@windyroad/itil 0.61.2 → 1.0.0

package/skills/manage-story-map/SKILL.md

@@ -24,9 +24,9 @@ Per ADR-060 amendment 2026-05-10 lines 145-189 + encoding amendment 2026-05-12:
 
 | Invariant | What it asserts | Where it fires |
 |-----------|-----------------|----------------|
-| **I3** trace-to-problem | Every map traces to ≥ 1 problem (ADR-060 line 187) | Hard-block at `/wr-itil:capture-story-map` + re-validated at every transition |
-| **I4** trace-to-JTBD | Every map traces to ≥ 1 JTBD (ADR-060 line 188) | Hard-block at `/wr-itil:capture-story-map` + re-validated at every transition |
-| **I5** no-WSJF-leak | Maps MUST NOT carry WSJF (ADR-060 line 189) | Behavioural test: argument grammar + frontmatter carry no WSJF |
+| **I3** trace-to-problem | Every map traces to ≥ 1 problem (ADR-060, the story-map schema's `problems:` field) | Hard-block at `/wr-itil:capture-story-map` + re-validated at every transition |
+| **I4** trace-to-JTBD | Every map traces to ≥ 1 JTBD (ADR-060, the story-map schema's `jtbd:` field) | Hard-block at `/wr-itil:capture-story-map` + re-validated at every transition |
+| **I5** no-WSJF-leak | Maps MUST NOT carry WSJF (ADR-060, the no-WSJF-on-maps invariant) | Behavioural test: argument grammar + frontmatter carry no WSJF |
 
 **Bootstrap-exemption marker** per ADR-060 line 339 + ADR-053 Bootstrapping precedent: STORY-MAP-001 ships with the `<!-- bootstrap-exempt -->` marker during retrofit; non-bootstrap captures with the marker fail.
 
@@ -38,7 +38,7 @@ Per ADR-060 amendment 2026-05-10 lines 145-189 + encoding amendment 2026-05-12:
 /wr-itil:manage-story-map <STORY-MAP-NNN> in-progress  # Manual transition
 /wr-itil:manage-story-map <STORY-MAP-NNN> completed    # Transition in-progress → completed
 /wr-itil:manage-story-map <STORY-MAP-NNN> archived     # Close without completion
-/wr-itil:manage-story-map <STORY-MAP-NNN> ratify       # ADR-090: confirm the map, then its stories, one at a time
+/wr-itil:manage-story-map <STORY-MAP-NNN> ratify       # ADR-103: confirm the map — approves every story on it
 /wr-itil:manage-story-map review                       # Re-validate all maps + refresh README
 ```
 
@@ -76,7 +76,7 @@ If `$story_map_id == "review"`, branch to Step 8 (review flow). Otherwise resolv
 
 ### 2. Read story-map HTML
 
-Parse `<meta>` block (problems, rfcs, jtbd, adrs, status, reported, decision-makers). Read backbone structure (`<section class="backbone">` → `.rib-header` → `.rib` → `<a class="slice">` data-* attributes).
+Parse `<meta>` block (problems, rfcs, jtbd, status, reported, decision-makers) — no `adrs`, and `problems`/`rfcs` are DERIVED, so they carry content the island does not. Read backbone structure from the grid's `<th class="act" scope="col">` columns and `<th class="slice" scope="row">` rows.
 
 ### 3-6. (Update flow — bare `<STORY-MAP-NNN>`)
 
@@ -101,7 +101,7 @@ For any transition `<from> → <to>`:
 4. **Reverse-trace refresh** — for each problem + JTBD in `<meta>` block:
 
 ```bash
-for pid_token in $(grep -oE '<meta name="problems" content="[^"]*"' "$map_file" | grep -oE 'P[0-9]{3}'); do
+for pid_token in $(grep -oE '<meta name="problems" content="[^"]*"' "$map_file" | grep -oE 'P[0-9]{3,}'); do
   pid_num="${pid_token#P}"
   problem_file=$(ls docs/problems/${pid_num}-*.md docs/problems/*/${pid_num}-*.md 2>/dev/null | head -1)
   [ -z "$problem_file" ] && continue
@@ -114,13 +114,13 @@ done
 
 Per architect amend finding 2 on Slice 7: story-map HTML files do NOT carry an auto-maintained markdown reverse-trace section themselves (the `<a class="slice">` data-attribute traces are authored manually during backbone design). No reverse-trace refresh on the map itself; reverse-trace only flows OUT to problem + JTBD parents.
 
-### 7.5. Ratification flow (`ratify`) — ADR-090 / STORY-022
+### 7.5. Ratification flow (`ratify`) — ADR-090 / ADR-103 / STORY-022
 
-`ratify` is **orthogonal to the status lifecycle** — a map can be ratified at any status. It confirms human oversight of the map + its stories after they are authored or edited. Ratification is **drift-invalidated** (ADR-009 lineage, NOT ADR-066 write-once): any later content edit silently re-opens it (the `oversight-hash` fingerprint stops matching). This is the STORY-022 surface.
+`ratify` is **orthogonal to the status lifecycle** — a map can be ratified at any status. It confirms human oversight of **the map**, and under ADR-103 that approves every story on it, including stories added later; stories are never ratified individually. Ratification is **drift-invalidated** (ADR-009 lineage, NOT ADR-066 write-once), but only a **substance** edit re-opens it: the map's own substance as ADR-090 defines it — its journey, its identity, and what it traces to. `oversight_map_substance_keys()` is the authoritative field list; this page deliberately does not restate it. Release rows, the cards in them, story-body edits and template restyling all sit outside the fingerprint basis and change nothing. This is the STORY-022 surface.
 
 **Born-confirmed discipline (P348).** Before any marker write, `export CLAUDE_SESSION_ID` from the transcript path — the marker shim silently no-ops on an empty SID. Every `confirmed` marker MUST be backed by a same-turn human confirm event; never write `confirmed` without the `AskUserQuestion` below (a hollow marker is the P348 bug).
 
-**Map first, then stories — one at a time (STORY-022 UX):**
+**Ratify the map; its stories follow (STORY-022 UX, amended by ADR-103):**
 
 1. **Ratify the map.** Present the map's path/URL + a self-contained briefing of what it is — the JTBD it serves, its backbone activities, its release slices — briefing the substance BEFORE any ID (P350; the user may be on a device with no repo access). Then `AskUserQuestion` with exactly two options:
    - **Ratify** — the map is correct as-is.
@@ -128,17 +128,17 @@ Per architect amend finding 2 on Slice 7: story-map HTML files do NOT carry an a
 
    On **Ratify**: run `wr-itil-mark-story-oversight-confirmed <map-file>` (writes `confirmed` + the fingerprint). The map is now ratified.
 
-2. **Ratify each story, one at a time.** ONLY after the map is ratified, walk the map's `data-story-id` references in order. For each story that is not already ratified (test with `wr-itil-detect-unratified-stories-maps` or the `is_story_map_ratified` lib helper): brief its `## User value` + `## Acceptance criteria` (substance before ID), then the SAME two-option `AskUserQuestion` (**Ratify** / type-something). On **Ratify**: `wr-itil-mark-story-oversight-confirmed <story-file>`. On free-text: apply the correction as a story edit and re-present (the edit re-opens that story only).
+2. **Do NOT ratify the stories at all (ADR-103).** Ratifying the map approves every story on it, so there is nothing left to do: no per-story marker, no per-story `AskUserQuestion`, and no oversight field written onto a story. `wr-itil-mark-story-oversight-confirmed` refuses a story path outright. Test a story's approval with `story_is_approved`, which derives it from the story's `story-maps:` field.
 
 3. **AFK / non-interactive (ADR-013 Rule 6).** When `AskUserQuestion` is unavailable, do NOT auto-ratify — that would forge a hollow marker (P348). Leave the artefacts unratified; they surface in the `/wr-itil:work-problems` Step 2.4 drain for the next interactive session.
 
-4. **Single commit** — stage the map + every newly-ratified story + the README refresh; commit per ADR-014.
+4. **Single commit** — stage the map + the README refresh; commit per ADR-014. No story file changes: ratifying a map approves its stories without touching them.
 
-**Why map-first:** an RFC may reference only ratified stories (`wr-itil-check-rfc-stories-ratified`), and a story is only meaningful inside its ratified map — ratifying stories under an unratified map would invert the dependency STORY-022 encodes.
+**Why the map:** an RFC may reference only approved stories (`wr-itil-check-rfc-stories-ratified`), and a story is only meaningful inside its map — which is why ADR-103 makes the map the single approval surface rather than ratifying at both tiers.
 
-**Reuse offers ratified stories only (STORY-024).** When decomposing a fix, existing map stories the fix touches are offered for **reuse** — referenced by an additional slice card / `data-story-id`, NOT duplicated as a new file; the reused story's `rfcs:` reverse-trace picks up the new RFC. Only **ratified** stories (test with `is_story_map_ratified`) are offered for reuse; an unratified story must be ratified (§ 7.5) before an RFC can reference it.
+**Reuse offers approved stories only (STORY-024).** When decomposing a fix, existing map stories the fix touches are offered for **reuse** — referenced by an additional slice card / `data-story-id`, NOT duplicated as a new file; the reused story's `rfcs:` reverse-trace picks up the new RFC. Only **approved** stories (test with `story_is_approved`, which honours ADR-103 map inheritance) are offered for reuse; an unapproved story needs its map ratified (§ 7) before an RFC can reference it.
 
-**Re-slicing re-opens ratification (STORY-025).** Grouping stories into ordered release slices (Release 1 walking skeleton → Release 2 …) is authored as `data-status` / slice-card edits on the map; deferred phases stay first-class cards (visible, competing for priority), never buried. Because slicing edits the map's content, it drifts the `oversight-hash` and silently re-opens the map's ratification (§ 7.5) — no explicit marker reset needed; the fingerprint handles it.
+**Re-slicing does NOT re-open ratification (STORY-025, amended by ADR-103).** Grouping stories into ordered release rows (Release 1 walking skeleton → Release 2 …) is authored as release-row and card edits on the map. **Composing a row asks the two questions in `/wr-itil:capture-story-map` — do these stories NEED to ship together, and SHOULD they — and re-slicing is where the second one usually gets skipped: rows drawn once are rarely re-examined against the cost of delay they now impose.**  deferred phases stay first-class cards (visible, competing for priority), never buried. Rows and cards sit OUTSIDE the fingerprint basis, so re-slicing is silent — scheduling is not what the human approved. What DOES re-open a map's approval: a change to the map's own substance — see `oversight_map_substance_keys()`. *(This sentence enumerated five of the seven keys until 2026-08-08, omitting `storyMapId` and `secondaryPersona`. It is the under-enumeration half of that day's drift: it told a maintainer mid-re-slice that a secondary-persona edit was safe when it re-opens approval.)* The fingerprint handles it either way; no explicit marker reset is needed.
 
 ### 8. List flow (`list`)
 
@@ -170,9 +170,11 @@ Story-map ID + new status + invariants verified + parent artefacts touched + tra
 
 ## Related
 
-- **ADR-060** — Problem-RFC-Story framework; Phase 2 amendment 2026-05-10 lines 145-189 + encoding amendment 2026-05-12 lines 381-435.
-- **ADR-060 line 145** — I5 no-WSJF-on-maps invariant.
-- **ADR-060 line 339 + ADR-053** — bootstrap-exemption marker contract.
+- **ADR-060** — Problem-RFC-Story framework; Phase 2 amendment 2026-05-10 (story-map frontmatter schema + the I3/I4/I5 invariants) + encoding amendment 2026-05-12.
+- **ADR-060**, the no-WSJF-on-maps invariant — I5.
+- **ADR-060**, the ordered `stories:` array on an RFC, **+ ADR-053** — bootstrap-exemption marker contract.
+
+  (Line-number citations were removed here: they are positional, and ADR-060 has been amended enough times that every one of them pointed at the wrong line.)
 - **`docs/STYLE-GUIDE.md`** — HTML style rules manage-story-map enforces.
 - **P170** — driver problem ticket.
 - **JTBD-008** — primary anchor.

package/skills/reconcile-stories/SKILL.md

@@ -10,10 +10,12 @@ Sibling to `/wr-itil:reconcile-readme` (P118 / ADR-014) and `/wr-itil:reconcile-
 
 **Diagnose-only mechanic** — wraps `packages/itil/scripts/reconcile-stories.sh` (resolved via `wr-itil-reconcile-stories` `$PATH` shim per ADR-049). The script reads `docs/stories/<state>/STORY-NNN-*.md` files across all 5 lifecycle subdirs (draft, accepted, in-progress, done, archived), parses `docs/stories/README.md`'s Story Rankings + Done tables, and reports each disagreement. Exit codes: `0` clean, `1` drift detected (structured stdout), `2` parse error.
 
-**Reverse-trace pass** — when `docs/problems/`, `docs/rfcs/`, and `docs/jtbd/` exist on disk (the default project layout), the reconciler ALSO checks the auto-maintained `## Stories` section on each parent artefact against the story frontmatter's `problems:` / `rfcs:` / `jtbd:` claims. Three drift kinds per parent tier (mirrors the RFC-tier reverse-trace contract):
+**Reverse-trace pass** — when the parent directories exist, the reconciler checks auto-maintained `## Stories` sections on problem, JTBD and legacy RFC files. For an ADR-103 row-backed RFC, it checks the map row instead: the RFC must resolve and the row must contain the story card.
 - `MISSING_REVERSE_TRACE STORY-NNN in <PARENT-ID> ## Stories` — story claims parent but parent's `## Stories` table doesn't list the story
 - `STALE_REVERSE_TRACE STORY-NNN in <PARENT-ID> ## Stories` — parent lists the story but story no longer claims the parent
 - `STATUS_MISMATCH STORY-NNN in <PARENT-ID> ## Stories claims=<X> actual=<Y>` — parent's row claims one lifecycle status; story's filesystem subdir is a different state
+- `UNRESOLVED_RFC_TRACE STORY-NNN claims=RFC-NNN` — neither a legacy RFC file nor a story-map release row exists
+- `MISSING_REVERSE_TRACE STORY-NNN in RFC-NNN release row` — the release row exists but does not contain the story card
 
 ## When to invoke
 
@@ -30,7 +32,7 @@ Sibling to `/wr-itil:reconcile-readme` (P118 / ADR-014) and `/wr-itil:reconcile-
 ### 1. Run the diagnose script
 
 ```bash
-wr-itil-reconcile-stories docs/stories docs/problems docs/rfcs docs/jtbd > /tmp/wr-itil-stories-drift-$$.txt
+wr-itil-reconcile-stories docs/stories docs/problems docs/rfcs docs/jtbd docs/story-maps > /tmp/wr-itil-stories-drift-$$.txt
 reconcile_exit=$?
 ```
 
@@ -47,6 +49,7 @@ Read `/tmp/wr-itil-stories-drift-$$.txt` line by line. Each line is one of:
 - `MISSING_REVERSE_TRACE STORY-NNN in <PARENT-ID> ## Stories` — parent's `## Stories` section needs the story added; call `update-<parent-kind>-references-section.sh <parent-file> "Stories"` to refresh.
 - `STALE_REVERSE_TRACE STORY-NNN in <PARENT-ID> ## Stories` — parent's `## Stories` section needs the story removed; same helper call (idempotent, lazy-empty discipline removes when no traces remain).
 - `STATUS_MISMATCH STORY-NNN in <PARENT-ID> ## Stories claims=<X> actual=<Y>` — same helper call refreshes the status column.
+- `UNRESOLVED_RFC_TRACE` / row `MISSING_REVERSE_TRACE` — repair the map's release row or card through `/wr-itil:manage-story-map`; do not create an empty RFC file.
 
 ### 3. Apply edits
 

package/skills/work-problems/SKILL.md

@@ -375,11 +375,11 @@ Before the orchestrator emits the final `ALL_DONE` sentinel for the AFK loop, it
 
 **Gate (0) × Step 0e `/goal` anchor (ADR-094).** Under an active goal, the `ALL_DONE` emit does not by itself end the session — the Step 0e external evaluator reads the printed gate (0) table + sentinel and independently confirms the condition holds; a premature emit just triggers a "keep working" turn with the evaluator's reason as guidance. The anchor is one-directional: a cleared goal (or a loop that was never anchored) does NOT relax this gate — gate (0) fires unconditionally either way.
 
-**Gate (a) — Outstanding-questions surface + oversight-unconfirmed drain (P348 amendment 2026-06-02).** Two sub-surfaces, both fire in this gate:
+**Gate (a) — Outstanding-questions surface + oversight-unconfirmed drain (ADR-110 / P348).** Two sub-surfaces, both fire in this gate:
 
 1. *Outstanding-questions surface.* Read `.afk-run-state/outstanding-questions.jsonl`. If non-empty, invoke Step 2.5b's surfacing routine to present the accumulated queue (via `AskUserQuestion`-when-available-else-table per ADR-013 Rule 1 / Rule 6). On completion, truncate the queue file. If the queue is empty, this sub-surface returns immediately. The surfacing routine is the existing Step 2.5b — Step 2.4 does NOT re-implement; it sequences.
 
-2. *Oversight-unconfirmed drain.* Run `wr-architect-detect-unoversighted`, `wr-jtbd-detect-unoversighted`, and `wr-itil-detect-unratified-stories-maps` (all ADR-049 PATH shims, all always exit 0; output is the list of unoversighted/unratified artefact paths). The story/map detector (**ADR-090**) is **drift-aware**: it lists story maps + stories that are never-ratified, explicitly `unconfirmed`, OR **drift-reopened** — a `confirmed` marker whose `oversight-hash` fingerprint no longer matches the edited content. Re-ratify each via `/wr-itil:manage-story` / `/wr-itil:manage-story-map` (or `wr-itil-mark-story-oversight-confirmed`); the nudge + 2-option `Drain now` / `Defer` surface below applies to this list identically. If either lists ≥ 1 artefact whose frontmatter carries `human-oversight: unconfirmed` (the AFK-explicit-deferred state, distinct from the implicit-absent state pre-existing ADR/JTBD files carry), surface a one-line nudge: *"N iter-deferred decision(s)/job(s) carry `human-oversight: unconfirmed`. Run `/wr-architect:review-decisions` and `/wr-jtbd:confirm-jobs-and-personas` to drain."* If `AskUserQuestion` is available (`/wr-itil:work-problems` was invoked interactively before the AFK loop started), surface a 2-option choice — `Drain now` (invokes the appropriate drain skill before `ALL_DONE`) / `Defer to next session` (proceeds to gate (b) with the nudge in the final summary). If `AskUserQuestion` is unavailable, the nudge prints in the final summary table and gate (b) proceeds. The drain is NOT a halt — `unconfirmed` markers are explicit-by-design AFK signals (the iter wrote them KNOWING the user would need to confirm), and the drain is the documented path. Detector difference matters: ADRs/JTBDs that pre-date the ADR-066/ADR-068 marker contract carry NO `human-oversight:` line at all; they fall through to the existing review-decisions/confirm-jobs-and-personas backlog drain (no new surfacing here). The new surfacing fires ONLY on the explicit `unconfirmed` value — the AFK-iter-deferred class P348 introduces.
+2. *Oversight-unconfirmed drain.* Run `wr-architect-detect-unoversighted`, `wr-jtbd-detect-unoversighted`, and `wr-itil-detect-unratified-stories-maps` (all ADR-049 PATH shims, all always exit 0; output is the list of unoversighted/unratified artefact paths). The story/map detector (**ADR-090** / **ADR-103**) is **drift-aware**: it lists story MAPS that are never-ratified, explicitly `unconfirmed`, or **drift-reopened** — a `confirmed` marker whose `oversight-hash` no longer matches the map's substance — plus the stories those maps leave unapproved. Re-ratify via `/wr-itil:manage-story-map` (or `wr-itil-mark-story-oversight-confirmed <map-file>`) — never per-story: a story carries no marker and the command refuses one; the nudge + 2-option `Drain now` / `Defer` surface below applies to this list identically. If either lists ≥ 1 artefact whose frontmatter carries `human-oversight: unconfirmed` (the AFK-explicit-deferred state, distinct from the implicit-absent state pre-existing ADR/JTBD files carry), surface a one-line nudge: *"N iter-deferred decision(s)/job(s) carry `human-oversight: unconfirmed`. Run `/wr-architect:review-decisions` and `/wr-jtbd:confirm-jobs-and-personas` to drain."* If `AskUserQuestion` is available (`/wr-itil:work-problems` was invoked interactively before the AFK loop started), surface a 2-option choice — `Drain now` (invokes the appropriate drain skill before `ALL_DONE`) / `Defer to next session` (proceeds to gate (b) with the nudge in the final summary). If `AskUserQuestion` is unavailable, the nudge prints in the final summary table and gate (b) proceeds. The drain is NOT a halt — `unconfirmed` markers are explicit-by-design AFK signals (the iter wrote them KNOWING the user would need to confirm), and the drain is the documented path. Detector difference matters: ADRs/JTBDs that pre-date the ADR-066/ADR-068 marker contract carry NO `human-oversight:` line at all; they fall through to the existing review-decisions/confirm-jobs-and-personas backlog drain (no new surfacing here). The new surfacing fires ONLY on the explicit `unconfirmed` value — the AFK-iter-deferred class P348 introduces.
 
 **Gate (b) — Session-level retro.** Invoke `/wr-retrospective:run-retro` via the Skill tool. This is the **orchestrator-main-turn session-level retro**, distinct from the per-iter retro fired inside each iter subprocess (per P086 / Step 5 retro-on-exit clause). The session-level retro covers cross-iter patterns, friction observations, framework-improvement candidates, and the AFK loop's overall trajectory — surface visible only after multiple iters have completed. Retro commits its own work per ADR-014; any tickets retro creates ride retro's own commit, and the orchestrator picks them up on the *next* invocation of `/wr-itil:work-problems` rather than re-entering the loop here.
 

package/templates/story-map.css

@@ -0,0 +1,195 @@
+/* Story-map presentation. One copy, shared by every map.
+   Generated into a repo beside the maps by wr-itil-render-story-map;
+   edit the copy shipped in @windyroad/itil, not this one. */
+:root {
+  color-scheme: light dark;
+  --bg: #ffffff; --fg: #1a1a1a; --muted: #565656; --line: #767676;
+  --card: #f6f6f6; --card-line: #767676;
+  --live-fg: #0b5d1e; --live-bg: #e4f4e8; --live-line: #0b5d1e;
+  --next-fg: #0b3a66; --next-bg: #e2eefb; --next-line: #0b3a66;
+  --later-fg: #6b3a00; --later-bg: #f6ead6; --later-line: #6b3a00;
+  --defect-fg: #8c1d18; --defect-bg: #fdecea; --defect-line: #8c1d18;
+  --focus: #0b3a66;
+}
+@media (prefers-color-scheme: dark) {
+  :root {
+    --bg: #16181c; --fg: #f2f3f5; --muted: #b6bac2; --line: #8a919c;
+    --card: #1f2228; --card-line: #8a919c;
+    --live-fg: #7fe0a0; --live-bg: #123020; --live-line: #7fe0a0;
+    --next-fg: #97c6f5; --next-bg: #10263c; --next-line: #97c6f5;
+    --later-fg: #f0c58a; --later-bg: #33260f; --later-line: #f0c58a;
+    --defect-fg: #ffb4ab; --defect-bg: #3b1512; --defect-line: #ffb4ab;
+    --focus: #97c6f5;
+  }
+}
+:root[data-theme="light"] {
+  color-scheme: light;
+  --bg: #ffffff; --fg: #1a1a1a; --muted: #565656; --line: #767676;
+  --card: #f6f6f6; --card-line: #767676;
+  --live-fg: #0b5d1e; --live-bg: #e4f4e8; --live-line: #0b5d1e;
+  --next-fg: #0b3a66; --next-bg: #e2eefb; --next-line: #0b3a66;
+  --later-fg: #6b3a00; --later-bg: #f6ead6; --later-line: #6b3a00;
+  --defect-fg: #8c1d18; --defect-bg: #fdecea; --defect-line: #8c1d18;
+  --focus: #0b3a66;
+}
+:root[data-theme="dark"] {
+  color-scheme: dark;
+  --bg: #16181c; --fg: #f2f3f5; --muted: #b6bac2; --line: #8a919c;
+  --card: #1f2228; --card-line: #8a919c;
+  --live-fg: #7fe0a0; --live-bg: #123020; --live-line: #7fe0a0;
+  --next-fg: #97c6f5; --next-bg: #10263c; --next-line: #97c6f5;
+  --later-fg: #f0c58a; --later-bg: #33260f; --later-line: #f0c58a;
+    --defect-fg: #ffb4ab; --defect-bg: #3b1512; --defect-line: #ffb4ab;
+  --focus: #97c6f5;
+}
+* { box-sizing: border-box; }
+body { font-family: system-ui, sans-serif; color: var(--fg); background: var(--bg);
+       max-width: 1500px; margin: 0 auto; padding: 1.5rem 1rem 3rem; line-height: 1.5; }
+h1 { font-size: 1.5rem; margin: 0 0 .5rem; }
+p { max-width: 74ch; }
+a { color: var(--focus); }
+/* Required on every interactive element, not just links: the theme toggle
+   (if a host adds one) and the scroll region both take focus. */
+/* :focus first as a fallback for engines without :focus-visible. The two rules
+   are deliberately IDENTICAL — the fallback exists so the only focusable
+   element on the page is never left without an indicator on older WebKit, not
+   to give keyboard and pointer focus different treatment. Do not "complete"
+   the pair by weakening the :focus rule; that would break 2.4.7 on those
+   engines.
+   No border-radius here — it clips the content of the overflow:auto
+   scroll region for as long as it holds focus. */
+a:focus, button:focus, [tabindex]:focus { outline: 3px solid var(--focus); outline-offset: 2px; }
+a:focus-visible,
+button:focus-visible,
+[tabindex]:focus-visible { outline: 3px solid var(--focus); outline-offset: 2px; }
+.badge { display: inline-flex; align-items: center; gap: .3rem; font-size: .75rem; font-weight: 700;
+         padding: .1rem .45rem; border-radius: 999px; border: 1px solid; white-space: nowrap; }
+/* Release state is carried by the badge's text label and by a glyph in real
+   markup (see .b-glyph). The glyph is aria-hidden — it is a second VISUAL
+   channel so colour is never the sole one, and assistive tech already has
+   the label. It must not be generated content: in forced-colors mode the
+   badge backgrounds all collapse to Canvas, and the glyph becomes the only
+   thing distinguishing the three states. */
+.b-live  { color: var(--live-fg);  background: var(--live-bg);  border-color: var(--live-line); }
+.b-next  { color: var(--next-fg);  background: var(--next-bg);  border-color: var(--next-line); }
+.b-later { color: var(--later-fg); background: var(--later-bg); border-color: var(--later-line); }
+/* A row with no RFC identity, or whose stories close no problem. Deliberately
+   red rather than the amber `.b-later` used for scheduled-later work: this is
+   not "later", it is wrong, and it needs an edit before the map is ratified.
+   7.97:1 light, 9.50:1 dark; the glyph carries it as a second channel. */
+.b-defect { color: var(--defect-fg); background: var(--defect-bg); border-color: var(--defect-line); }
+
+.scroll { overflow-x: auto; padding-bottom: .5rem; }
+table.map { border-collapse: collapse; width: 100%; min-width: 940px; }
+table.map caption { text-align: left; color: var(--muted); font-size: .85rem; margin-bottom: .5rem; }
+/* Activity headers across the top are the backbone: the user journey. */
+thead th.act { text-align: left; vertical-align: bottom; padding: .5rem .6rem; font-size: .9rem;
+               border-bottom: 3px solid var(--fg); width: 18%; }
+thead th.act .jtbd { display: block; font-weight: 400; color: var(--muted); font-size: .75rem; margin-top: .2rem; }
+thead td.corner { border-bottom: 3px solid var(--fg); }
+/* Each row is one release slice. A row read left to right is everything
+   that ships together. */
+th.slice { text-align: left; vertical-align: top; padding: .7rem .6rem; width: 10%; min-width: 96px;
+           border-bottom: 2px solid var(--fg); position: sticky; left: 0; background: var(--bg); }
+th.slice .s-name { font-size: .95rem; display: block; margin-top: .35rem; margin-bottom: .35rem; }
+th.slice .s-note { font-weight: 400; color: var(--muted); font-size: .75rem; display: block; margin-top: .35rem; }
+td.cell { vertical-align: top; padding: .5rem; border-bottom: 2px solid var(--fg); border-left: 1px solid var(--line); }
+/* An empty cell is meaningful — it says this activity ships nothing in this
+   release — so the hatch is drawn in the 3:1 border tone, not a tint. */
+td.cell.empty { background: repeating-linear-gradient(45deg, transparent, transparent 7px, var(--line) 7px, var(--line) 8px); }
+.task { border: 1px solid var(--card-line); border-radius: 6px; background: var(--card); padding: .5rem .55rem; }
+.task .t-title { font-size: .85rem; }
+.task .t-value { display: block; font-size: .75rem; color: var(--muted); margin-top: .35rem; }
+/* Three clauses, three lines. Run together they are a wall of text at card
+   width; the shape that makes the statement scannable is the shape it was
+   written in. */
+.task .v-line { display: block; margin-top: .2rem; }
+.task .v-line:first-child { margin-top: 0; }
+/* The connectives carry no information once you know the pattern, so they
+   recede and let the three payloads read as a list. The italic IS the channel —
+   there is deliberately no opacity. At .75 over --card this composited to
+   #7e7e7e for 3.76:1, under the 4.5:1 that 12px text needs; the muted token
+   alone is 6.79:1. Receding must not mean unreadable. */
+.task .v-lead { font-style: italic; }
+/* Whose journey this is, is the thing you scan a map for — so the line carries
+   the body colour rather than the muted value tone. Structural prominence, not
+   fabricated emphasis: bold here belongs to whatever the STORY marked. */
+.task .v-asa { color: var(--fg); }
+/* Author emphasis, rendered as written. */
+.task .t-value strong { font-weight: 700; color: var(--fg); }
+/* A card's own lifecycle state. Subordinate to the row badge by four axes at
+   once — no pill, no fill, smaller and lighter, on its own line, and only the
+   three states worth colouring get colour. Twenty-four cards would otherwise
+   put twenty-four coloured markers against five row badges.
+
+   No `forced-color-adjust: none` here, unlike `.badge`: that opts out because
+   its state lives in its fill; this marker's lives in its text, so letting the
+   UA force the colours is correct. */
+.task .t-status {
+  display: block;
+  font-size: .7rem;
+  font-weight: 600;
+  margin-bottom: .15rem;
+  letter-spacing: .01em;
+}
+.task .ts-glyph { font-weight: 700; margin-right: .25rem; }
+
+/* Coloured: the states worth picking out of a wall of cards. Border-only —
+   a fill on a data-bearing element is prohibited, and the row badge's own
+   fill is 1.14:1 anyway, so its loudness was never coming from the fill. */
+.task .ts-done { color: var(--live-fg); }
+.task .ts-prog { color: var(--later-fg); }
+/* `--muted`, NOT `--line`. Read literally, "archived = light gray" lands on
+   --line, which is 4.20:1 on --card in light mode — under the 4.5:1 that .7rem
+   text needs, and passing in dark at 5.02:1, so it fails in exactly one theme.
+   Same shape as the 3.76:1 .v-lead miss. */
+.task .ts-arch { color: var(--muted); }
+
+/* Achromatic: the common states, kept as texture so the coloured ones read. */
+.task .ts-acc,
+.task .ts-draft { color: var(--muted); font-weight: 400; }
+
+.task .t-ref { display: block; font-size: .75rem; color: var(--muted); margin-top: .3rem; }
+.slice .s-problems { display: block; font-size: .7rem; color: var(--muted); margin-top: .2rem; }
+.traces { margin-top: 1.5rem; border-top: 1px solid var(--line); padding-top: .75rem;
+          font-size: .8rem; color: var(--muted); }
+.traces .tr-group { display: inline-block; margin-right: 1.25rem; }
+/* The caption is the table's accessible name — a screen-reader user gets it,
+   and the dimensions in it, before entering the grid. On screen it repeated
+   the h1 immediately above, so it is hidden rather than deleted. */
+table.map > caption { position: absolute; width: 1px; height: 1px; padding: 0;
+  margin: -1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0; }
+
+.vh { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px;
+      overflow: hidden; clip-path: inset(50%); white-space: nowrap; border: 0; }
+.tasks { list-style: none; margin: 0; padding: 0; }
+.tasks li + li { margin-top: .5rem; }
+.b-glyph { font-weight: 900; }
+.genfrom { color: var(--muted); font-size: .8rem; margin-top: 1.5rem; }
+@media (forced-colors: active) {
+  /* background-image is not part of the forced-colors UA cascade, so the
+     hatch would paint literal #767676 over the user's chosen Canvas in
+     Chromium and vanish entirely in Firefox. Restate it in system colours. */
+  td.cell.empty { background-image: repeating-linear-gradient(45deg, Canvas, Canvas 7px, GrayText 7px, GrayText 8px); }
+  .badge { forced-color-adjust: none; border: 1px solid CanvasText; }
+}
+/* What the reader is being asked. Sits between the title and the grid, so it
+   is read before any scrolling and cannot be missed by not scrolling back. */
+.orient { max-width: 62ch; margin: .5rem 0 1rem; font-size: .95rem; line-height: 1.5; }
+.orient + .orient { color: var(--muted); }
+
+/* The column header is the journey step a card belongs to, and rows run taller
+   than a screen — so without this it scrolls away inside the first row and
+   never comes back, leaving horizontal scroll position as the only clue to
+   which activity you are looking at. The row header outranks it at the corner
+   intersection: it is pinned on the axis that moves further. */
+thead th.act { position: sticky; top: 0; z-index: 1; background: var(--bg); }
+th.slice { z-index: 2; }
+
+/* Sticky row headers are kept at narrow widths: this is exactly where the
+   table scrolls furthest, so losing the orientation anchor costs most. The
+   column is narrowed and its note dropped rather than unpinned. */
+@media (max-width: 640px) {
+  th.slice { min-width: 72px; padding: .5rem .35rem; font-size: .85rem; }
+  th.slice .s-note { display: none; }
+}

package/templates/story-map.html

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>{{TITLE_FULL}}</title>
+{{META}}
+  <link rel="stylesheet" href="../story-map.css">
+</head>
+<body>
+  <main>
+    <h1 id="story-map-title">{{TITLE}}</h1>
+{{ORIENT}}    <div id="story-map">{{GRID}}</div>
+{{TRACE}}
+  </main>
+
+
+  <script id="story-map-data" type="application/json">
+{{DATA}}
+  </script>
+{{STATUS}}
+</body>
+</html>

package/scripts/check-afk-accept-eligible.sh

@@ -1,230 +0,0 @@
-#!/usr/bin/env bash
-# check-afk-accept-eligible.sh — ADR-101 AFK pure-decomposition carve-out.
-#
-# Decides whether an AFK loop may transition a story `draft -> accepted` with a
-# machine-written `human-oversight: confirmed` marker, and implement it, WITHOUT
-# a fresh human ratification. Opt-in and fail-closed: absent the project opt-in
-# or the story's own declaration, the answer is always "not eligible".
-#
-# Eligible IFF the project has opted in AND the story declares
-# `afk-accept: pure-decomposition` AND both conditions hold:
-#
-#   (a) PARENT SUBSTANCE CONFIRMED — every `adrs:` / `jtbd:` entry resolves and
-#       carries `human-oversight: confirmed` (persona too); every `rfcs:` entry
-#       resolves and every ADR in THAT RFC's `adrs:` is confirmed; every
-#       `problems:` entry resolves; every `story-maps:` entry satisfies the
-#       ADR-101 map leg (fully ratified, OR confirmed with this story's own card
-#       excluded from the hash — ADR-095 compels that card, so it cannot be the
-#       thing that disqualifies the story). Map LIFECYCLE status is out of scope.
-#       The RFC tier holds no independent decisions per ADR-070 and so has no
-#       oversight marker of its own; condition (a) proxies through its `adrs:`.
-#
-#   (b) NO NEW SUBSTANCE, ESTABLISHED POSITIVELY — a whitelist, not a novelty
-#       blacklist, because "introduces no new design choice" is a negative
-#       existential an agent cannot discharge. `## Decomposition basis` must
-#       carry exactly one entry per acceptance criterion, each naming the
-#       artefact whose already-confirmed clause that criterion decomposes, and
-#       every cited ID must be a member of the set (a) PROVED ratified —
-#       frontmatter membership is not ratification. Zero criteria is FAIL-CLOSED.
-#       A secondary blacklist rejects open-decision markers outside fenced or
-#       backticked spans.
-#
-# The failure direction is deliberate: conservatively hold a genuine
-# decomposition rather than silently accept an embedded decision.
-#
-# Usage: check-afk-accept-eligible.sh <story-file> [maps-root] [rfcs-root]
-#                                     [jtbd-root] [problems-root] [decisions-root]
-# Exit:  0 = eligible; 1 = not eligible (reasons on stderr); 2 = usage / file error.
-#
-# @adr ADR-101 (AFK pure-decomposition carve-out) ADR-090 (drift-invalidated
-#      oversight) ADR-095 ADR-096 ADR-060 ADR-070 ADR-098 (config shape)
-#      ADR-013 (Rule 6) ADR-052 (behavioural bats)
-# @problem P456 (AFK iter cannot land a fix) P465 (accepted gate unenforced)
-# @jtbd JTBD-006 (Progress the Backlog While I'm Away)
-# @jtbd JTBD-003 (Compose Only the Guardrails I Need)
-set -uo pipefail
-
-# Adopter-safe: source the shared lazy-fingerprint lib RELATIVE TO THIS SCRIPT
-# (P317), never repo-relative.
-LIB="$(cd "$(dirname "${BASH_SOURCE[0]}")/../lib" 2>/dev/null && pwd)" || {
-  echo "check-afk-accept-eligible: cannot locate lib dir" >&2; exit 2; }
-# shellcheck source=/dev/null
-source "$LIB/story-oversight.sh"
-
-story="${1:-}"
-maps_root="${2:-docs/story-maps}"
-rfcs_root="${3:-docs/rfcs}"
-jtbd_root="${4:-docs/jtbd}"
-problems_root="${5:-docs/problems}"
-decisions_root="${6:-docs/decisions}"
-
-if [ -z "$story" ]; then
-  echo "check-afk-accept-eligible: usage: check-afk-accept-eligible.sh <story-file> [maps-root] [rfcs-root] [jtbd-root] [problems-root] [decisions-root]" >&2
-  exit 2
-fi
-[ -f "$story" ] || { echo "check-afk-accept-eligible: file not found: $story" >&2; exit 2; }
-
-fail() { echo "check-afk-accept-eligible: NOT ELIGIBLE — $1" >&2; exit 1; }
-
-# --- Project opt-in (ADR-101 split; config shape mirrors ADR-098) ------------
-# Resolution FAILS OPEN to the built-in default (this never errors); because the
-# built-in default is `false`, the POLICY outcome of every degraded path — no
-# jq, no file, unreadable, unparseable, non-boolean — is not-eligible.
-# Env trumps both files: a loosening override for bats and one-off use, NOT a
-# project-configuration surface.
-afk_accept_enabled() {
-  local v
-  case "${WR_ITIL_AFK_ACCEPT:-}" in
-    1|true) return 0 ;;
-    0|false) return 1 ;;
-  esac
-  command -v jq >/dev/null 2>&1 || return 1
-  for cfg in ".claude/itil.config.json" "$HOME/.claude/itil.config.json"; do
-    [ -r "$cfg" ] || continue
-    # Per-KEY fallback per ADR-098: a project file that simply omits the key
-    # must not strand the machine layer. Only a file that actually sets it
-    # decides the answer.
-    jq -e 'has("afk_accept_pure_decomposition")' "$cfg" >/dev/null 2>&1 || continue
-    # Strict: only the literal JSON `true` enables. The string form, 1, yes and
-    # null do not — a typo must never open a permission-loosening carve-out.
-    v="$(jq -r 'if .afk_accept_pure_decomposition == true then "true" else "false" end' "$cfg" 2>/dev/null || echo false)"
-    [ "$v" = "true" ] && return 0
-    return 1
-  done
-  return 1
-}
-
-afk_accept_enabled || fail "the project has not opted in to the ADR-101 carve-out (set \"afk_accept_pure_decomposition\": true in .claude/itil.config.json)"
-
-# --- Declaration ------------------------------------------------------------
-oversight_declares_pure_decomposition "$story" \
-  || fail "$story does not declare \`afk-accept: pure-decomposition\` — the carve-out is opt-in per story, never a default"
-
-story_id="$(basename "$story" | grep -oE 'STORY-[0-9]+' | head -1)"
-[ -n "$story_id" ] || fail "cannot resolve a STORY-NNN id from $story"
-
-# Read one frontmatter list field (inline `[A, B]` or block `- A` form).
-trace_ids() {
-  local field="$1" line ids
-  line="$(awk -v f="^${field}:" '$0 ~ f {print; exit}' "$story")"
-  ids="$(printf '%s' "$line" | grep -oE '(ADR|JTBD|RFC|STORY-MAP|P)-?[0-9]+' || true)"
-  if [ -z "$ids" ]; then
-    ids="$(awk -v f="^${field}:" '$0 ~ f {g=1;next} g&&/^[[:space:]]*-/{print} g&&/^[^[:space:]-]/{exit}' "$story" \
-      | grep -oE '(ADR|JTBD|RFC|STORY-MAP|P)-?[0-9]+' || true)"
-  fi
-  printf '%s' "$ids"
-}
-
-# The set condition (a) PROVES ratified. Condition (b) intersects against this,
-# so a basis entry can never cite an artefact (a) never verified (B4).
-RATIFIED_SET=""
-add_ratified() { RATIFIED_SET="$RATIFIED_SET $1"; }
-
-# (a) ADR parents — write-once oversight per ADR-066.
-for id in $(trace_ids adrs); do
-  n="${id#ADR-}"
-  f="$(ls "$decisions_root"/"$n"-*.md 2>/dev/null | head -1)"
-  [ -n "$f" ] || fail "$id does not resolve under $decisions_root — a new decision is new substance"
-  oversight_is_confirmed "$f" || fail "$id is not \`human-oversight: confirmed\` — condition (a) requires every parent decision be human-confirmed"
-  add_ratified "$id"
-done
-
-# (a) JTBD parents + their personas — ADR-068 oversight sibling.
-for id in $(trace_ids jtbd); do
-  n="${id#JTBD-}"
-  f="$(ls "$jtbd_root"/*/"JTBD-$n"-*.md 2>/dev/null | head -1)"
-  [ -n "$f" ] || fail "$id does not resolve under $jtbd_root — a new job is new substance"
-  oversight_is_confirmed "$f" || fail "$id is not \`human-oversight: confirmed\`"
-  p="$(dirname "$f")/persona.md"
-  if [ -f "$p" ]; then
-    oversight_is_confirmed "$p" || fail "the persona for $id ($p) is not \`human-oversight: confirmed\` — a new or unconfirmed persona is new substance"
-  fi
-  add_ratified "$id"
-done
-
-# (a) RFC parents — no oversight tier of their own (ADR-070); proxy via `adrs:`.
-for id in $(trace_ids rfcs); do
-  n="${id#RFC-}"
-  f="$(ls "$rfcs_root"/"RFC-$n"-*.md 2>/dev/null | head -1)"
-  [ -n "$f" ] || fail "$id does not resolve under $rfcs_root"
-  rfc_adrs="$(awk '/^adrs:/{print; exit}' "$f" | grep -oE 'ADR-[0-9]+' || true)"
-  for a in $rfc_adrs; do
-    af="$(ls "$decisions_root"/"${a#ADR-}"-*.md 2>/dev/null | head -1)"
-    [ -n "$af" ] || fail "$id depends on $a which does not resolve under $decisions_root"
-    oversight_is_confirmed "$af" || fail "$id depends on $a which is not \`human-oversight: confirmed\`"
-    add_ratified "$a"
-  done
-  add_ratified "$id"
-done
-
-# (a) Problem parents — resolve only; problems carry no oversight tier.
-for id in $(trace_ids problems); do
-  n="${id#P}"
-  f="$(ls "$problems_root"/"$n"-*.md "$problems_root"/*/"$n"-*.md 2>/dev/null | head -1)"
-  [ -n "$f" ] || fail "$id does not resolve under $problems_root"
-  add_ratified "$id"
-done
-
-# (a) Story-map parents — the ADR-101 map leg.
-for id in $(trace_ids story-maps); do
-  n="${id#STORY-MAP-}"
-  f="$(ls "$maps_root"/*/"STORY-MAP-$n"-*.html 2>/dev/null | head -1)"
-  [ -n "$f" ] || fail "$id does not resolve under $maps_root"
-  oversight_map_leg_ok "$f" "$story_id" \
-    || fail "$id fails the ADR-101 map leg — it is not human-confirmed, or it has drifted for a reason other than adding ${story_id}'s own card. Ratify the map."
-  add_ratified "$id"
-done
-
-# --- (b) NO NEW SUBSTANCE, established positively ---------------------------
-# Acceptance criteria: prefix-anchored section (headings carry trailing
-# qualifiers like `(accepted-gate, INVEST Testable)`), terminated by the next
-# `##`. Tick-insensitive so implementation progress never flips the check, and
-# the criterion literal is aligned with oversight_content_hash's normaliser so
-# every counted line is a normalised line.
-section_of() {
-  awk -v h="$1" '
-    $0 ~ h {inside=1; next}
-    inside && /^##[[:space:]]/ {exit}
-    inside {print}
-  ' "$story"
-}
-
-# NO `\b` IN THESE ANCHORS, and do not re-add it. Two independent reasons:
-# (1) awk escape-processes a `-v` assignment value, so `\b` arrives as a literal
-#     BACKSPACE (0x08) — the pattern then never matches a real heading, which
-#     silently makes this whole check inert. It fails CLOSED, so there is no
-#     permission hole, but the carve-out can never return eligible for anyone.
-# (2) POSIX ERE has no `\b` at all, so it is equally wrong in the commit-locus
-#     copy of this count in itil-no-implement-draft-gate.sh, where the failure
-#     would be silent in a different way. Those two loci MUST stay aligned.
-# Prefix matching is the documented intent anyway (ADR-101): corpus headings
-# carry trailing qualifiers like `(accepted-gate, INVEST Testable)`.
-criteria_count="$(section_of '^##[[:space:]]+Acceptance criteria' | grep -cE '^- \[[ xX]\]' || true)"
-[ "${criteria_count:-0}" -gt 0 ] \
-  || fail "no top-level \`- [ ]\` criterion lines found in the acceptance-criteria section — condition (b) is fail-closed on zero, since an absent section is indistinguishable from absent criteria"
-
-basis="$(section_of '^##[[:space:]]+Decomposition basis')"
-[ -n "$(printf '%s' "$basis" | tr -d '[:space:]')" ] \
-  || fail "\`## Decomposition basis\` is missing or empty — condition (b) requires each criterion to name the already-confirmed clause it decomposes"
-
-basis_count="$(printf '%s\n' "$basis" | grep -cE '^- ' || true)"
-[ "${basis_count:-0}" -eq "$criteria_count" ] \
-  || fail "\`## Decomposition basis\` has $basis_count entries but there are $criteria_count acceptance criteria — every criterion must name the confirmed clause it decomposes"
-
-# Every cited ID must be in the set condition (a) proved ratified (B4).
-for cited in $(printf '%s' "$basis" | grep -oE '(ADR|JTBD|RFC|STORY-MAP)-[0-9]+' | sort -u); do
-  case " $RATIFIED_SET " in
-    *" $cited "*) ;;
-    *) fail "\`## Decomposition basis\` cites $cited, which condition (a) never verified as ratified — cite only traced, confirmed parents" ;;
-  esac
-done
-
-# Secondary blacklist. Fenced and backticked spans are stripped first so a story
-# may DESCRIBE the blocked vocabulary (this one does) without tripping on it.
-prose="$(awk '/^```/{f=!f;next} !f' "$story" | sed -E 's/`[^`]*`//g')"
-if printf '%s' "$prose" | grep -qiE '\[Unratified Dependency\]|\bTBD\b|to be decided|open question|decision needed'; then
-  fail "an open-decision marker appears outside a fenced or backticked span — the story is not pure decomposition"
-fi
-
-echo "check-afk-accept-eligible: ELIGIBLE — $story_id is pure decomposition of confirmed substance ($criteria_count criteria, all basis citations ratified)" >&2
-exit 0