agentic-sdlc-wizard 1.85.0 → 1.87.0

package/hooks/instructions-loaded-check.sh

@@ -12,31 +12,19 @@ source "$HOOK_DIR/_find-sdlc-root.sh"
 dedupe_plugin_or_project "${BASH_SOURCE[0]}" || exit 0
 
 # CWD walk-up finds nearest SDLC project (#173: silent exit for non-SDLC dirs)
+# #236(b): the missing-SDLC.md/TESTING.md warning that used to live here was
+# removed — sdlc-prompt-check.sh already fires the same "SETUP NOT COMPLETE"
+# warning, louder and on every prompt (this hook only fires at session
+# start/resume), making this copy pure duplicate context.
 if find_sdlc_root; then
     PROJECT_DIR="$SDLC_ROOT"
 elif find_partial_sdlc_root; then
-    # Partial setup — one file exists but not both. Warn about missing files
     PROJECT_DIR="$SDLC_ROOT"
 else
     # Not an SDLC project at all — exit silently
     exit 0
 fi
 
-MISSING=""
-
-if [ ! -f "$PROJECT_DIR/SDLC.md" ]; then
-    MISSING="${MISSING:+${MISSING}, }SDLC.md"
-fi
-
-if [ ! -f "$PROJECT_DIR/TESTING.md" ]; then
-    MISSING="${MISSING:+${MISSING}, }TESTING.md"
-fi
-
-if [ -n "$MISSING" ]; then
-    echo "WARNING: Missing SDLC wizard files: ${MISSING}"
-    echo "Invoke Skill tool, skill=\"setup-wizard\" to generate them."
-fi
-
 # Version update check (non-blocking, best-effort).
 # Fetches npm latest at most once per 24h (ROADMAP #196). Prints a stronger
 # multi-line nudge when the gap is ≥3 minor versions — the one-liner gets
@@ -258,11 +246,43 @@ fi
 # Claude Code version check (non-blocking, best-effort)
 # Gate on CLAUDE_PROJECT_DIR — only Claude Code sets this. Without it, we're
 # running under Codex/OpenCode where a CC update nudge is misleading (#375).
+# #236(b): was an uncached npm network call on every session start with a
+# bare `!=` comparison (fires in either direction, including when local is
+# actually AHEAD of the cached/published "latest") — the exact bug class
+# already fixed above for the wizard's own version check (#254 Bug 2). Now
+# reuses the same 24h cache + semver_lt direction check.
 if [ -n "${CLAUDE_PROJECT_DIR:-}" ] && command -v claude > /dev/null 2>&1 && command -v npm > /dev/null 2>&1; then
     CC_LOCAL=$(claude --version 2>/dev/null | grep -o '[0-9][0-9.]*' | head -1) || true
-    if [ -n "$CC_LOCAL" ]; then
-        CC_LATEST=$(npm view @anthropic-ai/claude-code version 2>/dev/null) || true
-        if [ -n "$CC_LATEST" ] && [ "$CC_LATEST" != "$CC_LOCAL" ]; then
+    if [ -n "$CC_LOCAL" ] && [[ "$CC_LOCAL" =~ $SEMVER_RE ]]; then
+        CC_CACHE_DIR="${SDLC_WIZARD_CACHE_DIR:-$HOME/.cache/sdlc-wizard}"
+        CC_CACHE_FILE="$CC_CACHE_DIR/latest-cc-version"
+        CC_LATEST=""
+
+        if [ -f "$CC_CACHE_FILE" ]; then
+            if stat -f %m "$CC_CACHE_FILE" > /dev/null 2>&1; then
+                CC_CACHE_MTIME=$(stat -f %m "$CC_CACHE_FILE")
+            else
+                CC_CACHE_MTIME=$(stat -c %Y "$CC_CACHE_FILE" 2>/dev/null || echo 0)
+            fi
+            CC_CACHE_AGE=$(( $(date +%s) - CC_CACHE_MTIME ))
+            if [ "$CC_CACHE_AGE" -lt 86400 ]; then
+                CC_CACHE_CONTENT=$(cat "$CC_CACHE_FILE" 2>/dev/null) || CC_CACHE_CONTENT=""
+                if [[ "$CC_CACHE_CONTENT" =~ $SEMVER_RE ]] && ! semver_lt "$CC_CACHE_CONTENT" "$CC_LOCAL"; then
+                    CC_LATEST="$CC_CACHE_CONTENT"
+                fi
+            fi
+        fi
+
+        if [ -z "$CC_LATEST" ]; then
+            CC_NPM_RESULT=$(npm view @anthropic-ai/claude-code version 2>/dev/null) || true
+            if [[ "$CC_NPM_RESULT" =~ $SEMVER_RE ]]; then
+                CC_LATEST="$CC_NPM_RESULT"
+                mkdir -p "$CC_CACHE_DIR" 2>/dev/null || true
+                printf '%s' "$CC_LATEST" > "$CC_CACHE_FILE" 2>/dev/null || true
+            fi
+        fi
+
+        if [ -n "$CC_LATEST" ] && semver_lt "$CC_LOCAL" "$CC_LATEST"; then
             echo "Claude Code update available: ${CC_LOCAL} → ${CC_LATEST} (run: npm install -g @anthropic-ai/claude-code)"
         fi
     fi

package/hooks/model-effort-check.sh

@@ -1,18 +1,19 @@
 #!/bin/bash
 # SessionStart hook — effort/model nudge.
 #
-# Behavior (v1.84.0 update — model-aware floor):
+# Behavior (#440 update — medium joins the floor):
 #   CLAUDE_CODE_EFFORT_LEVEL env var takes precedence over effortLevel in settings.
 #   CC docs: max is session-only in settings.json — only the env var persists it.
 #   This hook cannot detect the active model (SessionStart payload has no model
 #   field, per ROADMAP #180), so it uses a floor that's correct across models:
-#   `high` is Sonnet 5's and Fable's tested default (escalate to xhigh for hard
-#   tasks); xhigh is Opus 4.8's floor; max remains the sweet spot on Opus 4.6
-#   (no xhigh support). Blanket max is WRONG for Sonnet 5/Opus 4.8 (wastes
-#   tokens for no quality gain — see AI_SETUP_LANES.md per-model table).
+#   `medium` is Sonnet 5's documented default (CodeRabbit testing: most of the
+#   upside at the lowest cost — escalate high -> xhigh for hard tasks); `high`
+#   is Fable's default; xhigh is Opus 4.8's floor; max remains the sweet spot
+#   on Opus 4.6 (no xhigh support). Blanket max is WRONG for Sonnet 5/Opus 4.8
+#   (wastes tokens for no quality gain — see AI_SETUP_LANES.md per-model table).
 #
-#   effort=high, xhigh, or max -> silent (all acceptable — model-dependent)
-#   anything else               -> LOUD WARNING
+#   effort=medium, high, xhigh, or max -> silent (all acceptable — model-dependent)
+#   anything else                       -> LOUD WARNING
 #
 # Non-blocking: always exits 0.
 
@@ -49,32 +50,37 @@ if [ -z "$effort" ]; then
     done
 fi
 
-# high/xhigh are always silent (persist fine via settings.json, no CC quirk).
-# max is silent EXCEPT when it's settings-only — CC docs: max is session-only
-# in settings.json, only the env var actually persists it.
-if [ "$effort" = "high" ] || [ "$effort" = "xhigh" ]; then
+# medium/high/xhigh are always silent (persist fine via settings.json, no CC
+# quirk). max is silent EXCEPT when it's settings-only — CC docs: max is
+# session-only in settings.json, only the env var actually persists it.
+if [ "$effort" = "medium" ] || [ "$effort" = "high" ] || [ "$effort" = "xhigh" ]; then
     exit 0
 fi
 if [ "$effort" = "max" ] && [ "$settings_max" -eq 0 ]; then
     exit 0
 fi
 
+# #236(b): unset (no env var, no settings entry) is CC's own current default —
+# not a problem state on its own (e.g. a deliberate Fable-session config).
+# Only warn on an EXPLICITLY set low-effort value or the settings-only-max
+# quirk below (CC silently ignores settings.json's "max" — genuinely
+# non-obvious, worth keeping).
+if [ -z "$effort" ]; then
+    exit 0
+fi
+
 if [ "$settings_max" -eq 1 ] && [ -z "${CLAUDE_CODE_EFFORT_LEVEL:-}" ]; then
     effort_display="max (settings-only — CC ignores this)"
-elif [ -z "$effort" ]; then
-    effort_display="unset"
 else
     effort_display="$effort"
 fi
 
-echo "=============================================================================="
-echo " WARNING: effort '$effort_display' — SDLC requires high, xhigh, or max."
-echo " Below high = degraded reasoning, shallow TDD, weak self-review."
-echo ""
-echo " Run: /effort xhigh (or /effort high — see AI_SETUP_LANES.md)"
-echo " Avoid shell-rc env var persistence — silently overrides model switches."
-echo ""
+echo "=============================================================="
+echo " WARNING: effort '$effort_display' — below the SDLC floor (medium)."
+echo " Degraded reasoning, shallow TDD, weak self-review."
+echo " Run: /effort medium (Sonnet 5) or your model's floor — see AI_SETUP_LANES.md"
+echo " Avoid shell-rc env persistence — overrides model switches."
 echo " recommended models: $RECOMMENDED_MODELS"
-echo "=============================================================================="
+echo "=============================================================="
 
