@techierathore/techieflow 1.0.2 → 1.0.4

package/.tfcore/hooks/guard-verify-deps.sh

@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+# TechieFlow PreToolUse hook — a verify run may START a dependency, never CREATE one,
+# and never point the application at a different one.
+#
+# TfLens, 2026-09-01 (MISS-TfLens-20260901-02). The configured dev database was refusing
+# connections. The agent ran `docker compose up -d db || docker compose up -d` — the
+# service is named `postgres`, so the `||` fallback executed the BARE compose command and
+# started every service, creating an application container and image the owner had to
+# delete by hand. It then exported the connection-string variable to point the whole test
+# suite at a different PostgreSQL and reported "689/689 pass" against it.
+#
+# Both halves are the same error. A verify run's entire product is trustworthy verdicts,
+# and verdicts measured against a system nobody chose are not weaker evidence — they are
+# evidence about a DIFFERENT system, reported under the checklist's name. The empty
+# substitute database then produced RENDER-EMPTY on nine controls whose real cause was
+# "no data", which is the plausible-wrong-number failure this framework exists to prevent,
+# arriving inside the verifier itself.
+#
+# §1 was already strict about unasked-for FILES (tests/.artifacts/, guard-artifacts.sh) and
+# silent about unasked-for INFRASTRUCTURE. A container, a volume and an image are exactly
+# as much machine state as a stray directory. This hook is that rule, as a rule and not a
+# paragraph (maintenance contract 3).
+#
+# REFUSES:
+#   - `docker compose up` / `docker-compose up` with no service named
+#   - any `|| docker compose up` fallback, which widens the command precisely when it failed
+#   - `docker compose run|create`, `docker run`, `docker volume create` — creating, not starting
+#   - an inline or exported connection-string variable in front of a test/run command
+# ALLOWS: `docker start <name>`, `docker compose up <service>`, `docker compose start`,
+#   `docker ps|logs|inspect`, and anything that is not one of the above.
+#
+# Wired in .claude/settings.json -> hooks.PreToolUse (matcher "Bash"); OpenCode via
+# .opencode/plugin/techieflow.js. Exit 2 + stderr = block and feed the message back.
+# Fails OPEN (exit 0) if python3 or parseable JSON is unavailable — a guard that cannot
+# read its input must not stop the run.
+#
+# Tested by tests/regression/run.sh tf_013.
+
+INPUT="$(cat)"
+command -v python3 >/dev/null 2>&1 || exit 0
+
+TF_HOOK_INPUT="$INPUT" python3 - <<'PY'
+import json, os, re, sys
+
+try:
+    data = json.loads(os.environ.get("TF_HOOK_INPUT", ""))
+except Exception:
+    sys.exit(0)
+
+cmd = (data.get("tool_input") or {}).get("command")
+if not isinstance(cmd, str) or not cmd.strip():
+    sys.exit(0)
+
+def block(what, instead):
+    print("BLOCKED by TechieFlow policy: %s\n"
+          "A verify run may START a service the project already defines; it may not CREATE "
+          "one, and it may never measure the application against a different instance — a "
+          "green suite against the wrong database is worse than a red one, because it is "
+          "quotable.\n%s\n"
+          "If the dependency is down and you cannot start the project's own definition of "
+          "it BY NAME, stop and ask, naming the one command the owner should run. Record "
+          "the resolved target (host, port, database — never credentials) in the verify "
+          "report, so which system was measured is on the face of it."
+          % (what, instead), file=sys.stderr)
+    sys.exit(2)
+
+# --- creating infrastructure, rather than starting what the project already defines ------
+COMPOSE = r"docker(?:\s+compose|-compose)"
+
+# a bare `up`: no service name before the end of the segment. Flags are not service names.
+for seg in re.split(r"(?:\|\||&&|;|\||\n)", cmd):
+    seg = seg.strip()
+    m = re.search(COMPOSE + r"\s+up\b(.*)$", seg, re.I)
+    if m:
+        rest = m.group(1)
+        # drop flags and their values; whatever is left is a service name
+        words = [w for w in re.split(r"\s+", rest.strip()) if w]
+        svc = []
+        skip = False
+        for w in words:
+            if skip:
+                skip = False
+                continue
+            if w.startswith("-"):
+                if "=" not in w and w in ("--scale", "--timeout", "--project-name", "-p", "--file", "-f"):
+                    skip = True
+                continue
+            svc.append(w)
+        if not svc:
+            block("`%s` starts EVERY service in the compose file." % seg[:120],
+                  "Name the service: `docker compose up -d <service>` — and check the name, "
+                  "because a `|| docker compose up` fallback runs the bare command exactly "
+                  "when the named one was wrong.")
+
+if re.search(r"\|\|\s*" + COMPOSE + r"\s+up\b", cmd, re.I):
+    block("a `|| docker compose up` fallback widens the command when the named service failed.",
+          "Drop the fallback. If the named service does not exist, the name is wrong — fix "
+          "the name or ask; do not start everything instead.")
+
+if re.search(COMPOSE + r"\s+(?:run|create)\b", cmd, re.I) or \
+   re.search(r"\bdocker\s+(?:run|create)\b", cmd, re.I) or \
+   re.search(r"\bdocker\s+volume\s+create\b", cmd, re.I):
+    block("this CREATES container or volume state the owner did not ask for.",
+          "Start what the project defines: `docker start <name>` or `docker compose up -d <service>`.")
+
+# --- repointing the application at a different instance ----------------------------------
+# The variable is whatever the project named it, so match the SHAPE of a connection string
+# rather than a list of names that would never be complete.
+CONNSTR = r"(?:Host|Server|Data\s*Source|Endpoint)\s*=|(?:postgres|postgresql|mysql|mongodb|mssql|sqlserver|redis)(?:\+srv)?://"
+ASSIGN = r"(?:\bexport\s+|\bset\s+|^|\s|;|&&)([A-Za-z_][A-Za-z0-9_]*)\s*=\s*[\"']?([^\"'\s;&|]*)"
+
+for m in re.finditer(ASSIGN, cmd):
+    name, val = m.group(1), m.group(2)
+    if re.search(CONNSTR, val, re.I) or (re.search(r"conn|db|database|datasource", name, re.I)
+                                         and re.search(r"[=:]//|Host\s*=|Port\s*=", val, re.I)):
+        block("`%s` points the application or its tests at a connection string chosen here, "
+              "not the one the project is configured with." % name,
+              "Use the app's own configured connection. TfLens's own test helper already "
+              "carries this rule — \"there is deliberately no default here … so tests and app "
+              "can never drift onto different servers again\" — and it cost a day to learn.")
+
+sys.exit(0)
+PY
+exit $?

