@windyroad/itil 0.55.4 → 0.55.5-preview.850

package/.claude-plugin/plugin.json

@@ -497,5 +497,5 @@
     }
   },
   "name": "wr-itil",
-  "version": "0.55.4"
+  "version": "0.55.5"
 }

package/hooks/hooks.json

@@ -61,6 +61,10 @@
       {
         "matcher": "Write|Edit|MultiEdit",
         "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-fictional-defer-detect.sh" }]
+      },
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/itil-deferral-cadence-gate.sh" }]
       }
     ],
     "Stop": [

package/hooks/itil-deferral-cadence-gate.sh

@@ -0,0 +1,181 @@
+#!/bin/bash
+# P375 — wr-itil PostToolUse:Write|Edit|MultiEdit hook.
+#
+# The ratified Option-C "authoring-time enforcement gate" (CORE SLICE,
+# advisory rollout). P375's root cause: the repo conflates a "named
+# re-entry point" (a /skill, a lifecycle transition, "next review") with
+# a SELF-FIRING cadence. A deferral that names `/wr-itil:manage-rfc`
+# rots because nothing self-fires manage-rfc on that artefact ("BUT
+# NOTHING TRIGGERS THAT WORK!!!", 2026-06-23). The correct rot test: a
+# deferral is legal only if its trigger chain is reachable from a
+# SELF-FIRING event (a hook, SessionStart, PreToolUse/PostToolUse, a CI
+# workflow, cron, or a work-problems pre-flight). ADR-084's SessionStart
+# census (Option A) only SURFACES accumulated rot; this gate attacks the
+# root cause — it fires at AUTHORING time, the moment a new uncadenced
+# deferral is written.
+#
+# Detection (diff-aware — scans the NEWLY-authored text only, so
+# descriptive prose already on disk never re-triggers):
+#   1. tool_name is Write/Edit/MultiEdit AND file_path is a SHIPPED
+#      authoring surface — SKILL.md, docs/decisions/*.md (ADRs),
+#      docs/rfcs/*.md (RFCs), or a hook *.sh — and is NOT under
+#      docs/problems/ (tickets descriptively narrate deferrals; highest
+#      false-positive surface; already covered by the ADR-084 census).
+#   2. The new text (Edit new_string / Write content / MultiEdit joined
+#      new_strings) introduces a deferral phrasing (DEFER_RE).
+#   3. Within the +/-5 line window of the match there is NO cadence
+#      annotation naming a SELF-FIRING trigger (CADENCE_RE) — an explicit
+#      `<!-- cadence: <trigger> -->` comment is the recommended carrier,
+#      but a bare prose mention of a self-firing surface also satisfies.
+#
+# THE LOAD-BEARING P375 REFINEMENT vs the P234 sibling
+# (itil-fictional-defer-detect.sh): a bare named on-demand skill
+# (/wr-foo:bar) or a bare ticket ID (Pnnn / RFC-nnn / ADR-nnn) does NOT
+# satisfy the cadence requirement — that bare-naming IS the conflation
+# P375 names illegal. So CADENCE_RE deliberately OMITS skill-invocation
+# and ticket-ID forms (which the P234 hook WRONGLY accepts).
+#
+# CORE-SLICE BOUNDARY (named loudly per the architect review): the gate
+# checks the cadence names a self-firing CLASS — it does NOT validate
+# that the named trigger actually EXISTS or fires on that artefact (the
+# transitive-reachability graph is a DEFERRED later slice; <!-- cadence:
+# retrospective-deferral-census.sh -->). Citing a plausible-but-fictional
+# hook name passes this slice; the graph check closes that gap later.
+#
+# Advisory only — NEVER blocks (exit 0 always). Per ADR-040/045
+# declarative-first + ADR-013 Rule 6 fail-open + the P375 architect
+# review (advisory-first per ADR-057 staged rollout; escalation to a
+# PreToolUse block is a queued user-owned rollout-mode decision once the
+# advisory's false-positive rate is measured). AFK self-suppress:
+# WR_SUPPRESS_DEFERRAL_CADENCE_GATE=1 (mirrors the census's
+# WR_SUPPRESS_DEFERRAL_CENSUS — advisory, valuable, but an AFK loop
+# authoring governance prose should be able to mute it).
+#
+# References:
+#   P375     — driver (this gate is the Option-C root-cause fix).
+#   P234     — the PostToolUse sibling (retro-only, accepts skills/IDs);
+#              converging the two onto a shared vocabulary is a tracked
+#              P375 follow-on, NOT done here (ADR-002/003 self-containment
+#              — itil keeps its own copy of the deferral vocabulary).
+#   ADR-084  — the surfacing-only census (Option A) this gate complements.
+#   ADR-040  — declarative-first; advisory over hard block.
+#   ADR-045  — hook injection budget; advisory ~600 bytes, ceiling 1000.
+#   ADR-013  — Rule 6 fail-open on empty/malformed stdin.
