@windyroad/itil 0.47.1 → 0.47.3

package/.claude-plugin/plugin.json

@@ -497,5 +497,5 @@
     }
   },
   "name": "wr-itil",
-  "version": "0.47.1"
+  "version": "0.47.3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/itil",
-  "version": "0.47.1",
+  "version": "0.47.3",
   "description": "ITIL-aligned IT service management for Claude Code (problem, and future incident/change skills)",
   "bin": {
     "windyroad-itil": "./bin/install.mjs"

package/scripts/reconcile-rfcs.sh

@@ -251,8 +251,16 @@ if [ -d "$PROBLEMS_DIR" ]; then
   # problem_rfc_ids["P168"] = "RFC-001 RFC-002 ..."
   declare -A problem_rfc_rows
   declare -A problem_rfc_ids
+  # P312 / ADR-031: scan both flat docs/problems/<NNN>-*.md AND per-state
+  # subdir docs/problems/<state>/<NNN>-*.md layouts so the reverse-trace
+  # remains valid post-migration. Mirrors reconcile-readme.sh lines 74-110.
   shopt -s nullglob
-  for pf in "$PROBLEMS_DIR"/[0-9][0-9][0-9]-*.md; do
+  problem_files=( "$PROBLEMS_DIR"/[0-9][0-9][0-9]-*.md )
+  for ticket_status in open known-error verifying closed parked; do
+    problem_files+=( "$PROBLEMS_DIR"/"$ticket_status"/[0-9][0-9][0-9]-*.md )
+  done
+  shopt -u nullglob
+  for pf in "${problem_files[@]}"; do
     pbase="$(basename "$pf")"
     pnum="${pbase%%-*}"
     pid="P${pnum}"
@@ -274,7 +282,6 @@ if [ -d "$PROBLEMS_DIR" ]; then
     done < <(awk -v start="$sec_start" 'NR>start { if (/^## /) exit; print }' "$pf")
     problem_rfc_ids["$pid"]="$rfcs_in_p"
   done
-  shopt -u nullglob
 
   # 1. MISSING_REVERSE_TRACE: RFC claims P, P does not list RFC.
   for rfc_id in "${!rfc_problems_claim[@]}"; do

package/scripts/test/reconcile-rfcs.bats

@@ -131,6 +131,40 @@ EOF
   fi
 }
 
+# Helper: write a problem ticket under the per-state subdir layout per
+# ADR-031 (state is the parent directory; filename has NO `.state.md` suffix).
+# Args: <pid-num> <slug> <state> <rfcs-rows-block>
+# Used to regression-test P312 — reconcile-rfcs reverse-trace must traverse
+# docs/problems/<state>/<NNN>-*.md, not just flat docs/problems/<NNN>-*.<state>.md.
+write_problem_subdir() {
+  local num="$1" slug="$2" state="$3" rfcs_rows="${4:-}"
+  mkdir -p "$PROBLEMS_DIR/$state"
+  local file="$PROBLEMS_DIR/$state/${num}-${slug}.md"
+  cat > "$file" <<EOF
+# Problem ${num}: ${slug}
+
+**Status**: ${state}
+
+## Description
+
+stub
+
+## Related
+
+stub
+EOF
+  if [ -n "$rfcs_rows" ]; then
+    cat >> "$file" <<EOF
+
+## RFCs
+
+| RFC | Status | Title |
+|-----|--------|-------|
+${rfcs_rows}
+EOF
+  fi
+}
+
 # ── Existence + executable ──────────────────────────────────────────────────
 
 @test "reconcile-rfcs: script exists" {
@@ -413,6 +447,35 @@ EOF
   done <<< "$output"
 }
 
+# ── P312: per-state subdir reverse-trace (ADR-031 layout) ───────────────────
+# Closes P312 — reconcile-rfcs reported spurious MISSING_REVERSE_TRACE for
+# tickets that live under docs/problems/<state>/<NNN>-*.md because the
+# reverse-trace pass only globbed the flat docs/problems/<NNN>-*.md layout.
+# RFC-002-class dual-tolerant-glob fix mirroring the sibling already shipped
+# in reconcile-readme.sh (P118).
+
+@test "P312: reverse-trace clean when problem ticket lives in per-state subdir" {
+  write_rfc "001" "foo" "accepted"
+  write_minimal_readme "| 2.0 | RFC-001 | foo | 3 Med | Accepted | M | 2026-05-05 |"
+  # Ticket lives under docs/problems/verifying/168-p168.md (no .state suffix).
+  write_problem_subdir "168" "p168" "verifying" "| RFC-001 | accepted | foo |"
+  run bash "$SCRIPT" "$FIXTURE_DIR" "$PROBLEMS_DIR"
+  [ "$status" -eq 0 ]
+  [[ "$output" != *"MISSING_REVERSE_TRACE"* ]]
+}
+
+@test "P312: reverse-trace detects missing trace when problem ticket lives in per-state subdir" {
+  write_rfc "001" "foo" "accepted"
+  write_minimal_readme "| 2.0 | RFC-001 | foo | 3 Med | Accepted | M | 2026-05-05 |"
+  # Subdir ticket WITHOUT a `## RFCs` section → MISSING_REVERSE_TRACE must fire.
+  write_problem_subdir "168" "p168" "verifying" ""
+  run bash "$SCRIPT" "$FIXTURE_DIR" "$PROBLEMS_DIR"
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"MISSING_REVERSE_TRACE"* ]]
+  [[ "$output" == *"RFC-001"* ]]
+  [[ "$output" == *"P168"* ]]
+}
+
 # ── ADR-049 bin shim contract ───────────────────────────────────────────────
 
 @test "wr-itil-reconcile-rfcs bin shim exists" {

package/skills/capture-rfc/SKILL.md

@@ -170,6 +170,7 @@ If interactive (AskUserQuestion available) AND the description is short enough t
 status: proposed
 rfc-id: <kebab-slug>
 reported: <YYYY-MM-DD>
+human-oversight: unconfirmed
 decision-makers: [<git config user.name>]
 problems: [P<NNN>, P<NNN>, ...]
 adrs: []
@@ -275,6 +276,8 @@ After the commit, report:
 
 The trailing pointer is **not optional** — it is the user-visible signal that the RFC is intentionally skeleton-only and how to advance it.
 
+**Oversight marker discipline (ADR-066 + ADR-068 amendments 2026-06-02 / P348).** The skeleton frontmatter MUST include `human-oversight: unconfirmed`. capture-rfc is the AFK-friendly aside surface; there is no substance-confirm `AskUserQuestion` pass in this flow (deferred to `/wr-itil:manage-rfc accepted`), so `confirmed` would be a hollow marker (the P348 bug class). The architect-side hook (`architect-oversight-marker-discipline.sh`) does NOT gate `docs/rfcs/`, but downstream paths that promote a captured RFC to `confirmed` MUST do so via a proper substance-confirm AskUserQuestion (e.g. `/wr-itil:manage-rfc accepted` for genuine ratification) — agents authoring RFCs at capture-time MUST NOT write `confirmed`. The drain pattern mirrors the ADR drain: an RFC's `unconfirmed` state surfaces interactively during the `accepted` transition.
+
 ## Composition with manage-rfc
 
 | Concern | manage-rfc | capture-rfc |

package/skills/work-problems/SKILL.md

@@ -216,7 +216,11 @@ For stop-conditions #1 and #3 (no actionable problems / all blocked), Step 2.5 s
 
 Before the orchestrator emits the final `ALL_DONE` sentinel for the AFK loop, it MUST run the following gate sequence. The sequence fires **unconditionally** — at every stop-condition (`#1`, `#2`, `#3` per Step 2) AND at every halt-path that emits a final AFK summary AND on quota-exhaustion / natural loop end. The sequence has three parts that MUST complete in order; the structural rule is `ALL_DONE` emits ONLY after (a) AND (b) complete cleanly. Per-state subdir layout reminder: this step's order in the SKILL is logical (Step 2.4 fires *between* the Step 2 stop-check and the Step 2.5 surfacing routine *only as a wrapper*); the numerical ordering reflects the conceptual sequence (Step 2.4 wraps Step 2.5 + the new retro gate, then Step 2.5/2.5b execute as gate (a)'s worker).
 
-**Gate (a) — Outstanding-questions surface.** Read `.afk-run-state/outstanding-questions.jsonl`. If non-empty, invoke Step 2.5b's surfacing routine to present the accumulated queue (via `AskUserQuestion`-when-available-else-table per ADR-013 Rule 1 / Rule 6). On completion, truncate the queue file. If the queue is empty, gate (a) returns immediately. The surfacing routine is the existing Step 2.5b — Step 2.4 does NOT re-implement; it sequences.
+**Gate (a) — Outstanding-questions surface + oversight-unconfirmed drain (P348 amendment 2026-06-02).** Two sub-surfaces, both fire in this gate:
+
+1. *Outstanding-questions surface.* Read `.afk-run-state/outstanding-questions.jsonl`. If non-empty, invoke Step 2.5b's surfacing routine to present the accumulated queue (via `AskUserQuestion`-when-available-else-table per ADR-013 Rule 1 / Rule 6). On completion, truncate the queue file. If the queue is empty, this sub-surface returns immediately. The surfacing routine is the existing Step 2.5b — Step 2.4 does NOT re-implement; it sequences.
+
+2. *Oversight-unconfirmed drain.* Run `wr-architect-detect-unoversighted` and `wr-jtbd-detect-unoversighted` (both ADR-049 PATH shims, both always exit 0; output is the list of unoversighted artefact paths). If either lists ≥ 1 artefact whose frontmatter carries `human-oversight: unconfirmed` (the AFK-explicit-deferred state, distinct from the implicit-absent state pre-existing ADR/JTBD files carry), surface a one-line nudge: *"N iter-deferred decision(s)/job(s) carry `human-oversight: unconfirmed`. Run `/wr-architect:review-decisions` and `/wr-jtbd:confirm-jobs-and-personas` to drain."* If `AskUserQuestion` is available (`/wr-itil:work-problems` was invoked interactively before the AFK loop started), surface a 2-option choice — `Drain now` (invokes the appropriate drain skill before `ALL_DONE`) / `Defer to next session` (proceeds to gate (b) with the nudge in the final summary). If `AskUserQuestion` is unavailable, the nudge prints in the final summary table and gate (b) proceeds. The drain is NOT a halt — `unconfirmed` markers are explicit-by-design AFK signals (the iter wrote them KNOWING the user would need to confirm), and the drain is the documented path. Detector difference matters: ADRs/JTBDs that pre-date the ADR-066/ADR-068 marker contract carry NO `human-oversight:` line at all; they fall through to the existing review-decisions/confirm-jobs-and-personas backlog drain (no new surfacing here). The new surfacing fires ONLY on the explicit `unconfirmed` value — the AFK-iter-deferred class P348 introduces.
 
 **Gate (b) — Session-level retro.** Invoke `/wr-retrospective:run-retro` via the Skill tool. This is the **orchestrator-main-turn session-level retro**, distinct from the per-iter retro fired inside each iter subprocess (per P086 / Step 5 retro-on-exit clause). The session-level retro covers cross-iter patterns, friction observations, framework-improvement candidates, and the AFK loop's overall trajectory — surface visible only after multiple iters have completed. Retro commits its own work per ADR-014; any tickets retro creates ride retro's own commit, and the orchestrator picks them up on the *next* invocation of `/wr-itil:work-problems` rather than re-entering the loop here.