 exit 0

package/hooks/precompact-seam-check.sh

@@ -1,18 +1,22 @@
 #!/bin/bash
-# PreCompact hook - block manual /compact at non-seam boundaries
+# PreCompact hook - block manual /compact mid-git-operation
 # Fires on manual /compact only (auto-compact is threshold-driven; blocking
 # it could push past 100% context and lose everything). Matcher: "manual"
 # in .claude/settings.json.
 #
 # Requires Claude Code v2.1.105+ (PreCompact event introduced April 13, 2026).
 #
-# Seam policy: compacting mid-cycle loses evidence the next round needs.
-# Block when:
-#   (1) .reviews/handoff.json status is PENDING_REVIEW or PENDING_RECHECK
-#       → mid-Codex-round, compact after CERTIFIED
-#   (2) git rebase/merge/cherry-pick in progress
-#       → finish in-progress git operation first
-# Allow otherwise.
+# #236(b): the original design also blocked on .reviews/handoff.json being
+# PENDING_REVIEW/PENDING_RECHECK (mid cross-model-review-round). Removed —
+# every real firing on record over ~2.5 months was a false positive (a
+# completed rebase's stale REBASE_HEAD, or an abandoned PENDING handoff),
+# never a true positive, and ~150 of this file's 256 lines were self-heal
+# machinery mitigating that false-positive rate (3 heal paths + dry-run
+# scaffolding). The git-op check below has no such record.
+#
+# Seam policy: compacting mid-git-operation loses evidence the operation
+# needs to finish correctly. Block when a rebase/merge/cherry-pick is in
+# progress; allow otherwise.
 
 # Token-bloat fix: when both project + plugin register this hook, plugin yields.
 # Use parameter expansion (not `dirname`) so the PATH-restricted gh-missing test
@@ -30,164 +34,9 @@ ROOT="${CLAUDE_PROJECT_DIR:-$PWD}"
 
 HOLD_REASONS=""
 
-# #240: Dry-run / simulation env vars. Let consumers verify hook behavior
-# without mutating real .reviews/handoff.json or .git/ state.
-#   SDLC_DRY_RUN_HANDOFF_STATUS=<value> — overrides handoff.json status
-#                                         lookup (skip the file read entirely)
-#   SDLC_DRY_RUN_GIT_STATE=rebase|merge|cherry-pick — simulates an in-flight
-#                                                    git operation
-# When set, dry-run values short-circuit the real-state checks below. The
-# hook still emits the same HOLD/silent decision so consumers can smoke-test
-# every code path. No filesystem writes — purely read-only simulation.
-
-# Check 1: Codex review mid-cycle
-# Self-heal paths (ordered by preference):
-#   (a) #209: handoff has pr_number + gh reports PR MERGED → implicit CERTIFIED (silent)
-#   (c) #257: handoff has no pr_number BUT every SHA cited in fixes_applied[]
-#       is in HEAD's ancestry AND .reviews/latest-review.md contains CERTIFIED
-#       (without "NOT CERTIFIED") → implicit CERTIFIED (silent). Catches the
-#       solo-developer pattern: write fixes, commit them, run targeted
-#       recheck, see CERTIFIED in latest-review.md, ship — and forget to
-#       update handoff.json status. The visible signals (commits landed +
-#       review file) already say "done" so blocking is high false-positive.
-#   (b) #229: handoff has no pr_number, no SHA-ancestry heal, but mtime >
-#       SDLC_HANDOFF_STALE_DAYS days → implicit CERTIFIED with WARN
-#       (forgotten artifact; blocking forever is worse UX). Default: 14 days.
-HANDOFF="$ROOT/.reviews/handoff.json"
-# Validate SDLC_HANDOFF_STALE_DAYS as non-negative integer. Anything else
-# (empty, "foo", "-3", "10.5") silently falls back to 14 — we don't want a
-# typo in the user's env to leak a bash arithmetic error to stderr every
-# time the hook runs (caught by Codex P2 review of PR #227).
-STALE_DAYS_RAW="${SDLC_HANDOFF_STALE_DAYS:-14}"
-case "$STALE_DAYS_RAW" in
-    ''|*[!0-9]*) STALE_DAYS=14 ;;
-    *) STALE_DAYS="$STALE_DAYS_RAW" ;;
-esac
-STALE_WARN=""
-# #240: dry-run override skips the real handoff.json read.
-if [ -n "${SDLC_DRY_RUN_HANDOFF_STATUS:-}" ]; then
-    STATUS="$SDLC_DRY_RUN_HANDOFF_STATUS"
-    case "$STATUS" in
-        PENDING_REVIEW|PENDING_RECHECK)
-            HOLD_REASONS="${HOLD_REASONS}  - Codex review is ${STATUS}. Round-1 evidence lives in this context — compacting now loses what round-2 needs to re-verify.
-    Resolve: wait for CERTIFIED (or escalate) before /compact."$'\n'
-            ;;
-    esac
-elif [ -f "$HANDOFF" ]; then
-    STATUS=$(grep -o '"status"[[:space:]]*:[[:space:]]*"[^"]*"' "$HANDOFF" 2>/dev/null | head -1 | sed 's/.*"\([^"]*\)"$/\1/')
-    case "$STATUS" in
-        PENDING_REVIEW|PENDING_RECHECK)
-            PR_NUMBER=$(grep -o '"pr_number"[[:space:]]*:[[:space:]]*[0-9][0-9]*' "$HANDOFF" 2>/dev/null | head -1 | grep -o '[0-9][0-9]*$')
-            HEALED=0
-            if [ -n "$PR_NUMBER" ]; then
-                # Path (a): PR-linked self-heal (#209). Applies regardless of mtime —
-                # an OPEN PR with old mtime is still a live review.
-                if command -v gh >/dev/null 2>&1; then
-                    PR_STATE=$(gh pr view "$PR_NUMBER" --json state --jq .state 2>/dev/null)
-                    [ "$PR_STATE" = "MERGED" ] && HEALED=1
-                fi
-            else
-                # Path (c) #257: SHA-ancestry self-heal. Look for git SHAs cited
-                # in fixes_applied[]; if every cited SHA is reachable from HEAD
-                # AND .reviews/latest-review.md says CERTIFIED, the review IS
-                # closed, the user just forgot to bump status. Silent heal.
-                REVIEW_MD="$ROOT/.reviews/latest-review.md"
-                if [ -f "$REVIEW_MD" ] \
-                    && grep -qE '\bCERTIFIED\b' "$REVIEW_MD" 2>/dev/null \
-                    && ! grep -qE '\bNOT CERTIFIED\b' "$REVIEW_MD" 2>/dev/null; then
-                    # Extract the fixes_applied[] block via bracket-depth
-                    # tracking — naive `/\]/` matching breaks on `]` inside
-                    # string literals (e.g. "[x] FIXED in <sha>" markdown
-                    # checkboxes), which would let phantom SHAs after the
-                    # broken-early bracket leak past path (c) and false-heal.
-                    # Codex P1 round 1.
-                    FIXES_BLOCK=$(awk '
-                        BEGIN { in_block = 0; depth = 0; started = 0 }
-                        /"fixes_applied"/ { in_block = 1 }
-                        in_block {
-                            print
-                            in_string = 0
-                            escaped = 0
-                            for (i = 1; i <= length($0); i++) {
-                                c = substr($0, i, 1)
-                                # Honor JSON backslash escapes: \" inside a
-                                # string is a literal quote, NOT a string
-                                # terminator. Without this, a fixes_applied
-                                # entry containing `\"]` falsely flips the
-                                # in_string flag and exits the array early —
-                                # letting later phantom SHAs leak past path
-                                # (c) and false-heal (Codex round 2 P1).
-                                if (escaped) { escaped = 0; continue }
-                                if (c == "\\") { escaped = 1; continue }
-                                if (c == "\"") { in_string = !in_string; continue }
-                                if (in_string) continue
-                                if (c == "[") { depth++; started = 1 }
-                                else if (c == "]") { depth-- }
-                            }
-                            if (started && depth <= 0) in_block = 0
-                        }
-                    ' "$HANDOFF" 2>/dev/null)
-                    if [ -n "$FIXES_BLOCK" ] && [ -d "$ROOT/.git" ]; then
-                        # Strip UUIDs (8-4-4-4-12 hex pattern) BEFORE extracting
-                        # SHA candidates. UUIDs have a fixed shape; their hex
-                        # segments would otherwise match \b[0-9a-f]{7,40}\b and
-                        # fail the ancestry check, false-blocking certified
-                        # reviews that cite UUIDs in fixes_applied (mission
-                        # UUIDs, Linear/Jira ticket IDs, etc.). Codex P2 round 1.
-                        # POSIX-compatible: no `\b` (BSD sed doesn't support it).
-                        # The hyphenated 8-4-4-4-12 shape is specific enough
-                        # that false-stripping a real SHA is implausible.
-                        CLEANED=$(echo "$FIXES_BLOCK" | sed -E 's/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}//g')
-                        SHAS=$(echo "$CLEANED" | grep -oE '\b[0-9a-f]{7,40}\b' | sort -u)
-                        if [ -n "$SHAS" ]; then
-                            # Every cited SHA must be reachable from HEAD —
-                            # phantom SHAs (e.g. typos, references to other
-                            # repos) correctly fail ancestry and block the heal.
-                            ALL_IN_HEAD=1
-                            for sha in $SHAS; do
-                                if ! git -C "$ROOT" merge-base --is-ancestor "$sha" HEAD 2>/dev/null; then
-                                    ALL_IN_HEAD=0
-                                    break
-                                fi
-                            done
-                            [ "$ALL_IN_HEAD" -eq 1 ] && HEALED=1
-                        fi
-                    fi
-                fi
-                # Path (b): stale-handoff auto-expire (#229). Only when no pr_number
-                # AND path (c) didn't already heal. We must not short-circuit
-                # PR-linked reviews.
-            if [ "$HEALED" -ne 1 ]; then
-                # Try GNU stat first (Linux: `-c %Y` gives mtime, BSD stat errors out
-                # so `||` fires). Then BSD stat (macOS: `-f %m` gives mtime). The
-                # reverse order fails on Linux because `stat -f` on GNU means
-                # `--file-system` and dumps filesystem info to stdout (non-error).
-                MTIME=$(stat -c %Y "$HANDOFF" 2>/dev/null || stat -f %m "$HANDOFF" 2>/dev/null)
-                # Numeric guard: if stat fails both flavors or returns junk, skip
-                # the stale-check entirely and fall through to HOLD (safe default).
-                case "$MTIME" in
-                    ''|*[!0-9]*) ;;
-                    *)
-                        NOW=$(date +%s)
-                        AGE_DAYS=$(( (NOW - MTIME) / 86400 ))
-                        if [ "$AGE_DAYS" -ge "$STALE_DAYS" ]; then
-                            HEALED=1
-                            STALE_WARN="WARN: handoff.json is ${STATUS} and ${AGE_DAYS}d old with no pr_number — treating as stale CERTIFIED (override: set SDLC_HANDOFF_STALE_DAYS or close out the review)."
-                        fi
-                        ;;
-                esac
-            fi
-            fi
-            if [ "$HEALED" -ne 1 ]; then
-                HOLD_REASONS="${HOLD_REASONS}  - Codex review is ${STATUS}. Round-1 evidence lives in this context — compacting now loses what round-2 needs to re-verify.
-    Resolve: wait for CERTIFIED (or escalate) before /compact."$'\n'
-            fi
-            ;;
-    esac
-fi
-
-# Check 2: in-progress git operation
-# #240: dry-run override simulates a git op without needing a real .git/.
+# #240: SDLC_DRY_RUN_GIT_STATE=rebase|merge|cherry-pick simulates an
+# in-flight git operation without needing a real .git/ state, so consumers
+# can smoke-test every code path (read-only, no writes).
 GITDIR="$ROOT/.git"
 # Step 1: when dry-run var matches a known scenario, simulate it.
 # Otherwise (unset, empty, or unknown value) fall through to the real
@@ -241,16 +90,12 @@ fi
 
 if [ -n "$HOLD_REASONS" ]; then
     {
-        echo "HOLD: manual /compact at a non-seam. Compacting mid-cycle loses evidence the next round needs."
+        echo "HOLD: manual /compact mid-git-operation."
         echo ""
         echo "$HOLD_REASONS"
-        echo "Natural seams: commit boundary, Codex CERTIFIED, PR merge, ROADMAP item DONE."
         echo "Override: resolve the blocker above, or temporarily disable this hook in .claude/settings.json."
     } >&2
     exit 2
 fi
 
-# Stale-handoff unblock: emit a one-line WARN so the user knows the hook
-# self-healed over an abandoned PENDING artifact (but still allow /compact).
-[ -n "$STALE_WARN" ] && echo "$STALE_WARN" >&2
 exit 0

package/hooks/sdlc-prompt-check.sh

@@ -35,19 +35,12 @@ else
     exit 0
 fi
 
-# Effort auto-bump (ROADMAP #195). Watches this UserPromptSubmit payload for
-# LOW-confidence / FAILED-repeatedly / CONFUSED phrases, logs a timestamped
-# signal, and emits a loud '/effort xhigh' nudge when ≥2 signals land inside
-# a 30-minute window. Enforces the SDLC confidence table mid-session so
-# Claude stops burning budget at 'high' after confidence drops.
-EFFORT_CACHE_DIR="${SDLC_WIZARD_CACHE_DIR:-$HOME/.cache/sdlc-wizard}"
-EFFORT_SIGNALS="$EFFORT_CACHE_DIR/effort-signals.log"
-PROMPT_TEXT=""
+# #236(b): the ROADMAP #195 effort auto-bump detector that used to live here
+# (phrase-matching low-confidence signals, loud '/effort xhigh' nudge after
+# ≥2 in 30 min) was removed — never fired in ~2 months of live use, the
+# largest unproven component in this file. SESSION_ID is still needed below
+# for the BASELINE fires-once sentinel, so stdin is still read for it.
 SESSION_ID=""
-# Read stdin once regardless of jq availability — session_id extraction
-# is jq-independent (Codex round 1 P1: BASELINE gate failed when jq was
-# missing or broken). Prompt extraction still needs jq because prompt
-# content can contain arbitrary multi-line text + escapes.
 if [ ! -t 0 ]; then
     STDIN_JSON=$(cat)
     if [ -n "$STDIN_JSON" ]; then
@@ -59,57 +52,6 @@ if [ ! -t 0 ]; then
             | grep -o '"session_id"[[:space:]]*:[[:space:]]*"[^"]*"' \
             | head -1 \
             | sed 's/.*"\([^"]*\)"$/\1/')
-        if command -v jq > /dev/null 2>&1; then
-            PROMPT_TEXT=$(printf '%s' "$STDIN_JSON" | jq -r '.prompt // empty' 2>/dev/null) || PROMPT_TEXT=""
-        fi
-    fi
-fi
-if [ -n "$PROMPT_TEXT" ]; then
-    LOWER=$(printf '%s' "$PROMPT_TEXT" | tr '[:upper:]' '[:lower:]')
-    SIGNAL_REASON=""
-    # Every trigger requires first-person ownership or a structured-label
-    # form, so educational/quoted mentions ("How do I name a low confidence
-    # badge?", "What does 'failed again' mean?") don't fire.
-    case "$LOWER" in
-        *"i'm stuck"*|*"i am stuck"*|*"im stuck"*|\
-        *"i'm confused"*|*"i am confused"*|*"im confused"*|\
-        *"i tried twice"*|*"i've tried twice"*|*"ive tried twice"*|\
-        *"i can't figure"*|*"i cant figure"*|\
-        *"i'm not sure why"*|*"i am not sure why"*|*"im not sure why"*|\
-        *"my confidence is low"*|*"my confidence: low"*|*"confidence: low"*|\
-        *"it's still failing"*|*"its still failing"*|\
-        *"it keeps failing"*|*"this keeps failing"*|\
-        *"it failed again"*|*"this failed again"*|\
-        *"failed twice"*|*"failed 2x"*)
-            SIGNAL_REASON="low"
-            ;;
-    esac
-    if [ -n "$SIGNAL_REASON" ]; then
-        # Group the write so redirection errors (e.g., unwritable HOME,
-        # cache-dir-is-a-file) land on /dev/null instead of leaking to stderr.
-        {
-            if mkdir -p "$EFFORT_CACHE_DIR" && [ -d "$EFFORT_CACHE_DIR" ]; then
-                # Prune entries older than 1h on every write to cap log size.
-                if [ -f "$EFFORT_SIGNALS" ]; then
-                    PRUNE_THRESH=$(( $(date +%s) - 3600 ))
-                    awk -v t="$PRUNE_THRESH" '$1+0 >= t' "$EFFORT_SIGNALS" > "${EFFORT_SIGNALS}.tmp" \
-                        && mv "${EFFORT_SIGNALS}.tmp" "$EFFORT_SIGNALS"
-                fi
-                printf '%s\t%s\n' "$(date +%s)" "$SIGNAL_REASON" >> "$EFFORT_SIGNALS"
-            fi
-        } 2>/dev/null || true
-    fi
-fi
-if [ -f "$EFFORT_SIGNALS" ]; then
-    NOW=$(date +%s)
-    THRESH=$(( NOW - 1800 ))
-    RECENT=$(awk -v t="$THRESH" '$1+0 >= t' "$EFFORT_SIGNALS" 2>/dev/null | wc -l | tr -d ' ')
-    if [ "${RECENT:-0}" -ge 2 ]; then
-        echo ""
-        echo "!! EFFORT BUMP REQUIRED: ${RECENT} low-confidence signals in last 30 min !!"
-        echo "   Run /effort xhigh NOW — spinning at 'high' after confidence drops wastes budget."
-        echo "   (Auto-enforcement of the SDLC confidence table. ROADMAP #195.)"
-        echo ""
     fi
 fi
 

package/hooks/tdd-pretool-check.sh

@@ -55,7 +55,22 @@ fi
 # slash BEFORE "src", so a cwd-relative file_path like "src/app.js" (no
 # leading slash) never matched and the whole gate silently no-op'd. Second
 # clause catches the relative form.
-if [[ "$FILE_PATH" == *"/src/"* || "$FILE_PATH" == "src/"* ]]; then
+# #236(b): SDLC_TDD_SRC_PATTERN overrides the gated path(s) via env var (set
+# it in the hook's "command" string in .claude/settings.json) instead of
+# editing this shared/distributed script — a "|"-separated list of
+# substrings, e.g. "hooks/|cli/". Falls back to the generic /src/ pattern
+# when unset, so every other install is unaffected.
+SRC_MATCH=0
+if [ -n "${SDLC_TDD_SRC_PATTERN:-}" ]; then
+  IFS='|' read -ra _tdd_patterns <<< "$SDLC_TDD_SRC_PATTERN"
+  for _p in "${_tdd_patterns[@]}"; do
+    [[ "$FILE_PATH" == *"$_p"* ]] && SRC_MATCH=1 && break
+  done
+else
+  [[ "$FILE_PATH" == *"/src/"* || "$FILE_PATH" == "src/"* ]] && SRC_MATCH=1
+fi
+
+if [ "$SRC_MATCH" -eq 1 ]; then
   # #436 gate: block implementation-first edits when no test file has been
   # touched yet this session. Degrades to allow without session_id.
   if [ -n "$SESSION_ID" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-sdlc-wizard",
-  "version": "1.85.0",
+  "version": "1.87.0",
   "description": "SDLC enforcement for Claude Code — hooks, skills, and wizard setup in one command",
   "bin": {
     "sdlc-wizard": "cli/bin/sdlc-wizard.js"

package/skills/feedback/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: feedback
 description: Submit feedback, bug reports, feature requests, or share SDLC patterns you've discovered. Privacy-first — always asks before scanning.
-argument-hint: [optional: bug | feature | pattern | improvement]
+argument-hint: "[optional: bug | feature | pattern | improvement]"
 effort: medium
 ---
 # Feedback — Community Contribution Loop

package/skills/sdlc/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: sdlc
 description: Full SDLC workflow for implementing features, fixing bugs, refactoring code, testing, releasing, publishing, and deploying. Use this skill when implementing, fixing, refactoring, testing, adding features, building new code, or releasing/publishing/deploying.
-argument-hint: [task description]
+argument-hint: "[task description]"
 ---
 # SDLC Skill - Full Development Workflow
 
@@ -9,7 +9,7 @@ argument-hint: [task description]
 
 This skill is loaded from **`.claude/skills/sdlc/SKILL.md`** in the active repo (symlinked to `skills/sdlc/SKILL.md` in the wizard's source tree). Claude Code prefers repo-local skills over global (`~/.claude/skills/sdlc/SKILL.md`) when both exist with the same name — the repo-local copy is the project's authoritative workflow contract. Use global skills only for cross-repo personal tooling (e.g. `feedback`, `revise-claude-md`); use repo-local for implementation, tests, release, and verification in this repo.
 
-If unsure which copy is active, compare `head -5 .claude/skills/sdlc/SKILL.md` against `head -5 ~/.claude/skills/sdlc/SKILL.md`. The repo-local copy wins. Don't mix guidance from both — pick the source for this repo and stay there.
+If unsure which copy is active, compare `head -5` of both — the repo-local copy wins. Don't mix guidance from both.
 
 ## Task
 $ARGUMENTS
@@ -119,7 +119,7 @@ Native `/goal <condition>` (**v2.1.143+**). Haiku evaluator re-checks transcript
 
 ## Recommended Model
 
-**Recommended: Sonnet 5 `high`→`xhigh`** — beats Opus 4.6, ~5x less quota. Escalate to **Opus 4.8 `xhigh`** when stuck. **Opus 4.6 `max`** valid for consistency. See `AI_SETUP_LANES.md`.
+**Recommended: Sonnet 5 `medium`→`high`→`xhigh`** — beats Opus 4.6 on benchmarks, generally lower quota (savings narrow at high/xhigh). Escalate to **Opus 4.8 `xhigh`** when stuck. **Opus 4.6 `max`** valid for consistency. See `AI_SETUP_LANES.md`.
 
 **Effort is model-aware, not blanket `max`** — `max` overthinks on Sonnet 5/Opus 4.8. Set via `/effort` per session, not a shell-rc env var (overrides post-switch — see SDLC.md). `/model` persists; picker `s` does not.
 
@@ -137,20 +137,18 @@ The loop goes back to PLANNING, not TDD RED. Run `/code-review`; issues at confi
 
 ## Cross-Model Review (REQUIRED for High-Stakes)
 
-**When to run:** high-stakes changes (auth, payments, data), releases/publishes, complex refactors. **When to skip (log justification):** trivial, hotfixes, risk < review cost. **Prerequisites:** Codex CLI + OpenAI API key. **Reviewer:** `gpt-5.5` xhigh — adversarial diversity.
+**When to run:** high-stakes changes (auth, payments, data), releases/publishes, complex refactors. **When to skip (log justification):** trivial, hotfixes, risk < review cost. **Prerequisites:** Codex CLI + OpenAI API key. **Reviewer:** `gpt-5.6-sol` xhigh — adversarial diversity.
 
 PROTOCOL is universal across domains; only `review_instructions` and `verification_checklist` change.
 
 1. **Preflight** (`.reviews/preflight-{review_id}.md`) — what you already checked: `/code-review` passed, tests passing, manual verifications, known limits. Reduces reviewer findings to 0-1/round.
 2. **Mission-first handoff** (`.reviews/handoff.json`) — required keys: `"review_id"`, `"status": "PENDING_REVIEW"`, `"round": 1`, `"mission"`/`"success"`/`"failure"` (without them you get "looks good"), `"files_changed"`, `"verification_checklist"` (verification checklist with file:line refs — NOT generic), `"review_instructions"`, `"preflight_path"`. Optional `"pr_number":` opts into PreCompact self-heal (#209: MERGED → implicit CERTIFIED).
-3. **Run reviewer:** `codex exec -c 'model_reasoning_effort="xhigh"' -s danger-full-access -o .reviews/latest-review.md "<prompt>" < /dev/null`. Always `xhigh`. Bash tool requires `run_in_background: true` + `dangerouslyDisableSandbox: true`; always append `< /dev/null`. **Why:** `< /dev/null` prevents codex stdin-hang at S/0% CPU; `run_in_background: true` avoids the Bash 10-min (`600000` ms) `timeout` cap that force-kills foreground codex (multi-artifact bundles take 5–30 min). xhigh 1–30 min; wrapper's `STALL_SECONDS=1800` controls it. Heartbeat: `scripts/codex-review-with-progress.sh`. Foreground burned 70 min on a 7-min review (#364).
-4. **Dialogue loop:** per-finding response (`{"finding": "1", "action": "FIXED|DISPUTED|ACCEPTED", "summary": "..."}` in `.reviews/response.json`). Bump round, set status `PENDING_RECHECK`, add `fixes_applied` (numbered, file:line). Recheck prompt: "TARGETED RECHECK. FIXED → verify certify condition. DISPUTED → ACCEPT if sound, REJECT with reasoning. ACCEPTED → verify applied. No new findings unless P0." **NEVER unilaterally dismiss** — always run the recheck. It's a conversation: the reviewer may accept your dispute or counter with evidence you missed.
+3. **Run reviewer:** `codex exec -c 'model_reasoning_effort="xhigh"' -s danger-full-access -o .reviews/latest-review.md "<prompt>" < /dev/null`. Always `xhigh`. Bash tool requires `run_in_background: true` + `dangerouslyDisableSandbox: true`; always append `< /dev/null`. **Why:** `< /dev/null` prevents codex stdin-hang at S/0% CPU; `run_in_background: true` avoids the Bash 10-min (`600000` ms) `timeout` cap that force-kills foreground codex (multi-artifact bundles take 5–30 min). xhigh 1–30 min; wrapper's `STALL_SECONDS=1800` controls it. Foreground burned 70 min on a 7-min review (#364).
+4. **Dialogue loop:** per-finding response (`{"finding": "1", "action": "FIXED|DISPUTED|ACCEPTED", "summary": "..."}` in `.reviews/response.json`). Bump round, set status `PENDING_RECHECK`, add `fixes_applied` (numbered, file:line). Recheck prompt: "TARGETED RECHECK. FIXED → verify certify condition. DISPUTED → ACCEPT if sound, REJECT with reasoning. ACCEPTED → verify applied. No new findings unless P0." **NEVER unilaterally dismiss** — always run the recheck. It's a conversation: the reviewer may accept your dispute or counter with evidence you missed. **On CERTIFIED, write `"commit_sha": "<git rev-parse HEAD>"` into `handoff.json`** — the gate hook (#437) treats a missing/mismatched SHA as stale, not just the status string.
 
 **Convergence:** 2 rounds sweet spot, 3 max, escalate after — except large migrations: judge by finding trend, not count.
 
-**Enforcement:** `hooks/goal-confidence-check.sh` warns when `/goal` skips the 95%-confidence or DLC-binding gates (#360).
-
-**Multi-reviewer:** respond to each independently (no shared anchoring). **Non-code domains:** add `"audience"`/`"stakes"` keys.
+**Multi-reviewer:** respond to each independently. **Non-code domains:** add `"audience"`/`"stakes"` keys.
 
 ### Release Review Focus
 
@@ -275,7 +273,7 @@ Don't fix only the symptom. Add a gate so it can't happen again. Example: PR #14
 - Auto-compact fires at ~95%; `/usage` shows what's driving token spend
 - After committing a PR, `/clear` before next feature
 - `--bare` mode (v2.1.81+) skips ALL hooks/skills/LSP/plugins. Scripted headless only — never normal development.
-- Custom subagents (`.claude/agents/`) run autonomously and return results. Skills guide behavior; agents do work. Use for parallel tasks or fresh context. Examples: `sdlc-reviewer`, `ci-debug`, `test-writer`.
+- Custom subagents (`.claude/agents/`) run autonomously and return results. Skills guide behavior; agents do work. Use for parallel tasks or fresh context.
 
 ## Design System Check (UI Changes Only)
 

package/skills/setup/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: setup-wizard
 description: Setup wizard — scans codebase, builds confidence per data point, only asks what it can't figure out, generates SDLC files. Use for first-time setup or re-running setup.
-argument-hint: [optional: regenerate | verify-only]
+argument-hint: "[optional: regenerate | verify-only]"
 effort: high
 ---
 # Setup Wizard - Confidence-Driven Project Configuration
@@ -245,7 +245,7 @@ The output is JSON: `{ tier: "simple" | "complex", score, signals }`. Use the re
 > How do you want to configure the model for this repo?
 >
 > - **[N] No pin (default):** Auto-mode. CC picks model per turn. Simplest, no advisor.
-> - **[s] Sonnet 5 + Fable** *(Setup A — recommended if you want a pin):* Pins `model: "sonnet"`, `advisorModel: "fable"`. Native 1M context, no `[1m]` suffix needed. Beats Opus 4.6 on every coding benchmark at ~5x less Max quota per turn. Effort: `high`, escalate to `xhigh` for hard tasks.
+> - **[s] Sonnet 5 + Fable** *(Setup A — recommended if you want a pin):* Pins `model: "sonnet"`, `advisorModel: "fable"`. Native 1M context, no `[1m]` suffix needed. Beats Opus 4.6 on every coding benchmark, generally lower Max quota. Effort: `medium`, escalate `high` → `xhigh` for hard tasks.
 > - **[o] OpusPlan Hybrid** *(Setup C — cost-conscious, still want Opus reasoning):* Pins `model: "opusplan"`. Opus 4.8 plans (Shift+Tab), Sonnet 5 executes. Max-bundled. No API credit drain (#390).
 > - **[b] Opus 4.6 Stability** *(Setup B — legacy flagship, proven consistency for high-stakes/complex repos):* Pins `model: "claude-opus-4-6"`. Opus 4.6 max everywhere. Max-bundled (auto-upgrades to 1M on Max plans).
 >
@@ -259,14 +259,14 @@ The output is JSON: `{ tier: "simple" | "complex", score, signals }`. Use the re
 {
   "model": "sonnet",
   "advisorModel": "fable",
-  "effortLevel": "high",
+  "effortLevel": "medium",
   "env": {
     "CLAUDE_AUTOCOMPACT_PCT_OVERRIDE": "75"
   }
 }
 ```
 
-Tell the user: "Sonnet 5 + Fable — the wizard's recommended pin (Setup A). Effort defaults to `high`, escalate via `/effort xhigh` for hard tasks. Requires CC v2.1.170+ — run `! claude update` if needed."
+Tell the user: "Sonnet 5 + Fable — the wizard's recommended pin (Setup A). Effort: `medium`, escalate `/effort high` → `xhigh` for hard tasks. Requires CC v2.1.170+ — run `! claude update` if needed."
 
 **If the user answers `o` (opusplan):** Edit `.claude/settings.json` and add: