@windyroad/itil 0.51.2 → 0.52.0-preview.763

package/.claude-plugin/plugin.json

@@ -497,5 +497,5 @@
     }
   },
   "name": "wr-itil",
-  "version": "0.51.2"
+  "version": "0.52.0"
 }

package/bin/wr-itil-update-rfc-commits-section

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Generated by scripts/sync-shim-wrappers.sh from
+# packages/shared/lib/shim-wrapper-template.sh. DO NOT EDIT individual
+# shim files in packages/*/bin/wr-* directly; edit the template + run
+# `npm run sync:shim-wrappers` to regenerate.
+#
+# Resolution (ADR-080):
+#   1. If the wrapper's parent dir is semver-shaped, treat as installed-
+#      cache execution and resolve to the highest-version sibling's
+#      scripts/ entry below.
+#   2. Otherwise (parent dir is e.g. `architect`), treat as source-
+#      monorepo execution and dispatch to own scripts/. The source-repo-
+#      guard `exec` is the anchor parsed by
+#      packages/retrospective/scripts/check-tarball-shipped-shims.sh.
+#   3. If the cache parent contains zero semver-shaped siblings, exit
+#      127 with a stderr message naming the cache parent (per SQ-080-2).
+#
+# @adr ADR-080 (highest-version-wins shim wrapper plugin scaffold)
+# @adr ADR-049 (plugin-bundled scripts resolve via bin/ on $PATH — amended)
+# @problem P343 (mid-session staleness window)
+
+set -euo pipefail
+
+SHIM_DIR="$(cd "$(dirname "$0")" && pwd)"
+OWN_VERSION_DIR="$(dirname "$SHIM_DIR")"
+OWN_VERSION_NAME="$(basename "$OWN_VERSION_DIR")"
+CACHE_PARENT="$(dirname "$OWN_VERSION_DIR")"
+
+SEMVER_RE='^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$'
+
+# Source-repo guard: own parent dir is NOT semver → dispatch to own scripts/.
+if ! [[ "$OWN_VERSION_NAME" =~ $SEMVER_RE ]]; then
+  exec "$SHIM_DIR/../scripts/update-rfc-commits-section.sh" "$@"
+fi
+
+# Cache execution: pick the highest-semver sibling under CACHE_PARENT.
+HIGHEST=""
+while IFS= read -r dir; do
+  name="$(basename "$dir")"
+  [[ "$name" =~ $SEMVER_RE ]] || continue
+  if [[ -z "$HIGHEST" ]] || [[ "$(printf '%s\n%s\n' "$HIGHEST" "$name" | sort -V | tail -1)" == "$name" ]]; then
+    HIGHEST="$name"
+  fi
+done < <(find "$CACHE_PARENT" -mindepth 1 -maxdepth 1 -type d 2>/dev/null)
+
+if [[ -z "$HIGHEST" ]]; then
+  printf 'wr-shim: no cached versions in %s\n' "$CACHE_PARENT" >&2
+  exit 127
+fi
+
+exec "$CACHE_PARENT/$HIGHEST/scripts/update-rfc-commits-section.sh" "$@"

package/hooks/hooks.json

@@ -5,6 +5,10 @@
       {
         "matcher": "startup",
         "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-pending-questions-surface.sh" }]
+      },
+      {
+        "matcher": "startup",
+        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-rfc-oversight-nudge.sh" }]
       }
     ],
     "UserPromptSubmit": [
@@ -50,6 +54,10 @@
         "matcher": "Bash",
         "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-rfc-trailer-advisory.sh" }]
       },
+      {
+        "matcher": "Bash",
+        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-commit-trailer-transition-advisory.sh" }]
+      },
       {
         "matcher": "Write|Edit|MultiEdit",
         "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-fictional-defer-detect.sh" }]

package/hooks/itil-commit-trailer-transition-advisory.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+# wr-itil — PostToolUse:Bash hook (P378/RFC-030 Piece 2). The SHARED
+# commit-trailer auto-transition trigger that ADR-060 (line 292/307) promised
+# for BOTH the RFC and story tiers and that manage-rfc + manage-story both
+# deferred to "a future commit-trailer-trigger hook" — never built. This is it.
+#
+# Per ADR-014, a hook MUST NOT perform the transition itself (git mv + Status
+# edit + commit lands OUTSIDE the triggering commit's grain). So the hook
+# DETECTS eligibility and ADVISES; the skill (/wr-itil:manage-rfc |
+# /wr-itil:manage-story) — or an AFK orchestrator acting on the advisory —
+# performs the transition. The detection is now self-firing; the false
+# "auto-transitions on first non-capture commit" claims in both skills are
+# corrected to describe this detect-then-perform shape.
+#
+# Trigger: a `git commit` whose HEAD message
+#   - carries a `Refs: RFC-<NNN>` or `Refs: STORY-<NNN>` trailer, AND
+#   - is NOT the artefact's capture commit (subject does not start with
+#     `docs(rfcs): capture RFC-` / `feat(itil): capture STORY-`), AND
+#   - the referenced artefact is in a pre-in-progress status
+#     (RFC: .proposed/.accepted ; story: .draft) on disk.
+# → emit a stderr advisory naming the transition command. Silent otherwise.
+#
+# Advisory-only (ADR-013 Rule 6 fail-open; ADR-045 ≤300-byte band; exit 0).
+# Bypass: BYPASS_TRANSITION_ADVISORY=1.
+#
+# @adr ADR-060 (line 292/307 auto-transition triggers) ADR-014 (hook detects,
+#      skill commits) ADR-045 (budget) ADR-013 (Rule 6 fail-open) ADR-052 (bats)
+# @problem P378  @rfc RFC-030
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=lib/command-detect.sh
+source "$SCRIPT_DIR/lib/command-detect.sh"
+
+INPUT=$(cat)
+TOOL_NAME=$(printf '%s' "$INPUT" | python3 -c "import sys,json
+try: print(json.load(sys.stdin).get('tool_name',''))
+except: print('')" 2>/dev/null || echo "")
+[ "$TOOL_NAME" = "Bash" ] || exit 0
+
+COMMAND=$(printf '%s' "$INPUT" | python3 -c "import sys,json
+try: print(json.load(sys.stdin).get('tool_input',{}).get('command',''))
+except: print('')" 2>/dev/null || echo "")
+command_invokes_git_commit "$COMMAND" || exit 0
+[ "${BYPASS_TRANSITION_ADVISORY:-}" = "1" ] && exit 0
+git rev-parse --is-inside-work-tree >/dev/null 2>&1 || exit 0
+
+SUBJECT=$(git log -1 --format='%s' HEAD 2>/dev/null) || exit 0
+BODY=$(git log -1 --format='%B' HEAD 2>/dev/null) || exit 0
+
+# Skip capture commits — they CREATE the artefact, not advance it.
+case "$SUBJECT" in
+  *"capture RFC-"*|*"capture STORY-"*) exit 0 ;;
+esac
+
+TRAILERS=$(printf '%s\n' "$BODY" | git interpret-trailers --parse 2>/dev/null \
+  | grep -oE 'RFC-[0-9]{3}|STORY-[0-9]{3}' | sort -u || true)
+[ -n "$TRAILERS" ] || exit 0
+
+advise() { echo "P378 ADVISORY: $1" >&2; }
+
+while IFS= read -r id; do
+  [ -n "$id" ] || continue
+  case "$id" in
+    RFC-*)
+      [ -d "./docs/rfcs" ] || continue
+      shopt -s nullglob; files=(./docs/rfcs/${id}-*.proposed.md ./docs/rfcs/${id}-*.accepted.md); shopt -u nullglob
+      [ ${#files[@]} -gt 0 ] || continue
+      advise "${id} carries a non-capture commit but is still $(basename "${files[0]}" | grep -oE 'proposed|accepted'). It should advance to in-progress — run /wr-itil:manage-rfc ${id} in-progress (the skill performs the transition; a hook cannot, per ADR-014). Bypass: BYPASS_TRANSITION_ADVISORY=1."
+      ;;
+    STORY-*)
+      [ -d "./docs/stories" ] || continue
+      shopt -s nullglob; files=(./docs/stories/draft/${id}-*.md ./docs/stories/${id}-*.draft.md); shopt -u nullglob
+      [ ${#files[@]} -gt 0 ] || continue
+      advise "${id} carries a non-capture commit but is still draft. It should advance to in-progress — run /wr-itil:manage-story ${id} in-progress. Bypass: BYPASS_TRANSITION_ADVISORY=1."
+      ;;
+  esac
+done <<< "$TRAILERS"
+
+exit 0

