+// turn an upgrade into a hard failure. It is accepted, never validated against
+// a registry, and never written back.
+const RETIRED_MANIFEST_TARGET_KEYS = ["ci"];
+const RETIRED_CI_PROVIDERS = ["github", "gitlab", "generic"];
+
+// The paths those adapters used to write. Nothing generates them any more, but
+// a pre-0.10.0 manifest still lists them, so they stay recognized outputs —
+// otherwise the upgrade fails validation before it can do anything. They are
+// released rather than retired, so the sweep never deletes an adopter's CI
+// gate — see finalizeGeneratedFilesWithCapabilities.
+const RETIRED_GENERATED_OUTPUTS = [".github/workflows/stdd.yml", ".gitlab/stdd.gitlab-ci.yml"];
+
 function validateManifestTargets(value) {
-	const required = ["tools", "ci", "hooks", "sessionHook", "stopHook"];
+	const required = ["tools", "hooks", "sessionHook", "stopHook"];
 	if (typeof value !== "object" || value === null || Array.isArray(value)) {
 		throw new TypeError("must be an object");
 	}
 	const keys = Object.keys(value);
 	const missing = required.filter((key) => !Object.hasOwn(value, key));
-	const unknown = keys.filter((key) => !required.includes(key));
+	const unknown = keys.filter(
+		(key) => !required.includes(key) && !RETIRED_MANIFEST_TARGET_KEYS.includes(key),
+	);
 	if (missing.length > 0 || unknown.length > 0) {
 		throw new TypeError(
 			`must contain exactly ${required.join(", ")}${
@@ -97,13 +111,17 @@ function validateManifestTargets(value) {
 	const tools = validateAdapterSelection("tools", value.tools, KNOWN_TOOLS, {
 		nonEmpty: true,
 	});
-	const ci = validateAdapterSelection("ci", value.ci, KNOWN_CI);
+	// A retired key is still graded before it is discarded: tolerating the
+	// upgrade is not the same as accepting a corrupt manifest, and `check`
+	// exists to notice one.
+	if (Object.hasOwn(value, "ci")) {
+		validateAdapterSelection("ci", value.ci, RETIRED_CI_PROVIDERS);
+	}
 	for (const field of ["hooks", "sessionHook", "stopHook"]) {
 		if (typeof value[field] !== "boolean") throw new TypeError(`${field} must be a boolean`);
 	}
 	return {
 		tools,
-		ci,
 		hooks: value.hooks,
 		sessionHook: value.sessionHook,
 		stopHook: value.stopHook,
@@ -188,9 +206,7 @@ function isRecognizedGeneratedOutput(file) {
 	const exact = new Set([
 		".stdd/method.md",
 		...Object.values(AGENT_ADAPTERS).map((adapter) => adapter.snippetFile),
-		...Object.values(CI_ADAPTERS)
-			.map((adapter) => adapter.outputFile)
-			.filter((output) => output !== null),
+		...RETIRED_GENERATED_OUTPUTS,
 		...[...KNOWN_MANAGED_PLAYBOOK_FILES].map((name) => `.stdd/playbooks/${name}`),
 	]);
 	if (exact.has(file)) return true;
@@ -1116,6 +1132,18 @@ export async function finalizeGeneratedFilesWithCapabilities(
 	try {
 		for (const [file, hash] of Object.entries(oldFiles)) {
 			if (Object.hasOwn(generated, file)) continue;
+			// Release, do not retire. A pre-0.10.0 install lists a generated
+			// provider workflow here; nothing generates one now, so the sweep
+			// below would delete it for being byte-identical and unclaimed — an
+			// upgrade that silently removes the repository's CI gate. Skipping it
+			// leaves the file on disk and out of the new manifest: the adopter
+			// owns it from here, edits and all.
+			if (RETIRED_GENERATED_OUTPUTS.includes(file)) {
+				console.log(
+					`Left ${file} in place — stdd no longer generates provider CI; it is yours to maintain`,
+				);
+				continue;
+			}
 			const inspected = await nativeInspectOutput(context, file);
 			if (inspected.kind === "missing") continue;
 			if (inspected.kind !== "ok") {
@@ -1356,7 +1384,6 @@ export async function finalizeGeneratedFilesWithCapabilities(
 			files: generated,
 			targets: {
 				tools: targets.tools,
-				ci: targets.ci,
 				hooks: targets.hooks,
 				sessionHook: targets.sessionHook,
 				stopHook: targets.stopHook,
@@ -1470,9 +1497,6 @@ function discoverGeneratedOutputs(targetDir) {
 		...loadLocalPlaybooks(targetDir).map((playbook) => playbook.meta.name),
 	]);
 	for (const playbook of shippedPlaybooks) addIfPresent(`.stdd/playbooks/${playbook.file}`);
-	for (const adapter of Object.values(CI_ADAPTERS)) {
-		if (adapter.outputFile) addIfPresent(adapter.outputFile);
-	}
 
 	for (const adapter of Object.values(AGENT_ADAPTERS)) {
 		// Shipped and validated local skill names reserve generated-output paths. Surface an

package/runtime/cli/init.mjs

@@ -3,13 +3,11 @@ import path from "node:path";
 import { createInterface } from "node:readline/promises";
 import {
 	AGENT_ADAPTERS,
-	CI_ADAPTERS,
 	CROSS_CLI_REVIEW_VIA_TOKEN,
 	getAgentAdapter,
 	MANDATORY_ROUTING_SKILLS,
 	renderAgentInstructions,
 	renderAgentSkill,
-	renderCiTemplate,
 } from "../sdk/adapters.mjs";
 import { resolveWritableRepoPath } from "../sdk/path.mjs";
 import { hasLocalStddBinary, isStddSourceCheckout, prepareAgentHooks } from "./claude-hooks.mjs";
@@ -29,7 +27,6 @@ import {
 	renderInstalledMethod,
 	SOURCE_RUNNER,
 	STAMP,
-	VERSION,
 	validateAdapterSelection,
 } from "./generated-files.mjs";
 import {
@@ -233,9 +230,6 @@ export async function interview() {
 	// The first selected native host is the driver for the repository-level
 	// default. Generated skills still carry a per-host explicit override.
 	const reviewVia = await askReviewVia(ask, close, recommendedReviewVia(tools, capabilities));
-	const ci = (await yes("Install the GitHub Actions gate (stdd check + PR evidence)?", true))
-		? ["github"]
-		: [];
 	const hooks = await yes("Install the pre-push hook (stdd check — fast, offline)?", true);
 	const sessionHook =
 		tools.length > 0 ? await yes("Wire native agent session hooks (stdd status --local)?", true) : false;
@@ -261,7 +255,6 @@ export async function interview() {
 	}
 	return {
 		tools,
-		ci,
 		hooks,
 		sessionHook,
 		stopHook,
@@ -301,14 +294,12 @@ export async function configure(targetDir, opts) {
 	}
 	// installs made before targets were remembered: infer what the previous
 	// init actually GENERATED from manifest.files — live directories lie (a
-	// stray empty .claude/skills must not smuggle claude in) and an
-	// inferred blank would make the stale-file cleanup delete the CI
-	// workflow. The filesystem is the last resort with no usable manifest;
-	// hook files and settings entries are user-owned, never
-	// manifest-tracked, so they are always read from their files.
+	// stray empty .claude/skills must not smuggle claude in). The filesystem
+	// is the last resort with no usable manifest; hook files and settings
+	// entries are user-owned, never manifest-tracked, so they are always read
+	// from their files.
 	if (!targets) {
 		const tools = [];
-		const ci = [];
 		const skillRootCounts = new Map();
 		for (const adapter of Object.values(AGENT_ADAPTERS)) {
 			skillRootCounts.set(adapter.skillRoot, (skillRootCounts.get(adapter.skillRoot) ?? 0) + 1);
@@ -324,9 +315,6 @@ export async function configure(targetDir, opts) {
 					tools.push(adapter.id);
 				}
 			}
-			for (const adapter of Object.values(CI_ADAPTERS)) {
-				if (adapter.outputFile && manifestFiles.includes(adapter.outputFile)) ci.push(adapter.id);
-			}
 		} else {
 			for (const adapter of Object.values(AGENT_ADAPTERS)) {
 				const ownsDistinctSkillRoot = skillRootCounts.get(adapter.skillRoot) === 1;
@@ -337,11 +325,6 @@ export async function configure(targetDir, opts) {
 					tools.push(adapter.id);
 				}
 			}
-			for (const adapter of Object.values(CI_ADAPTERS)) {
-				if (adapter.outputFile && fs.existsSync(path.join(targetDir, adapter.outputFile))) {
-					ci.push(adapter.id);
-				}
-			}
 		}
 		let settingsText = "";
 		for (const relative of new Set(Object.values(AGENT_ADAPTERS).map((adapter) => adapter.hooksFile))) {
@@ -353,7 +336,6 @@ export async function configure(targetDir, opts) {
 		}
 		targets = {
 			tools: tools.length > 0 ? tools : ["claude"],
-			ci,
 			hooks: fs.existsSync(path.join(targetDir, ".stdd", "hooks", "pre-push")),
 			sessionHook:
 				settingsText.includes("stdd status") ||
@@ -414,14 +396,8 @@ export async function configure(targetDir, opts) {
 		);
 	}
 	const desiredStopHook = stopHook || targets.stopHook;
-	const existingCi = targets.ci.filter((provider) => {
-		const outputFile = CI_ADAPTERS[provider].outputFile;
-		return outputFile === null || fs.existsSync(path.join(targetDir, outputFile));
-	});
 	await init(targetDir, {
 		tools: targets.tools,
-		ci: existingCi,
-		rememberedCiTargets: targets.ci,
 		hooks: false,
 		sessionHook: false,
 		stopHook: desiredStopHook,
@@ -437,9 +413,8 @@ export async function configure(targetDir, opts) {
 }
 
 export async function init(targetDir, opts) {
-	const { tools, ci, hooks, sessionHook, capabilitiesList } = opts;
+	const { tools, hooks, sessionHook, capabilitiesList } = opts;
 	const stopHook = Boolean(opts.stopHook);
-	const rememberedCiTargets = opts.rememberedCiTargets ?? ci;
 	const rememberedHookTargets = opts.rememberedHookTargets ?? {
 		hooks: Boolean(hooks),
 		sessionHook: Boolean(sessionHook),
@@ -553,19 +528,6 @@ export async function init(targetDir, opts) {
 			}),
 		});
 	}
-	const ciPlans = new Map();
-	for (const provider of ci) {
-		const adapter = CI_ADAPTERS[provider];
-		if (adapter.outputFile !== null) {
-			ciPlans.set(
-				provider,
-				renderCiTemplate(
-					fs.readFileSync(path.join(PKG_ROOT, "templates", adapter.templateFile), "utf8"),
-					{ stamp: STAMP, version: VERSION },
-				),
-			);
-		}
-	}
 	const publicationPaths = new Set([".stdd/method.md", ".stdd/config.json", ".gitignore"]);
 	for (const pb of kitActive) publicationPaths.add(`.stdd/playbooks/${pb.file}`);
 	for (const { adapter, skills } of toolPlans.values()) {
@@ -578,7 +540,6 @@ export async function init(targetDir, opts) {
 	for (const adapter of Object.values(AGENT_ADAPTERS)) {
 		publicationPaths.add(adapter.instructionsFile);
 	}
-	for (const provider of ciPlans.keys()) publicationPaths.add(CI_ADAPTERS[provider].outputFile);
 	if (hooks) publicationPaths.add(".stdd/hooks/pre-push");
 	publicationPaths.add(".stdd/policy.md");
 	for (const relative of publicationPaths) {
@@ -755,20 +716,6 @@ export async function init(targetDir, opts) {
 			console.log(`Removed the managed STDD section from deselected ${adapter.instructionsFile}`);
 		}
 
-		for (const provider of ci) {
-			const adapter = CI_ADAPTERS[provider];
-			if (adapter.outputFile === null) {
-				console.log(
-					`Portable CI contract for ${adapter.id} (compose with your provider's checkout and live PR/MR body):\n` +
-						`  npx --yes @stdd/cli@${VERSION} check .\n` +
-						`  printf '%s' "$REVIEW_BODY" | npx --yes @stdd/cli@${VERSION} check-pr - --base "$BASE_REF"`,
-				);
-				continue;
-			}
-			await writeGenerated(adapter.outputFile, ciPlans.get(provider));
-			console.log(`Installed ${adapter.outputFile} (${provider} live review evidence)`);
-		}
-
 		// Repository-owned standing decisions. Seeded once and then hands-off:
 		// user-owned after generation like config.json, never manifested, so a
 		// recorded permission survives every later init.
@@ -865,7 +812,6 @@ export async function init(targetDir, opts) {
 			retainedCleanupJournals: [...previouslyRetainedCleanupJournals, ...recoveredCleanupJournals],
 			targets: {
 				tools,
-				ci: rememberedCiTargets,
 				hooks: rememberedHookTargets.hooks,
 				sessionHook: rememberedHookTargets.sessionHook,
 				stopHook: rememberedHookTargets.stopHook,

package/runtime/cli/status.mjs

@@ -225,11 +225,21 @@ export function status(cwd, asJson, localOnly = false) {
 		: `enable a compatible review capability/route, then run ${reviewInvocation}${
 				reviewBudgetSpent ? " deliberately" : " again"
 			}`;
-	const planReviewSatisfied = Boolean(plan.present && plan.review?.present && plan.review.done);
+	// The closing review rides on coordination — a plan that ordered the work, or
+	// a slice handed to a worker whose code the orchestrator never watched being
+	// written. A single slice coordinates nothing, claims no review, and is owed
+	// none, so nothing is named. Expectation and completion are separate
+	// questions: reading a missing plan as an unfinished review is what made
+	// `status` ask after every verified loop, whatever the change's size.
+	const reviewExpected = Boolean(latestReview) || plan.present || Boolean(scopeEvent);
 	const recordedReviewSatisfied = latestReview?.verdict === "approved" && !reviewStale;
 	// Once a ledger verdict exists it is authoritative; a checked legacy
 	// heuristic item must never hide a newer failed or stale review.
-	const reviewSatisfied = latestReview ? recordedReviewSatisfied : planReviewSatisfied;
+	const reviewSatisfied = !reviewExpected
+		? true
+		: latestReview
+			? recordedReviewSatisfied
+			: Boolean(plan.review?.done);
 	const reviewNeedsAction = !reviewSatisfied;
 	const reviewFailureGuidance =
 		latestReview?.verdict === "changes-requested"

package/runtime/cli/stdd.mjs

@@ -8,7 +8,6 @@ import { loadConfig } from "./config.mjs";
 import { checkPr, evidence } from "./evidence.mjs";
 import {
 	KNOWN_CAPABILITIES,
-	KNOWN_CI,
 	KNOWN_TOOLS,
 	VERSION,
 	validateAdapterSelection,
@@ -300,7 +299,6 @@ async function main() {
 		}
 	}
 	let tools = null;
-	let ci = null;
 	let baseRefArg = null;
 	let prArg = null;
 	let readinessOnly = false;
@@ -400,19 +398,6 @@ async function main() {
 			i = parsedValueIndex;
 			prArg = parsedValue;
 			if (!prArg) fail("--pr requires a PR number, or . for the current branch's PR");
-		} else if (parsedArg === "--ci") {
-			if (command !== "init") fail(`--ci is only valid for "stdd init"`);
-			i = parsedValueIndex;
-			ci = parseGenericList(parsedValue, "--ci", {
-				noun: "ci provider(s)",
-				example: "github",
-				known: KNOWN_CI,
-			});
-			try {
-				ci = validateAdapterSelection("ci", ci, KNOWN_CI);
-			} catch (err) {
-				fail(`--ci ${err.message.replace(/^ci /, "")}`);
-			}
 		} else if (parsedArg === "--tools") {
 			if (command !== "init") fail(`--tools is only valid for "stdd init"`);
 			i = parsedValueIndex;
@@ -439,17 +424,13 @@ async function main() {
 
 	switch (command) {
 		case "init": {
-			if (
-				interviewFlag &&
-				(tools || ci || capabilitiesArg || hooksFlag || sessionHookFlag || stopHookFlag)
-			) {
+			if (interviewFlag && (tools || capabilitiesArg || hooksFlag || sessionHookFlag || stopHookFlag)) {
 				fail("--interview replaces the other init flags — drop them and answer the questions instead");
 			}
 			const opts = interviewFlag
 				? await interview()
 				: {
 						tools: tools ?? KNOWN_TOOLS,
-						ci: ci ?? [],
 						hooks: hooksFlag,
 						sessionHook: sessionHookFlag,
 						stopHook: stopHookFlag,
@@ -515,7 +496,7 @@ async function main() {
 			}
 			console.log(
 				"Usage: stdd <init|configure|check|check-pr|evidence|doctor|task|status|ci|docs|red|verify|note|defer|policy|slice|worker|scope|review|stop-hook> " +
-					"[dir|pr-body-file|pr] [--tools claude,codex,pi] [--ci github,gitlab,generic] [--hooks] " +
+					"[dir|pr-body-file|pr] [--tools claude,codex,pi] [--hooks] " +
 					"[--session-hook] [--interview] [--base <ref>] " +
 					"[--pr <n|.>] [--watch] [--readiness] [--json] [--gate] [--local] [--reason <why>] " +
 					"[--capabilities <list>] [--via subagent|codex|claude] [--review-via <route>] " +

package/runtime/method/README.md

@@ -94,6 +94,41 @@ classify → read docs → docs edit (the spec) → failing test → implement
    The base comes from `--base` or the `baseRef` key in `.stdd/config.json`;
    there is no built-in default.
 
+## Proportionality
+
+The default route for an agreed change is one slice: the docs decision, a
+failing test where one applies, the implementation, a fresh verify. A plan, a
+delegated worker, and an independent review are escalations from that route,
+each with a condition below. None of it touches proof — the docs decision, a
+genuine red where a test applies, and a fresh verify hold at every size.
+Proportionality cuts paperwork, never evidence.
+
+A change is one slice when, at the moment of deciding, it has one agreed
+observable outcome, one coherent implementation boundary, one acceptance check,
+and no known dependency on another independently verifiable change. Escalate as
+soon as any of four things appears: a second independent outcome, an ordering
+dependency between parts, a need to hand work to another session, or a design
+decision nobody has made yet. They are usually discovered mid-work. Escalating
+then is the normal case, not a failed classification — the criterion is re-read
+as the work goes, never declared once at the start.
+
+Two independent axes decide which escalation applies. **Coordination
+complexity** decides the plan and delegation: work that must be ordered, split,
+or handed over needs a durable plan, because those artifacts exist against
+memory that does not survive compaction or a handoff. **Consequence** is why a human may want an
+independent review that coordination did not already require: a two-line change
+to authorization or pricing can carry more of it than a two-hundred-line
+rename. `stdd status` names the review from coordination alone, because
+coordination is what it can observe; consequence is a judgement, and
+`stdd review` is callable for it at any moment. Which surfaces carry
+consequence is the adopting team's contract, not this kit's — see "What stdd
+does not cover". Diff size decides neither axis; it proxies both and measures
+neither.
+
+A PR, and the CI wait that follows it, ride on the delivery boundary the user
+asked for. A change requested as a local edit is complete when it is verified
+locally.
+
 ## The frontend exception: design-first
 
 Frontend **visual** work — layout, styling, markup structure, presentation
@@ -324,11 +359,14 @@ snapshot. A passing verify becomes stale after any later checkout change;
 current proof. Older ledger events without snapshots remain readable but
 are explicitly reported as legacy evidence. Timing
 leaves the prose: run `stdd status` at session start and before opening a
-PR. Once the loop is verified and the plan is exhausted, the closing
-review is the named next step ahead of the evidence line — when the
-capability profile has a dispatch route on (`subagents` or `crossCli`),
-`status` says to dispatch the fresh reviewer explicitly; with both off
-the suggestion is omitted rather than degraded to self-review.
+PR. Once the loop is verified, `status` names the closing review only when
+something expects one: a plan is present, a slice was delegated (a recorded
+`scope` event), or a review verdict is already recorded. With none of the
+three it goes straight to the evidence line — a single slice makes no review
+claim and is not asked for one. Where a review is expected, it is named ahead
+of the evidence line when the capability profile has a dispatch route on
+(`subagents` or `crossCli`); with both off the suggestion is omitted rather
+than degraded to self-review.
 
 ## The durable plan and `stdd defer`
 
@@ -367,7 +405,10 @@ delegated work alike, and its reviewer is a fresh context (a read-only
 subagent or the other CLI, per the capability profile) that sees the plan
 and the diff, never the implementing session's history. With both dispatch
 capabilities off, capability compilation omits the review item and closing
-review guidance entirely; it never substitutes self-review.
+review guidance entirely; it never substitutes self-review. A change that
+needed no plan carries no such item, makes no review claim, and is not asked
+for one — the review rides on coordination, and `stdd review` stays callable
+at any moment for a change whose consequence warrants it.
 
 The review item carries a `[review:]` tag, and the tag follows the same
 claim-vs-proof rule as `[red:]`: the checkbox is a claim, the ledger is
@@ -411,8 +452,8 @@ authority.
 A permission's action comes from a closed set: `merge`, `deploy`, `publish`,
 `migrate`, `force-push`, and `external-mutation`. Any other action is rejected,
 which is also why policy cannot waive a method gate — the docs edit, a genuine
-red, verification, the closing review, and `stdd check` are not actions the
-file can name. Policy widens what an agent may do without asking; it never
+red, verification, a closing review the plan claims, and `stdd check` are not
+actions the file can name. Policy widens what an agent may do without asking; it never
 narrows what the loop must prove.
 
 The set is enforced when the document is read, not only when `stdd policy`

package/runtime/method/reference-commands.md

@@ -98,7 +98,13 @@ formatting characters are rejected before durable state is written.
 
 A managed worker sandbox created by `stdd worker create` requires an active
 task and an already recorded docs
-decision. Its destination must not exist. Managed create and collect use the
+decision. Its destination must not exist, must be outside the source checkout,
+and must be outside any Git repository — a sandbox carries no `.git` and must
+not be swept up by a surrounding one. That puts it beside the project rather
+than inside it, so the convention is one hidden container,
+`../.stdd-workers/<slice>`: a directory of projects then collects a single
+`.stdd-workers/` however many slices are delegated, instead of one visible
+sibling each. Managed create and collect use the
 native mutation helper and fail before mutation when the destination
 filesystem cannot provide the required capability guarantees. Creation copies
 the checkout's tracked and non-ignored untracked files at

package/runtime/method/reference-integration.md

@@ -88,9 +88,9 @@ repository; its lazy skills remain available, while lifecycle integrations stay
 dormant outside a checkout containing `.stdd/`.
 **Shared repository contract** use runs `init` once and commits `.stdd/`, native
 agent routing, and repository policy. **Enforced contract** use explicitly adds
-repository-owned hooks or a CI adapter; ordinary `init` never creates CI, and
-CI reads checkout and review-request facts rather than the private ledger or
-agent state.
+repository-owned hooks, or the two CI commands below to a job the repository
+owns; `init` never creates CI, and CI reads checkout and review-request facts
+rather than the private ledger or agent state.
 
 Repo-local generated skills remain a valid team contract and need no plugin.
 The optional universal bundle at `plugins/stdd/` distributes one generated set
@@ -159,46 +159,39 @@ The five skills named by that router (`stdd-investigation`,
 that would make one inactive. Other inactive local overrides still shadow
 their kit playbook intentionally.
 
-## CI adapters
+## CI
 
-CI integration is an explicit, optional transport adapter around
-provider-neutral CLI contracts. `init` without `--ci` creates no provider file;
-a team may instead place the printed generic commands in an existing quality
-job. Every configured provider runs `stdd check`; a review pipeline pipes its
-live PR/MR description to `stdd check-pr - --base <ref>`. CI uses read-only
-repository and review-request access. It never attempts to prove the agent's
-reasoning, consume the ignored ledger, dispatch workers, or mutate Git: it
-grades only facts derivable from the checkout and review request.
+CI is read-only enforcement of checkout and PR facts, composed into whatever
+job the repository already runs. stdd writes no provider configuration: a
+workflow is ordinary infrastructure the team owns, and generating one taught
+nothing the two commands below do not already say. CI never attempts to prove
+the agent's reasoning, consume the ignored ledger, dispatch workers, or mutate
+Git — it grades only facts derivable from the checkout and the review request.
 
-On GitHub, `stdd init --ci github` writes the canonical workflow for these
-gates and installs an explicit supported Node runtime. It fetches the PR body
-live from the API and re-runs on body edits —
-a workflow reading `github.event.pull_request.body` validates a payload
-frozen at trigger time, so an edited body is never re-checked and a re-run
-replays the stale text. The fetch uses node, not the gh CLI — node is
-already required to run stdd, while self-hosted runners often lack gh —
-and the step sets `pipefail`, so a failed fetch fails the gate as a fetch
-error instead of feeding check-pr an empty body that misreports as a
-missing evidence line. `stdd doctor` flags the frozen-payload form, and flags a PR
-template carrying an unquoted evidence label at the start of a line, since
-its placeholder residue would pass the gate on every PR.
+The contract is two commands:
 
-On GitLab, `stdd init --ci gitlab` writes an includeable
-`.gitlab/stdd.gitlab-ci.yml` job. It uses the merge-request API to fetch the
-live description, pipes it to `check-pr -`, and passes
-`CI_MERGE_REQUEST_DIFF_BASE_SHA` as the base. The job enables `pipefail`, so
-an API failure fails the gate instead of being mistaken for an empty body.
-Same-project pipelines authenticate with the short-lived `CI_JOB_TOKEN`.
-Because fork merge-request pipelines normally run in the source project, the
-target must allowlist that source for job-token access. A controlled trusted
-fork may instead supply a masked and hidden target-project
-`STDD_GITLAB_READ_API_TOKEN` with only `read_api`; target credentials are
-never safe in an untrusted fork pipeline. Authentication failure names the
-required setup instead of pretending fork access is automatic.
-`stdd init --ci generic` writes no provider file; it prints and records the
-portable command contract for teams to compose into Jenkins, Buildkite, or an
-existing pipeline. Provider templates are adapters, never dependencies of
-the method or public SDK.
+```
+stdd check .
+<live review description> | stdd check-pr - --base <base ref>
+```
+
+Three things a hand-written job has to get right, because they are the part
+that is not obvious:
+
+- **Fetch the description live from the provider API.** An event payload is
+  frozen at trigger time, so a body-only edit is never re-checked and a re-run
+  replays the stale text. On GitHub that means the workflow must not read
+  `github.event.pull_request.body`, and must re-run on the `edited` trigger;
+  `stdd doctor` reports a workflow that validates the frozen payload — a local
+  diagnostic, not part of the `stdd check` gate the job itself runs.
+- **Set `pipefail` on the fetch step.** Otherwise a failed fetch feeds
+  `check-pr` an empty body, which misreports as a missing evidence line
+  instead of as a fetch error.
+- **Check out full history.** `check-pr --base` diffs against the base ref.
+
+`stdd doctor` flags the frozen-payload form, and flags a PR template carrying
+an unquoted evidence label at the start of a line, since its placeholder
+residue would pass the gate on every PR.
 
 ## Local hooks
 

package/runtime/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@stdd/cli",
-	"version": "0.9.2",
+	"version": "0.10.0",
 	"description": "Spec + Test Driven Development — a markdown-first methodology kit for teams building software with AI coding agents",
 	"type": "module",
 	"exports": {

package/runtime/playbooks/delegate-slice.md

@@ -19,11 +19,17 @@ compaction, its recorded events do.
    sandbox when the worker does not need Git authority:
 
    ```bash
-   stdd worker create ../stdd-worker-billing \
+   mkdir -p ../.stdd-workers
+   stdd worker create ../.stdd-workers/billing \
      --frozen "docs/**,migrations/**" \
      --allowed "src/billing/**,test/billing/**"
    ```
 
+   A sandbox cannot live inside the checkout or inside any Git repository, so
+   it goes beside the project — in one hidden container, not as a visible
+   sibling per slice. A directory of projects collects one `.stdd-workers/`
+   however many slices you delegate, and deleting it removes every sandbox.
+
    Use `stdd slice new --frozen ... --allowed ...` only when the worker must
    operate in an existing isolated checkout. `--frozen` names globs the worker
    must not touch. `--allowed` names the only paths it may change. At least one

package/runtime/playbooks/finish-change.md

@@ -1,6 +1,6 @@
 ---
 name: stdd-finish-change
-description: Close an implemented change with independent review, PR evidence, terminal CI, and runtime verification when required
+description: Close an implemented change with the review, PR evidence, terminal CI, and runtime verification its delivery boundary requires
 when: Implementation is locally verified and the change is ready for review, delivery, or handoff.
 ---
 
@@ -9,8 +9,10 @@ when: Implementation is locally verified and the change is ready for review, del
 Close the current checkout in this order:
 
 1. Run the complete affected local verification.
-2. Finish every plan item and run the independent closing review when the
-   capability profile supports it.
+2. Finish every plan item. Run the independent closing review when the plan
+   carries a `[review:]` item or a slice was delegated, and the capability
+   profile supports it; a single slice makes no review claim and is not asked
+   for one.
 <!-- cap:crossCli -->
    `stdd review --via {{STDD_CROSS_CLI_REVIEW_VIA}}` dispatches the other CLI
    read-only and records the verdict in the ledger.
@@ -29,6 +31,11 @@ Close the current checkout in this order:
 6. Run `stdd task finish` only after the requested delivery boundary is
    actually complete.
 
+Steps 3 and 4 apply when that delivery boundary is a PR. A change the user
+asked for as a local edit is complete after step 2 and closes at step 6 —
+opening a PR for it is work nobody requested. Step 5 is not a PR step: any
+delivery carrying a runtime effect gets that verification, PR or not.
+
 <!-- cap:subagents|crossCli -->
 An `approved` verdict freezes the checkout. Anything you notice afterwards —
 a stale comment, a better name, one more edge case — is deferred with

package/runtime/playbooks/planning.md

@@ -1,11 +1,15 @@
 ---
 name: stdd-planning
 description: Turn an agreed behavior contract into an executable, verifiable sequence of work
-when: The behavior contract is agreed (docs edit drafted or committed) and the change is large enough to need ordered steps — before the first implementation edit, to fix the execution mode and delivery boundary.
+when: The behavior contract is agreed (docs edit drafted or committed) and the change is more than one slice — a second independent outcome, an ordering dependency between parts, work to hand to another session, or an unresolved design decision — before the first implementation edit, to fix the execution mode and delivery boundary.
 ---
 
 # Planning
 
+A single-slice change does not come here: it goes straight to
+`stdd-implement`. Planning starts when a second slice appears, which is
+usually mid-work rather than at classification time.
+
 A plan is a disposable working artifact: it guides one execution and is thrown
 away. It is never committed as a file — its home is the PR description (for
 the durable summary) and `.stdd/plan.md` (for the working copy: per checkout,

package/runtime/playbooks/start-change.md

@@ -28,13 +28,23 @@ stdd status --local
 If another task is active, do not reset it silently. Finish it, continue it,
 or ask the user which task owns the checkout.
 
-Then classify the chosen action and route to the smallest applicable workflow:
-
-- behavior or scope is still uncertain → invoke `stdd-brainstorming` within
+Then route. The default is one slice: invoke `stdd-implement` directly. A
+change is one slice when, at the moment of deciding, it has one agreed
+observable outcome, one coherent implementation boundary, one acceptance check,
+and no known dependency on another independently verifiable change.
+
+Escalate from that default only on a named trigger:
+
+- a second independent outcome or an ordering dependency between parts →
+  invoke `stdd-planning`;
+- work to hand to another session → invoke `stdd-planning`, then
+  `stdd-delegate-slice`;
+- a design decision nobody has made yet → invoke `stdd-brainstorming` within
   the active change boundary;
-- agreed multi-step behavior → invoke `stdd-planning`;
-- known defect without a diagnosis → invoke `stdd-debugging`;
-- small agreed change → invoke `stdd-implement` directly.
+- a known defect without a diagnosis → invoke `stdd-debugging`.
+
+Any of them may appear mid-work. Escalating then is the normal case, not a
+failed classification.
 
 Read `.stdd/method.md` and the canonical docs governing the touched behavior.
 The classification is a routing decision, not ceremony: skip workflows that do

package/runtime/sdk/adapters.mjs

@@ -3,9 +3,6 @@ import { assertPrintableSingleLine } from "./text.mjs";
 
 const SEMVER_PATTERN =
 	/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
-const CI_STAMP_PLACEHOLDER = "__STAMP__";
-const CI_VERSION_PLACEHOLDER = "__VERSION__";
-const CI_PLACEHOLDER_PATTERN = /__[A-Z][A-Z0-9_]*__/u;
 export const CROSS_CLI_REVIEW_VIA_TOKEN = "{{STDD_CROSS_CLI_REVIEW_VIA}}";
 const CROSS_CLI_REVIEW_VIAS = new Set(["claude", "codex"]);
 
@@ -92,23 +89,6 @@ export function defineAgentAdapter(adapter) {
 	return deepFreeze(copy);
 }
 
-export function defineCiAdapter(adapter) {
-	const id = assertSkillName(adapter?.id, "CI adapter id");
-	const outputIsNull = adapter?.outputFile === null;
-	const templateIsNull = adapter?.templateFile === null;
-	if (outputIsNull !== templateIsNull) {
-		throw new TypeError("CI adapter outputFile and templateFile must both be null or both be paths");
-	}
-	const copy = {
-		id,
-		outputFile: outputIsNull ? null : requireRepoPath(adapter?.outputFile, "CI adapter outputFile"),
-		templateFile: templateIsNull
-			? null
-			: requireRepoPath(adapter?.templateFile, "CI adapter templateFile"),
-	};
-	return deepFreeze(copy);
-}
-
 export const AGENT_ADAPTERS = deepFreeze({
 	claude: defineAgentAdapter({
 		id: "claude",
@@ -139,24 +119,6 @@ export const AGENT_ADAPTERS = deepFreeze({
 	}),
 });
 
-export const CI_ADAPTERS = deepFreeze({
-	github: defineCiAdapter({
-		id: "github",
-		outputFile: ".github/workflows/stdd.yml",
-		templateFile: "github-stdd.yml",
-	}),
-	gitlab: defineCiAdapter({
-		id: "gitlab",
-		outputFile: ".gitlab/stdd.gitlab-ci.yml",
-		templateFile: "gitlab-stdd.yml",
-	}),
-	generic: defineCiAdapter({
-		id: "generic",
-		outputFile: null,
-		templateFile: null,
-	}),
-});
-
 export function getAgentAdapter(id) {
 	if (!Object.hasOwn(AGENT_ADAPTERS, id)) {
 		throw new Error(`unknown agent adapter ${JSON.stringify(id)}`);
@@ -164,13 +126,6 @@ export function getAgentAdapter(id) {
 	return AGENT_ADAPTERS[id];
 }
 
-export function getCiAdapter(id) {
-	if (!Object.hasOwn(CI_ADAPTERS, id)) {
-		throw new Error(`unknown CI adapter ${JSON.stringify(id)}`);
-	}
-	return CI_ADAPTERS[id];
-}
-
 function resolveAgentAdapter(adapter) {
 	return typeof adapter === "string" ? getAgentAdapter(adapter) : defineAgentAdapter(adapter);
 }
@@ -274,19 +229,3 @@ export function renderAgentInstructions({
 		"",
 	].join("\n");
 }
-
-export function renderCiTemplate(template, { stamp, version }) {
-	const safeTemplate = requireString(template, "CI template");
-	const safeStamp = assertPrintableSingleLine(stamp, "CI stamp");
-	const safeVersion = assertSemanticVersion(version, "CI version");
-	if (!safeTemplate.includes(CI_STAMP_PLACEHOLDER) || !safeTemplate.includes(CI_VERSION_PLACEHOLDER)) {
-		throw new TypeError("CI template must contain __STAMP__ and __VERSION__ placeholders");
-	}
-	const rendered = safeTemplate.replace(/__STAMP__|__VERSION__/gu, (placeholder) =>
-		placeholder === CI_STAMP_PLACEHOLDER ? safeStamp : safeVersion,
-	);
-	if (CI_PLACEHOLDER_PATTERN.test(rendered)) {
-		throw new TypeError("CI template contains an unresolved placeholder");
-	}
-	return rendered;
-}

package/runtime/sdk/index.d.ts

@@ -49,17 +49,9 @@ export interface AgentAdapter {
 	readonly hooksFile: string;
 	readonly crossCliReviewVia?: "codex" | "claude" | null;
 }
-export interface CiAdapter {
-	readonly id: string;
-	readonly outputFile: string | null;
-	readonly templateFile: string | null;
-}
 export const AGENT_ADAPTERS: DeepReadonly<Record<"claude" | "codex" | "pi", AgentAdapter>>;
-export const CI_ADAPTERS: DeepReadonly<Record<"github" | "gitlab" | "generic", CiAdapter>>;
 export function defineAgentAdapter(adapter: AgentAdapter): DeepReadonly<AgentAdapter>;
-export function defineCiAdapter(adapter: CiAdapter): DeepReadonly<CiAdapter>;
 export function getAgentAdapter(id: string): AgentAdapter;
-export function getCiAdapter(id: string): CiAdapter;
 export function renderAgentSkill(input: {
 	adapter?: string | AgentAdapter;
 	name: string;
@@ -75,7 +67,6 @@ export function renderAgentInstructions(input: {
 	crossCli: boolean;
 	projectLogEnabled?: boolean;
 }): string;
-export function renderCiTemplate(template: string, input: { stamp: string; version: string }): string;
 export function assertSkillName(name: string, label?: string): string;
 export function isPrintableSingleLine(value: unknown): value is string;
 export function assertPrintableSingleLine(value: unknown, label?: string): string;

package/runtime/sdk/index.mjs

@@ -12,14 +12,10 @@ export {
 } from "../cli/lib.mjs";
 export {
 	AGENT_ADAPTERS,
-	CI_ADAPTERS,
 	defineAgentAdapter,
-	defineCiAdapter,
 	getAgentAdapter,
-	getCiAdapter,
 	renderAgentInstructions,
 	renderAgentSkill,
-	renderCiTemplate,
 } from "./adapters.mjs";
 export { assertSkillName, resolveRepoPath, resolveWritableRepoPath } from "./path.mjs";
 export { assertPrintableSingleLine, isPrintableSingleLine } from "./text.mjs";

package/skills/stdd-brainstorming/SKILL.md

@@ -3,7 +3,7 @@ name: stdd-brainstorming
 description: "Explore future behavior and hypothetical approaches without forcing action. Use when: Asked for opinions, ideation, future behavior, or a hypothetical implementation approach, with no explicit intent to persist or modify the repository."
 ---
 
-<!-- generated by stdd plugin build v0.9.2 — do not edit -->
+<!-- generated by stdd plugin build v0.10.0 — do not edit -->
 
 
 # Brainstorming

package/skills/stdd-debugging/SKILL.md

@@ -3,7 +3,7 @@ name: stdd-debugging
 description: "Find and fix the root cause of a defect, not its symptom. Use when: A bug, crash, failing test, or unexplained behavior is reported."
 ---
 
-<!-- generated by stdd plugin build v0.9.2 — do not edit -->
+<!-- generated by stdd plugin build v0.10.0 — do not edit -->
 
 
 # Debugging

package/skills/stdd-delegate-slice/SKILL.md

@@ -3,7 +3,7 @@ name: stdd-delegate-slice
 description: "Hand a slice of work to a worker session with a declared scope, a ledger handoff, and a reviewed result. Use when: Before implementing a multi-step change whose steps are independent — hand slices to worker sessions (subagent, second CLI, teammate) instead of implementing everything inline; also whenever a worker's result comes back for review."
 ---
 
-<!-- generated by stdd plugin build v0.9.2 — do not edit -->
+<!-- generated by stdd plugin build v0.10.0 — do not edit -->
 
 
 # Delegate a Slice
@@ -21,11 +21,17 @@ compaction, its recorded events do.
    sandbox when the worker does not need Git authority:
 
    ```bash
-   stdd worker create ../stdd-worker-billing \
+   mkdir -p ../.stdd-workers
+   stdd worker create ../.stdd-workers/billing \
      --frozen "docs/**,migrations/**" \
      --allowed "src/billing/**,test/billing/**"
    ```
 
+   A sandbox cannot live inside the checkout or inside any Git repository, so
+   it goes beside the project — in one hidden container, not as a visible
+   sibling per slice. A directory of projects collects one `.stdd-workers/`
+   however many slices you delegate, and deleting it removes every sandbox.
+
    Use `stdd slice new --frozen ... --allowed ...` only when the worker must
    operate in an existing isolated checkout. `--frozen` names globs the worker
    must not touch. `--allowed` names the only paths it may change. At least one

package/skills/stdd-finish-change/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: stdd-finish-change
-description: "Close an implemented change with independent review, PR evidence, terminal CI, and runtime verification when required. Use when: Implementation is locally verified and the change is ready for review, delivery, or handoff."
+description: "Close an implemented change with the review, PR evidence, terminal CI, and runtime verification its delivery boundary requires. Use when: Implementation is locally verified and the change is ready for review, delivery, or handoff."
 ---
 
-<!-- generated by stdd plugin build v0.9.2 — do not edit -->
+<!-- generated by stdd plugin build v0.10.0 — do not edit -->
 
 
 # Finish change
@@ -11,8 +11,10 @@ description: "Close an implemented change with independent review, PR evidence,
 Close the current checkout in this order:
 
 1. Run the complete affected local verification.
-2. Finish every plan item and run the independent closing review when the
-   capability profile supports it.
+2. Finish every plan item. Run the independent closing review when the plan
+   carries a `[review:]` item or a slice was delegated, and the capability
+   profile supports it; a single slice makes no review claim and is not asked
+   for one.
    `stdd review --via subagent` prints the brief path for a fresh read-only
    subagent; feed its JSON back with `stdd review --result <file>`.
 3. Generate the PR evidence with `stdd evidence`; never hand-author a claim
@@ -25,6 +27,11 @@ Close the current checkout in this order:
 6. Run `stdd task finish` only after the requested delivery boundary is
    actually complete.
 
+Steps 3 and 4 apply when that delivery boundary is a PR. A change the user
+asked for as a local edit is complete after step 2 and closes at step 6 —
+opening a PR for it is work nobody requested. Step 5 is not a PR step: any
+delivery carrying a runtime effect gets that verification, PR or not.
+
 An `approved` verdict freezes the checkout. Anything you notice afterwards —
 a stale comment, a better name, one more edge case — is deferred with
 `stdd defer`, not edited in. Editing discards the approval rather than

package/skills/stdd-implement/SKILL.md

@@ -3,7 +3,7 @@ name: stdd-implement
 description: "Execute one agreed behavior slice through docs, genuine red, implementation, and fresh verification. Use when: The behavior contract is agreed and production changes are ready to begin."
 ---
 
-<!-- generated by stdd plugin build v0.9.2 — do not edit -->
+<!-- generated by stdd plugin build v0.10.0 — do not edit -->
 
 
 # Implement

package/skills/stdd-investigation/SKILL.md

@@ -3,7 +3,7 @@ name: stdd-investigation
 description: "Read-only current-state diagnosis — evidence-backed findings, no changes. Use when: Asked a factual question about current behavior, or to diagnose or triage it, WITHOUT changing anything."
 ---
 
-<!-- generated by stdd plugin build v0.9.2 — do not edit -->
+<!-- generated by stdd plugin build v0.10.0 — do not edit -->
 
 
 # Investigation

package/skills/stdd-planning/SKILL.md

@@ -1,13 +1,17 @@
 ---
 name: stdd-planning
-description: "Turn an agreed behavior contract into an executable, verifiable sequence of work. Use when: The behavior contract is agreed (docs edit drafted or committed) and the change is large enough to need ordered steps — before the first implementation edit, to fix the execution mode and delivery boundary."
+description: "Turn an agreed behavior contract into an executable, verifiable sequence of work. Use when: The behavior contract is agreed (docs edit drafted or committed) and the change is more than one slice — a second independent outcome, an ordering dependency between parts, work to hand to another session, or an unresolved design decision — before the first implementation edit, to fix the execution mode and delivery boundary."
 ---
 
-<!-- generated by stdd plugin build v0.9.2 — do not edit -->
+<!-- generated by stdd plugin build v0.10.0 — do not edit -->
 
 
 # Planning
 
+A single-slice change does not come here: it goes straight to
+`stdd-implement`. Planning starts when a second slice appears, which is
+usually mid-work rather than at classification time.
+
 A plan is a disposable working artifact: it guides one execution and is thrown
 away. It is never committed as a file — its home is the PR description (for
 the durable summary) and `.stdd/plan.md` (for the working copy: per checkout,

package/skills/stdd-pr-green/SKILL.md

@@ -3,7 +3,7 @@ name: stdd-pr-green
 description: "A PR is done only when its required checks settle terminal-green on the current head. Use when: A PR/MR exists, or is about to be opened, for the current branch."
 ---
 
-<!-- generated by stdd plugin build v0.9.2 — do not edit -->
+<!-- generated by stdd plugin build v0.10.0 — do not edit -->
 
 
 # PR Green

package/skills/stdd-start-change/SKILL.md

@@ -3,7 +3,7 @@ name: stdd-start-change
 description: "Open durable task state and route work after explicit intent to persist or modify the repository. Use when: The user explicitly wants a persisted work artifact or repository change."
 ---
 
-<!-- generated by stdd plugin build v0.9.2 — do not edit -->
+<!-- generated by stdd plugin build v0.10.0 — do not edit -->
 
 
 # Start change
@@ -30,13 +30,23 @@ stdd status --local
 If another task is active, do not reset it silently. Finish it, continue it,
 or ask the user which task owns the checkout.
 
-Then classify the chosen action and route to the smallest applicable workflow:
+Then route. The default is one slice: invoke `stdd-implement` directly. A
+change is one slice when, at the moment of deciding, it has one agreed
+observable outcome, one coherent implementation boundary, one acceptance check,
+and no known dependency on another independently verifiable change.
 
-- behavior or scope is still uncertain → invoke `stdd-brainstorming` within
+Escalate from that default only on a named trigger:
+
+- a second independent outcome or an ordering dependency between parts →
+  invoke `stdd-planning`;
+- work to hand to another session → invoke `stdd-planning`, then
+  `stdd-delegate-slice`;
+- a design decision nobody has made yet → invoke `stdd-brainstorming` within
   the active change boundary;
-- agreed multi-step behavior → invoke `stdd-planning`;
-- known defect without a diagnosis → invoke `stdd-debugging`;
-- small agreed change → invoke `stdd-implement` directly.
+- a known defect without a diagnosis → invoke `stdd-debugging`.
+
+Any of them may appear mid-work. Escalating then is the normal case, not a
+failed classification.
 
 Read `.stdd/method.md` and the canonical docs governing the touched behavior.
 The classification is a routing decision, not ceremony: skip workflows that do

package/skills/stdd-worktrees/SKILL.md

@@ -3,7 +3,7 @@ name: stdd-worktrees
 description: "Work in an isolated workspace without fighting the platform's native isolation. Use when: Starting implementation work that should not disturb the user's current checkout."
 ---
 
-<!-- generated by stdd plugin build v0.9.2 — do not edit -->
+<!-- generated by stdd plugin build v0.10.0 — do not edit -->
 
 
 # Isolated Workspaces

package/runtime/templates/github-stdd.yml

@@ -1,42 +0,0 @@
-# __STAMP__
-#
-# Validates the PR body fetched LIVE from the API, not the event payload —
-# the payload is frozen at trigger time, so a body-only edit would never be
-# re-checked. The `edited` trigger re-runs this workflow on body changes.
-name: STDD
-on:
-  pull_request:
-    types: [opened, edited, synchronize, reopened]
-
-permissions:
-  contents: read
-  pull-requests: read
-
-jobs:
-  stdd:
-    name: STDD Contract
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0 # check-pr --base diffs against the base ref
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-      - name: stdd check
-        run: npx --yes @stdd/cli@__VERSION__ check .
-      - name: PR docs evidence (live body)
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        # node, not gh: node is already required for stdd, while self-hosted
-        # runners often lack the gh CLI. pipefail: a failed fetch must fail
-        # the gate as a fetch error, not feed check-pr an empty body.
-        run: |
-          set -o pipefail
-          node --input-type=module -e '
-            const url = "https://api.github.com/repos/" + process.env.GITHUB_REPOSITORY + "/pulls/" + process.env.PR_NUMBER;
-            const res = await fetch(url, { headers: { authorization: "Bearer " + process.env.GH_TOKEN, accept: "application/vnd.github+json" } });
-            if (!res.ok) { console.error("GitHub API " + res.status + " for " + url); process.exit(1); }
-            process.stdout.write((await res.json()).body ?? "");
-          ' | npx --yes @stdd/cli@__VERSION__ check-pr - --base "origin/$GITHUB_BASE_REF"

package/runtime/templates/gitlab-stdd.yml

@@ -1,72 +0,0 @@
-# __STAMP__
-#
-# Include this file from the repository's root .gitlab-ci.yml:
-#   include:
-#     - local: .gitlab/stdd.gitlab-ci.yml
-#
-# The job defaults to GitLab's reserved .pre stage, so this include stays valid
-# when a consumer defines custom stages without "test". To run STDD in an
-# existing consumer stage, override the included job in the root .gitlab-ci.yml.
-# The override must name a stage declared by that pipeline:
-#
-# stdd:
-#   stage: verify
-#
-# Same-project merge requests use CI_JOB_TOKEN. A fork pipeline runs in its
-# source project, so the target must allowlist that project under CI/CD job
-# token permissions. Only for a controlled, trusted source project, an
-# optional masked and hidden STDD_GITLAB_READ_API_TOKEN may carry a
-# target-project access token with read_api. Never expose a target token to
-# untrusted fork code.
-stdd:
-  stage: .pre
-  image: node:22
-  variables:
-    GIT_DEPTH: "0"
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-  script:
-    - npx --yes @stdd/cli@__VERSION__ check .
-    - |
-      set -o pipefail
-      node --input-type=module -e '
-        const targetProjectId = process.env.CI_MERGE_REQUEST_PROJECT_ID;
-        const pipelineProjectId = process.env.CI_PROJECT_ID;
-        const crossProject = Boolean(
-          pipelineProjectId && targetProjectId && pipelineProjectId !== targetProjectId
-        );
-        const readApiToken = crossProject
-          ? process.env.STDD_GITLAB_READ_API_TOKEN
-          : "";
-        const headers = readApiToken
-          ? { "PRIVATE-TOKEN": readApiToken, accept: "application/json" }
-          : { "JOB-TOKEN": process.env.CI_JOB_TOKEN, accept: "application/json" };
-        const url = process.env.CI_API_V4_URL + "/projects/" +
-          encodeURIComponent(targetProjectId) + "/merge_requests/" +
-          process.env.CI_MERGE_REQUEST_IID;
-        const res = await fetch(url, { headers });
-        if (!res.ok) {
-          console.error("GitLab API " + res.status + " for " + url);
-          if (crossProject && !readApiToken) {
-            console.error(
-              "Fork or cross-project MR pipeline project " + pipelineProjectId +
-              " cannot read target project " + targetProjectId +
-              ". Add pipeline project " + pipelineProjectId +
-              " to the target CI/CD job token allowlist, or only for a trusted source project " +
-              "define masked and hidden STDD_GITLAB_READ_API_TOKEN with target-project read_api."
-            );
-          } else if (crossProject) {
-            console.error(
-              "STDD_GITLAB_READ_API_TOKEN cannot read target project " + targetProjectId +
-              "; verify that it is a target-project token with read_api."
-            );
-          } else {
-            console.error(
-              "The same-project CI_JOB_TOKEN cannot read this merge request; " +
-              "verify the triggering user and job-token permissions."
-            );
-          }
-          process.exit(1);
-        }
-        process.stdout.write((await res.json()).description ?? "");
-      ' | npx --yes @stdd/cli@__VERSION__ check-pr - --base "$CI_MERGE_REQUEST_DIFF_BASE_SHA"