+#   ADR-052  — behavioural bats live alongside.
+#   ADR-057  — staged advisory-first rollout for cluster-shaped rules.
+
+# Self-suppress (AFK). Only the literal "1" suppresses.
+[ "${WR_SUPPRESS_DEFERRAL_CADENCE_GATE:-}" = "1" ] && exit 0
+
+# Per-surface configuration (copy-and-retarget extensible, like the
+# P234 sibling: adjust the regex vars below).
+DEFER_RE='deferred to|deferred pending|defer pending|pending review|re-rate at next|\(deferred|: deferred|deferred[ ]*[—.,;:-]|lands in [Ss]lice|future slice|flesh(ed)? out later|next review|when ready'
+# Cadence-satisfying SELF-FIRING citations. NOTE the deliberate absence
+# of skill-invocation (/wr-foo:bar) and ticket-ID (Pnnn/RFC-nnn/ADR-nnn)
+# — those are the P375 conflation and do NOT satisfy the cadence.
+HOOK_PATH_RE='[A-Za-z0-9_./-]+\.sh\b'
+SESSIONSTART_RE='SessionStart'
+TOOLUSE_RE='PreToolUse|PostToolUse'
+CI_WORKFLOW_RE='\.github/workflows/'
+CRON_RE='\bcron\b'
+PREFLIGHT_RE='work-problems Step|pre-flight|Step 0[a-z]'
+
+INPUT=$(cat 2>/dev/null || true)
+[ -n "$INPUT" ] || exit 0
+
+TOOL_NAME=$(echo "$INPUT" | python3 -c "
+import sys, json
+try:
+    print(json.load(sys.stdin).get('tool_name', ''))
+except Exception:
+    print('')
+" 2>/dev/null || echo "")
+
+case "$TOOL_NAME" in
+  Write|Edit|MultiEdit) ;;
+  *) exit 0 ;;
+esac
+
+FILE_PATH=$(echo "$INPUT" | python3 -c "
+import sys, json
+try:
+    print(json.load(sys.stdin).get('tool_input', {}).get('file_path', ''))
+except Exception:
+    print('')
+" 2>/dev/null || echo "")
+
+[ -n "$FILE_PATH" ] || exit 0
+
+# Scope: shipped authoring surfaces only; docs/problems/ excluded.
+case "$FILE_PATH" in
+  */docs/problems/*|docs/problems/*) exit 0 ;;
+esac
+if ! echo "$FILE_PATH" | grep -qE '(^|/)SKILL\.md$|/docs/decisions/.*\.md$|docs/decisions/.*\.md$|/docs/rfcs/.*\.md$|docs/rfcs/.*\.md$|\.sh$'; then
+  exit 0
+fi
+
+# Extract the NEWLY-authored text (diff-aware). Write content; Edit
+# new_string; MultiEdit joined new_strings.
+NEW_TEXT=$(echo "$INPUT" | python3 -c "
+import sys, json
+try:
+    ti = json.load(sys.stdin).get('tool_input', {})
+    if 'content' in ti:
+        print(ti.get('content', ''))
+    elif 'new_string' in ti:
+        print(ti.get('new_string', ''))
+    elif 'edits' in ti:
+        print('\n'.join(e.get('new_string', '') for e in ti.get('edits', [])))
+    else:
+        print('')
+except Exception:
+    print('')
+" 2>/dev/null || echo "")
+
+[ -n "$NEW_TEXT" ] || exit 0
+
+# Buffer the new text so we can do the +/-5 line window check.
+SCAN=$(mktemp 2>/dev/null) || exit 0
+printf '%s\n' "$NEW_TEXT" > "$SCAN"
+TOTAL_LINES=$(wc -l < "$SCAN" | tr -d ' ')
+
+MATCHES=$(grep -inE "$DEFER_RE" "$SCAN" 2>/dev/null || true)
+if [ -z "$MATCHES" ]; then
+  rm -f "$SCAN"
+  exit 0
+fi
+
+FICTIONAL_LINE=""
+FICTIONAL_PHRASE=""
+
+while IFS= read -r row; do
+  [ -n "$row" ] || continue
+  LN="${row%%:*}"
+  text="${row#*:}"
+
+  START=$((LN - 5)); [ "$START" -lt 1 ] && START=1
+  END=$((LN + 5)); [ "$END" -gt "$TOTAL_LINES" ] && END="$TOTAL_LINES"
+  WINDOW=$(sed -n "${START},${END}p" "$SCAN" 2>/dev/null || true)
+
+  # Self-firing cadence citation present? → cadenced, skip.
+  echo "$WINDOW" | grep -qE "$HOOK_PATH_RE"   && continue
+  echo "$WINDOW" | grep -qE "$SESSIONSTART_RE" && continue
+  echo "$WINDOW" | grep -qE "$TOOLUSE_RE"     && continue
+  echo "$WINDOW" | grep -qE "$CI_WORKFLOW_RE" && continue
+  echo "$WINDOW" | grep -qE "$CRON_RE"        && continue
+  echo "$WINDOW" | grep -qE "$PREFLIGHT_RE"   && continue
+
+  # No self-firing citation → uncadenced deferral. Record the first.
+  FICTIONAL_LINE="$LN"
+  FICTIONAL_PHRASE=$(echo "$text" | tr -s ' ' ' ' | sed 's/^[[:space:]]*//' | cut -c1-70)
+  break
+done <<< "$MATCHES"
+
+rm -f "$SCAN"
+
+[ -n "$FICTIONAL_LINE" ] || exit 0
+
+# Advisory to stderr. ADR-045 budget (~600 bytes target). exit 0 always.
+echo "P375 ADVISORY: uncadenced deferral authored in ${FILE_PATH} — \"${FICTIONAL_PHRASE}\". A named on-demand re-entry point (/wr-foo:bar, a lifecycle transition, \"next review\") is NOT a cadence — nothing self-fires it, so the work rots. Add a cadence annotation naming a SELF-FIRING trigger within +/-5 lines: <!-- cadence: <hook *.sh | SessionStart | PreToolUse/PostToolUse | .github/workflows/ | cron | work-problems pre-flight> --> OR do the work now. (Core slice checks the trigger CLASS, not that it exists.) See P375." >&2
+
+exit 0