package/hooks/itil-rfc-oversight-nudge.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# wr-itil — SessionStart hook (P378/RFC-030; ADR-066/068 oversight-nudge clone)
+#
+# Surfaces a one-line nudge when RFCs lack the human-oversight marker, so the
+# user can ratify them via /wr-itil:manage-rfc <RFC-NNN> (the accepted
+# transition ratifies RFC scope). Sibling of architect-oversight-nudge.sh
+# (ADR-066) and jtbd-oversight-nudge.sh (ADR-068); same class-B SessionStart
+# shape as the ADR-040 session-start surface — so ratification is auto-surfaced
+# every session instead of leaning on the user's memory (P378).
+#
+# Detection is token-cheap: delegates to detect-unoversighted-rfcs.sh (a grep
+# over docs/rfcs/ frontmatter — no body reads, no per-RFC LLM call). Silent
+# when the unoversighted count is zero (steady state once ratified).
+#
+# AFK self-suppress: shares the suite-wide WR_SUPPRESS_OVERSIGHT_NUDGE guard
+# with the architect + jtbd oversight nudges (ADR-068 § shared cross-plugin
+# contracts). AFK orchestrators export it once and every oversight nudge
+# self-suppresses — so this interactive ratify nudge never fires into an
+# absent-user subprocess (JTBD-006 friction guard). Only the literal "1"
+# suppresses. Silent-on-zero; fail-open; ADR-040 ≤2KB budget (one line).
+
+set -uo pipefail
+
+if [ "${WR_SUPPRESS_OVERSIGHT_NUDGE:-}" = "1" ]; then
+  exit 0
+fi
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
+RFCS_DIR="$PROJECT_DIR/docs/rfcs"
+
+[ -d "$RFCS_DIR" ] || exit 0
+
+DETECT="${CLAUDE_PLUGIN_ROOT:-$(dirname "$0")/..}/scripts/detect-unoversighted-rfcs.sh"
+[ -x "$DETECT" ] || DETECT="$(dirname "$0")/../scripts/detect-unoversighted-rfcs.sh"
+[ -r "$DETECT" ] || exit 0
+
+COUNT="$(bash "$DETECT" "$RFCS_DIR" 2>/dev/null | grep -c . || true)"
+COUNT="${COUNT:-0}"
+
+[ "$COUNT" -gt 0 ] 2>/dev/null || exit 0
+
+if [ "$COUNT" -eq 1 ]; then
+  echo "[wr-itil] 1 RFC lacks human oversight — run /wr-itil:manage-rfc <RFC-NNN> to ratify it (the accepted transition confirms scope)."
+else
+  echo "[wr-itil] $COUNT RFCs lack human oversight — run /wr-itil:manage-rfc <RFC-NNN> to ratify them (the accepted transition confirms scope)."
+fi

package/hooks/test/itil-commit-trailer-transition-advisory.bats

@@ -0,0 +1,70 @@
+#!/usr/bin/env bats
+
+# P378/RFC-030 Piece 2: itil-commit-trailer-transition-advisory.sh — the shared
+# RFC+story commit-trailer auto-transition DETECTOR. Advises (ADR-014: does not
+# perform) proposed/accepted RFC → in-progress and draft story → in-progress on
+# the first non-capture commit carrying the Refs trailer. Behavioural.
+
+setup() {
+  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
+  HOOK="$REPO_ROOT/packages/itil/hooks/itil-commit-trailer-transition-advisory.sh"
+  DIR="$(mktemp -d)"; cd "$DIR"
+  git init -q; git config user.email t@e.x; git config user.name t
+  mkdir -p docs/rfcs docs/stories/draft
+  echo x > seed; git add -A; git commit -qm "chore: seed"
+}
+teardown() { cd /; rm -rf "$DIR"; }
+
+# Feed the hook a PostToolUse Bash payload for a `git commit` command.
+run_hook() {
+  printf '{"tool_name":"Bash","tool_input":{"command":"git commit -m x"}}' | bash "$HOOK"
+}
+
+commit() { git commit -q --allow-empty -m "$1"; }
+
+@test "advises proposed RFC → in-progress on a non-capture Refs commit" {
+  echo "---" > docs/rfcs/RFC-201-x.proposed.md; git add -A; commit "$(printf 'docs(rfcs): capture RFC-201 x\n\nRefs: RFC-201')"
+  commit "$(printf 'feat(itil): do slice 1\n\nRefs: RFC-201')"
+  run run_hook
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"RFC-201"* ]]
+  [[ "$output" == *"in-progress"* ]]
+  [[ "$output" == *"manage-rfc"* ]]
+}
+
+@test "silent on the capture commit itself" {
+  echo "---" > docs/rfcs/RFC-201-x.proposed.md; git add -A; commit "$(printf 'docs(rfcs): capture RFC-201 x\n\nRefs: RFC-201')"
+  run run_hook
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "silent when the RFC is already in-progress (no .proposed/.accepted file)" {
+  echo "---" > docs/rfcs/RFC-201-x.in-progress.md; git add -A; commit "$(printf 'feat(itil): more\n\nRefs: RFC-201')"
+  run run_hook
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "advises draft story → in-progress on a non-capture Refs commit" {
+  echo "---" > docs/stories/draft/STORY-201-y.md; git add -A; commit "$(printf 'feat(itil): capture STORY-201 y\n\nRefs: STORY-201')"
+  commit "$(printf 'feat(itil): implement\n\nRefs: STORY-201')"
+  run run_hook
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"STORY-201"* ]]
+  [[ "$output" == *"manage-story"* ]]
+}
+
+@test "bypass env var suppresses the advisory" {
+  echo "---" > docs/rfcs/RFC-201-x.proposed.md; git add -A; commit "$(printf 'feat: s\n\nRefs: RFC-201')"
+  run env BYPASS_TRANSITION_ADVISORY=1 bash -c 'printf "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"git commit -m x\"}}" | bash "$0"' "$HOOK"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "silent when commit carries no Refs trailer" {
+  echo "---" > docs/rfcs/RFC-201-x.proposed.md; git add -A; commit "chore: untagged"
+  run run_hook
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}

package/hooks/test/itil-rfc-oversight-nudge.bats

@@ -0,0 +1,78 @@
+#!/usr/bin/env bats
+
+# P378/RFC-030: itil-rfc-oversight-nudge.sh (SessionStart) emits a one-line
+# nudge when RFCs lack the human-oversight marker, is silent when none do, and
+# self-suppresses under the shared AFK guard (WR_SUPPRESS_OVERSIGHT_NUDGE=1).
+# Behavioural — exercises the hook against fixture docs/rfcs/ trees. Clone of
+# the architect/jtbd oversight-nudge contract (ADR-066/068).
+
+setup() {
+  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
+  HOOK="$REPO_ROOT/packages/itil/hooks/itil-rfc-oversight-nudge.sh"
+  PLUGIN_ROOT="$REPO_ROOT/packages/itil"
+  DIR="$(mktemp -d)"
+  mkdir -p "$DIR/docs/rfcs"
+}
+
+teardown() { rm -rf "$DIR"; }
+
+mk_unconfirmed() {
+  { echo "---"; echo "status: proposed"; echo "human-oversight: unconfirmed"; echo "---"; echo "# $1"; } \
+    > "$DIR/docs/rfcs/$1"
+}
+mk_confirmed() {
+  { echo "---"; echo "status: proposed"; echo "human-oversight: confirmed"; echo "---"; echo "# $1"; } \
+    > "$DIR/docs/rfcs/$1"
+}
+
+run_hook() { run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" "$@" bash "$HOOK"; }
+
+@test "emits a count line when there are unoversighted RFCs" {
+  mk_unconfirmed "RFC-201-foo.proposed.md"
+  mk_unconfirmed "RFC-202-bar.proposed.md"
+  run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"2 RFCs lack human oversight"* ]]
+  [[ "$output" == *"/wr-itil:manage-rfc"* ]]
+}
+
+@test "singular wording for exactly one unoversighted RFC" {
+  mk_unconfirmed "RFC-201-foo.proposed.md"
+  run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
+  [[ "$output" == *"1 RFC lacks human oversight"* ]]
+}
+
+@test "silent when every RFC is confirmed" {
+  mk_confirmed "RFC-201-foo.proposed.md"
+  run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "excludes superseded and closed RFCs from the count" {
+  mk_unconfirmed "RFC-201-foo.superseded.md"
+  mk_unconfirmed "RFC-202-bar.closed.md"
+  run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "shared AFK guard suppresses the nudge entirely" {
+  mk_unconfirmed "RFC-201-foo.proposed.md"
+  run env WR_SUPPRESS_OVERSIGHT_NUDGE=1 CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "guard value other than 1 does not suppress" {
+  mk_unconfirmed "RFC-201-foo.proposed.md"
+  run env WR_SUPPRESS_OVERSIGHT_NUDGE=yes CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
+  [[ "$output" == *"lack"*"human oversight"* ]] || [[ "$output" == *"lacks human oversight"* ]]
+}
+
+@test "silent when docs/rfcs does not exist (framework not adopted)" {
+  rm -rf "$DIR/docs/rfcs"
+  run env CLAUDE_PROJECT_DIR="$DIR" CLAUDE_PLUGIN_ROOT="$PLUGIN_ROOT" bash "$HOOK"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}

package/lib/install-utils.mjs

@@ -7,10 +7,12 @@ import { execSync } from "node:child_process";
 
 const MARKETPLACE_REPO = "windyroad/agent-plugins";
 const MARKETPLACE_NAME = "windyroad";
+const CODEX_MARKETPLACE_PATH = ".";
+const CODEX_MARKETPLACE_NAME = "windyroad-local";
 
 let _dryRun = false;
 
-export { MARKETPLACE_REPO, MARKETPLACE_NAME };
+export { MARKETPLACE_REPO, MARKETPLACE_NAME, CODEX_MARKETPLACE_PATH, CODEX_MARKETPLACE_NAME };
 
 export function setDryRun(value) {
   _dryRun = value;
@@ -35,16 +37,34 @@ export function run(cmd, label) {
   }
 }
 
-export function checkPrerequisites() {
+function runtimesFor(runtime = "claude") {
+  if (runtime === "both") return ["claude", "codex"];
+  return [runtime];
+}
+
+export function checkPrerequisites({ runtime = "claude" } = {}) {
   if (_dryRun) return;
 
-  try {
-    execSync("claude --version", { stdio: "pipe" });
-  } catch {
-    console.error(
-      "Error: 'claude' CLI not found. Install Claude Code first:\n  https://docs.anthropic.com/en/docs/claude-code\n"
-    );
-    process.exit(1);
+  for (const currentRuntime of runtimesFor(runtime)) {
+    if (currentRuntime === "claude") {
+      try {
+        execSync("claude --version", { stdio: "pipe" });
+      } catch {
+        console.error(
+          "Error: 'claude' CLI not found. Install Claude Code first:\n  https://docs.anthropic.com/en/docs/claude-code\n"
+        );
+        process.exit(1);
+      }
+    } else if (currentRuntime === "codex") {
+      try {
+        execSync("codex --version", { stdio: "pipe" });
+      } catch {
+        console.error(
+          "Error: 'codex' CLI not found. Install Codex CLI first:\n  https://developers.openai.com/codex\n"
+        );
+        process.exit(1);
+      }
+    }
   }
 }
 
@@ -55,6 +75,13 @@ export function addMarketplace() {
   );
 }
 
+export function addCodexMarketplace() {
+  return run(
+    `codex plugin marketplace add ${CODEX_MARKETPLACE_PATH}`,
+    `Codex marketplace: ${CODEX_MARKETPLACE_NAME}`
+  );
+}
+
 export function installPlugin(pluginName, { scope = "project" } = {}) {
   return run(
     `claude plugin install ${pluginName}@${MARKETPLACE_NAME} --scope ${scope}`,
@@ -62,6 +89,13 @@ export function installPlugin(pluginName, { scope = "project" } = {}) {
   );
 }
 
+export function installCodexPlugin(pluginName) {
+  return run(
+    `codex plugin add ${pluginName}@${CODEX_MARKETPLACE_NAME}`,
+    pluginName
+  );
+}
+
 export function updatePlugin(pluginName, { scope = "project" } = {}) {
   return run(
     `claude plugin update "${pluginName}@${MARKETPLACE_NAME}" --scope ${scope}`,
@@ -69,18 +103,36 @@ export function updatePlugin(pluginName, { scope = "project" } = {}) {
   );
 }
 
+export function updateCodexMarketplace() {
+  return run(
+    `codex plugin marketplace add ${CODEX_MARKETPLACE_PATH}`,
+    `Codex marketplace: ${CODEX_MARKETPLACE_NAME}`
+  );
+}
+
 export function uninstallPlugin(pluginName) {
   return run(`claude plugin uninstall ${pluginName}`, `Removing ${pluginName}`);
 }
 
+export function uninstallCodexPlugin(pluginName) {
+  return run(`codex plugin remove ${pluginName}`, `Removing ${pluginName}`);
+}
+
 /**
  * Install a single package: marketplace add + plugin install.
  */
-export function installPackage(pluginName, { deps = [], scope = "project" } = {}) {
+export function installPackage(pluginName, { deps = [], scope = "project", runtime = "claude" } = {}) {
   console.log(`\nInstalling @windyroad/${pluginName.replace("wr-", "")} (${scope} scope)...\n`);
 
-  addMarketplace();
-  installPlugin(pluginName, { scope });
+  if (runtime === "claude" || runtime === "both") {
+    addMarketplace();
+    installPlugin(pluginName, { scope });
+  }
+
+  if (runtime === "codex" || runtime === "both") {
+    addCodexMarketplace();
+    installCodexPlugin(pluginName);
+  }
 
   if (deps.length > 0) {
     console.log(`\nNote: This plugin works best with:`);
@@ -90,34 +142,47 @@ export function installPackage(pluginName, { deps = [], scope = "project" } = {}
   }
 
   console.log(
-    `\nDone! Restart Claude Code to activate.\n`
+    `\nDone! Restart ${runtime === "codex" ? "Codex" : runtime === "both" ? "Claude Code and Codex" : "Claude Code"} to activate.\n`
   );
 }
 
 /**
  * Update a single package.
  */
-export function updatePackage(pluginName, { scope = "project" } = {}) {
+export function updatePackage(pluginName, { scope = "project", runtime = "claude" } = {}) {
   console.log(`\nUpdating @windyroad/${pluginName.replace("wr-", "")}...\n`);
 
-  run(
-    `claude plugin marketplace update ${MARKETPLACE_NAME}`,
-    "Updating marketplace"
-  );
-  updatePlugin(pluginName, { scope });
+  if (runtime === "claude" || runtime === "both") {
+    run(
+      `claude plugin marketplace update ${MARKETPLACE_NAME}`,
+      "Updating marketplace"
+    );
+    updatePlugin(pluginName, { scope });
+  }
 
-  console.log("\nDone! Restart Claude Code to apply updates.\n");
+  if (runtime === "codex" || runtime === "both") {
+    updateCodexMarketplace();
+    installCodexPlugin(pluginName);
+  }
+
+  console.log(`\nDone! Restart ${runtime === "codex" ? "Codex" : runtime === "both" ? "Claude Code and Codex" : "Claude Code"} to apply updates.\n`);
 }
 
 /**
  * Uninstall a single package.
  */
-export function uninstallPackage(pluginName) {
+export function uninstallPackage(pluginName, { runtime = "claude" } = {}) {
   console.log(`\nUninstalling @windyroad/${pluginName.replace("wr-", "")}...\n`);
 
-  uninstallPlugin(pluginName);
+  if (runtime === "claude" || runtime === "both") {
+    uninstallPlugin(pluginName);
+  }
+
+  if (runtime === "codex" || runtime === "both") {
+    uninstallCodexPlugin(pluginName);
+  }
 
-  console.log("\nDone. Restart Claude Code to apply changes.\n");
+  console.log(`\nDone. Restart ${runtime === "codex" ? "Codex" : runtime === "both" ? "Claude Code and Codex" : "Claude Code"} to apply changes.\n`);
 }
 
 /**
@@ -131,6 +196,7 @@ export function parseStandardArgs(argv) {
     update: args.includes("--update"),
     dryRun: args.includes("--dry-run"),
     scope: "project",
+    runtime: "claude",
   };
   const scopeIdx = args.indexOf("--scope");
   if (scopeIdx !== -1 && args[scopeIdx + 1]) {
@@ -142,5 +208,15 @@ export function parseStandardArgs(argv) {
       process.exit(1);
     }
   }
+  const runtimeIdx = args.indexOf("--runtime");
+  if (runtimeIdx !== -1 && args[runtimeIdx + 1]) {
+    const val = args[runtimeIdx + 1];
+    if (["claude", "codex", "both"].includes(val)) {
+      flags.runtime = val;
+    } else {
+      console.error("--runtime requires: claude, codex, or both");
+      process.exit(1);
+    }
+  }
   return flags;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/itil",
-  "version": "0.51.2",
+  "version": "0.52.0-preview.763",
   "description": "ITIL-aligned IT service management for Claude Code (problem, and future incident/change skills)",
   "bin": {
     "windyroad-itil": "./bin/install.mjs"