package/.tfcore/hooks/guard-verify.sh

@@ -1,27 +1,22 @@
 #!/usr/bin/env bash
-# TechieFlow PreToolUse hook — blocks self-attested `Verified` verdicts.
+# TechieFlow PreToolUse hook — a `Verified` cell is written only by an executed verify run.
 #
-# `Verified` is the verifier's verdict, written ONLY by an EXECUTED verify-phase
-# run (chained inline by build-phase §6b, or a standalone `*verify`). On
-# 2026-07-09 a build orchestrator did its own smoke and wrote `Verified`
-# verdicts itself — the prose rule ("chain the verifier") was skipped silently.
-# This hook makes the gate MECHANICAL, the same way block-git.sh made the git
-# ban mechanical and guard-status.sh made the status shape mechanical.
+# `Verified` is the verifier's verdict. Since Sitting 4c (2026-09-06) the verify run's own script,
+# tf-verify-verdict.sh, writes the cells from the evidence it collected and writes the ledger
+# docs/.last-verify.json with every row's verdict. This hook refuses any Write/Edit/MultiEdit of a
+# *-Checklist.md that INTRODUCES a `Verified` cell unless a ledger dated today lists that row as
+# PASS. Owner decision 2026-09-06: a hand-written Verified the ledger does not list is refused.
+# Two older ledger shapes still unlock: {"mode":"reconcile"} written by *refresh-status for a row
+# whose Remarks already carry dated evidence, and a same-day ledger without a `rows` map from a
+# framework version before this sitting (the row is then checked by date only, as before).
 #
-# How it works: verify-phase §6 writes a run ledger `docs/.last-verify.json`
-# ({"date","app","scope","booted","gates","evidence"}) immediately before it
-# records verdicts — after actually booting the app and running the gates.
-# Any Write/Edit/MultiEdit to a `*-Checklist.md` that INTRODUCES a `Verified`
-# status cell is blocked unless a same-day ledger sits next to the checklist.
-#
-# Wired in .claude/settings.json → hooks.PreToolUse (matcher "Write|Edit|MultiEdit").
-# Exit 2 + stderr = block the call and feed the message back to the agent.
+# Wired in .claude/settings.json → hooks.PreToolUse (matcher "Write|Edit|MultiEdit") and in the
+# OpenCode plugin. Exit 2 + stderr = block the call and feed the message back to the agent.
 # Fails OPEN (exit 0) if python3 or parseable JSON is unavailable.
 
