@techierathore/techieflow 1.1.1 → 1.2.0

package/.claude/commands/TechieFlow/tasks/_smoke-test-policy.md

@@ -12,23 +12,25 @@ A screen passes only if all three hold, at a desktop width and a mobile width:
 
 A failure on any of the three is a defect: write it into the row's Remarks (prefix `⚠ visual:` for 2 and 3) and do not report the row done. A smoke earns a row at most `Implemented`; only an executed verify run writes `Verified`.
 
-The evidence of a smoke is the file `bash .tfcore/utils/tf-verify-screens.sh --screen <name>=<route> … --base <url>` writes (`tests/.artifacts/verify/screens.json`, with a screenshot per screen and width); a row is written `Implemented` only after that run, and its Remark names the file. The application is booted with `bash .tfcore/utils/tf-verify-boot.sh start`, which also drives an embedded-browser desktop head Windows head; a head the script cannot boot leaves the row below `Implemented` with the reason.
+The evidence of a smoke is the file `bash .tfcore/utils/tf-verify-screens.sh --screen <name>=<route> … --base <url>` writes (`tests/.artifacts/verify/screens.json`, with a screenshot per screen and width); a row is written `Implemented` only after that run, and its Remark names the file. The application is booted with `bash .tfcore/utils/tf-verify-boot.sh start`, which also drives a Windows head; a head the script cannot boot leaves the row below `Implemented` with the reason.
 
 ## Run it yourself
 
-The build ladder (`.tfcore/templates/v4custom/build-invocation-ladder.md`) says how to build, run and reach the running UI on every supported host, including native and mobile heads. Follow it. A dependent service that is down is something you start, from its own configuration, in dependency order. Ask the owner to run something only after the ladder's last rung has failed, and then still run the smoke yourself once they answer.
+The build ladder (`.tfcore/templates/v4custom/build-invocation-ladder.md`) says how to build, run and reach the running UI on every supported host, including native and mobile heads. Follow it. Start a dependent service that is down, from its own configuration, in dependency order. Ask the owner to run something only after the ladder's last rung has failed, and then still run the smoke yourself once they answer.
 
 ## Test users
 
-Resolve credentials in this order and stop at the first that works:
+Take credentials from the first that works:
 
 1. The Test users table in `docs/<App>-UsageGuide.md`.
-2. An existing account in the database, read with the connection string from the configuration.
+2. An existing account in the database, read with the configured connection string.
 3. Ask the owner, showing what you would create.
-4. Only after a yes, create it and add it to the Test users table.
+4. Only after a yes, create it and add it to the table.
 
 Never invent a throwaway account.
 
+An AppManager app skips steps 2 to 4 (stack answer Q4a): register through its register call, passwords in git-ignored secrets, never the owner's account.
+
 ## Say what ran
 
 Name the exact command and where it ran: which host, which rung, focused tests or the full build, your own smoke or an executed verify. A green intermediate step is not a pass of the whole.

package/.tfcore/hooks/block-git.sh

@@ -21,7 +21,9 @@
 #     the only place that decides. Outside YOLO it returns permissionDecision=ask
 #     for them (same prompt the owner always had). In YOLO it stays silent and the
 #     bare "Bash" allow rule lets them run — an unattended goal run never stalls on
-#     a delete. Catastrophic `rm -rf /|~` stay in settings.json `deny` (every mode).
+#     a delete. A delete of the whole disk or home folder (rm -rf / , /* , ~ , ~/*)
+#     is refused here in every mode; settings.json deny keeps only the exact
+#     `rm -rf /` and `rm -rf ~` (a deny `*` matched every absolute path).
 #
 # YOLO is ON when any of: env TF_YOLO=1 · .tfcore/.session/yolo.json exists
 # (tf-yolo.sh on) · the hook payload's permission_mode is bypassPermissions/auto.
@@ -198,6 +200,20 @@ def classify_gh(args):
 found = {"read": 0, "write": 0}
 found_rm = [False]
 found_sudo = [False]
+found_wipe = [False]
+
+# A delete whose target is the whole disk or the home folder is refused in every mode. These
+# lived in settings.json deny as "rm -rf /*" and "rm -rf ~/*", but a deny rule's * matches any
+# text, so they also refused every delete of an absolute path (rm -rf /mnt/c/...), even in
+# bypass mode (Lekhak scratch folder, 2026-10-18).
+HOME_DIR = os.path.expanduser("~").rstrip("/")
+WIPE = {"/", "/*", "/.", "/..", "~", "~/", "~/*", "~/.", "$HOME", "$HOME/", "$HOME/*",
+        "${HOME}", "${HOME}/", "${HOME}/*"}
+def is_wipe(t):
+    t = t.strip()
+    if t in WIPE or re.fullmatch(r"/+\*?", t):
+        return True
+    return bool(HOME_DIR) and t.rstrip("/*") == HOME_DIR
 
 def scan(cmdline, depth=0):
     if depth > 4:
@@ -263,6 +279,8 @@ def scan(cmdline, depth=0):
             found[classify_gh(args)] += 1
         elif head in ("rm", "rmdir", "unlink", "shred"):
             found_rm[0] = True
+            if any(is_wipe(a) for a in args if not a.startswith("-") or a == "-"):
+                found_wipe[0] = True
         elif head in ("find",) and ("-delete" in args or "-exec" in args and any(basename(x) == "rm" for x in args)):
             found_rm[0] = True
 
@@ -276,7 +294,9 @@ except Exception:
         print("ALLOW")
     sys.exit(0)
 
-if found["write"]:
+if found_wipe[0]:
+    print("BLOCK_WIPE")
+elif found["write"]:
     print("BLOCK_WRITE")
 elif found["read"] and (strict_git or not yolo):
     print("BLOCK_READ")
@@ -290,6 +310,9 @@ VERDICT="$(TF_HOOK_INPUT="$INPUT" TF_YOLO_ON="$YOLO" python3 -c "$GIT_GUARD_PY"
 case "$VERDICT" in
   BLOCK_WRITE) block_git_msg; exit 2 ;;
   BLOCK_READ)  block_read_msg; exit 2 ;;
+  BLOCK_WIPE)
+    echo "BLOCKED by TechieFlow policy: this deletes the whole disk or the home folder. Never run it, in any mode. Delete the folder you mean by its own path." >&2
+    exit 2 ;;
   ASK_RM)
     # Claude Code: surface the owner's usual delete/sudo prompt (hook "ask"
     # beats the bare "Bash" allow). OpenCode: its own `rm *: ask` map prompts.

package/.tfcore/hooks/guard-status-html.sh

@@ -149,7 +149,11 @@ if written_this_session:
             app = os.path.basename(cl)[: -len("-Checklist.md")]
             brd = os.path.join(root, "docs", f"{app}-BRD.md")
             if os.path.isfile(brd) and os.path.getmtime(cl) > os.path.getmtime(brd):
-                problems.append(f"docs/{app}-BRD.md is older than docs/{app}-Checklist.md. Run: bash .tfcore/utils/tf-brd-status.sh {app}")
+                # the stem of a phase file is "<App>-P<n>": the command takes the app and --phase n
+                # (Lekhak TF-034, TechieRag TF-007)
+                m = re.match(r"^(.+)-P(\d+)$", app)
+                cmd = f"{m.group(1)} --phase {m.group(2)}" if m else app
+                problems.append(f"docs/{app}-BRD.md is older than docs/{app}-Checklist.md. Run: bash .tfcore/utils/tf-brd-status.sh {cmd}")
     except Exception:
         pass
 

package/.tfcore/tasks/_smoke-test-policy.md

@@ -12,23 +12,25 @@ A screen passes only if all three hold, at a desktop width and a mobile width:
 
 A failure on any of the three is a defect: write it into the row's Remarks (prefix `⚠ visual:` for 2 and 3) and do not report the row done. A smoke earns a row at most `Implemented`; only an executed verify run writes `Verified`.
 
-The evidence of a smoke is the file `bash .tfcore/utils/tf-verify-screens.sh --screen <name>=<route> … --base <url>` writes (`tests/.artifacts/verify/screens.json`, with a screenshot per screen and width); a row is written `Implemented` only after that run, and its Remark names the file. The application is booted with `bash .tfcore/utils/tf-verify-boot.sh start`, which also drives an embedded-browser desktop head Windows head; a head the script cannot boot leaves the row below `Implemented` with the reason.
+The evidence of a smoke is the file `bash .tfcore/utils/tf-verify-screens.sh --screen <name>=<route> … --base <url>` writes (`tests/.artifacts/verify/screens.json`, with a screenshot per screen and width); a row is written `Implemented` only after that run, and its Remark names the file. The application is booted with `bash .tfcore/utils/tf-verify-boot.sh start`, which also drives a Windows head; a head the script cannot boot leaves the row below `Implemented` with the reason.
 
 ## Run it yourself
 
-The build ladder (`.tfcore/templates/v4custom/build-invocation-ladder.md`) says how to build, run and reach the running UI on every supported host, including native and mobile heads. Follow it. A dependent service that is down is something you start, from its own configuration, in dependency order. Ask the owner to run something only after the ladder's last rung has failed, and then still run the smoke yourself once they answer.
+The build ladder (`.tfcore/templates/v4custom/build-invocation-ladder.md`) says how to build, run and reach the running UI on every supported host, including native and mobile heads. Follow it. Start a dependent service that is down, from its own configuration, in dependency order. Ask the owner to run something only after the ladder's last rung has failed, and then still run the smoke yourself once they answer.
 
 ## Test users
 
-Resolve credentials in this order and stop at the first that works:
+Take credentials from the first that works:
 
 1. The Test users table in `docs/<App>-UsageGuide.md`.
-2. An existing account in the database, read with the connection string from the configuration.
+2. An existing account in the database, read with the configured connection string.
 3. Ask the owner, showing what you would create.
-4. Only after a yes, create it and add it to the Test users table.
+4. Only after a yes, create it and add it to the table.
 
 Never invent a throwaway account.
 
+An AppManager app skips steps 2 to 4 (stack answer Q4a): register through its register call, passwords in git-ignored secrets, never the owner's account.
+
 ## Say what ran
 
 Name the exact command and where it ran: which host, which rung, focused tests or the full build, your own smoke or an executed verify. A green intermediate step is not a pass of the whole.

package/.tfcore/templates/stack-defaults/dotnet.md

@@ -17,6 +17,7 @@
 | Q2 | Secrets in development | Project user secrets (`dotnet user-secrets`), visible to the developer, never committed. `appsettings.Development.json` is committed and therefore never holds a real secret. A `secrets.example.json` in the project lists every key the application reads. | No |
 | Q3 | Database | PostgreSQL, running in Docker, for development and production. Docker is always running on the development machine because WSL, where the harness runs, depends on it. If PostgreSQL is unreachable the container is stopped: the agent starts it and continues. Only if no PostgreSQL container exists at all does the agent stop and ask the owner for connection details. It never substitutes another engine and never creates its own database container. | No, unless no container exists |
 | Q4 | Authentication | Two choices only: **AppManager**, the author's shared platform for identity, roles, licences and subscriptions, which counts as part of the application and not as an external integration; or a different mechanism named by the owner. | **Yes**: "AppManager, or something else?" |
+| Q4a | Test users of an AppManager app | An app that signs in through AppManager registers its own test users on AppManager, through AppManager's register call (`POST /AuthSvc/register`, or `device-register` for a device-bound app), under the app's own application id: one for the owner's walkthrough (`{app}-owner@…`), a second user (`{app}-second@…`), and one for unattended runs (`{app}-yolo-tester@…`). A script in the project does it (for example `tests/verify/register-test-users.mjs`): it generates each password and writes it only to the project's git-ignored secrets (user secrets, or a git-ignored `.env.local`). The UsageGuide's Test users table lists the three, names where each password is kept, and never holds a password. An agent never asks for, stores or uses the owner's personal AppManager account. `tf-doc-check.sh` holds the UsageGuide to this. | No |
 | Q5 | Logging | Serilog, always, with file logging wired at startup before anything else can fail. | No |
 | Q6 | Tests | xUnit, always. A test project exists from day-1. | No |
 | Q7 | Layout and naming | `src/` and `tests/` at the root. The primary executable project is named exactly `<App>`; `<App>.App` is banned. Secondary heads take a descriptive suffix (`<App>.Api`, `<App>.Desktop`). | No |
@@ -32,6 +33,7 @@ Required packages: `TrBlazeUI.Components` — for a project with a Blazor or MAU
 ## Notes
 
 - Q4 is asked on purpose even with this answer set, because the choice differs per product.
+- Q4a follows from an AppManager answer to Q4 and is never asked (owner, 2026-10-18).
 - Q3's "start the container, never create one" replaces the behaviour that produced TfLens's own database container: an agent that cannot reach the expected database restarts it or asks, and never builds an alternative.
 - Q11.5 replaces the `database` folder of loose migration scripts that TfLens accumulated.
 - Q11.3 is a standing framework convention restated as a stack rule so that it is recorded per project and its violations can be counted.

package/.tfcore/templates/v4custom/app-usageguide-tmpl.md

@@ -13,13 +13,16 @@ entries: How to test, screen by screen |
 per-entry: 90 120
 budget: S 2500 3500 | M 4000 6000 | L 4000 6000
 rule: test-users-table
+rule: appmanager-test-users
 rule: execution-code
 rule: entry-steps
 rule: entry-expected
 -->
 <!-- Authoring notes (agent only; never visible text).
      The owner's test plan. Every agent (smoke, verify) and the owner's UAT use the SAME test users and
-     the SAME walkthrough; nobody invents accounts. One `###` per screen in navigation order, at most
+     the SAME walkthrough; nobody invents accounts. An app that signs in through AppManager lists its own three users
+     (owner walkthrough, second user, unattended runs), registered through AppManager's register call, each password named by
+     where the git-ignored secrets keep it, never written here; never the owner's personal AppManager account. One `###` per screen in navigation order, at most
      120 words: who to sign in as, numbered steps, the expected result, the REQ ids covered.
      The Execution guide is copy-pasteable commands, one per line, no narrative. Hosting and production
      deployment are not here; they are in the Deployment Checklist after UAT.

package/.tfcore/utils/tf-brd-status.py

@@ -5,7 +5,8 @@
 
 On a Large project the pair is the phase being worked: --phase N, else appPhase in
 .tfcore/core-config.yaml (phase 1 is docs/<App>-BRD.md and -Checklist.md, phase n is
-docs/<App>-Pn-BRD.md and docs/<App>-Pn-Checklist.md).
+docs/<App>-Pn-BRD.md and docs/<App>-Pn-Checklist.md). A name that carries the phase, as the file
+stem does (<App>-P3), is read as <App> --phase 3.
 
 Reads docs/<App>-Checklist.md: every REQ row of the Requirements Status table, and
 the "## Page: …" section its detail entry sits under, which names the screen.
@@ -127,10 +128,18 @@ def main(argv):
     render = "--no-render" not in argv
     root = os.getcwd()
     phase = None
+    # A name that already carries the phase, as the file stem reads ("Lekhak-P3"), is the app and that
+    # phase: adding appPhase again looked for docs/Lekhak-P3-P3-Checklist.md (Lekhak TF-034,
+    # TechieRag TF-007).
+    m = re.match(r"^(.+)-P(\d+)$", app)
+    if m:
+        app, phase = m.group(1), int(m.group(2))
     if "--phase" in argv:
         i = argv.index("--phase")
         if i + 1 >= len(argv) or not argv[i + 1].isdigit() or int(argv[i + 1]) < 1:
             die("--phase needs a number from 1 upwards")
+        if phase is not None and phase != int(argv[i + 1]):
+            die(f"{argv[1]} names phase {phase} but --phase says {argv[i + 1]}")
         phase = int(argv[i + 1])
     if phase is None:
         cfg = os.path.join(root, ".tfcore", "core-config.yaml")

package/.tfcore/utils/tf-checklist-edit.py

@@ -86,6 +86,13 @@ def siblings(path):
     return [os.path.join(d, n) for n in sorted(names) if n != f and re.match(rf"^{app}(?:-P\d+)?-Checklist\.md$", n)]
 
 
+def streams(path):
+    """the telemetry streams beside the checklists: an id a miss or gate record carries is taken even
+    after its row was renamed, since a record cannot be amended (TechieRag TF-005)"""
+    d = os.path.join(os.path.dirname(path) or ".", "metrics")
+    return [os.path.join(d, n) for n in ("gates.jsonl", "misses.jsonl", "runs.jsonl") if os.path.isfile(os.path.join(d, n))]
+
+
 def next_id(text, prefix, others=()):
     """one past the highest id of that prefix in this checklist AND every other checklist of the app:
     counting this one alone gave REQ-UI-055 twice, once in phase 1 and once in phase 3 (Chatur TF-011)"""
@@ -99,7 +106,7 @@ def add_row(path, prefix, title, acceptance, section=None, remark=None, status="
     """append a row to the Requirements Status table and a detail entry under `section`
     (a new section at the end when it does not exist); returns the new id"""
     text = read(path)
-    rid = next_id(text, prefix, siblings(path))
+    rid = next_id(text, prefix, siblings(path) + streams(path))
     nl = "\r\n" if "\r\n" in text else "\n"
     lines = text.split(nl)
     # the table: after the last REQ row

package/.tfcore/utils/tf-doc-check.py

@@ -30,6 +30,7 @@ Schema grammar (one `key: value` per line inside the comment):
 from __future__ import annotations
 
 import argparse
+import glob
 import json
 import os
 import re
@@ -412,6 +413,17 @@ def resolve_kind(header, brd_header, cfg) -> str:
     return "library" if raw.startswith("lib") else "app"
 
 
+def signs_in_through_appmanager(root, app):
+    """the Architecture's authentication row (Q4, Auth…, Identity) names AppManager"""
+    for f in glob.glob(os.path.join(root or ".", "docs", f"{app}-Architecture.md")):
+        for _h, rows in tables_in(open(f, encoding="utf-8", errors="replace").read()):
+            for r in rows:
+                head = " ".join(r[:2]).lower()
+                if re.search(r"\bq4\b|auth|identity|sign-in", head) and re.search(r"(?i)app ?manager", " ".join(r[1:3])):
+                    return True
+    return False
+
+
 def section_text(present, name):
     key = norm_heading(name)
     return next((txt for k, _h, txt in present if key_matches(key, k)), None)
@@ -799,6 +811,35 @@ def check_doc_rule(rule, c, rep):
         if txt is not None and not has_table_with(txt, "user", "role"):
             rep.fail(rel, 'the "Test users" section needs a table with User and Role columns')
 
+    elif rule == "appmanager-test-users":
+        # An app that signs in through AppManager has its own three test users there, registered through
+        # AppManager's register call, each password kept in the git-ignored secrets and never written in
+        # the guide; never the owner's personal account (stack answer Q4a, owner 2026-10-18).
+        txt = section_text(present, "Test users")
+        app = c.get("app")
+        if txt is None or c["kind"] != "app" or not app or app.lower() == "appmanager" or not signs_in_through_appmanager(c["root"], app):
+            return
+        users = []
+        for hdr, rows in tables_in(txt):
+            low = [h.lower() for h in hdr]
+            if not any("user" in h for h in low):
+                continue
+            pw = next((i for i, h in enumerate(low) if "password" in h), None)
+            users += [(r, r[pw] if pw is not None and pw < len(r) else "") for r in rows if "@" in " ".join(r)]
+        whole = lambda r: " ".join(r).lower()
+        want = (("owner", r"owner|account holder"), ("second user", r"second"), ("unattended-run user", r"unattended|yolo"))
+        missing = [n for n, pat in want if not any(re.search(pat, whole(r)) for r, _p in users)]
+        if missing:
+            rep.fail(rel, f'{app} signs in through AppManager: the Test users table lists no {", no ".join(missing)} '
+                          f'(stack answer Q4a: owner walkthrough, second user, unattended runs, registered through AppManager\'s register call)')
+        for r, cell in users:
+            if not re.search(r"(?i)secret|\.env|credential|keychain", cell):
+                who = re.search(r"[\w.+-]+@[\w-]+(?:\.[\w-]+)*", " ".join(r)).group(0)
+                rep.fail(rel, f'test user {who}: the Password cell names no git-ignored secret; keep the password in the project\'s '
+                              f'secrets and name the key here, never the password (stack answer Q4a)')
+        if users and not re.search(r"(?i)regist", txt):
+            rep.fail(rel, "the Test users section does not say the users were registered through AppManager's register call (stack answer Q4a)")
+
     elif rule == "next-command-blocks":
         seg = re.search(r"(?ms)^## Next command to run\s*\n(.*?)(?=^## |\Z)", nocomment)
         if not seg:

package/.tfcore/utils/tf-mockup-parity.mjs

@@ -275,7 +275,12 @@ const PROBE = (wanted = []) => {
   // reads every other border property but not this one keeps missing that whole
   // vocabulary. Quantised to the three values that carry meaning rather than the
   // full CSS keyword set, so the clause stays as noise-free as the colour buckets.
+  // A checkbox, switch or radio is not compared by its border (Lekhak TF-035): a native
+  // <input type="checkbox"> computes border-style none because the browser draws its box, while a
+  // library's role="checkbox" draws the same box as a CSS border. Same control, so not applicable.
+  const TOGGLE = 'input[type="checkbox"],input[type="radio"],[role="checkbox"],[role="switch"],[role="radio"]';
   const strokeOf = (el) => {
+    if (el.matches(TOGGLE)) return null;
     const cs = getComputedStyle(el);
     const q = (s) => (s === 'none' || s === 'hidden' ? 'none'
       : s === 'dashed' || s === 'dotted' ? 'dashed' : 'solid');
@@ -465,7 +470,7 @@ const PROBE = (wanted = []) => {
       // the badge and the visible border one element away, for the clauses to accept (TF-047)
       near: {
         badge: near.some((n) => chromeOn(n)?.badge === true),
-        stroke: near.map(strokeOf).find((s) => s.visible) || null,
+        stroke: near.map(strokeOf).find((s) => s && s.visible) || null,
       },
       tag: el.tagName.toLowerCase(),
       text: ownText(el).trim().replace(/\s+/g, ' ').slice(0, 60),

package/.tfcore/utils/tf-owner-text.py

@@ -59,13 +59,31 @@ def load_words(root):
 
 
 def upstream_state(root):
-    """Every entry id in the project's feedback files -> (state, where), from the one reader
-    every script uses (tf_feedback.py), so this check and PROJECT-STATUS can never disagree."""
+    """Every entry id in the project's feedback files -> [(state, where, names)], one per file, from
+    the one reader every script uses (tf_feedback.py), so this check and PROJECT-STATUS can never disagree."""
     sys.path.insert(0, HERE)
     import tf_feedback
     return tf_feedback.state_map(root)
 
 
+def resolve(rid, cands, unit, text):
+    """The feedback file an id in this unit means (TrBlazeUI TF-006). One file holding it: that one.
+    Several: the files whose project the unit names ("Lekhak TR-002"), else the files the whole text
+    names. -> (state, where), or (None, the files) when it stays several that disagree."""
+    if len(cands) == 1:
+        return cands[0][:2]
+    for txt in (unit, text):
+        # a name every candidate file shares (the library's own) says nothing about which one
+        shared = set.intersection(*(set(c[2]) for c in cands))
+        hit = [c for c in cands if any(n not in shared and re.search(rf"(?<![\w-]){re.escape(n)}(?![\w-])", txt) for n in c[2])]
+        if hit:
+            cands = hit
+            break
+    if len({c[0] for c in cands}) == 1:
+        return cands[0][:2]
+    return None, ", ".join(c[1].split(",")[0] for c in cands)
+
+
 def split_text(text):
     """-> (prose lines [(n, line)], the text inside code blocks)."""
     prose, fenced, fence = [], [], None
@@ -142,9 +160,13 @@ def check(text, label, root, final=False, words=None, ups=None):
     for n, txt, header in us:
         for rid in dict.fromkeys(ANY_ID.findall(txt)):
             if rid in ups:
-                mentions.setdefault(rid, []).append((n, txt, header))
-    for rid, ms in sorted(mentions.items(), key=lambda kv: kv[1][0][0]):
-        st, where = ups[rid]
+                st, where = resolve(rid, ups[rid], txt, text)
+                if st is None:
+                    fail(n, f'{rid} is an entry in several feedback files ({where}); name whose it is with the id, '
+                            f'as in "{ups[rid][0][2][0]} {rid}"')
+                    continue
+                mentions.setdefault((rid, st, where), []).append((n, txt, header))
+    for (rid, st, where), ms in sorted(mentions.items(), key=lambda kv: kv[1][0][0]):
         if st in ("fixed", "closed"):
             # read the sentence that names it, or its table row: "TF-901 is filed. X is fixed." is wrong
             said = lambda txt, h: [txt] if h is not None else [s for s in re.split(r"(?<=[.!?])\s+", txt) if rid in s]

package/.tfcore/utils/tf-triage.py

@@ -13,8 +13,10 @@ row in whichever docs/<App>-Checklist.md or docs/<App>-P<N>-Checklist.md holds i
 
 demote  the row goes to Needs re-verify (% capped at 75) with a dated Remark holding the symptom in the
         reporter's words, the evidence path and the kind.
-new     a defect no row covers: the next free id in the prefix, a Not Started row, a detail entry with the
-        acceptance line and the marker BRD-pending (*amend-docs gives it its BRD item).
+new     a defect no row covers: the next free id in the prefix, across every checklist of the app and the
+        telemetry streams, a Not Started row, a detail entry with the acceptance line and the marker
+        BRD-pending (*amend-docs gives it its BRD item). Without --prefix: FN, or the one prefix a
+        checklist with no FN row uses; with several such prefixes it asks for --prefix.
 note    a dated remark on the nearest row, no status change (could not reproduce).
 close   what triage owes the telemetry, from the actions above (tests/.artifacts/verify/triage.json):
         one gate record per demoted or new row with gate "escaped" (no check caught it), one miss per row
@@ -31,6 +33,7 @@ import datetime
 import importlib.util
 import json
 import os
+import re
 import subprocess
 import sys
 
@@ -176,7 +179,19 @@ def main(argv):
             die("new needs \"<title>\" \"<acceptance>\"")
         title, acc = argv[3], argv[4]
         cl = checklist(app, argv, ce)
-        prefix = opt(argv, "--prefix", "FN").upper(); section = opt(argv, "--section"); ev = opt(argv, "--evidence")
+        prefix = opt(argv, "--prefix")
+        if prefix is None:
+            # FN unless this checklist has no FN row: then the one prefix it uses is the default, and
+            # several are asked for (TechieRag TF-005: phase 3 is all RAG, and FN was a slip)
+            used = sorted(set(re.findall(r"(?m)^\|\s*REQ-([A-Z]+)-\d{3,}", ce.read(cl))))
+            if not used or "FN" in used:
+                prefix = "FN"
+            elif len(used) == 1:
+                prefix = used[0]
+                print(f"note: every row of {cl} is REQ-{prefix}-…, so the new row is one too; pass --prefix to choose another")
+            else:
+                die(f"{cl} has no REQ-FN rows; name the prefix: --prefix {'|'.join(used)}")
+        prefix = prefix.upper(); section = opt(argv, "--section"); ev = opt(argv, "--evidence")
         src = opt(argv, "--source", "owner"); mockup = opt(argv, "--mockup")
         if prefix == "UI" and not mockup and cfg_project_type() not in ("library", "docs"):   # TrBlazeUI TF-003
             print("note: a UI row needs a mockup link; pass --mockup docs/mockups/<screen>.html or the checker will flag it")

package/.tfcore/utils/tf-verify-boot.sh

@@ -13,7 +13,8 @@
 #            side that built it, reading its settings from the project folder as `dotnet run` does.
 #            Builders side by side never serve each other's half-written build (TF-043). A standalone
 #            WebAssembly project is still started with `dotnet run`. Prints BOOTED mode=base url=….
-#   windows  a MAUI Blazor Hybrid head (UseMaui + a net*-windows target): started Windows-side with
+#   windows  a MAUI Blazor Hybrid head (UseMaui + a net*-windows target + a BlazorWebView; a plain MAUI
+#            app is refused at once, NONE kind=no-webview, TechieRag TF-006): started Windows-side with
 #            WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS=--remote-debugging-port=9222, the DevTools port
 #            relayed to every interface by tf-cdp-relay.ps1, and reached from WSL over CDP. Prints
 #            BOOTED mode=cdp url=http://<host>:9223. Proven on MyDiary, 2026-09-06.
@@ -85,6 +86,13 @@ find_projects() { # prints csproj paths under src/, source/, the root and one le
 }
 is_web()  { grep -qE 'Microsoft\.NET\.Sdk\.Web|Microsoft\.NET\.Sdk\.BlazorWebAssembly' "$1"; }
 is_maui_win() { grep -qiE '<UseMaui>[[:space:]]*true|Microsoft\.NET\.Sdk\.Maui' "$1" && grep -qE 'net[0-9.]+-windows' "$1"; }
+# A Windows head is driven over its web view's DevTools port, so only a Blazor Hybrid app has one. A
+# plain MAUI app (TechieRag's samples/TechieRag.Probe) was picked as the windows head and waited the
+# full 300 s for a port it can never open (TechieRag TF-006).
+is_hybrid() {
+  grep -qE 'Microsoft\.AspNetCore\.Components\.WebView\.Maui' "$1" && return 0
+  grep -rqlE 'AddMauiBlazorWebView|BlazorWebView' --include='*.cs' --include='*.xaml' --exclude-dir=bin --exclude-dir=obj "$(dirname "$1")" 2>/dev/null
+}
 is_maui_mac() { grep -qiE '<UseMaui>[[:space:]]*true|Microsoft\.NET\.Sdk\.Maui' "$1" && grep -qE 'net[0-9.]+-maccatalyst' "$1"; }
 
 poll_http() { # url seconds pid-to-watch(optional) -> 0 when it answers
@@ -285,7 +293,11 @@ fi
 # ---- pick the project and the head ------------------------------------------------------
 tf_read_lines ALL < <(find_projects)
 WEB=(); WIN=(); MAC=()
-for p in ${ALL[@]+"${ALL[@]}"}; do is_web "$p" && WEB+=("$p"); is_maui_win "$p" && WIN+=("$p"); is_maui_mac "$p" && MAC+=("$p"); done
+WIN_NATIVE=()
+for p in ${ALL[@]+"${ALL[@]}"}; do
+  is_web "$p" && WEB+=("$p"); is_maui_mac "$p" && MAC+=("$p")
+  if is_maui_win "$p"; then if is_hybrid "$p"; then WIN+=("$p"); else WIN_NATIVE+=("$p"); fi; fi
+done
 # a Mac Catalyst head is picked unasked only on a Mac, the one host that runs it
 [[ "$PLATFORM" == "macos" ]] || MAC=()
 # Several web projects: the one that serves screens. The first in sorted order booted AppManager's
@@ -325,9 +337,14 @@ if [[ -n "$PROJECT" ]]; then
 elif [[ -z "$HEAD" ]]; then
   if [[ ${#WEB[@]} -gt 0 ]]; then HEAD=web; pick_web
   elif [[ ${#MAC[@]} -gt 0 ]]; then HEAD=maccatalyst; PROJECT="${MAC[0]}"
-  elif [[ ${#WIN[@]} -gt 0 ]]; then HEAD=windows; PROJECT="${WIN[0]}"; fi
+  elif [[ ${#WIN[@]} -gt 0 ]]; then HEAD=windows; PROJECT="${WIN[0]}"
+  elif [[ ${#WIN_NATIVE[@]} -gt 0 ]]; then HEAD=windows; PROJECT="${WIN_NATIVE[0]}"; fi
 else
-  case "$HEAD" in web) pick_web ;; windows) PROJECT="${WIN[0]:-}" ;; maccatalyst) PROJECT="${MAC[0]:-}" ;; esac
+  case "$HEAD" in web) pick_web ;; windows) PROJECT="${WIN[0]:-${WIN_NATIVE[0]:-}}" ;; maccatalyst) PROJECT="${MAC[0]:-}" ;; esac
+fi
+if [[ "$HEAD" == windows && -n "$PROJECT" ]] && ! is_hybrid "$PROJECT"; then
+  [[ $DRYRUN -eq 1 ]] || write_state windows none "" "" "" "$PROJECT" "a MAUI app with no BlazorWebView: no web view, not drivable over CDP" no-webview "$PLATFORM"
+  echo "NONE head=windows kind=no-webview reason=$PROJECT is a MAUI app with no BlazorWebView (no AddMauiBlazorWebView, no <BlazorWebView>): it has no web view, so it is not drivable over CDP; its rows are graded by their tests"; exit 2
 fi
 if [[ $DRYRUN -eq 1 ]]; then echo "PICK head=${HEAD:-none} project=${PROJECT:-none}"; exit 0; fi
 case "$HEAD" in
@@ -714,6 +731,9 @@ MINE="$(comm -13 <(printf '%s\n' "$BEFORE_IDS") <(win_ids) | tr '\n' ' ')"
 if [[ -z "$URL" ]]; then
   pkill -P "$APP_PID" 2>/dev/null; kill "$APP_PID" "$RELAY_PID" 2>/dev/null
   for w in $MINE; do taskkill.exe /F /T /PID "$w" >/dev/null 2>&1; done
+  # the relay runs Windows-side and outlives its WSL parent: a second try then failed "Only one usage
+  # of each socket address" (TechieRag TF-006)
+  powershell.exe -NoProfile -Command "Get-NetTCPConnection -LocalPort $RELAY_PORT -State Listen -ErrorAction SilentlyContinue | ForEach-Object { Stop-Process -Id \$_.OwningProcess -Force -ErrorAction SilentlyContinue }" >/dev/null 2>&1
   write_state windows none "" "" "cmd.exe /c dotnet run -f $TFM" "$PROJECT" "the DevTools port $RELAY_PORT never answered within 300 s" host "$PLATFORM"
   echo "NONE head=windows kind=host reason=the app's DevTools port never answered on ${HOSTS[*]}:$RELAY_PORT within 300 s (log $LOG, relay $DIR/relay.log)"; exit 2
 fi

package/.tfcore/utils/tf-verify-screens.mjs

@@ -366,8 +366,14 @@ async function inspect(page, anchors, attr, errorSelectors) {
         return !/^(transparent|rgba\(0, 0, 0, 0\))$/.test(cs.backgroundColor) || cs.backgroundImage !== 'none'
           || ['Top', 'Right', 'Bottom', 'Left'].some((s) => parseFloat(cs[`border${s}Width`]) > 0 && cs[`border${s}Style`] !== 'none');
       };
+      // A checkbox, switch or radio drawn by a library (TrBlazeUI: <button role="checkbox"
+      // aria-checked="false">, no text, no child while unticked) paints its own box, the way a native
+      // <input type="checkbox"> does (Lekhak TF-035). Counted filled when it paints; an unpainted one
+      // with no size is still empty.
+      const toggle = '[role="checkbox"],[role="switch"],[role="radio"],[aria-checked]';
       const filled = text.length > 0 || ['input', 'select', 'textarea', 'img', 'svg', 'canvas', 'video', 'iframe', 'progress', 'meter'].includes(tag)
         || el.matches(bar) || el.querySelector(`img,svg,canvas,input,select,textarea,button,a,${bar}`) !== null
+        || (el.matches(toggle) && paints(el)) || [...el.querySelectorAll(toggle)].some(paints)
         || [...el.children].some(paints);
       const c = clipRect(el);
       out.anchors.push({ id, present: true, visible: vis(el), filled, tag, w: Math.round(r.width), h: Math.round(r.height), x: Math.round(r.left), y: Math.round(r.top),

package/.tfcore/utils/tf_feedback.py

@@ -195,12 +195,17 @@ def upstream_of(path, app=None):
 
 
 def state_map(root):
-    """Every entry id across the project's feedback files -> (state, "<file>, <date>")."""
+    """Every entry id across the project's feedback files -> [(state, "<file>, <date>", names)], one
+    item per file holding it. Every consumer numbers its own entries from 1, so a library with nine
+    consumer files can hold nine TR-002s (TrBlazeUI TF-006); `names` are the two project names in the
+    file's name (Lekhak and TrBlazeUI in Lekhak-TrBlazeUI-Feedback.md), which a line names to say whose."""
     out = {}
     for f in files(root):
         rel = os.path.relpath(f, root).replace(os.sep, "/")
+        names = tuple(os.path.basename(f)[: -len("-Feedback.md")].split("-"))
         for e in entries(f):
-            out[e["id"]] = (e["state"], f"{rel}" + (f", Resolution status {e['since']}" if e["since"] else ""))
+            out.setdefault(e["id"], []).append(
+                (e["state"], f"{rel}" + (f", Resolution status {e['since']}" if e["since"] else ""), names))
     return out
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techierathore/techieflow",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "TechieFlow: a spec-driven development framework for AI coding agents, for Claude Code and OpenCode. One command installs it into any project.",
   "license": "Apache-2.0",
   "repository": {

package/scripts/install.mjs

@@ -313,7 +313,7 @@ const canonicalSettings = String.raw`{
     ],
     "ask": [],
     "deny": [
-      "Bash(rm -rf /)", "Bash(rm -rf /*)", "Bash(rm -rf ~)", "Bash(rm -rf ~/*)",
+      "Bash(rm -rf /)", "Bash(rm -rf ~)",
       "Bash(git commit*)", "Bash(git push*)", "Bash(git add*)", "Bash(git rm*)",
       "Bash(git mv*)", "Bash(git reset*)", "Bash(git checkout*)", "Bash(git switch*)",
       "Bash(git restore*)", "Bash(git merge*)", "Bash(git rebase*)", "Bash(git cherry-pick*)",