package/scripts/detect-unoversighted-rfcs.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# wr-itil — detect RFCs lacking the human-oversight marker (P378/RFC-030).
+#
+# Clone of the architect/jtbd detect-unoversighted shape (ADR-066/068): greps
+# each RFC's YAML frontmatter for `human-oversight: confirmed`. No body reads,
+# no per-RFC LLM call. An RFC is "unoversighted" when its frontmatter does not
+# carry that marker line (RFCs are born `human-oversight: unconfirmed` at
+# capture-rfc; they are ratified at the /wr-itil:manage-rfc accepted transition
+# where scope is confirmed).
+#
+# Usage:
+#   detect-unoversighted-rfcs.sh [RFCS_DIR]   (default docs/rfcs)
+# Output: one unoversighted RFC file path per line, sorted. Empty = all
+# confirmed. Always exits 0 (detector, not a gate).
+#
+# Consumed by: itil-rfc-oversight-nudge.sh (SessionStart count). Marker
+# contract: ADR-066 (human-oversight marker), as extended to RFCs by ADR-070/071.
+
+set -euo pipefail
+
+RFCS_DIR="${1:-docs/rfcs}"
+
+[ -d "$RFCS_DIR" ] || exit 0
+
+shopt -s nullglob
+for f in "$RFCS_DIR"/*.md "$RFCS_DIR"/*/*.md; do
+  base="$(basename "$f")"
+  [ "$base" = "README.md" ] && continue
+  # Superseded + closed RFCs are retired/done — ratifying their scope is moot,
+  # so they are not part of the "needs oversight" set (keeps the nudge focused
+  # on live RFCs the user can still act on).
+  case "$base" in *.superseded.md|*.closed.md) continue ;; esac
+
+  fm="$(awk '
+    NR==1 && $0 != "---" { exit }
+    NR==1 { next }
+    /^---[[:space:]]*$/ { exit }
+    { print }
+  ' "$f")"
+
+  if printf '%s\n' "$fm" | grep -qiE '^human-oversight:[[:space:]]*confirmed[[:space:]]*$'; then
+    continue
+  fi
+
+  echo "$f"
+done | sort

package/scripts/test/update-rfc-commits-section.bats

@@ -0,0 +1,77 @@
+#!/usr/bin/env bats
+
+# P378/RFC-030 Piece 1 (ADR-085): update-rfc-commits-section.sh renders the RFC
+# `## Commits` section as a derived view from `git log --grep "Refs: RFC-NNN"`.
+# Behavioural — exercises the renderer against a throwaway git repo.
+
+setup() {
+  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
+  HELPER="$REPO_ROOT/packages/itil/scripts/update-rfc-commits-section.sh"
+  DIR="$(mktemp -d)"
+  cd "$DIR"
+  git init -q
+  git config user.email t@e.x; git config user.name t
+  mkdir -p docs/rfcs
+  cat > docs/rfcs/RFC-201-thing.proposed.md <<'EOF'
+# RFC-201: thing
+
+## Commits
+
+(placeholder)
+
+## Related
+
+x
+EOF
+  git add -A && git commit -qm "chore: seed"
+}
+teardown() { cd /; rm -rf "$DIR"; }
+
+@test "renders commits carrying the Refs: RFC-NNN trailer, newest first" {
+  echo a > a; git add a; git commit -qm "$(printf 'feat: a\n\nRefs: RFC-201')"
+  echo b > b; git add b; git commit -qm "$(printf 'fix: b\n\nRefs: RFC-201')"
+  run bash "$HELPER" docs/rfcs/RFC-201-thing.proposed.md
+  [ "$status" -eq 0 ]
+  run sed -n '/## Commits/,/## Related/p' docs/rfcs/RFC-201-thing.proposed.md
+  [[ "$output" == *"fix: b"* ]]
+  [[ "$output" == *"feat: a"* ]]
+  # newest first: fix: b appears before feat: a
+  [[ "$output" == *"fix: b"*"feat: a"* ]]
+  # placeholder body is gone
+  [[ "$output" != *"(placeholder)"* ]]
+}
+
+@test "does NOT include commits without the trailer" {
+  echo a > a; git add a; git commit -qm "$(printf 'feat: tagged\n\nRefs: RFC-201')"
+  echo b > b; git add b; git commit -qm "chore: untagged"
+  run bash "$HELPER" docs/rfcs/RFC-201-thing.proposed.md
+  run sed -n '/## Commits/,/## Related/p' docs/rfcs/RFC-201-thing.proposed.md
+  [[ "$output" == *"feat: tagged"* ]]
+  [[ "$output" != *"chore: untagged"* ]]
+}
+
+@test "no trailer-bearing commits → renders a self-describing placeholder, not a false claim" {
+  run bash "$HELPER" docs/rfcs/RFC-201-thing.proposed.md
+  [ "$status" -eq 0 ]
+  run sed -n '/## Commits/,/## Related/p' docs/rfcs/RFC-201-thing.proposed.md
+  [[ "$output" == *"rendered from"* ]] && [[ "$output" == *"git log"* ]]
+  [[ "$output" != *"maintained automatically"* ]]
+}
+
+@test "idempotent — second render is a byte-stable no-op" {
+  echo a > a; git add a; git commit -qm "$(printf 'feat: a\n\nRefs: RFC-201')"
+  bash "$HELPER" docs/rfcs/RFC-201-thing.proposed.md
+  h1=$(shasum docs/rfcs/RFC-201-thing.proposed.md | cut -d' ' -f1)
+  bash "$HELPER" docs/rfcs/RFC-201-thing.proposed.md
+  h2=$(shasum docs/rfcs/RFC-201-thing.proposed.md | cut -d' ' -f1)
+  [ "$h1" = "$h2" ]
+}
+
+@test "preserves sections after ## Commits (## Related survives)" {
+  echo a > a; git add a; git commit -qm "$(printf 'feat: a\n\nRefs: RFC-201')"
+  bash "$HELPER" docs/rfcs/RFC-201-thing.proposed.md
+  run grep -c "## Related" docs/rfcs/RFC-201-thing.proposed.md
+  [ "$output" -eq 1 ]
+  run grep -c "^x$" docs/rfcs/RFC-201-thing.proposed.md
+  [ "$output" -eq 1 ]
+}

package/scripts/update-rfc-commits-section.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# packages/itil/scripts/update-rfc-commits-section.sh
+#
+# Renders an RFC's `## Commits` section as a DERIVED VIEW from the git history
+# (P378/RFC-030 Piece 1; ADR-085). The commit log is the source of truth; the
+# section is a projection of `git log --grep "Refs: RFC-NNN"`. Because nothing
+# is written per-commit, there is no post-commit working-tree edit and no
+# ADR-014 grain problem — the section is regenerated skill-side (manage-rfc on
+# every transition/review; reconcile-rfcs) exactly like docs/problems/README.md
+# is a rendered index (ADR-031 precedent).
+#
+# Usage: update-rfc-commits-section.sh <rfc-file>
+# Idempotent: rewriting a current section is a byte-stable no-op.
+#
+# @adr ADR-085 (RFC ## Commits is a git-log-derived view, rendered skill-side)
+# @adr ADR-031 (rendered-index precedent) ADR-014 (why not a post-commit hook)
+# @problem P378
+# @rfc RFC-030
+
+set -uo pipefail
+
+RFC_FILE="${1:-}"
+[ -n "$RFC_FILE" ] || { echo "ERROR: missing rfc-file argument" >&2; exit 1; }
+[ -f "$RFC_FILE" ] || { echo "ERROR: rfc file not found: $RFC_FILE" >&2; exit 1; }
+
+# RFC id from filename (RFC-NNN-...).
+RFC_ID=$(basename "$RFC_FILE" | grep -oE 'RFC-[0-9]{3}' | head -1)
+[ -n "$RFC_ID" ] || { echo "ERROR: cannot derive RFC id from $RFC_FILE" >&2; exit 1; }
+
+# Render the commit list from git log (newest first). Fail-open to a sentinel
+# line when not in a git tree (e.g. adopter tarball inspection).
+if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  RENDERED=$(git log --grep="Refs: ${RFC_ID}\b" --format='- `%h` %s — %ad' --date=short 2>/dev/null || true)
+else
+  RENDERED=""
+fi
+if [ -z "$RENDERED" ]; then
+  RENDERED="(no commits yet — this section is rendered from \`git log --grep \"Refs: ${RFC_ID}\"\`)"
+fi
+
+# Rewrite the body of the `## Commits` section in place (everything between the
+# `## Commits` heading and the next `## ` heading). awk preserves the rest. The
+# rendered (multi-line) content is passed via a file — awk -v cannot carry
+# embedded newlines.
+TMP="$(mktemp)"
+RENDERED_FILE="$(mktemp)"
+printf '%s\n' "$RENDERED" > "$RENDERED_FILE"
+awk -v rfile="$RENDERED_FILE" '
+  BEGIN { in_sec = 0 }
+  /^## Commits[[:space:]]*$/ {
+    print
+    print ""
+    while ((getline line < rfile) > 0) print line
+    close(rfile)
+    print ""
+    in_sec = 1
+    next
+  }
+  in_sec && /^## / { in_sec = 0 }   # next section header ends the block
+  in_sec { next }                    # drop old body lines
+  { print }
+' "$RFC_FILE" > "$TMP"
+rm -f "$RENDERED_FILE"
+
+# Idempotent: only replace on change.
+if ! cmp -s "$TMP" "$RFC_FILE"; then
+  cat "$TMP" > "$RFC_FILE"
+fi
+rm -f "$TMP"

package/skills/capture-problem/SKILL.md

@@ -35,8 +35,8 @@ This skill has **at most one direction-setting AskUserQuestion (the I12 derive-t
 |----------|-----------|
 | Duplicate-check | Mechanical 3-keyword title-only grep; matches listed in report; capture proceeds regardless. False-positives are cheaper than false-negatives (P155 line 24). |
 | Hang-off arbitration (P346 Phase 3) | Mechanical pre-filter (≤5 candidates by shared ADR/RFC/SKILL/file signal) + fresh-context `wr-itil:hang-off-check` subagent dispatch (ADR-032 5th invocation pattern). Verdict-acts: `HANG_OFF: P<NNN>` halts capture + routes orchestrator to amend parent; `PROCEED_NEW` continues + appends rationale to `## Related`. AFK safe-default: ambiguous → PROCEED_NEW per subagent Rule 6 contract. JTBD-301 firewall: maintainer-side only. |
-| Priority default | Framework-policy: `3 (Medium) — Impact 3 × Likelihood 1` flagged "deferred — re-rate at next /wr-itil:review-problems". |
-| Effort default | Framework-policy: `M` flagged "deferred — re-rate at next /wr-itil:review-problems". |
+| Priority (Impact × Likelihood) | **Derived at capture** silently from the description per Step 4a (ADR-067 silent-derivation + ADR-026 grounding/sentinel; ADR-076 honest-likelihood). No deferred placeholder, no false-low. Category-4 silent-framework per ADR-044. |
+| Effort | **Derived at capture** silently per Step 4a (ADR-067 t-shirt buckets + ADR-026 grounding/sentinel). No deferred placeholder. |
 | Multi-concern split | Out of scope: capture-problem creates one ticket per invocation. Multi-concern observations route to `/wr-itil:manage-problem` (its Step 4b owns the split). |
 | Empty `$ARGUMENTS` | Halt-with-stderr-directive: print "capture-problem requires a description in $ARGUMENTS — invoke /wr-itil:manage-problem instead for the full intake flow" and exit. AFK orchestrators MUST NOT invoke capture-problem with empty arguments — caller-side contract. |
 | JTBD-trace + persona derivation (I12 derive-then-ratify — ADR-060 Amendment 2026-06-02) | **Derive-then-ratify per ADR-044 category 1 (direction-setting) on the AskUserQuestion fallback path; silent-framework category 4 on the derive-success path.** Step 1.5b runs lexical detection (`\bJTBD-[0-9]+\b`) + flag pre-resolution (`--jtbd=` / `--persona=`) + cited-JTBD persona derivation. **Derive-success** → silent-proceed with derived values + stderr advisory. **Derive-failure or ambiguity** → AskUserQuestion proposes up-to-3 candidate persona+JTBD pairs + a Reject option (4-option cap per ADR-044 Rule 1). User response semantics: **REJECT** → halt-with-stderr-directive + exit non-zero (REJECT of proposed persona/JTBD = REJECT of the problem; no ticket created). **Option-pick** (acceptance of a proposed candidate as-is) → silent-proceed with picked values. **Free-text correction** → silent-proceed with corrected values (correction-as-acceptance). |
@@ -239,9 +239,9 @@ Log the renumber decision in the operation report if origin and local diverged.
 
 **Status**: Open
 **Reported**: <YYYY-MM-DD>
-**Priority**: 3 (Medium) — Impact: 3 x Likelihood: 1 (deferred — re-rate at next /wr-itil:review-problems)
+**Priority**: <Severity = Impact × Likelihood> (<band>) — Impact: <1-5> × Likelihood: <1-5> — derived at capture from the description per Step 4a
 **Origin**: internal
-**Effort**: M (deferred — re-rate at next /wr-itil:review-problems)
+**Effort**: <S|M|L|XL> — derived at capture per Step 4a
 **JTBD**: <jtbd_trace_value_as_comma_separated_list_OR_omit_line_when_empty>
 **Persona**: <persona_value_OR_omit_line_when_empty>
 
@@ -268,7 +268,6 @@ Log the renumber decision in the operation report if origin and local diverged.
 
 ### Investigation Tasks
 
-- [ ] Re-rate Priority and Effort at next /wr-itil:review-problems
 - [ ] Investigate root cause
 - [ ] Create reproduction test
 
@@ -283,7 +282,17 @@ Log the renumber decision in the operation report if origin and local diverged.
 (captured via /wr-itil:capture-problem; expand at next investigation)
 ```
 
-The deferred-placeholder pattern is load-bearing — `/wr-itil:review-problems` keys off the literal string `(deferred — re-rate at next /wr-itil:review-problems)` to surface captured tickets for re-rating.
+**Rate at capture, do not defer (P375 / ADR-032 amendment 2026-06-24).** The Priority (Impact × Likelihood) and Effort fields are **derived at capture** per Step 4a below — a real best-effort rating, ALWAYS. No `(deferred — re-rate…)` placeholder and **no "not estimated" / "no prior data" marker** — those are deferrals wearing a different hat (user correction 2026-06-24: *"that's just another deferral"*). The old deferred-placeholder default was the single largest uncadenced-deferral rot generator (P375): nothing self-fired `review-problems`, and the `Likelihood: 1` false-low buried every capture at the bottom of WSJF. Estimation under uncertainty produces an estimate, not a deferral: a thin description still gets a real number (rough is fine). `/wr-itil:review-problems` re-rates the whole backlog when it runs — captures need no per-ticket re-rate flag.
+
+### 4a. Derive the rating at capture (P375 / ADR-032 amendment; ADR-067 + ADR-026 + ADR-076)
+
+Derive Priority and Effort from the description **silently** — NO `AskUserQuestion` (ADR-067 item 1 silent-derivation, category-4 silent-framework per ADR-044; preserves the lightweight 3-4-turn capture cost shape). This is one inference over text the agent has already read, NOT the `/wr-itil:manage-problem` ceremony.
+
+1. **Impact (1-5)** and **Likelihood (1-5)** — read the description against `RISK-POLICY.md`'s impact bands and assess how often / how broadly the harm manifests. `Severity = Impact × Likelihood`; `Priority` band follows the standard matrix. Likelihood is **honest field-risk only** — never inflate it to lift WSJF rank (ADR-076).
+2. **Effort (S/M/L/XL)** — derive from the described scope (files touched, cross-package, migration-heavy → larger), per ADR-067's t-shirt buckets.
+3. **Always a real value (ADR-026 grounding without deferral)** — when a comparable prior ticket informs the estimate, cite it inline (e.g. `— cf. P<NNN>`). When no comparable prior exists, **still commit to a real best-effort number** grounded in the description's own signals — do NOT append "not estimated" / "no prior data" or any other re-rate flag (that is a deferral; user correction 2026-06-24). A rough estimate from a thin description is honest estimation; a marker that says "I didn't really estimate this" is the rot this brick removes.
+
+Write the derived values into the template's `**Priority**` and `**Effort**` lines (replacing the `<…>` placeholders). Every captured ticket leaves Step 4a with a real Impact × Likelihood and a real Effort bucket — never a placeholder, never a deferral marker.
 
 ### 5. Write the file
 
@@ -341,19 +350,19 @@ After the commit, report:
   preflight_reason="$(wr-itil-check-deferred-placeholder-staleness "$PWD")"
   ```
 
-  See `/wr-itil:work-problems` SKILL.md Step 0c for the canonical contract on the two-axis trigger (count ≥ 3 deferred placeholders AND README age > 7 days); the threshold constants live in the helper. <!-- DEFERRED-PLACEHOLDER-STALENESS-CONTRACT-SOURCE: packages/itil/lib/check-deferred-placeholder-staleness.sh -->
+  See `/wr-itil:work-problems` SKILL.md Step 0c for the canonical contract on the two-axis trigger (count ≥ 3 ungrounded-rating tickets — the ADR-026 `not estimated` sentinel — AND README age > 7 days); the threshold constants live in the helper. <!-- DEFERRED-PLACEHOLDER-STALENESS-CONTRACT-SOURCE: packages/itil/lib/check-deferred-placeholder-staleness.sh -->
 
   | `preflight_reason`                                | Trailing-pointer shape                                                                                |
   |---------------------------------------------------|--------------------------------------------------------------------------------------------------------|
-  | `no-deferred-placeholders` / `below-threshold ...` / `fresh-readme ...` | Default (low-priority) pointer: *"Run `/wr-itil:review-problems` next to re-rate the deferred Priority/Effort placeholders on P\<NNN\>."* (README is now refreshed inline at Step 6 per P199 Option 2 — the pointer no longer names a README-refresh action in the default shape.) |
-  | `no-readme count=<N>`                              | **Highlighted (actionable) pointer**: *"⚠ `<N>` deferred-placeholder ticket(s) have accumulated AND `docs/problems/README.md` is missing/malformed — run `/wr-itil:review-problems` NOW to rebuild the README and re-rate placeholders."* (Fires only when README is genuinely missing/malformed despite this skill's inline refresh — a drift class the helper still surfaces.) |
-  | `stale-readme count=<N> age=<X>s threshold=<Y>s`   | **Highlighted (actionable) pointer**: *"⚠ `<N>` deferred-placeholder ticket(s) have accumulated AND the WSJF Rankings cadence is `<X>` days stale (> 7-day threshold) — run `/wr-itil:review-problems` NOW to re-rate placeholders."* (Inline refresh at Step 6 freshens the README mtime on every capture, so this shape now fires only when captures are absent for > 7 days — a real cadence-stale signal, not capture-driven drift.) |
+  | `no-deferred-placeholders` / `below-threshold ...` / `fresh-readme ...` | Default (low-priority) pointer: *"Run `/wr-itil:review-problems` next to re-rate the ungrounded (`not estimated — no prior data`) ratings."* (README is now refreshed inline at Step 6 per P199 Option 2 — the pointer no longer names a README-refresh action in the default shape.) |
+  | `no-readme count=<N>`                              | **Highlighted (actionable) pointer**: *"⚠ `<N>` ungrounded-rating ticket(s) (ADR-026 `not estimated` sentinel) have accumulated AND `docs/problems/README.md` is missing/malformed — run `/wr-itil:review-problems` NOW to rebuild the README and re-rate placeholders."* (Fires only when README is genuinely missing/malformed despite this skill's inline refresh — a drift class the helper still surfaces.) |
+  | `stale-readme count=<N> age=<X>s threshold=<Y>s`   | **Highlighted (actionable) pointer**: *"⚠ `<N>` ungrounded-rating ticket(s) (ADR-026 `not estimated` sentinel) have accumulated AND the WSJF Rankings cadence is `<X>` days stale (> 7-day threshold) — run `/wr-itil:review-problems` NOW to re-rate placeholders."* (Inline refresh at Step 6 freshens the README mtime on every capture, so this shape now fires only when captures are absent for > 7 days — a real cadence-stale signal, not capture-driven drift.) |
 
-  **Why conditional, not auto-dispatch** (ADR-032 + JTBD-001): capture-problem is intentionally lightweight per ADR-032 P155 amendment. Auto-dispatching review-problems from capture would re-introduce the ~10-turn ceremony the lightweight aside is engineered to avoid. The conditional pointer surfaces the signal "deferred-placeholder backlog has grown AND the cadence axis hit threshold" when both axes fire. The user picks when to absorb the re-rate cost.
+  **Why conditional, not auto-dispatch** (ADR-032 + JTBD-001): capture-problem is intentionally lightweight per ADR-032 P155 amendment. Auto-dispatching review-problems from capture would re-introduce the ~10-turn ceremony the lightweight aside is engineered to avoid. The conditional pointer surfaces the signal "ungrounded-rating backlog has grown AND the cadence axis hit threshold" when both axes fire. The user picks when to absorb the re-rate cost.
 
   **Fail-soft**: any error in the helper invocation MUST NOT block the report — fall back to the default pointer shape.
 
-The trailing pointer is **not optional** — it is the user-visible signal for deferred-placeholder re-rating cadence. The conditional highlight (P271) escalates the signal when the deferred-placeholder backlog AND the cadence axis both hit threshold. Drift here re-opens P271.
+The trailing pointer is **not optional** — it is the user-visible signal for ungrounded-rating re-rating cadence (P375 re-point: the count is now ADR-026 `not estimated` sentinels, not blanket deferred placeholders). The conditional highlight (P271) escalates the signal when the ungrounded-rating backlog AND the cadence axis both hit threshold. Drift here re-opens P271.
 
 <!-- @jtbd JTBD-001 (Enforce Governance Without Slowing Down — conditional highlight escalates the signal without forcing a flow break) -->
 

package/skills/capture-problem/test/capture-problem.bats

@@ -198,30 +198,30 @@ EOF
 }
 
 # ---------------------------------------------------------------------------
-# Skeleton-fill ticket shape — capture-problem writes a deferred-placeholder
-# ticket. Default Priority and Effort are flagged for re-rate at next review.
+# Skeleton-fill ticket shape — capture-problem DERIVES the Priority/Effort
+# rating at capture (P375 / ADR-032 amendment 2026-06-24). NO deferred false-
+# low placeholder. The ADR-026 sentinel `not estimated — no prior data` is the
+# residual re-rate signal, emitted only when no comparable prior grounds the
+# rating.
 # ---------------------------------------------------------------------------
 
-@test "capture-problem: skeleton-filled ticket carries the deferred-placeholder pattern" {
-  # Fixture mirrors the SKILL.md Step 4-5 prescribed write target — per
-  # ADR-031 per-state-subdir layout (`docs/problems/open/<NNN>-<slug>.md`),
-  # NOT the pre-ADR-031 flat shape (`docs/problems/<NNN>-<slug>.open.md`).
-  # P281 (template-refresh sub-shape) corrected the SKILL.md drift; this
-  # fixture exercises the now-canonical write path.
+@test "capture-problem: skeleton ticket carries a DERIVED rating, not a deferred false-low" {
   mkdir -p "$TMPROOT/docs/problems/open"
   TITLE="example-aside-finding"
   ID="200"
   TODAY=$(date -u +%Y-%m-%d)
   DESCRIPTION="Quick observation worth a ticket but not blocking."
 
-  # Mirror the SKILL.md skeleton-fill template.
+  # Mirror the SKILL.md Step 4a + Step 4 template: a derived rating (real
+  # Impact × Likelihood) — a real best-effort value, NO deferral marker of
+  # any kind (no "deferred — re-rate", no "not estimated" sentinel).
   cat > "$TMPROOT/docs/problems/open/${ID}-${TITLE}.md" <<EOF
 # Problem ${ID}: ${TITLE}
 
 **Status**: Open
 **Reported**: ${TODAY}
-**Priority**: 3 (Medium) — Impact: 3 x Likelihood: 1 (deferred — re-rate at next /wr-itil:review-problems)
-**Effort**: M (deferred — re-rate at next /wr-itil:review-problems)
+**Priority**: 6 (Medium) — Impact: 3 × Likelihood: 2
+**Effort**: M
 
 ## Description
 
@@ -231,49 +231,42 @@ ${DESCRIPTION}
 
 (deferred to investigation)
 
-## Workaround
-
-(deferred to investigation)
-
-## Impact Assessment
-
-- **Who is affected**: (deferred to investigation)
-- **Frequency**: (deferred to investigation)
-- **Severity**: (deferred to investigation)
-- **Analytics**: (deferred to investigation)
-
 ## Root Cause Analysis
 
 ### Investigation Tasks
 
-- [ ] Re-rate Priority and Effort at next /wr-itil:review-problems
 - [ ] Investigate root cause
 - [ ] Create reproduction test
 
-## Dependencies
-
-- **Blocks**: (none)
-- **Blocked by**: (none)
-- **Composes with**: (none)
-
 ## Related
 
 (captured via /wr-itil:capture-problem; expand at next investigation)
 EOF
 
-  # Behavioural assertions: ticket file has the load-bearing fields.
   TICKET="$TMPROOT/docs/problems/open/${ID}-${TITLE}.md"
   [ -f "$TICKET" ]
   run grep -F '**Status**: Open' "$TICKET"
   [ "$status" -eq 0 ]
-  # Description survives verbatim
   run grep -F "$DESCRIPTION" "$TICKET"
   [ "$status" -eq 0 ]
-  # Deferred placeholders flag re-rating
+
+  # The dropped false-low default MUST NOT appear.
   run grep -F 'deferred — re-rate at next /wr-itil:review-problems' "$TICKET"
-  [ "$status" -eq 0 ]
-  # Investigation Tasks nudges user to re-rate
+  [ "$status" -ne 0 ]
   run grep -F 'Re-rate Priority and Effort at next /wr-itil:review-problems' "$TICKET"
+  [ "$status" -ne 0 ]
+  run grep -F 'Likelihood: 1 (deferred' "$TICKET"
+  [ "$status" -ne 0 ]
+  # No "not estimated" sentinel either — that is just another deferral
+  # (user correction 2026-06-24). Every capture carries a real value.
+  run grep -F 'not estimated' "$TICKET"
+  [ "$status" -ne 0 ]
+
+  # A real derived Impact × Likelihood is present (not the buried false-low).
+  run grep -E 'Impact: [1-5] (×|x) Likelihood: [1-5]' "$TICKET"
+  [ "$status" -eq 0 ]
+  # And a real Effort bucket with no trailing deferral marker.
+  run grep -E '^\*\*Effort\*\*: (S|M|L|XL)$' "$TICKET"
   [ "$status" -eq 0 ]
 }
 

package/skills/capture-rfc/SKILL.md

@@ -210,7 +210,7 @@ stories: [<from --stories flag — ordered execution sequence; or [] if --storie
 
 ## Commits
 
-(maintained automatically — populated by the commit-message RFC trailer hook per ADR-060 Phase 1 item 12; lands in Slice 3 task B5.T9)
+(rendered from `git log --grep "Refs: RFC-<NNN>"` by `/wr-itil:manage-rfc` + `wr-itil-reconcile-rfcs` per ADR-085 — a git-log-derived view, not stored per-commit. At capture there are no commits yet.)
 
 ## Related
 

package/skills/capture-story/SKILL.md

@@ -201,7 +201,7 @@ problems: [P<NNN>, P<NNN>, ...]
 jtbd: [JTBD-<NNN>, JTBD-<NNN>, ...]
 rfcs: [<RFC-<NNN>, ...> or empty]
 story-maps: [<STORY-MAP-<NNN>, ...> or empty]
-estimated-effort: deferred
+estimated-effort: <S|M|L|XL — derived at capture per ADR-067 (real best-effort value, no deferral marker)>
 ---
 
 # STORY-<NNN>: <Title>
@@ -212,7 +212,7 @@ estimated-effort: deferred
 **JTBD**: <JTBD-<NNN> [, ...]>
 **RFCs**: <RFC-<NNN> [, ...]> or (none — populate at accepted transition per I7)
 **Story Maps**: <STORY-MAP-<NNN> [, ...]> or (none — populate at accepted transition per I8)
-**Estimated effort**: deferred (populate at accepted transition per I10 INVEST Estimable)
+**Estimated effort**: <S|M|L|XL> — derived at capture as a real best-effort value (P375 / ADR-032 amendment 2026-06-24; ADR-067 silent-derivation). NO `deferred` default and no "not estimated" marker — those are deferrals (user correction 2026-06-24). Confirmed/refined at the accepted transition per I10 INVEST Estimable.
 
 ## User value (required, INVEST Valuable)
 

package/skills/capture-story/test/capture-story-behavioural.bats

@@ -198,7 +198,7 @@ problems: [P170]
 jtbd: [JTBD-008]
 rfcs: []
 story-maps: []
-estimated-effort: deferred
+estimated-effort: M
 ---
 
 # STORY-${next_id}: ${description}

package/skills/manage-incident/SKILL.md

@@ -305,7 +305,7 @@ Commit the completed work per ADR-014 (governance skills commit their own work):
    - Incident mitigated: `docs(incidents): I<NNN> mitigated — <mitigation summary>`
    - Incident restored: `docs(incidents): I<NNN> restored — <action>`
    - Incident closed: `docs(incidents): close I<NNN>`
-4. If risk is above appetite: use `AskUserQuestion` to ask whether to commit anyway, remediate first, or park the work. This is the ADR-044 **category-3 (one-time-override)** surface — in incident-mitigation context the tech lead may need to ship a fix despite higher residual risk to restore service fast (JTBD-201); the rule (RISK-POLICY appetite) still stands but this specific case warrants an exception. The 3-option vocabulary (commit anyway / remediate / park) is the genuine category-3 surface. If `AskUserQuestion` is unavailable, skip the commit and report the uncommitted state clearly per ADR-013 Rule 6.
+4. If commit risk is above appetite: this is **framework-mediated, NOT a category-3 one-time-override ask** (P377/RFC-029 amendment 2026-06-24 — there is no incident carve-out). Per **ADR-042 Rule 1b (incident-context scoring)**: an active incident is a risk being realised (Likelihood already 5), so the incident-response change is scored against that live realised-risk baseline — weighing P(the change increases impact) vs P(it reduces impact & likelihood / restores service) + P(it introduces a new incident). If net risk-reducing, it takes the risk-reducing path (the `reducing` bypass — `RISK_BYPASS: reducing`) and proceeds, no ask. This is *better* for restore-service-fast (JTBD-201): a genuine hotfix clears via scoring with no consent gate mid-outage. If the change is NOT net-reducing, auto-remediate per ADR-042 Rule 1 or halt per Rule 5. **MUST NOT commit above appetite; MUST NOT `AskUserQuestion` "commit anyway".** If `AskUserQuestion` is unavailable, the ADR-013 Rule 6 fail-safe applies — skip the commit and report the uncommitted state.
 
 ### 15. Auto-release when changesets are queued (ADR-020)
 

package/skills/manage-problem/SKILL.md

@@ -1080,7 +1080,7 @@ Commit the completed work per ADR-014 (governance skills commit their own work):
    - Problem closed: `docs(problems): close P<NNN> <title>`
    - Review/re-rank: `docs(problems): review — re-rank priorities`
    - Fix implemented: `fix(<scope>): <description> (closes P<NNN>)` — include problem file changes (rename to `.verifying.md` + `## Fix Released` section) in the same commit per ADR-022
-5. If risk is above appetite: use `AskUserQuestion` to ask whether to commit anyway, remediate first, or park the work. If `AskUserQuestion` is unavailable, skip the commit and report the uncommitted state clearly (ADR-013 Rule 6 fail-safe). This applies only to the risk-above-appetite branch, not to the delegation-unavailable case above.
+5. If commit risk is above appetite: auto-apply scorer remediations per **ADR-042 Rule 1** incrementally until residual commit risk is within appetite (≤ 4/25), OR halt per ADR-042 Rule 5 if the scorer cannot converge. **The skill MUST NOT commit above appetite, and MUST NOT call `AskUserQuestion` to ask whether to commit anyway** (P377/RFC-029 amendment 2026-06-24 — above-appetite is framework-mediated, never a category-3 one-time-override; same invariant the push/release branch at Step 12 already enforces). The ADR-013 Rule 6 fail-safe (no `AskUserQuestion` available / non-interactive → skip the commit and report the uncommitted state) remains the terminal fallback. This applies only to the risk-above-appetite branch, not to the delegation-unavailable case above.
 
 **Multi-commit slice changeset discipline (P141 Phase 2)**: when a single logical fix lands across multiple ADR-014-grain commits targeting the same plugin (e.g. helper extraction in commit 1, callers wired in commit 2, SKILL note + transition in commit 3 — all `packages/<plugin>/`), author ONE changeset on the first commit in the slice. Subsequent same-plugin commits do NOT need their own changeset — the `itil-changeset-discipline.sh` hook's Check 2b recognises any `.changeset/*.md` (or held-window `docs/changesets-holding/*.md` entry) already in the unpushed slice scope (`origin/<base>..HEAD` + untracked + modified-not-staged) that targets `"@windyroad/<plugin>": <any-bump>` and allows. This eliminates the per-commit changeset ceremony that previously produced N redundant `.changeset/*.md` files for one logical release entry (changesets-action collapses bump-class at version-package time, so per-commit changesets rendered N near-identical CHANGELOG bullets for one release). Once a changeset hits `origin/<base>` (drained at release time), it no longer counts — a fresh changeset is required for the next slice. Cross-plugin coverage is NOT permitted: an `@windyroad/itil` changeset does not satisfy a `packages/voice-tone/` commit.
 

package/skills/manage-rfc/SKILL.md

@@ -135,6 +135,21 @@ git add docs/rfcs/RFC-<NNN>-<slug>.<new-status>.md
 
 **P057 staging trap rule**: re-stage explicitly after the Edit tool runs. `git mv` alone stages only the rename, not subsequent content edits.
 
+#### Auto-transition detection (P378/RFC-030 Piece 2; ADR-060 line 292)
+
+`proposed → in-progress` is **detected** by `itil-commit-trailer-transition-advisory.sh` (PostToolUse:Bash; the shared RFC+story commit-trailer trigger): when the first non-capture commit carrying `Refs: RFC-<NNN>` lands while the RFC is still `proposed`/`accepted`, the hook emits a stderr advisory. Per ADR-014 the hook does NOT perform the `git mv` (that would land outside the commit grain) — this skill (or an AFK orchestrator acting on the advisory) performs the transition. Mirrors the manage-story draft→in-progress trigger; both share the one hook. (This closes the "future commit-trailer-trigger hook (deferred)" that manage-rfc and manage-story both named but never built.)
+
+#### Render the `## Commits` section (P378/RFC-030 Piece 1; ADR-085)
+
+On every transition AND every `review` (Step 9), render the affected RFC's `## Commits` section from git history — it is a derived view (`git log --grep "Refs: RFC-NNN"`), NOT stored per-commit, so it must be regenerated skill-side (a PostToolUse hook can't write it without breaking the ADR-014 commit grain). Invoke the helper before staging the RFC file:
+
+```bash
+wr-itil-update-rfc-commits-section docs/rfcs/RFC-<NNN>-<slug>.<status>.md
+git add docs/rfcs/RFC-<NNN>-<slug>.<status>.md
+```
+
+`wr-itil-update-rfc-commits-section` is the ADR-049 `$PATH` shim for `packages/itil/scripts/update-rfc-commits-section.sh` (idempotent — a current section is a byte-stable no-op, so the `git add` is a no-op when nothing changed). This closes the never-built ADR-060 item 12; the section is honestly rendered-as-of-this-skill-run, never a false "maintained automatically" claim.
+
 #### README refresh on every transition (P062 mirror)
 
 After renaming + Editing + `git add`-ing the transitioned RFC file, regenerate `docs/rfcs/README.md` in-place reflecting the new filename set and the transitioned RFC's new Status. Stage the refreshed README with the same commit.

package/skills/manage-story/SKILL.md

@@ -116,7 +116,7 @@ For any transition `<from> → <to>`:
 
 The auto-transition logic fires in two contexts:
 
-- **`draft → in-progress`**: when the FIRST commit AFTER the story's capture commit lands with a `Refs: STORY-<NNN>` trailer AND a commit subject NOT prefixed with `feat(itil): capture STORY-`. Detected by a future commit-trailer-trigger hook (deferred to a hook-source slice); manual `manage-story <NNN> in-progress` invocation works in the interim.
+- **`draft → in-progress`**: when the FIRST commit AFTER the story's capture commit lands with a `Refs: STORY-<NNN>` trailer AND a commit subject NOT prefixed with `feat(itil): capture STORY-`. **Detected by `itil-commit-trailer-transition-advisory.sh`** (PostToolUse:Bash; the shared RFC+story commit-trailer trigger — P378/RFC-030 Piece 2, no longer "a future deferred hook"). Per ADR-014 the hook DETECTS + emits a stderr advisory; it does NOT perform the `git mv` itself (that would land outside the commit grain). The transition is performed by `manage-story <NNN> in-progress` (run on the advisory) or by an AFK orchestrator acting on it.
 
 - **`in-progress → done`**: when all `- [ ]` lines in `## Acceptance criteria` are ticked AND the linked RFC is `closed`. Detected at manage-rfc close-fire (the RFC's transition triggers a sweep of its `stories:` array; each in-progress story with all-criteria-ticked auto-transitions to `done`). Manual `manage-story <NNN> done` invocation works in the interim.
 

package/skills/mitigate-incident/SKILL.md

@@ -168,7 +168,7 @@ Per ADR-014, governance skills commit their own work.
 1. `git add` the renamed / modified incident file.
 2. Delegate to `wr-risk-scorer:pipeline` (subagent_type: `wr-risk-scorer:pipeline`) to assess the staged changes and create a bypass marker. If the subagent type is not available (spawned subagent surface), invoke `/wr-risk-scorer:assess-release` via the Skill tool instead — per ADR-015 it wraps the same pipeline subagent.
 3. `git commit -m "docs(incidents): I<NNN> mitigated — <action summary>"`.
-4. If risk is above appetite: use `AskUserQuestion` to ask whether to commit anyway, remediate first, or park the work. This is the ADR-044 **category-3 (one-time-override)** surface — the rule (RISK-POLICY appetite) still stands but this specific case in incident-mitigation context often warrants an exception (the tech lead may need to ship a mitigation despite higher residual risk to restore service fast — JTBD-201). The 3-option vocabulary is the genuine category-3 surface. If `AskUserQuestion` is unavailable (rare in incident context — incident skills are interactive by definition), skip the commit and report the uncommitted state clearly per ADR-013 Rule 6.
+4. If commit risk is above appetite: this is **framework-mediated, NOT a category-3 one-time-override ask** (P377/RFC-029 — no incident carve-out). Per **ADR-042 Rule 1b (incident-context scoring)**: an active incident is a risk being realised (Likelihood already 5); score the mitigation against that live realised-risk baseline — P(increases impact) vs P(reduces impact & likelihood / restores service) + P(introduces a new incident). Net risk-reducing → it takes the risk-reducing path (`RISK_BYPASS: reducing`) and proceeds, no ask — exactly the restore-service-fast (JTBD-201) case, cleared via scoring not a consent gate. Not net-reducing → auto-remediate (ADR-042 Rule 1) or halt (Rule 5). **MUST NOT commit above appetite; MUST NOT `AskUserQuestion` "commit anyway".** If `AskUserQuestion` is unavailable, ADR-013 Rule 6 fail-safe — skip + report.
 
 ### 9. Auto-release when changesets are queued (ADR-020)
 

package/skills/restore-incident/SKILL.md

@@ -137,7 +137,7 @@ Per ADR-014, governance skills commit their own work.
 1. `git add` the renamed / modified incident file.
 2. Delegate to `wr-risk-scorer:pipeline` (subagent_type: `wr-risk-scorer:pipeline`) to assess the staged changes and create a bypass marker. If the subagent type is not available (spawned subagent surface), invoke `/wr-risk-scorer:assess-release` via the Skill tool instead — per ADR-015 it wraps the same pipeline subagent.
 3. `git commit -m "docs(incidents): I<NNN> restored — <verification signal summary>"`.
-4. If risk is above appetite: use `AskUserQuestion` to ask whether to commit anyway, remediate first, or park the work. If `AskUserQuestion` is unavailable, skip the commit and report the uncommitted state clearly.
+4. If commit risk is above appetite: **framework-mediated, no ask** (P377/RFC-029 — no incident carve-out). Per **ADR-042 Rule 1b**: score the restore action against the live realised-risk baseline (incident Likelihood already 5) — net risk-reducing actions take the risk-reducing path (`RISK_BYPASS: reducing`) and proceed; otherwise auto-remediate (Rule 1) or halt (Rule 5). **MUST NOT commit above appetite; MUST NOT `AskUserQuestion` "commit anyway".** If `AskUserQuestion` is unavailable, ADR-013 Rule 6 fail-safe — skip the commit and report the uncommitted state.
 
 ### 9. Auto-release when changesets are queued (ADR-020)
 

package/skills/transition-problem/SKILL.md

@@ -307,7 +307,7 @@ Omit `docs/problems/README-history.md` from the path list when the P134 rotation
 - Known Error → Verification Pending (standalone, no fix riding with it): `docs(problems): P<NNN> verification pending — <release marker>`
 - Verification Pending → Closed: `docs(problems): close P<NNN> <title>`
 
-If risk is above appetite and `AskUserQuestion` is available: ask whether to commit anyway, remediate first, or park the work. If `AskUserQuestion` is unavailable (AFK), skip the commit and report the uncommitted state (ADR-013 Rule 6 fail-safe). This applies only to the risk-above-appetite branch, not to the delegation-unavailable case above.
+If commit risk is above appetite: auto-apply scorer remediations per **ADR-042 Rule 1** until residual risk is within appetite, OR halt per ADR-042 Rule 5 if the scorer cannot converge. **MUST NOT commit above appetite; MUST NOT call `AskUserQuestion` to ask whether to commit anyway** (P377/RFC-029 — above-appetite is framework-mediated, not a one-time-override). If `AskUserQuestion` is unavailable (AFK), the ADR-013 Rule 6 fail-safe applies as the terminal fallback: skip the commit and report the uncommitted state. This applies only to the risk-above-appetite branch, not to the delegation-unavailable case above.
 
 ### 9. Report the outcome
 

package/skills/transition-problems/SKILL.md

@@ -212,7 +212,7 @@ ONE commit covers: every surviving renamed ticket file + every Status edit + eve
 - Mixed-destination batch: `docs(problems): batch transition — P063 close, P070 known-error, P094 verifying (3 tickets)`
 - If the batch destination is `verifying` and rides with a fix commit, the commit-message scope follows the singular's pattern: `fix(<scope>): <description> (closes P063, P067)` — but the batch surface is unusual in the riding-with-fix shape; the canonical caller is verification-close housekeeping, not fix-release.
 
-If risk is above appetite and `AskUserQuestion` is available: ask whether to commit anyway, remediate first, or park. If `AskUserQuestion` is unavailable (AFK), skip the commit and report the uncommitted state per ADR-013 Rule 6 fail-safe — apply the same rule the singular does at the same gate.
+If commit risk is above appetite: auto-apply scorer remediations per **ADR-042 Rule 1** until within appetite, OR halt per ADR-042 Rule 5. **MUST NOT commit above appetite; MUST NOT call `AskUserQuestion` to ask whether to commit anyway** (P377/RFC-029 — framework-mediated, not a one-time-override). If `AskUserQuestion` is unavailable (AFK), the ADR-013 Rule 6 fail-safe applies — skip the commit and report the uncommitted state — apply the same rule the singular does at the same gate.
 
 ### 5. Report the outcome