package/hooks/test/itil-deferral-cadence-gate.bats

@@ -0,0 +1,187 @@
+#!/usr/bin/env bats
+
+# P375 — itil-deferral-cadence-gate.sh PostToolUse:Write|Edit|MultiEdit
+# advisory hook. The ratified Option-C "authoring-time enforcement gate"
+# (core slice, advisory rollout per ADR-057 staged-rollout + the P375
+# architect review 2026-06-28).
+#
+# The gate fires at AUTHORING time on the NEWLY-authored text (Edit
+# new_string / Write content / MultiEdit concatenated new_strings —
+# diff-aware so descriptive prose already on disk never re-triggers) of
+# a SHIPPED authoring surface (SKILL.md, docs/decisions/*.md ADRs,
+# docs/rfcs/*.md RFCs, hook *.sh). When the new text introduces an
+# uncadenced-deferral phrasing (`deferred to <on-demand re-entry>`,
+# `pending review`, `re-rate at next`, `(deferred …`, `next review`,
+# `when ready`, `lands in Slice N`) WITHOUT a cadence annotation naming
+# a SELF-FIRING trigger within the +/-5 line window, it emits a stderr
+# advisory citing P375 + the remedy.
+#
+# THE LOAD-BEARING P375 REFINEMENT vs the P234 sibling
+# (itil-fictional-defer-detect.sh): a bare named on-demand skill
+# (/wr-foo:bar) or a bare ticket ID (Pnnn / RFC-nnn / ADR-nnn) does NOT
+# satisfy the cadence requirement — naming an on-demand re-entry point
+# and treating it as a cadence IS the exact conflation P375 captures
+# ("BUT NOTHING TRIGGERS THAT WORK!!!"). Only a self-firing-CLASS
+# citation satisfies: a hook *.sh, SessionStart, PreToolUse/PostToolUse,
+# .github/workflows/ (CI), cron, or a work-problems Step-0x / pre-flight
+# reference. The existing P234 hook WRONGLY accepts skills + ticket IDs;
+# this hook does not.
+#
+# Core-slice boundary (architect refinement 1, named loudly): the gate
+# checks the cadence annotation names a self-firing-CLASS trigger — it
+# does NOT validate that the named trigger actually exists / fires (the
+# transitive-reachability graph is a deferred later slice). docs/problems/
+# tickets are EXCLUDED (they descriptively narrate deferrals — highest
+# false-positive surface, already covered by the ADR-084 census).
+#
+# Advisory only — NEVER blocks (exit 0 always), per ADR-040/045
+# declarative-first + ADR-013 Rule 6 fail-open. Behavioural per ADR-052
+# (asserts emitted stderr, never source-greps the hook). Hermetic per
+# P391 (unsets inherited suppress vars in setup).
+
+setup() {
+  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
+  HOOK="$REPO_ROOT/packages/itil/hooks/itil-deferral-cadence-gate.sh"
+  # P391 hermeticity: AFK iters export suppress vars that would poison
+  # the advisory-fires assertions. Strip them for the test process.
+  unset WR_SUPPRESS_DEFERRAL_CADENCE_GATE
+  unset WR_SUPPRESS_OVERSIGHT_NUDGE
+}
+
+# Emit a PostToolUse stdin payload for an Edit tool call.
+# $1 = file_path, $2 = new_string (the newly-authored text).
+emit_edit() {
+  jq -n --arg p "$1" --arg n "$2" '{
+    session_id: "deferral-cadence-test",
+    tool_name: "Edit",
+    tool_input: { file_path: $p, old_string: "X", new_string: $n },
+    tool_response: { success: true }
+  }'
+}
+
+# Emit a PostToolUse stdin payload for a Write tool call.
+emit_write() {
+  jq -n --arg p "$1" --arg c "$2" '{
+    session_id: "deferral-cadence-test",
+    tool_name: "Write",
+    tool_input: { file_path: $p, content: $c },
+    tool_response: { success: true }
+  }'
+}
+
+fires() { [[ "$output" == *"P375"* ]] || [[ "$stderr" == *"P375"* ]]; }
+silent() { [[ "$output" != *"P375"* ]] && [[ "$stderr" != *"P375"* ]]; }
+
+# --- Positive: uncadenced deferral authored → advisory fires ---
+
+@test "fire: SKILL.md deferral citing a bare on-demand skill (the P375 conflation) fires" {
+  # This is the case the P234 sibling WRONGLY allows — a named on-demand
+  # skill is NOT a self-firing cadence.
+  run bash "$HOOK" <<<"$(emit_edit packages/foo/skills/bar/SKILL.md \
+    'Full scope deferred to /wr-itil:manage-rfc accepted transition.')"
+  [ "$status" -eq 0 ]
+  fires
+}
+
+@test "fire: ADR new_string deferral with no citation at all fires" {
+  run bash "$HOOK" <<<"$(emit_edit docs/decisions/099-thing.proposed.md \
+    'Considered Options and Consequences deferred — flesh out later.')"
+  [ "$status" -eq 0 ]
+  fires
+}
+
+@test "fire: RFC deferral citing only a bare ticket ID (not a cadence) fires" {
+  # A ticket ID is an audit annotation, not a self-firing trigger.
+  run bash "$HOOK" <<<"$(emit_edit docs/rfcs/RFC-099-thing.proposed.md \
+    'Scope deferred to next review per P375.')"
+  [ "$status" -eq 0 ]
+  fires
+}
+
+@test "fire: Write of a hook .sh whose content carries an uncadenced deferral fires" {
+  run bash "$HOOK" <<<"$(emit_write packages/foo/hooks/foo.sh \
+    '# TODO pending review when ready; not wired yet.')"
+  [ "$status" -eq 0 ]
+  fires
+}
+
+@test "fire: deferral with a cadence comment that names an ON-DEMAND skill still fires" {
+  # The annotation carrier is fine but its value must name a self-firing
+  # CLASS — naming an on-demand skill inside the comment does not help.
+  run bash "$HOOK" <<<"$(emit_edit packages/foo/skills/bar/SKILL.md \
+    'Tasks deferred. <!-- cadence: /wr-itil:manage-rfc accepted -->')"
+  [ "$status" -eq 0 ]
+  fires
+}
+
+# --- Negative: cadenced deferral or out-of-scope → silent ---
+
+@test "allow: deferral citing a self-firing hook .sh in window exits silent" {
+  run bash "$HOOK" <<<"$(emit_edit packages/foo/skills/bar/SKILL.md \
+    'Re-rate deferred; surfaced every session by retrospective-deferral-census.sh.')"
+  [ "$status" -eq 0 ]
+  silent
+}
+
+@test "allow: deferral with an explicit cadence annotation naming PostToolUse exits silent" {
+  run bash "$HOOK" <<<"$(emit_edit docs/decisions/099-thing.proposed.md \
+    'Section deferred. <!-- cadence: PostToolUse itil-foo-gate.sh fires on author -->')"
+  [ "$status" -eq 0 ]
+  silent
+}
+
+@test "allow: deferral citing SessionStart self-firing surface exits silent" {
+  run bash "$HOOK" <<<"$(emit_edit docs/rfcs/RFC-099-thing.proposed.md \
+    'Drain deferred; the SessionStart nudge re-surfaces it every session.')"
+  [ "$status" -eq 0 ]
+  silent
+}
+
+@test "allow: deferral citing a CI workflow exits silent" {
+  run bash "$HOOK" <<<"$(emit_edit packages/foo/skills/bar/SKILL.md \
+    'Validation deferred to .github/workflows/check.yml on every push.')"
+  [ "$status" -eq 0 ]
+  silent
+}
+
+@test "allow: deferral in a docs/problems/ ticket (excluded surface) exits silent" {
+  run bash "$HOOK" <<<"$(emit_edit docs/problems/open/099-thing.open.md \
+    'Severity deferred to investigation; expand at next review.')"
+  [ "$status" -eq 0 ]
+  silent
+}
+
+@test "allow: deferral phrasing in a non-authoring file (.ts) exits silent" {
+  run bash "$HOOK" <<<"$(emit_edit packages/foo/src/index.ts \
+    '// deferred to next review — TODO')"
+  [ "$status" -eq 0 ]
+  silent
+}
+
+@test "allow: authoring-surface edit with NO deferral phrasing exits silent" {
+  run bash "$HOOK" <<<"$(emit_edit packages/foo/skills/bar/SKILL.md \
+    'This step validates the marker and proceeds to Step 2.')"
+  [ "$status" -eq 0 ]
+  silent
+}
+
+# --- Robustness ---
+
+@test "fail-open: empty stdin exits 0 silent" {
+  run bash "$HOOK" <<<""
+  [ "$status" -eq 0 ]
+  silent
+}
+
+@test "fail-open: malformed JSON stdin exits 0 silent" {
+  run bash "$HOOK" <<<"{not json"
+  [ "$status" -eq 0 ]
+  silent
+}
+
+@test "suppress: WR_SUPPRESS_DEFERRAL_CADENCE_GATE=1 silences the advisory" {
+  run env WR_SUPPRESS_DEFERRAL_CADENCE_GATE=1 bash "$HOOK" <<<"$(emit_edit \
+    packages/foo/skills/bar/SKILL.md 'deferred to /wr-itil:manage-rfc accepted')"
+  [ "$status" -eq 0 ]
+  silent
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/itil",
-  "version": "0.55.4",
+  "version": "0.55.5-preview.850",
   "description": "ITIL-aligned IT service management for Claude Code (problem, and future incident/change skills)",
   "bin": {
     "windyroad-itil": "./bin/install.mjs"

package/skills/capture-rfc/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: wr-itil:capture-rfc
-description: Lightweight RFC-capture skill for aside-invocation during foreground work — mandatory problem-trace per ADR-060 I1 invariant, skeleton RFC file, single commit per capture, no inline README refresh. Defers full duplicate analysis and README refresh to /wr-itil:manage-rfc. Use this when the user (or agent) wants to capture an RFC quickly with a clear problem trace. For full lifecycle management, use /wr-itil:manage-rfc.
+description: Lightweight RFC-capture skill for aside-invocation during foreground work — mandatory problem-trace per ADR-060 I1 invariant, skeleton RFC file by default (or a fully-authored Scope + Tasks under the `--fix-time` flag, per ADR-073), single commit per capture, no inline README refresh. Defers full duplicate analysis and README refresh to /wr-itil:manage-rfc. Use this when the user (or agent) wants to capture an RFC quickly with a clear problem trace. For full lifecycle management, use /wr-itil:manage-rfc.
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob
 ---
 
@@ -10,7 +10,7 @@ Capture a Request for Change (RFC) ticket quickly during foreground work. Lightw
 
 This skill is one half of the capture-then-manage RFC framework introduced by ADR-060 (Problem-RFC-Story framework with mandatory problem-trace and unified problem ontology, accepted 2026-05-05). The other half is `/wr-itil:manage-rfc` (heavyweight intake + lifecycle management).
 
-**Related JTBDs**: JTBD-008 (primary — Decompose a Fix Into Coordinated Changes; this skill IS the capture-time decomposition surface), JTBD-001 (extended scope — change-set-level governance), JTBD-101 (atomic-fix-adopter — every fix goes through an RFC per ADR-071; capture-rfc is invoked deliberately, not auto-fired, because RFC scope is direction-setting per ADR-073 — NOT because atomic fixes skip ceremony).
+**Related JTBDs**: JTBD-008 (primary — Decompose a Fix Into Coordinated Changes; this skill IS the capture-time decomposition surface), JTBD-001 (extended scope — change-set-level governance), JTBD-101 (atomic-fix-adopter — every fix goes through an RFC per ADR-071). capture-rfc is invoked two ways: (1) the **user-aside path** (deliberate, default skeleton — the user fleshes scope out later at `/wr-itil:manage-rfc accepted`); and (2) the **fix-time auto-create path** (`--fix-time`), where the I13 propose-fix gate auto-fires it on an RFC-less Known Error and it **authors the full RFC** from the traced problem. Per the ADR-073 P399 amendment, fix-time RFC scope is **framework-mediated** (derived from the already-pinned problem + ADR-071, not direction-setting), so auto-firing with full authoring is correct — NOT a re-ask of a decided question (P132 / inverse-P078).
 
 ## Output Formatting
 
@@ -35,6 +35,8 @@ When referencing RFC IDs, problem IDs, ADR IDs, JTBD IDs, or story IDs in prose
 
 **Optional flag (Phase 2)**: `--stories STORY-<NNN>,STORY-<NNN>,...` — ORDERED execution sequence per ADR-060 line 262. Cardinality 0..N: an RFC whose work is not decomposed into stories OMITS the flag and capture-rfc populates `stories: []` in frontmatter (a structural state, NOT a reduced-ceremony path — every fix goes through an RFC per ADR-071); story-decomposed RFCs supply the ordered list. The flag accepts STORY-IDs that don't yet resolve to files (forward-reference is permitted at capture; the existence check happens at `manage-rfc <NNN> accepted` transition per ADR-060 working-the-problem flow line 304).
 
+**Optional flag (fix-time authoring, ADR-073 P399)**: `--fix-time` — switches Step 5 from the deferred-placeholder template to **full authoring**: capture-rfc reads the traced problem ticket(s) and authors a populated `## Scope` (the fix being proposed + chosen implementation approach as prose) and a real `## Tasks` decomposition from the problem's `## Root Cause Analysis` + `## Fix Strategy`, instead of the `(deferred — populate at manage-rfc accepted)` placeholders. Set by the I13 propose-fix gate's auto-create branch (`/wr-itil:manage-problem` + `/wr-itil:work-problems`); the user-aside path omits it. The authored RFC still carries NO Considered-Options block (ADR-070 — chosen-path prose only) and is still born `human-oversight: unconfirmed` (ratified at `manage-rfc accepted`). Composes with `--stories`.
+
 ```
 /wr-itil:capture-rfc P168 Pipeline consume-catalog and bootstrap-from-reports — multi-commit retrofit
 /wr-itil:capture-rfc P038,P064 Voice-and-tone gates on external comms — coordinated rollout across changeset/PR/release-notes
@@ -54,6 +56,7 @@ This skill has **one direction-setting AskUserQuestion** (problem-trace, when ar
 | RFC ID allocation | Mechanical: `max(local, origin) + 1`, three-digit padded | silent-mechanical |
 | Title kebab-slug | Mechanical: first 8-10 non-stopword tokens of description | silent-mechanical |
 | Title prose / scope summary refinement | Optional `AskUserQuestion`; silent-default to derived form when unavailable | taste |
+| Fix-time Scope/Tasks authoring (`--fix-time`) | Framework-mediated: author `## Scope` + `## Tasks` from the traced problem's RCA + Fix Strategy. NO `AskUserQuestion` — the scope is *derived* from already-pinned ADR-071 direction, not new direction-setting (ADR-073 § ADR-044 reclassification, P399). Born `unconfirmed`; ratified at `manage-rfc accepted` | silent-framework |
 | File write / frontmatter | Mechanical: shape per `docs/rfcs/README.md` § RFC body structure | silent-mechanical |
 | Single commit | Mechanical: `docs(rfcs): capture RFC-<NNN> <title>` | silent-mechanical |
 | Empty arguments | Halt-with-stderr-directive: print "capture-rfc requires `<problem-trace> <description>` — invoke /wr-itil:manage-rfc instead for the full intake flow" and exit. AFK orchestrators MUST NOT invoke capture-rfc with empty arguments. | n/a |
@@ -85,12 +88,14 @@ The arguments must begin with a problem-trace token (`P<NNN>` or comma-separated
 
 ```bash
 # Tokenise: first non-flag token = problem-trace; rest = description.
-# Optional --stories STORY-NNN,STORY-NNN,... flag may appear anywhere.
+# Optional --stories STORY-NNN,STORY-NNN,... and --fix-time flags may appear anywhere.
 stories_trace=""
+fix_time=0
 positional=()
 while [ $# -gt 0 ]; do
   case "$1" in
     --stories) stories_trace="$2"; shift 2 ;;
+    --fix-time) fix_time=1; shift ;;
     *) positional+=("$1"); shift ;;
   esac
 done
@@ -202,11 +207,13 @@ stories: [<from --stories flag — ordered execution sequence; or [] if --storie
 
 ## Scope
 
-(deferred — populate at /wr-itil:manage-rfc accepted transition)
+<default (user-aside path): (deferred — populate at /wr-itil:manage-rfc accepted transition)>
+<--fix-time path (ADR-073 P399): AUTHOR this from the traced problem — a real paragraph describing the fix being proposed (the change(s) the Known Error needs) plus the chosen implementation approach as prose. Derive it from the problem's `## Root Cause Analysis` + `## Fix Strategy`. Do NOT enumerate rejected alternatives or add a Considered-Options block (ADR-070 — chosen-path prose only).>
 
 ## Tasks
 
-- [ ] (deferred — populate at /wr-itil:manage-rfc accepted transition)
+<default (user-aside path): - [ ] (deferred — populate at /wr-itil:manage-rfc accepted transition)>
+<--fix-time path (ADR-073 P399): AUTHOR a real ordered task decomposition (one-purpose-per-commit per ADR-014) from the Fix Strategy — the concrete steps to land the fix, as `- [ ]` checkboxes.>
 