 INPUT="$(cat)"
 command -v python3 >/dev/null 2>&1 || exit 0
 
-# stdin feeds python the SCRIPT (heredoc), so the payload travels via env var.
 TF_HOOK_INPUT="$INPUT" python3 - <<'PY'
 import datetime, json, os, re, sys
 
@@ -35,10 +30,19 @@ path = (ti.get("file_path") or "").replace("\\", "/")
 if not path.rsplit("/", 1)[-1].lower().endswith("-checklist.md"):
     sys.exit(0)
 
-# A `Verified` STATUS CELL: a table cell holding exactly Verified (optional
-# bold / trailing date qualifier). Remarks prose like "VERIFIED 2026-07-07"
-# or "Needs re-verify" does not match.
 CELL = re.compile(r"\|\s*\**Verified\**\s*(?:\([^)|]*\))?\s*\|")
+ROW = re.compile(r"^\s*\|\s*`?(REQ-[A-Z]+-\d+)`?\s*\|", re.I)
+
+
+def verified_ids(text):
+    """the row ids whose STATUS cell reads Verified, in a piece of checklist text"""
+    out = set()
+    for line in text.splitlines():
+        m = ROW.match(line)
+        if m and CELL.search(line):
+            out.add(m.group(1).upper())
+    return out
+
 
 new_pieces, old_pieces = [], []
 if isinstance(ti.get("content"), str):
@@ -56,51 +60,69 @@ for e in ti.get("edits") or []:
 
 n_new = sum(len(CELL.findall(p)) for p in new_pieces)
 n_old = sum(len(CELL.findall(p)) for p in old_pieces)
+if isinstance(ti.get("content"), str):
+    # a whole-file write: what is Verified on disk already does not count as new
+    try:
+        with open(path, encoding="utf-8", errors="replace") as f:
+            n_old = len(CELL.findall(f.read()))
+    except FileNotFoundError:
+        n_old = 0
 if n_new <= n_old:
-    sys.exit(0)  # no NEW Verified cell introduced (demotions, moves, other edits)
+    sys.exit(0)  # no NEW Verified cell (a demotion, a move, another edit)
+
+new_ids = set().union(*(verified_ids(p) for p in new_pieces)) if new_pieces else set()
+old_ids = set().union(*(verified_ids(p) for p in old_pieces)) if old_pieces else set()
+if isinstance(ti.get("content"), str):
+    try:
+        with open(path, encoding="utf-8", errors="replace") as f:
+            old_ids = verified_ids(f.read())
+    except FileNotFoundError:
+        old_ids = set()
+introduced = new_ids - old_ids
 
-# Introducing `Verified` — require a same-day run ledger next to the checklist.
-ledger_path = os.path.join(os.path.dirname(path), ".last-verify.json")
+ledger_path = os.path.join(os.path.dirname(path) or ".", ".last-verify.json")
+today = datetime.date.today().isoformat()
 try:
     with open(ledger_path, "r", encoding="utf-8") as f:
         ledger = json.load(f)
-    if str(ledger.get("date", "")).strip() == datetime.date.today().isoformat():
-        sys.exit(0)  # fresh ledger — an executed verify-phase (or documented reconcile) unlocked it
-    stale = f"exists but is dated {ledger.get('date')!r}, not today"
 except FileNotFoundError:
-    stale = "does not exist"
+    ledger, problem = None, "does not exist"
 except Exception:
-    stale = "exists but is not valid JSON"
+    ledger, problem = None, "exists but is not valid JSON"
+
+if ledger is not None:
+    if str(ledger.get("date", "")).strip() != today:
+        problem = f"exists but is dated {ledger.get('date')!r}, not today"
+    elif ledger.get("mode") == "reconcile":
+        sys.exit(0)  # *refresh-status reconciling a row to dated evidence already in its Remarks
+    elif "rows" not in ledger:
+        sys.exit(0)  # a same-day ledger from a framework version before Sitting 4c: date unlocks
+    else:
+        rows = ledger.get("rows") or {}
+        not_listed = sorted(i for i in introduced if rows.get(i) != "PASS")
+        if not introduced:
+            # a Verified cell without a readable row id (a malformed line): refuse, nothing can vouch for it
+            not_listed = ["(row id not readable)"]
+        if not not_listed:
+            sys.exit(0)
+        problem = ("lists these rows as " + ", ".join(f"{i}: {rows.get(i, 'absent')}" for i in not_listed)
+                   + ", not PASS")
 
 print(
     "BLOCKED by TechieFlow policy: this write INTRODUCES a `Verified` status, "
-    f"but the verify run ledger {ledger_path} {stale}.",
-    file=sys.stderr,
-)
-print(
-    " - `Verified` is the VERIFIER'S verdict. It is written only downstream of an "
-    "EXECUTED .tfcore/tasks/verify-phase.md run — boot the app, run the scoped "
-    "tests, apply the §4a data-render + §4b visual-truth gates, write the run "
-    "ledger (verify-phase §6), THEN record verdicts.",
-    file=sys.stderr,
-)
-print(
-    " - If you are the build orchestrator after your self-smoke: your ceiling is "
-    "`Implemented` (build-phase §6a / _smoke-test-policy). Chain the verifier by "
-    "EXECUTING verify-phase inline (build-phase §6b) — summarizing your smoke as "
-    "a verdict is self-attestation, the exact failure this hook exists to stop.",
+    f"but the verify ledger {ledger_path} {problem}.",
     file=sys.stderr,
 )
 print(
-    " - If you are *refresh-status* reconciling a status column to PRE-EXISTING "
-    "dated VERIFIED evidence already in that row's Remarks: write the ledger with "
-    '{"date":"<today>","mode":"reconcile","evidence":"<the pre-existing remark '
-    'date>"} first (refresh-status §4).',
+    " - `Verified` is written by the verify run's own script from the evidence it collected: "
+    "bash .tfcore/utils/tf-verify-verdict.sh <App> --apply, after boot, tests, screens, assets, "
+    "parity and perf have run (.tfcore/tasks/verify-phase.md). Writing it by hand is refused.",
     file=sys.stderr,
 )
 print(
-    " - Writing the ledger WITHOUT having run verify-phase's steps is falsifying "
-    "the audit record.",
+    " - A build, a fix or a smoke reaches at most `Implemented`; chain the verifier by executing "
+    "verify-phase.md. *refresh-status may reconcile a row that already carries dated verify evidence "
+    'by writing the ledger {"date":"<today>","mode":"reconcile","evidence":"<that date>"} first.',
     file=sys.stderr,
 )
 sys.exit(2)

package/.tfcore/hooks/sweep-artifacts.sh

@@ -2,7 +2,7 @@
 # TechieFlow hook — automatic sweep of expired run material (added 2026-08-26).
 #
 # Wired as a SessionStart hook in .claude/settings.json (Claude Code), as
-# `codex-adapter.py session-start` (Codex) and on the first root
+# on the first root
 # `session.created` in .opencode/plugin/techieflow.js (OpenCode).
 #
 # WHY: verify-phase.md §1 pins every run artifact under tests/.artifacts/ and
@@ -60,7 +60,7 @@ root = os.path.realpath(root)
 DRY = os.environ.get("TF_SWEEP_DRY_RUN") == "1"
 
 # Throttle: at most one sweep per hour per project, whichever harness fires it
-# (Codex re-fires session-start on every prompt; a walk of a big tree on every
+# (a harness may re-fire session-start on every prompt; a walk of a big tree on every
 # turn is waste). TF_SWEEP_FORCE=1 bypasses. Dry runs never touch the stamp.
 stamp = os.path.join(root, ".tfcore", ".session", "sweep.stamp")
 if not DRY and os.environ.get("TF_SWEEP_FORCE") != "1":

package/.tfcore/install-manifest.yaml

@@ -91,9 +91,6 @@ files:
   - path: .tfcore\tasks\test-design.md
     hash: bcd13a95d296ce22
     modified: false
-  - path: .tfcore\tasks\shard-doc.md
-    hash: a83c900f64ea3d4f
-    modified: false
   - path: .tfcore\tasks\risk-profile.md
     hash: addf5d143cfe6f12
     modified: false
@@ -106,24 +103,12 @@ files:
   - path: .tfcore\tasks\nfr-assess.md
     hash: b9011d038b81a69b
     modified: false
-  - path: .tfcore\tasks\kb-mode-interaction.md
-    hash: 4d6b921c24ba4999
-    modified: false
-  - path: .tfcore\tasks\index-docs.md
-    hash: 70b1d526b19d015e
-    modified: false
   - path: .tfcore\tasks\generate-ai-frontend-prompt.md
     hash: ca4cabd824ea1b60
     modified: false
   - path: .tfcore\tasks\facilitate-brainstorming-session.md
     hash: 38594d876614e077
     modified: false
-  - path: .tfcore\tasks\execute-checklist.md
-    hash: 8a704b6f2bc52e12
-    modified: false
-  - path: .tfcore\tasks\document-project.md
-    hash: 98f8790d20e83cf3
-    modified: false
   - path: .tfcore\tasks\create-next-story.md
     hash: 99e5cc3237a9cffd
     modified: false
@@ -148,9 +133,6 @@ files:
   - path: .tfcore\tasks\apply-qa-fixes.md
     hash: 70e6143a80f7296b
     modified: false
-  - path: .tfcore\tasks\advanced-elicitation.md
-    hash: d39118bf32237a21
-    modified: false
   - path: .tfcore\data\test-priorities-matrix.md
     hash: 1dd5698a46ab054e
     modified: false

package/.tfcore/routing.yaml

@@ -7,7 +7,7 @@
 # A phase declares a TIER, never a model. The tiers map resolves a tier to a
 # per-harness model id (Claude Code aliases: opus|sonnet|haiku|inherit|<id>,
 # pinnable via ANTHROPIC_DEFAULT_*_MODEL; OpenCode ids: provider/model, list
-# with `opencode models`; Codex model slugs: list with `codex debug models`).
+# with `opencode models`).
 # Routing is declared at the harness boundary and
 # OBSERVED by telemetry (runs.jsonl model/tier fields) — it is never enforced
 # mid-turn, because neither harness can switch a running turn's model.
@@ -23,26 +23,97 @@
 # §5.3/§5.4 and the rollout order in §6. Flipping the flag alone changes
 # nothing; that is deliberate.
 
-enabled: false
-
+# Owner decisions: 2026-09-05, Sonnet for every long-running Claude phase, Haiku for the cheap ones;
+# 2026-09-06, the OpenAI models for OpenCode (gpt-5.6-terra for frontier and standard, gpt-5.6-luna
+# for economy) after the OpenCode Go monthly limit was reached with MiMo.
+#
+# HOW TO CHANGE A MODEL (the plain version; the full guide is docs/TechieFlow-Routing-Guide.md):
+#   1. This file is the FRAMEWORK DEFAULT. A project gets a copy at .tfcore/routing.yaml when it is
+#      scaffolded, and update-framework.sh never overwrites that copy. So to change one project,
+#      edit the project's copy; to change every future project, edit this one.
+#   2. Edit the model id under `tiers:` for the harness you use (claude: opus|sonnet|haiku or a
+#      full id; opencode: provider/model as printed by `opencode models`).
+#   3. In the project folder run: bash .tfcore/utils/tf-routing-bind.sh
+#      That regenerates the harness bindings (.claude/agents/*.md, .claude/commands/tf/*.md,
+#      .opencode/opencode.json). Nothing changes until it runs.
+#   4. For one unattended run only, pass --model <id> to tf-goal.sh instead; the main agent uses
+#      it, the sub-agents still use the bindings from step 3.
+#   5. When a model's usage limit is reached, the tier's `fallbacks:` list is the answer — see the
+#      block below. Nothing is automatic until a limit is actually hit.
+enabled: true
 # ---------------------------------------------------------------------------
 # Tier → model id, per harness. STARTING VALUES — the owner tunes these.
-# OpenCode ids below are from this machine's `opencode models` (opencode-go /
-# Zen gateway); swap for anthropic/* ids if an Anthropic key is configured.
+# OpenCode ids are provider/model as printed by `opencode models` on this machine.
 # ---------------------------------------------------------------------------
 tiers:
   frontier:
-    claude: opus
-    opencode: opencode-go/kimi-k3
-    codex: gpt-5.6
+    claude: sonnet
+    opencode: openai/gpt-5.6-terra
   standard:
     claude: sonnet
-    opencode: opencode-go/kimi-k2.7-code
-    codex: gpt-5.6-terra
+    opencode: openai/gpt-5.6-terra
   economy:
     claude: haiku
-    opencode: opencode-go/deepseek-v4-flash
-    codex: gpt-5.6-luna
+    opencode: openai/gpt-5.6-luna
+
+# ---------------------------------------------------------------------------
+# Tier → the models to try INSTEAD, in order, while the tier model is limited.
+# Comma-separated, one line per harness, same flat two-space shape as `tiers:`.
+#
+# WHAT USES IT. `bash .tfcore/utils/tf-model-pick.sh pick <tier> <harness>` returns the first
+# model in "tier model, then this list" that is NOT on cooldown. tf-goal.sh puts a model on
+# cooldown when a cycle ends in a usage limit, re-binds, and starts the next cycle on the next
+# model; tf-routing-bind.sh reads the same answer, so the sub-agents move with the main agent
+# instead of failing behind it. A cooldown expires by itself at the reset time the limit message
+# stated, and the tier goes back to its own model.
+#
+# WHEN IT DOES NOT HELP, stated plainly: on Claude Code the 5-hour and weekly limits are the
+# ACCOUNT's, not the model's, so a fallback to another Claude model is limited too. The supervisor
+# finds that out the honest way — the next cycle hits the same limit, that model goes on cooldown
+# as well, and once the chain is exhausted it sleeps until the reset exactly as it did before.
+# A per-model limit (Opus exhausted while the account is fine) is where the Claude column earns
+# its keep; a provider outage or a monthly balance is where the OpenCode column does.
+#
+# Empty list = no fallback for that tier; the supervisor sleeps. That is the safe default for
+# anyone who does not want a phase silently running on a different model.
+#
+# WHERE THE "limited until <time>" RECORD IS KEPT. In this project, at
+# .tfcore/.session/model-cooldown.json — the framework is installed per project, so its state is
+# per project too, and one project's setting never reaches another. Uncomment the line below to
+# move it: a path relative to the project root, or an absolute one. Several projects pointed at
+# one file learn about a limit from each other instead of each finding it out for themselves.
+# cooldown_file: .tfcore/.session/model-cooldown.json
+# ---------------------------------------------------------------------------
+# The OpenCode lines below are OpenCode Go models (https://opencode.ai/docs/go — a $10/month plan
+# with a per-model monthly allowance, which is exactly the limit these chains exist for). Each tier
+# falls back to a DIFFERENT model, because the allowance that ran out is per model, and then to a
+# different provider, because a whole plan can run out at once.
+fallbacks:
+  frontier:
+    claude: opus, haiku
+    opencode: opencode-go/glm-5.3, opencode-go/kimi-k3, openai/gpt-5.6-sol
+  standard:
+    claude: haiku
+    opencode: opencode-go/mimo-v2.5, opencode-go/qwen3.8-max, openai/gpt-5.6-luna
+  economy:
+    claude: sonnet
+    opencode: opencode-go/deepseek-v4-flash, opencode-go/glm-5.3-flash, openai/gpt-5.6-luna
+
+# ---------------------------------------------------------------------------
+# How each harness is PAID FOR. This is what stops one `cost_usd` column pooling
+# three different kinds of number (SCHEMA.md §2.5b).
+#   subscription  a flat fee buys a quota. Marginal dollars are zero; the unit that means
+#                 anything is tokens. Claude Max, and any OpenCode provider signed in with OAuth.
+#   metered       an API key billed per token. The dollars are real money and are summed.
+#   local         a model on this machine. No quota, no bill.
+#   auto          work it out per model — OpenCode's own auth.json says oauth or api, and a
+#                 provider it has never heard of that answers locally is local.
+# `auto` is right for OpenCode because one machine mixes all three at once. Claude Code is
+# declared, because nothing in a transcript says which plan paid for it.
+# ---------------------------------------------------------------------------
+billing:
+  claude: subscription
+  opencode: auto
 
 # ---------------------------------------------------------------------------
 # Phase → tier. One line each; values: frontier | standard | economy | inherit.
@@ -52,13 +123,14 @@ tiers:
 phases:
   day1-greenfield: frontier
   day1-brownfield: frontier
-  author-brd: frontier
   amend-docs: frontier
   mockups: standard
   split-brd: standard
   build-phase: standard
   fix-issues: frontier
+  triage-and-fix: frontier
   triage-issues: standard
+  log-miss: economy
   verify-phase: standard
   devguide: standard
   productguide: economy
@@ -79,7 +151,7 @@ subagents:
   tf-explorer: economy
 
 # ---------------------------------------------------------------------------
-# Tier → reasoning effort (used by Claude Code and Codex; ignored by OpenCode).
+# Tier → reasoning effort (used by Claude Code; ignored by OpenCode).
 # ---------------------------------------------------------------------------
 effort:
   frontier: high

package/.tfcore/standards/coding-standards-core.md

@@ -0,0 +1,61 @@
+# TechieFlow — Coding Standards, core
+
+<!-- How this file is used and edited.
+     Applies to EVERY project, whatever the stack. It is loaded by the build and by the verifier's
+     standards check together with the stack file named in the project's Coding Standards document
+     (docs/<App>-Coding-Standards.md → "Standards applied"). Rules here are technology-neutral;
+     anything that names a language, framework or package belongs in a stack file
+     (.tfcore/standards/coding-standards-<stack>.md).
+     To change a rule: edit this file in the TechieFlow repository, then run update-framework.sh on
+     each project. Projects never edit their .tfcore/ copy. A rule an agent has ignored twice becomes
+     a script or a hook, or is deleted; it never gets a second paragraph. -->
+
+## 1. Names
+
+- One naming style per kind of thing, declared in the stack file, used everywhere. Never mix styles in one project.
+- Names say what a thing is or does. No abbreviations a newcomer would have to ask about.
+- Files are named after the one type they hold.
+
+## 2. Layout
+
+- Source under `src/`, tests under `tests/`. No other folders at the repository root unless the stack file allows one.
+- Log files go under the build output folder, never at the repository root.
+- The primary executable project carries the product name. A project named `<App>.App` is not allowed.
+
+## 3. Dependencies and configuration
+
+- No package is added without a row in the Architecture Decisions log saying why.
+- One configuration mechanism per project. A second one is a defect.
+- A missing feature in an internal library (TrBlazeUI, TechieRag, TechieFlow) is recorded in that library's feedback file and the feature is held. No workaround is written.
+
+## 4. Code shape
+
+- One type per file. Small methods. Early returns for validation. At most three levels of nesting.
+- Every public member has a documentation comment in the language's own form.
+- No commented-out code. Comments say why, not what.
+
+## 5. Tests
+
+- A test project exists from day one.
+- Test names are short; the scenario lives in the test's documentation comment.
+- Arrange, act, assert. One behaviour per test.
+
+## 6. Security
+
+- No credentials in code or in committed configuration. Secrets come from the mechanism in Stack Q2.
+- Database access uses parameters, never string-built queries.
+- Every input from outside the process is validated at the boundary. Security events are logged.
+
+## 7. Logging
+
+- Every executable head writes a rolling log file, wired at startup before anything else can fail, and logs unhandled exceptions at its boundary.
+- Libraries log through the logging abstraction only; they never reference a logging implementation.
+
+## 8. Testability
+
+- Every interactive or data-bound control the verifier must reach carries a stable test id, named by intent (`LoginSubmit`, `EntriesGrid`), never by position.
+
+## 9. Enforcement
+
+- The machine-checkable subset lives in the repository's editor configuration and analyzer settings, as the stack file specifies.
+- The verifier's standards check runs the greps listed in the stack file's Enforcement section and records findings in the checklist Remarks and PROJECT-STATUS.

package/.tfcore/standards/coding-standards-dotnet.md

@@ -0,0 +1,93 @@
+# TechieFlow — Coding Standards, .NET
+
+<!-- How this file is used and edited.
+     The .NET answer set's coding standards. Loaded with coding-standards-core.md when a project's
+     Coding Standards document names it. Owners in another stack write their own
+     coding-standards-<stack>.md with the same section names.
+     Seeded from the framework author's projects (the two sample files in the TechieFlow docs folder).
+     To change a rule: edit this file in the TechieFlow repository, then run update-framework.sh on
+     each project. Per-project choices this file leaves open are recorded in
+     docs/<App>-Coding-Standards.md → "Standards applied"; project-only rules go in "Project rules". -->
+
+## 1. Names
+
+**Never use underscores** in any identifier, database object or environment variable name.
+
+| Kind | Convention | Example |
+|---|---|---|
+| Classes, records, structs | PascalCase, descriptive | `SqlQueryBuilder`, not `SqlQB` |
+| Interfaces | `I` prefix | `IQueryExecutor` |
+| Methods | PascalCase verb phrase; async methods end in `Async` | `GetConnectionAsync()` |
+| Properties | PascalCase, no prefix | `ConnectionString` |
+| Instance fields | **per-project choice**: `obj` prefix (`objLogger`) or bare PascalCase (`Logger`). Default `obj`. Recorded in the project's Coding Standards | `private readonly ILogger<X> objLogger;` |
+| Static and const fields | PascalCase, no prefix | `MaxRetryCount`, not `MAX_RETRY_COUNT` |
+| Method parameters | `a` prefix + PascalCase | `LoginAsync(string aEmail)` |
+| Local variables | `v` prefix + PascalCase | `var vResponse = …` |
+| Booleans | same prefix, question form | `IsValid`, `vHasRows`, `aCanEdit` |
+| Test methods | short PascalCase; scenario in the XML `<summary>` | `LoginRejectsBadPassword` |
+| Environment variables | PascalCase, no separators; read through `IConfiguration` via a provider that maps them to `Section:Key` | `AppManagerBaseUrl` |
+
+Rejected: `_field` prefixes, snake_case, Hungarian type prefixes (`strName`), `Method_State_Result` test names, `UPPER_SNAKE` or `Section__Key` environment variables.
+
+Controller actions: the `a` prefix applies to `[FromRoute]`, `[FromQuery]` and `[FromBody]` parameters and flows into the OpenAPI schema. DTO **property** names stay PascalCase without prefix.
+
+## 2. Database
+
+- PascalCase, singular table names: `CustomerOrder`. PascalCase columns: `FirstName`.
+- Primary key `<Table>Id`; foreign key `<ReferencedTable>Id`.
+- Stored procedures and functions: verb prefix, PascalCase: `GetCustomerOrders`, `InsertOrder`.
+- Index `IX<Table><Column>` · primary key `Pk<Table>` · foreign key `Fk<Table><Ref>` · unique `Uc<Table><Column>`.
+- Data access is Dapper. Migrations live in a dedicated `<App>Db` project using DbUp, run at application startup or by the pipeline. Never a `database` folder of loose scripts at the root.
+
+## 3. Projects and files
+
+- `src/` and `tests/` at the root. The primary head is `src/<App>/<App>.csproj`; `<App>.App` is banned. Secondary heads take a descriptive suffix: `<App>.Api`, `<App>.Desktop`, `<App>.Cli`. Satellites: `<App>.Core`, `<App>UI` (Razor class library), `<App>.Tests`.
+- One class per file; file-scoped namespaces; nullable reference types enabled.
+- File order: usings, namespace, type; inside the type: fields, constructor, properties, methods.
+- Configuration: `appsettings.json` layered by `appsettings.{Environment}.json`; development secrets in `dotnet user-secrets`, with a `secrets.example.json` listing every key. No second mechanism.
+
+## 4. Code
+
+- Methods under about 20 lines; single responsibility; at most three levels of nesting; early returns.
+- `async`/`await` for all I/O; `ConfigureAwait(false)` in libraries; no `async void` outside event handlers.
+- LINQ method syntax for simple queries; avoid multiple enumeration.
+- `StringBuilder` in loops; dispose `IDisposable`; cache expensive work.
+- XML documentation on every public member: `<summary>`, `<param>`, `<returns>`, `<exception>`; `<remarks>` where the flow is not obvious.
+
+## 5. Tests
+
+- xUnit. A test project from day one.
+- Short PascalCase names, scenario in `<summary>`; arrange, act, assert; one assertion per test where practical.
+
+## 6. Logging
+
+- Serilog with a rolling file sink in every executable head (web, API, MAUI, desktop, console, background service), wired before anything else can fail: `Log.Logger = new LoggerConfiguration().MinimumLevel.Information().WriteTo.Console().WriteTo.File("<build output>/logs/<app>-.log", rollingInterval: RollingInterval.Day, retainedFileCountLimit: 14).CreateLogger();` then `builder.Services.AddSerilog()` or `builder.Host.UseSerilog()`; MAUI: `builder.Logging.AddSerilog()` in `MauiProgram`, path under `FileSystem.AppDataDirectory`.
+- `Log.Fatal` around startup, handlers for `AppDomain.CurrentDomain.UnhandledException` and `TaskScheduler.UnobservedTaskException`, `Log.CloseAndFlush()` on exit.
+- Class libraries reference only `Microsoft.Extensions.Logging.Abstractions` and log through `ILogger<T>` with structured templates.
+- Brownfield: an existing structured file-logging stack is compliant; new heads still use Serilog.
+
+## 7. Testability
+
+- Blazor: a stable `data-testid` (or element id) on every control the verifier must reach.
+- MAUI: a stable, unique `AutomationId` on every interactive or data-bound control, named by intent (`LoginSubmitButton`, `ClientsGrid`), set on the element whose data the gate asserts.
+
+## 8. Security
+
+- No credentials in code. Parameterised queries. Validate inputs. Log security events.
+
+## 9. Enforcement
+
+`.editorconfig` at the repository root (created at day-1) enforces: file-scoped namespaces (warning), `Async` suffix (warning), `var` for locals (warning), nullable enabled, no `_` prefix on private fields (custom naming rule, warning). `StyleCop.Analyzers` is optional and off by default.
+
+The verifier's standards check runs:
+
+```bash
+# underscore-prefixed fields
+grep -rE "private(\s+readonly)?\s+\w+\s+_[a-z]" src/ 2>/dev/null
+# underscores in test method names
+grep -rE "public\s+(async\s+)?Task\s+\w+_\w+\s*\(" tests/ 2>/dev/null
+# fields missing the obj prefix (obj-style projects only)
+grep -rPE "private(\s+readonly)?\s+\w+\s+(?!obj)[A-Z]\w+\s*[;=]" src/ 2>/dev/null | grep -v "static\|const"
+```
+
+Severity: error for file-scoped namespace and underscore field prefix; warning for nullable and the `Async` suffix; the rest informational.