 ## Commits
 
@@ -217,7 +224,10 @@ stories: [<from --stories flag — ordered execution sequence; or [] if --storie
 (captured via /wr-itil:capture-rfc; expand at next /wr-itil:manage-rfc invocation)
 ```
 
-The deferred-section pattern matches `capture-problem`'s placeholder approach — the captured RFC is intentionally minimal; full scope and task decomposition land at the manage-rfc accepted-transition step.
+**Mode branch (`fix_time` from Step 1):**
+
+- **`fix_time=0` (user-aside path, default)**: write the deferred placeholders verbatim. The deferred-section pattern matches `capture-problem`'s placeholder approach — the captured RFC is intentionally minimal; full scope and task decomposition land at the manage-rfc accepted-transition step.
+- **`fix_time=1` (fix-time auto-create path, ADR-073 P399)**: BEFORE writing the file, Read each traced problem ticket (`docs/problems/.../<NNN>-*.md`) and author the `## Scope` + `## Tasks` sections from its `## Root Cause Analysis` + `## Fix Strategy` (the fix being proposed + its task decomposition). The RFC is NOT a skeleton on this path — the deferred "flesh out later" step never self-fires (P375), so the scope is authored now while the fix context is in hand. Keep it ADR-070-compliant: chosen-path prose in `## Scope`, NO Considered-Options / alternatives-rejected block (enumerating ≥2 options and choosing among them would be cat-1 direction-setting; deriving the single fix the problem already implies is framework-mediated — ADR-073 § ADR-044 reclassification). `human-oversight` stays `unconfirmed` (Step 7 oversight discipline holds — no per-RFC substance-confirm at fix-time; ratified at `manage-rfc accepted`).
 
 ### 6. Single commit — `## RFCs` reverse-trace refresh; no rfcs README refresh
 
@@ -278,9 +288,11 @@ After the commit, report:
 - The new RFC file path and ID.
 - The traced problems with their lifecycle states (Open / Known Error / Verifying / Closed / Parked).
 - Any advisory warnings (Verifying, Closed, Parked traces).
-- Trailing pointer: `Run /wr-itil:manage-rfc <RFC-<NNN>> next to populate Scope / Tasks and advance to accepted; refresh docs/rfcs/README.md.`
+- Trailing pointer:
+  - **user-aside path (default)**: `Run /wr-itil:manage-rfc <RFC-<NNN>> next to populate Scope / Tasks and advance to accepted; refresh docs/rfcs/README.md.`
+  - **`--fix-time` path**: `RFC-<NNN> is authored (Scope + Tasks populated from P<NNN>) and born human-oversight: unconfirmed. Run /wr-itil:manage-rfc <RFC-<NNN>> accepted to ratify the authored scope; refresh docs/rfcs/README.md.`
 
-The trailing pointer is **not optional** — it is the user-visible signal that the RFC is intentionally skeleton-only and how to advance it.
+The trailing pointer is **not optional** — on the user-aside path it is the user-visible signal that the RFC is intentionally skeleton-only and how to advance it; on the `--fix-time` path it signals the RFC is already authored and points at the ratification drain.
 
 **Oversight marker discipline (ADR-066 + ADR-068 amendments 2026-06-02 / P348).** The skeleton frontmatter MUST include `human-oversight: unconfirmed`. capture-rfc is the AFK-friendly aside surface; there is no substance-confirm `AskUserQuestion` pass in this flow (deferred to `/wr-itil:manage-rfc accepted`), so `confirmed` would be a hollow marker (the P348 bug class). The architect-side hook (`architect-oversight-marker-discipline.sh`) does NOT gate `docs/rfcs/`, but downstream paths that promote a captured RFC to `confirmed` MUST do so via a proper substance-confirm AskUserQuestion (e.g. `/wr-itil:manage-rfc accepted` for genuine ratification) — agents authoring RFCs at capture-time MUST NOT write `confirmed`. The drain pattern mirrors the ADR drain: an RFC's `unconfirmed` state surfaces interactively during the `accepted` transition.
 

package/skills/manage-problem/SKILL.md

@@ -191,7 +191,7 @@ wr-itil-check-fix-rfc-trace <problem-file>
 - **Empty stdout** (an RFC already traces the problem): proceed to the traversal below.
 - **Non-empty stdout** (directive `no-rfc-trace: P<NNN> …`): the predicate has confirmed only that *no RFC's `problems:` array names this PID* — it has NOT decided that no fix vehicle exists. Distinguish **two sub-cases** before acting (P371; ADR-073 auto-create is intended ONLY when no fix vehicle exists, NOT when an existing vehicle merely lacks the trace edge — architect-confirmed):
   - **(a) Existing-vehicle-untraced — an RFC is already this ticket's fix vehicle but just hasn't wired the trace edge.** Read the ticket's `## Fix Strategy` / `## Resolution` / `## Dependencies` / `## Related` sections for an RFC cited as the **fix vehicle** — i.e. the fix IS that RFC's task set (the recurring shape: a rework / follow-on Known Error whose fix is an existing RFC's B-tasks, so that RFC's `problems:` array names the *original driver* problem, not this ticket). This is a **judgement read of the citation context, NOT a blind "any cited RFC" match**: an RFC named only as context / `composes with` / `**Related**` background is NOT a fix vehicle — wiring its trace edge would pollute its `problems:` array. If a genuine existing fix vehicle is found: **wire** this problem's trace edge into that RFC's frontmatter `problems:` array (Edit the `problems: [...]` line to include `P<NNN>` + a short inline `**Problems**:` body annotation noting the edge was wired because the vehicle already exists), then run `wr-itil-update-problem-rfcs-section <problem-file>` so the ticket's derived `## RFCs` section reflects the wired trace. Re-run the predicate (now empty) and proceed. Do **NOT** auto-create — minting a second RFC here produces a redundant duplicate that fragments the fix across two trace vehicles (the exact P371 defect). Structured-log the wire event (e.g. `I13: wired P<NNN> trace edge into existing fix-vehicle RFC-<NNN>`) to the iter summary `notes` for the JTBD-006 audit trail.
-  - **(b) No-vehicle — no existing RFC is this ticket's fix vehicle.** **auto-create** a problem-traced skeleton RFC — do NOT block, do NOT skip, do NOT ask (ADR-073 auto-create-everywhere; the create is framework-mediated, not cat-1 direction-setting, so NO `AskUserQuestion` consent gate fires here — P132 / inverse-P078). Delegate to `/wr-itil:capture-rfc` with a problem trace derived from this Known Error (`--problem=P<NNN>` + a fix-scoped title from the problem's `## Fix Strategy` / root cause), which is the canonical ADR-070-compliant vehicle (allocates the next RFC ID, refreshes the RFC README, emits no Considered-Options block — no create logic is duplicated). Then re-run the predicate (now empty) and proceed. The auto-created RFC is the fix-proposal artifact; its body is fleshed out as fix work proceeds (ADR-073 — a living scope artifact, not a one-shot). Structured-log the auto-create event to the iter summary `notes` (the ADR-073 reassessment criterion — auto-created-RFC-under-scoped signal feeds `/wr-retrospective:run-retro`).
+  - **(b) No-vehicle — no existing RFC is this ticket's fix vehicle.** **auto-create AND fully author** a problem-traced RFC — do NOT block, do NOT skip, do NOT ask (ADR-073 auto-create-everywhere; the create AND its full scope authoring are framework-mediated, not cat-1 direction-setting — the scope is *derived* from the already-traced problem under ADR-071's pinned direction, not new direction *invented*; so NO `AskUserQuestion` consent gate fires here — P132 / inverse-P078; ADR-073 § ADR-044 reclassification, P399). Delegate to `/wr-itil:capture-rfc --fix-time` with a problem trace derived from this Known Error (`P<NNN>` + a fix-scoped title from the problem's `## Fix Strategy` / root cause), which is the canonical ADR-070-compliant vehicle (allocates the next RFC ID, refreshes the RFC README, emits no Considered-Options block — no create logic is duplicated). The `--fix-time` flag makes capture-rfc author a **populated `## Scope`** (the fix being proposed + implementation approach) and a **real `## Tasks`** decomposition from the problem's RCA + Fix Strategy — NOT an empty skeleton placeholder (ADR-073 P399: the deferred "flesh out later" step never self-fires, P375, so author it now while the fix context is in hand). Then re-run the predicate (now empty) and proceed. The authored RFC is the fix-proposal artifact, born `human-oversight: unconfirmed` (ratified at `manage-rfc accepted`). Structured-log the auto-create event to the iter summary `notes` (the ADR-073 reassessment criterion — auto-authored-RFC-mis-scoped signal feeds `/wr-retrospective:run-retro`).
 
 The predicate is the load-bearing detection half (committed shell + behavioural bats per ADR-052: `packages/itil/scripts/test/check-fix-rfc-trace.bats`); the create half is orchestrated through `capture-rfc` (the ADR-060 I1 load-bearing-from-the-start standard — deterministic detection in committed shell, create through the canonical capture surface). This gate fires at **every** fix-time surface; the AFK `/wr-itil:work-problems` orchestrator dispatches its fix work *through this same manage-problem traversal*, so the gate covers the AFK surface transitively (ADR-073 "everywhere").
 

package/skills/work-problems/SKILL.md

@@ -642,7 +642,7 @@ rm -f "$ITER_JSON"
 
 1. **Context**: this is one iteration of the AFK work-problems loop. The user is AFK. The orchestrator selected `P<NNN> (<title>)` as the highest-WSJF actionable ticket.
 2. **Task**: apply the `/wr-itil:manage-problem` workflow for `work highest WSJF problem that can be progressed non-interactively as the user is AFK`. Follow manage-problem SKILL.md verbatim, including architect / jtbd / style-guide / voice-tone gate reviews and the commit gate (manage-problem Step 11). Because this subprocess has the Agent tool in its own surface, the normal review-via-subagent paths work — no inline-verdict fallback needed.
-3. **Constraints**: commit the completed work per ADR-014. Do NOT push, do NOT run `push:watch`, do NOT run `release:watch` — the orchestrator's Step 6.5 owns release cadence. Do NOT invoke `capture-*` background skills mid-iter (AFK carve-out — ADR-032), **EXCEPT** (a) **retro-surfaced observations of recurring class-of-behaviour** — those route to `/wr-itil:capture-problem` per the **P342 mechanical-stage carve-out** (see retro-on-exit constraint #4 below; same trust-boundary as `/wr-retrospective:run-retro` Step 4a verification close-on-evidence — P342); and (b) **the I13 fix-time RFC auto-create** — when the propose-fix gate inside the delegated `/wr-itil:manage-problem` traversal detects an RFC-less Known Error (`wr-itil-check-fix-rfc-trace` emits a `no-rfc-trace:` directive), the iter auto-creates a problem-traced skeleton RFC via `/wr-itil:capture-rfc` then proceeds (ADR-073 auto-create-everywhere) — **UNLESS** an existing RFC cited in the ticket is already its fix vehicle and merely lacks the trace edge, in which case the iter **wires** the trace edge into that RFC's `problems:` array (running `wr-itil-update-problem-rfcs-section`) rather than minting a redundant duplicate RFC that fragments the fix (P371; existing-vehicle-untraced sub-case — ADR-073 auto-create is the *no-vehicle* case only; vehicle-vs-merely-related is a judgement read of citation context, structured-logged as `I13: wired P<NNN> trace edge into existing RFC-<NNN>`; the load-bearing branch prose lives in the delegated `/wr-itil:manage-problem` I13 gate). This is NOT an aside-capture distraction: the auto-created RFC is the **mandatory vehicle for THIS iter's own fix** (ADR-071), not a tangential observation — it is in-scope working of the current ticket, framework-mediated (NOT cat-1 direction-setting → NO `AskUserQuestion`, P132), and the loop is NEVER skipped or blocked for a missing RFC (ADR-073). Structured-log the auto-create event to the iter summary (`notes`) per JTBD-006 audit-trail + the ADR-073 reassessment criterion (auto-created-RFC-under-scoped signal feeds `/wr-retrospective:run-retro`). Do NOT use `ScheduleWakeup` under any circumstance (P083 — iteration workers must not self-reschedule). **NEVER call `AskUserQuestion` mid-loop in AFK** (P135 / ADR-044): direction / deviation-approval / one-time-override / silent-framework observations queue at `ITERATION_SUMMARY.outstanding_questions` for loop-end batched presentation. **This includes the manage-problem substance-confirm-before-build guard (ADR-074 (Confirm a decision's substance before building dependent work)):** when the propose-fix step detects that the fix builds on a born-`proposed` decision whose substance is unconfirmed (via `wr-architect-is-decision-unconfirmed`), the iter does NOT implement on it and does NOT ask mid-loop — it queues a `category: "direction"` entry naming the unconfirmed ADR + its Decision Outcome for loop-end confirmation, and routes the ticket to `action: skipped`, `skip_reason_category: user-answerable`. Building on the unconfirmed substance instead (or guessing the choice) is the P315 failure this guard exists to prevent. The queued substance-confirm is a legitimate cat-1 direction ask — it is NOT counted as lazy in the Step 2d Ask Hygiene Pass (ADR-074 lazy-count exclusion). Per-iter `AskUserQuestion` calls are sub-contracting framework-resolved decisions back to the user (lazy deferral per Step 2d Ask Hygiene Pass classification). Non-interactive defaults apply per ADR-013 Rule 6 + ADR-044's framework-resolution boundary. **Treat the user as transient** (P130): even when observably present at orchestrator dispatch time, the user may answer one question and disappear for hours; presence is not a reliable signal and is not the goal. The iter's job is to progress the ticket and accumulate questions for batched surfacing — not to ask "is it OK to proceed?" at a mechanical-stage boundary. **Do NOT poll `bats` output with a bats-console-summary regex against TAP-format output** (P146 — bash until-loop-deadlock antipattern). The bats-console-summary line `<N> tests, <M> failures` is emitted ONLY by bats's *default* (non-TAP) formatter; `bats --tap` does not emit a console summary, so a polling loop of shape `until [ -f $OUT ] && grep -qE '^[0-9]+ tests?,' $OUT; do sleep 5; done` spins forever after bats completes (silent deadlock — no error, no exit; recovery requires manual SIGTERM with metadata loss per the P146/P147 stuck-before-emit subclass). When you need to wait on a backgrounded bats run, prefer `wait $bg_pid` (Unix idiom — completion signaled by process exit, no regex required) or, for the Bash tool, `run_in_background=true` + `BashOutput` polling on the tool's exit-state field rather than regex-poll on stdout. If you genuinely must regex-poll TAP output, anchor on the TAP plan line `^[0-9]+\.\.[0-9]+` (e.g. `1..1455`) — TAP's plan line is emitted on completion and is format-stable across bats versions; the bats-console-summary line is not. The console-summary vs TAP-format divergence is the load-bearing detail: `bats` and `bats --tap` produce structurally different stdout, and the antipattern assumes the former when iter dispatch typically uses the latter. **Do NOT poll subprocess completion with `pgrep -f '<pattern>'` inside an `until` / `while` loop** (P232 — self-referential pgrep deadlock; sibling variant of P146). `pgrep -f` matches against the FULL command line of every running process, so the polling loop's own `zsh -c` argument (which contains the literal `pgrep -f '<pattern>'` text) matches itself; with multiple concurrent polling loops, each loop matches the others and spins forever. Worked example of the antipattern: `until ! pgrep -f 'bats --recursive' > /dev/null 2>&1; do sleep 5; done` — the 2026-05-16 P232 deadlock witness; 4 concurrent polling loops each matched the others' command lines while no actual bats process ran; 45 min wall-clock + $20-30 wasted before manual SIGTERM. The same self-reference shape applies to `while pgrep -f ...; do sleep; done` and to `until ! pkill -0 -f '<pattern>'` / `while pkill -0 -f '<pattern>'` (signal-0 polling). The structural fix is the same as P146: prefer `wait $bg_pid` (Unix idiom — shell-native completion signal, no regex / no pgrep) or Bash-tool `run_in_background=true` + `BashOutput` polling (harness-tracked completion state). The hook `packages/itil/hooks/itil-bash-polling-antipattern-detect.sh` denies these shapes at PreToolUse:Bash, but the prompt rule belongs here too — structural enforcement + prompt discipline together close the class. **Do NOT leave a backgrounded task unreaped at turn-end** (`run_in_background: true` on an Agent or Bash tool call, or a `&`-detached shell job, whose completion you intend to observe in a *later* turn) inside iter dispatch contexts (P370 — turn-end-mid-background work-loss; sibling-class to P083 / P146 / P232). The iter subprocess is dispatched via `claude -p`, a single-shot CLI invocation with NO auto-resume affordance: its turn boundary IS its process boundary. A background task that outlives the turn never resumes — the iter exits at turn-end with the task incomplete and its own work staged but uncommitted (witnessed: iter 11 of a prior loop — $8.02 / 17 min / 8 staged files / 11 GREEN bats / ZERO commits; recovery required orchestrator main-turn salvage). **The prohibition is on the cross-turn / turn-end-survivor shape, NOT on backgrounding per se:** the P146/P232-sanctioned idiom of launching `run_in_background=true` + `BashOutput`-poll-then-`wait $bg_pid` (or plain `wait $bg_pid` on a `&` job) **within the same turn** is fine — it reaps the task before turn-end. Use foreground-synchronous invocation instead: the Agent tool WITHOUT `run_in_background: true` (the result returns in-turn, so the commit step is reached), or intra-turn background that you `wait` on before the turn closes. The distinction from the P146/P232 polling antipatterns: those forbid *how* you wait (regex / pgrep poll loops); this forbids *deferring a task's completion past the turn boundary*, where `claude -p` has no notification re-entry to bring you back. The interactive Claude Code session masks this hazard (notification-driven re-entry); the AFK iter subprocess does not. **If the fix changes shippable code or package behaviour** (any path under `packages/<plugin>/{src,bin,hooks,skills,scripts,lib,agents}` excluding test paths — `test/`, `hooks/test/`, `scripts/test/` — and excluding `README.md` + `docs/*.md`), **the iter MUST author a `.changeset/*.md` entry in the same single ADR-014-grain commit as the fix** (the changeset names the bumping plugin via the YAML frontmatter `"@windyroad/<plugin>": <patch|minor|major>` per the changesets-action contract). **Doc-only changes** (under `docs/`, `*.md`) **and test-only changes** (under any `test/` path) **that ship no behaviour MAY omit the changeset**. The orchestrator's Step 6.5 release-cadence drain runs `release:watch` only when `.changeset/` is non-empty after push — without an iter-authored changeset, code-shape fixes accumulate without ever shipping to npm (violating JTBD-006's audit-trail expectation + JTBD-007's "Keep Plugins Current" closure dependency). Hook `packages/itil/hooks/itil-changeset-discipline.sh` (P141) provides hook-level enforcement at `git commit` time as defence-in-depth — but plugin hook execution depends on the marketplace cache carrying the current hook version, so the prompt-time constraint here MUST land independently (composes-with the hook; does NOT rely on the hook being installed). Inbound-reported from downstream consumer bbstats as their P195 — see [Related](#related) for `**Origin**: inbound-reported (bbstats#195)` per ADR-076. **`@jtbd JTBD-006`** (load-bearing) **`@jtbd JTBD-007`** (closure-dependent).
+3. **Constraints**: commit the completed work per ADR-014. Do NOT push, do NOT run `push:watch`, do NOT run `release:watch` — the orchestrator's Step 6.5 owns release cadence. Do NOT invoke `capture-*` background skills mid-iter (AFK carve-out — ADR-032), **EXCEPT** (a) **retro-surfaced observations of recurring class-of-behaviour** — those route to `/wr-itil:capture-problem` per the **P342 mechanical-stage carve-out** (see retro-on-exit constraint #4 below; same trust-boundary as `/wr-retrospective:run-retro` Step 4a verification close-on-evidence — P342); and (b) **the I13 fix-time RFC auto-create** — when the propose-fix gate inside the delegated `/wr-itil:manage-problem` traversal detects an RFC-less Known Error (`wr-itil-check-fix-rfc-trace` emits a `no-rfc-trace:` directive), the iter auto-creates AND fully authors a problem-traced RFC via `/wr-itil:capture-rfc --fix-time` (authoring a populated `## Scope` + real `## Tasks` from the problem's RCA + Fix Strategy, NOT an empty skeleton — ADR-073 P399; the deferred "flesh out later" step never self-fires, P375) then proceeds (ADR-073 auto-create-everywhere) — **UNLESS** an existing RFC cited in the ticket is already its fix vehicle and merely lacks the trace edge, in which case the iter **wires** the trace edge into that RFC's `problems:` array (running `wr-itil-update-problem-rfcs-section`) rather than minting a redundant duplicate RFC that fragments the fix (P371; existing-vehicle-untraced sub-case — ADR-073 auto-create is the *no-vehicle* case only; vehicle-vs-merely-related is a judgement read of citation context, structured-logged as `I13: wired P<NNN> trace edge into existing RFC-<NNN>`; the load-bearing branch prose lives in the delegated `/wr-itil:manage-problem` I13 gate). This is NOT an aside-capture distraction: the auto-created RFC is the **mandatory vehicle for THIS iter's own fix** (ADR-071), not a tangential observation — it is in-scope working of the current ticket, framework-mediated (NOT cat-1 direction-setting → NO `AskUserQuestion`, P132), and the loop is NEVER skipped or blocked for a missing RFC (ADR-073). Structured-log the auto-create event to the iter summary (`notes`) per JTBD-006 audit-trail + the ADR-073 reassessment criterion (auto-created-RFC-under-scoped signal feeds `/wr-retrospective:run-retro`). Do NOT use `ScheduleWakeup` under any circumstance (P083 — iteration workers must not self-reschedule). **NEVER call `AskUserQuestion` mid-loop in AFK** (P135 / ADR-044): direction / deviation-approval / one-time-override / silent-framework observations queue at `ITERATION_SUMMARY.outstanding_questions` for loop-end batched presentation. **This includes the manage-problem substance-confirm-before-build guard (ADR-074 (Confirm a decision's substance before building dependent work)):** when the propose-fix step detects that the fix builds on a born-`proposed` decision whose substance is unconfirmed (via `wr-architect-is-decision-unconfirmed`), the iter does NOT implement on it and does NOT ask mid-loop — it queues a `category: "direction"` entry naming the unconfirmed ADR + its Decision Outcome for loop-end confirmation, and routes the ticket to `action: skipped`, `skip_reason_category: user-answerable`. Building on the unconfirmed substance instead (or guessing the choice) is the P315 failure this guard exists to prevent. The queued substance-confirm is a legitimate cat-1 direction ask — it is NOT counted as lazy in the Step 2d Ask Hygiene Pass (ADR-074 lazy-count exclusion). Per-iter `AskUserQuestion` calls are sub-contracting framework-resolved decisions back to the user (lazy deferral per Step 2d Ask Hygiene Pass classification). Non-interactive defaults apply per ADR-013 Rule 6 + ADR-044's framework-resolution boundary. **Treat the user as transient** (P130): even when observably present at orchestrator dispatch time, the user may answer one question and disappear for hours; presence is not a reliable signal and is not the goal. The iter's job is to progress the ticket and accumulate questions for batched surfacing — not to ask "is it OK to proceed?" at a mechanical-stage boundary. **Do NOT poll `bats` output with a bats-console-summary regex against TAP-format output** (P146 — bash until-loop-deadlock antipattern). The bats-console-summary line `<N> tests, <M> failures` is emitted ONLY by bats's *default* (non-TAP) formatter; `bats --tap` does not emit a console summary, so a polling loop of shape `until [ -f $OUT ] && grep -qE '^[0-9]+ tests?,' $OUT; do sleep 5; done` spins forever after bats completes (silent deadlock — no error, no exit; recovery requires manual SIGTERM with metadata loss per the P146/P147 stuck-before-emit subclass). When you need to wait on a backgrounded bats run, prefer `wait $bg_pid` (Unix idiom — completion signaled by process exit, no regex required) or, for the Bash tool, `run_in_background=true` + `BashOutput` polling on the tool's exit-state field rather than regex-poll on stdout. If you genuinely must regex-poll TAP output, anchor on the TAP plan line `^[0-9]+\.\.[0-9]+` (e.g. `1..1455`) — TAP's plan line is emitted on completion and is format-stable across bats versions; the bats-console-summary line is not. The console-summary vs TAP-format divergence is the load-bearing detail: `bats` and `bats --tap` produce structurally different stdout, and the antipattern assumes the former when iter dispatch typically uses the latter. **Do NOT poll subprocess completion with `pgrep -f '<pattern>'` inside an `until` / `while` loop** (P232 — self-referential pgrep deadlock; sibling variant of P146). `pgrep -f` matches against the FULL command line of every running process, so the polling loop's own `zsh -c` argument (which contains the literal `pgrep -f '<pattern>'` text) matches itself; with multiple concurrent polling loops, each loop matches the others and spins forever. Worked example of the antipattern: `until ! pgrep -f 'bats --recursive' > /dev/null 2>&1; do sleep 5; done` — the 2026-05-16 P232 deadlock witness; 4 concurrent polling loops each matched the others' command lines while no actual bats process ran; 45 min wall-clock + $20-30 wasted before manual SIGTERM. The same self-reference shape applies to `while pgrep -f ...; do sleep; done` and to `until ! pkill -0 -f '<pattern>'` / `while pkill -0 -f '<pattern>'` (signal-0 polling). The structural fix is the same as P146: prefer `wait $bg_pid` (Unix idiom — shell-native completion signal, no regex / no pgrep) or Bash-tool `run_in_background=true` + `BashOutput` polling (harness-tracked completion state). The hook `packages/itil/hooks/itil-bash-polling-antipattern-detect.sh` denies these shapes at PreToolUse:Bash, but the prompt rule belongs here too — structural enforcement + prompt discipline together close the class. **Do NOT leave a backgrounded task unreaped at turn-end** (`run_in_background: true` on an Agent or Bash tool call, or a `&`-detached shell job, whose completion you intend to observe in a *later* turn) inside iter dispatch contexts (P370 — turn-end-mid-background work-loss; sibling-class to P083 / P146 / P232). The iter subprocess is dispatched via `claude -p`, a single-shot CLI invocation with NO auto-resume affordance: its turn boundary IS its process boundary. A background task that outlives the turn never resumes — the iter exits at turn-end with the task incomplete and its own work staged but uncommitted (witnessed: iter 11 of a prior loop — $8.02 / 17 min / 8 staged files / 11 GREEN bats / ZERO commits; recovery required orchestrator main-turn salvage). **The prohibition is on the cross-turn / turn-end-survivor shape, NOT on backgrounding per se:** the P146/P232-sanctioned idiom of launching `run_in_background=true` + `BashOutput`-poll-then-`wait $bg_pid` (or plain `wait $bg_pid` on a `&` job) **within the same turn** is fine — it reaps the task before turn-end. Use foreground-synchronous invocation instead: the Agent tool WITHOUT `run_in_background: true` (the result returns in-turn, so the commit step is reached), or intra-turn background that you `wait` on before the turn closes. The distinction from the P146/P232 polling antipatterns: those forbid *how* you wait (regex / pgrep poll loops); this forbids *deferring a task's completion past the turn boundary*, where `claude -p` has no notification re-entry to bring you back. The interactive Claude Code session masks this hazard (notification-driven re-entry); the AFK iter subprocess does not. **If the fix changes shippable code or package behaviour** (any path under `packages/<plugin>/{src,bin,hooks,skills,scripts,lib,agents}` excluding test paths — `test/`, `hooks/test/`, `scripts/test/` — and excluding `README.md` + `docs/*.md`), **the iter MUST author a `.changeset/*.md` entry in the same single ADR-014-grain commit as the fix** (the changeset names the bumping plugin via the YAML frontmatter `"@windyroad/<plugin>": <patch|minor|major>` per the changesets-action contract). **Doc-only changes** (under `docs/`, `*.md`) **and test-only changes** (under any `test/` path) **that ship no behaviour MAY omit the changeset**. The orchestrator's Step 6.5 release-cadence drain runs `release:watch` only when `.changeset/` is non-empty after push — without an iter-authored changeset, code-shape fixes accumulate without ever shipping to npm (violating JTBD-006's audit-trail expectation + JTBD-007's "Keep Plugins Current" closure dependency). Hook `packages/itil/hooks/itil-changeset-discipline.sh` (P141) provides hook-level enforcement at `git commit` time as defence-in-depth — but plugin hook execution depends on the marketplace cache carrying the current hook version, so the prompt-time constraint here MUST land independently (composes-with the hook; does NOT rely on the hook being installed). Inbound-reported from downstream consumer bbstats as their P195 — see [Related](#related) for `**Origin**: inbound-reported (bbstats#195)` per ADR-076. **`@jtbd JTBD-006`** (load-bearing) **`@jtbd JTBD-007`** (closure-dependent).
 4. **Retro-on-exit (P086) + retro-surfaced observation classification (P342) + iter-owned BRIEFING commit (P212)**: before emitting `ITERATION_SUMMARY`, invoke `/wr-retrospective:run-retro`. Retro runs INSIDE this subprocess so its Step 2b pipeline-instability scan has access to the iteration's rich tool-call history (hook misbehaviour, repeat-workaround patterns, subagent-delegation friction, release-path instability). Tickets retro creates ride a separate path: they delegate through `/wr-itil:manage-problem` which IS ADR-014 in-scope and self-commits each ticket per its own Step 11. Those commits land independently and the orchestrator picks them up on the next Step 1 scan.
 
    **BRIEFING.md commit responsibility — iter owns, run-retro does not (P212).** run-retro is explicitly out-of-scope for self-commit per ADR-014's Scope section (which lists `packages/retrospective/skills/run-retro/SKILL.md` under "Out of scope for now"). Retro therefore EDITS but DOES NOT COMMIT `docs/BRIEFING.md` / `docs/briefing/*.md`. The iter subprocess (NOT run-retro, NOT the orchestrator main turn) owns the BRIEFING commit. After retro completes, run `git status --porcelain docs/BRIEFING.md docs/briefing/`. If non-empty, the iter: