agentplugged 1.3.0 → 2.0.0

package/dist/method/skills/setup-ci/assets/stack-rust-github.yml

@@ -0,0 +1,107 @@
+# Base CI for Rust (cargo test, clippy, cargo audit): a template of the method, advice only.
+# Yours to edit or to leave: decline it and nothing else changes. It makes no call to the method;
+# every tool below is the ecosystem's own and free.
+# One job per check of the pull request (lint, test, build, audit). A failed job keeps its logs and
+# reports in `reports/` as a CI artifact. Adjust versions and paths to your product.
+# Test and audit need a committed Cargo.lock (a library may not have one: commit it or drop --locked).
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - name: lint
+        run: |
+          mkdir -p reports
+          rustup component add clippy rustfmt 2>&1 | tee -a reports/lint.txt
+          cargo fmt --check 2>&1 | tee -a reports/lint.txt
+          cargo clippy --all-targets -- -D warnings 2>&1 | tee -a reports/lint.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: lint-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - name: test
+        run: |
+          mkdir -p reports
+          cargo test --locked 2>&1 | tee -a reports/test.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - name: build
+        run: |
+          mkdir -p reports
+          cargo build --locked --release 2>&1 | tee -a reports/build.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  audit:
+    name: audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: audit
+        run: |
+          mkdir -p reports
+          cargo install cargo-audit --locked 2>&1 | tee -a reports/audit.txt
+          cargo audit 2>&1 | tee -a reports/audit.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: audit-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14

package/dist/method/skills/setup-ci/assets/stack-rust-gitlab.yml

@@ -0,0 +1,64 @@
+# Base CI for Rust (cargo test, clippy, cargo audit): a template of the method, advice only.
+# Yours to edit or to leave: decline it and nothing else changes. It makes no call to the method;
+# every tool below is the ecosystem's own and free.
+# One job per check of the merge request (lint, test, build, audit). A failed job keeps its logs and
+# reports in `reports/` as a CI artifact. Adjust versions and paths to your product.
+# Test and audit need a committed Cargo.lock (a library may not have one: commit it or drop --locked).
+image: rust:1
+
+stages:
+  - check
+
+default:
+  timeout: 30 minutes
+
+lint:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'rustup component add clippy rustfmt 2>&1 | tee -a reports/lint.txt'
+    - 'cargo fmt --check 2>&1 | tee -a reports/lint.txt'
+    - 'cargo clippy --all-targets -- -D warnings 2>&1 | tee -a reports/lint.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+
+test:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'cargo test --locked 2>&1 | tee -a reports/test.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+
+build:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'cargo build --locked --release 2>&1 | tee -a reports/build.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+
+audit:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'cargo install cargo-audit --locked 2>&1 | tee -a reports/audit.txt'
+    - 'cargo audit 2>&1 | tee -a reports/audit.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/

package/dist/method/skills/setup-ci/references/security.md

@@ -0,0 +1,39 @@
+# Security checks of the CI
+
+`npx agentplugged ci setup` writes them beside the base checks, for any language. Read its
+`security` field and `todo`. GitHub: `.github/workflows/security.yml`; GitLab: three more jobs in
+`.gitlab-ci.yml`. A CI that already exists gets the workflow too (GitHub) or a `todo` naming the
+jobs to add. The jobs keep these names: the engine reads them for the commit to release.
+
+- `secrets`: gitleaks over the whole history.
+- `sast`: semgrep with its default rules (`p/default`), no account.
+- `access`: only when `.agentplugged/access.json` declares a role. No role: the job is not
+  written, the result says `not_required`, nothing is skipped silently.
+
+## Declaring roles and routes
+
+Ask the architecture for the roles, then write `.agentplugged/access.json` (then run `ci setup`
+again; the script `.agentplugged/ci/access-check.mjs` is the method's, never edited):
+
+```json
+{
+  "start": "npm start",
+  "base_url": "http://localhost:3000",
+  "roles": {
+    "admin": { "headers": { "Authorization": "Bearer ${TOKEN_ADMIN}" } },
+    "member": { "headers": { "Authorization": "Bearer ${TOKEN_MEMBER}" } }
+  },
+  "routes": [
+    { "method": "GET", "path": "/admin/users", "allow": ["admin"] },
+    { "method": "GET", "path": "/account", "allow": ["admin", "member"] },
+    { "method": "GET", "path": "/", "allow": ["anonymous"] }
+  ]
+}
+```
+
+- `start` is the command that runs the product in the CI; leave it out when it runs already.
+- `${NAME}` is a secret of the forge, by name (test accounts only, never a real one); the
+  workflow passes it. Ask the creator to create it, never put a value in the file.
+- A caller listed in `allow` must reach the route (a 2xx status); any other, `anonymous`
+  included, must get 401, 403, 404 or a redirect. At least one route is required.
+- List every route that checks who calls it, at least one per role.

package/dist/method/skills/setup-ci/references/stacks.md

@@ -0,0 +1,22 @@
+# Other stacks: ready-made base workflows
+
+When `npx agentplugged ci setup` reports a stack it does not know (`other`), or the product is not
+Node.js, pick the template of the stack from its manifest, copy it as the CI file of the forge, then
+complete it as in step 3 of the sheet. It is advice: the creator can decline it, and nothing is
+imposed.
+
+| Manifest | GitHub Actions (`.github/workflows/ci.yml`) | GitLab (`.gitlab-ci.yml`) |
+|---|---|---|
+| `pyproject.toml`, `requirements.txt` | `assets/stack-python-github.yml` | `assets/stack-python-gitlab.yml` |
+| `go.mod` | `assets/stack-go-github.yml` | `assets/stack-go-gitlab.yml` |
+| `Cargo.toml` | `assets/stack-rust-github.yml` | `assets/stack-rust-gitlab.yml` |
+| `pom.xml` | `assets/stack-jvm-maven-github.yml` | `assets/stack-jvm-maven-gitlab.yml` |
+| `build.gradle(.kts)` | `assets/stack-jvm-gradle-github.yml` | `assets/stack-jvm-gradle-gitlab.yml` |
+| `*.sln`, `*.csproj` | `assets/stack-dotnet-github.yml` | `assets/stack-dotnet-gitlab.yml` |
+
+- Each has the four jobs `lint`, `test`, `build`, `audit`, with the ecosystem's own free tools, and
+  keeps the logs and reports of a failed job (`reports/`) as a CI artifact.
+- Read the notes at the top of the file and adjust versions, paths and the main branch. Never
+  weaken a job to turn it green (step 3 holds).
+- No template for the stack: keep the `TODO` plan of `ci setup`.
+- The security jobs are separate: `references/security.md` still applies.

package/dist/method/skills/split-into-stories/SKILL.md

@@ -7,199 +7,66 @@ metadata:
 ---
 # Split into stories
 
-This skill takes the approved plan of the product and turns it into work that a developer agent
-can pick up, finish and hand over for review with nothing but the story in hand. It writes the
-epics in `.agentplugged/epics/` and the stories in `.agentplugged/stories/`, proves with
-`npx agentplugged docs check` that the breakdown holds, and ends with a checkpoint the creator
-answers. It never plans a sprint: that is a separate step.
+## Overview
 
-Work through the steps in order. Do not jump ahead: each step relies on what the previous one
-settled with the creator.
+- **Step:** build, as Izzy (`agent: izzy` in every MCP call); no sprint planning.
+- **Produces:** `.agentplugged/epics/epic-<n>.md` from `assets/epic.md.tmpl` and
+  `.agentplugged/stories/<n>-<s>.md` from `assets/story.md.tmpl`.
+- **Reads:** by section (`reading: true`, `docs read @requirements @journeys
+  @decisions @screens`), never whole. Short path
+  (`full_path` in `journey.skipped`): `spec.md` alone stands for all three, its Stories part is
+  the first draft. A prototype without PRD: 3 to 6 stories, one per page, citing the prototype's
+  sections instead of requirements.
+- **Validation point:** a `document` checkpoint per epic (step 6), one stack.
 
-## Rules that hold throughout
+## Rules
 
 - Follow "Rules for skills and agents" (reference `skill-rules`): checkpoint before the question, ask once; a point the creator did not keep goes to `checkpoint.decide`; in French say « tu »; start with `memory.read`.
-- Write only in `.agentplugged/epics/` and `.agentplugged/stories/`. The PRD, the architecture and
-  the UX specification are read, never edited: a gap in them goes back to their owner (Maya, Alex,
-  Stella) through the creator.
-- Identifiers: an epic is `epic-<n>`, a story `<n>-<s>` (`2-6` is the sixth story of epic 2), the
-  same id the journal uses. Story numbers follow the delivery order inside the epic, and epics
-  follow each other in the order they can be built. Never renumber an id once the creator has
-  seen it: add a new one, or mark the old one `(retired)` in its title.
-- The order of the ids is the order of the work: `1-9` before `1-10` before `2-1`. A story may
-  depend only on stories that come before it in that order. `docs check` refuses anything else.
-- Report through the `agentplugged` MCP server: `agent.status` (`working`) when you start,
-  `checkpoint.open` at the end, `story.result` with your assumptions and open questions, then
-  `agent.status` (`idle` or `waiting`).
-
-## The short path: a prototype to carry over
-
-When the creator gave a complete prototype and chose the short path (no PRD, a light
-architecture), cut it into a few stories, not a long list: one story per page or per group of
-screens, each one naming the sections of the prototype to reproduce, the check that the rendering
-matches (on a computer and on a phone, in each language the prototype has), and what stays as it
-already is. Three to six stories usually carry a whole site. A story's budget is read in
-`state.get` `usage.estimates` (the product's measured stories, else the method's reference), never a
-figure guessed. Where `docs check`
-asks for requirement identifiers the short path does not have, say it once to the creator and
-cite the prototype's sections instead: never write requirements nobody asked for just to
-satisfy it. The full breakdown stays possible if the creator prefers it.
-
-## The short path: one spec
-
-When `journey.skipped` holds `full_path`, `spec.md` stands for the PRD, the architecture and the
-UX specification: read it whole instead of Step 1's documents, with the creator's approval of the
-spec as the only gate (no closed phases to check). Its Stories part is your first draft of the
-epics and stories; refine it with the creator and write them from the same templates.
-
-## Step 1: check that the plan can be cut
-
-1. Read `.agentplugged/docs/prd.md`, `architecture.md` and `ux.md` in full (skip `ux.md` only
-   when the profile has no UX domain).
-2. With `state.get`, check that the planning and design phases are closed (`phase.phases`): their
-   `phase_end` checkpoints resolved `approved` (`state.get { checkpoints: { type: "phase_end", status: "resolved" } }`). A draft is not an input. If one is missing, say which and who
-   owns it, and stop.
-3. Check that the requirements carry stable identifiers (`EF-n`, `ENF-n`) and are testable, that
-   the architecture answers what stories will need (stack, data, interfaces, decisions `AD-n`),
-   and that the key flows of the UX specification are described. List each gap with its owner.
-   Small gaps can be noted as assumptions; a gap that changes what gets built goes to the creator
-   before you cut anything.
-4. Check that the developers the plan needs are at work. Read `profile.specialties` in
-   `.agentplugged/method.yaml` and compare it with the platforms the architecture and the PRD decide (a mobile
-   app needs `mobile`, a website or a web app `frontend`, a service or an API `backend`). When a
-   specialty is off, say it before you cut anything: you do not name an inactive developer as a
-   story's owner (the engine refuses a sprint that does), and you do not give the work to another
-   specialty to get around it. Hand back to Noah, who asks the creator to turn it on
-   (`guard.creator_action`, `profile` or `agent_enable`); cut the plan once it is on, or, if the
-   creator prefers, with the story owned by `creator`.
-
-## Step 2: take the inventory
-
-Build, for yourself, the full list of what the breakdown must carry:
-
-- every active `EF-n` and `ENF-n` of the PRD, with a short label (a requirement marked
-  `(retired)` is out);
-- the architecture decisions (`AD-n`) that shape the work: a starter or template to set up first,
-  the data model, the interfaces between parts, the infrastructure;
-- the UX elements: flows, screens with their sketches, responsive rules, and each `UX-n` of the
-  table "Elements to build" of `ux.md` (components, states, accessibility fixes), none dropped.
-
-Show the inventory to the creator in a compact form, and ask whether anything is missing or
-should be left out on purpose.
-
-## Step 3: design the epics
-
-1. Group the requirements into epics by user value: each epic lets a user do something they could
-   not do before. Never cut by technical layer ("database", "API", "front end"): such an epic
-   delivers nothing a user can see.
-2. Order the epics so that each one works on top of the previous ones alone, never waiting on a
-   later epic. When the architecture names a starter or template, the first story of the first
-   epic sets it up.
-3. Map every active `EF-n` and `ENF-n` to an epic. A requirement the creator decides to leave out
-   of this breakdown goes into the `out_of_scope` list of the epic it would belong to, so that the
-   choice is written down rather than forgotten.
-4. Present the list: for each epic, its title, the user value in one sentence and the requirements
-   it covers. Refine it with the creator until they agree.
-5. Write one file per epic from `assets/epic.md.tmpl`: copy the template, keep its header keys,
-   replace every value and every `<…>` placeholder (`docs check` refuses one left behind). In
-   `links`, name only documents that exist: drop `ux` when the profile has no UX domain. Mention a requirement in backticks (`` `EF-1` ``),
-   never as `EF-1 : …` at the start of a line: that would define it a second time, next to the
-   PRD's definition, and `docs check` refuses it.
-
-## Step 4: write the stories, one epic at a time
-
-For each epic, in order, propose its stories to the creator, then write one file per story from
-`assets/story.md.tmpl`, replacing every `<…>` placeholder and keeping in `links` only documents
-that exist (no `ux` without a UX domain). Each story:
-
-- is small enough for one developer agent to finish and one reviewer to check, ideally in a day of
-  agent work; split anything larger;
-- delivers something observable: a user can do it, or a later story can build on it;
-- creates or changes only the data, files and interfaces it needs now, never "everything the next
-  epics will use";
-- carries the full header: `id`, `kind: story`, `owner` (the developer who will build it: an active
-  developer of the specialty the story concerns, for example `sam` or `ethan` for the server and
-  the data, `hugo` or `lina` for the interface, `jade` for the mobile applications; a small change
-  goes to that same developer, who builds it in the quick lane), `links` (the documents it builds
-  on), `title`, `epic` (`epic-<n>`, the epic of its id), `reviewer` (`quentin` for QA, or
-  `creator` without a quality
-  agent), `requirements` (the `EF-n`, `ENF-n`, `AD-n` it implements: at least one), `budget_usd`
-  (the story's estimate in US dollars at the API's public prices, above zero: the `expected` of
-  its lane in `state.get` `usage.estimates`, `standard` or `fast` for a small change, never a figure
-  of your own; `plan.sprint` refuses a budget three times off that range), `branch` (`feat/<id>-<slug>`) and
-  `depends_on` (earlier stories only). Never a status, a progress or a cost spent: the journal
-  holds those;
-- has the four sections, as level 2 headings:
-  - `## Context`: everything the developer needs, by identifier: requirements, architecture
-    decisions, screens, flows and the `UX-n` it builds, and the page of its screen in
-    `ux-mockups/` if one is drawn (opened for visual detail only). Cite; do not paste whole
-    documents;
-  - `## Intent`: why the story exists and what it must achieve, in a few plain sentences. Once the
-    creator approves the breakdown, this section belongs to the creator;
-  - `## Acceptance criteria`: testable criteria, one per line, in "given, when, then" form,
-    covering the error cases and edges, not only the happy path. A story that builds a screen
-    takes that screen's sketch in `ux.md` as a criterion, by region number;
-  - `## Out of scope`: what the story does not do, and which story does it, by id.
-
-Write each story as if its developer will read nothing else. If a criterion only makes sense with
-another story in hand, the cut is wrong: move the boundary.
-
-## Step 5: check the breakdown
-
-1. Run `npx agentplugged docs check` and fix everything it reports. Beyond the headers and the
-   identifiers, it checks the breakdown:
-   - `REQ_NOT_COVERED`: an active `EF-n` or `ENF-n` of the PRD is in no story's `requirements`
-     and in no epic's `out_of_scope`;
-   - `STORY_DEPENDENCY_FORWARD`: a story depends on a later one. Reorder the stories, or split
-     the earlier one;
-   - `STORY_DEPENDENCY_CYCLE`: stories depend on each other in a loop, or a story on itself;
-   - `STORY_SECTION_INVALID`: one of the four sections is missing, empty or given twice;
-   - `LAUNCH_DOCUMENT_INVALID` with reason `ux_element_uncovered`: a `UX-n` of `ux.md` is named in
-     the Context or criteria of no story;
-   - `DOC_PLACEHOLDER_LEFT`: a `<…>` marker of a template is still in a title or a section;
-   - `DOC_HEADER_INVALID` and `DOC_LINK_DANGLING`: a field outside the contract, an epic, story or
-     requirement that does not exist.
-2. Then review what the command cannot see:
-   - every story traces to at least one requirement, and its acceptance criteria actually cover
-     the requirements it lists;
-   - no story text refers to work that a later story does;
-   - each epic works with the earlier epics only;
-   - the budgets are plausible next to each other and read from `usage.estimates`. Tell the
-     creator what they rest on (`basis`: `history`, the product's own measured stories, or
-     `reference`, the method's prudent range because none is measured yet), always as a range
-     (`low` to `high`), and the product's total as the sum of its stories, never a global figure.
-     Never write an amount without that basis: an estimate without a base is not given.
-3. Draw the dependency graph in each epic file (the `## Dependency graph` section of the
-   template): one line per story with what it depends on, earlier stories only.
-
-## Step 6: ask the creator to validate
-
-1. Commit the epics and stories on your working branch, so that Git holds the exact files the
-   creator will approve.
-2. For each epic, open a checkpoint with `checkpoint.open`: `type: document`, `risk: medium`, no
-   story and no blocks, a title naming the epic, a summary with the user value, the stories in
-   order, the dependency graph, the requirements covered and those left out of scope, and your
-   open questions. In `documents`, list the epic file and each of its story files, each with the
-   branch and its Git blob (`git rev-parse HEAD:<path>`): at most 20 documents per checkpoint, so
-   split a larger epic's stories over two checkpoints.
-3. Only once the checkpoints are open, ask the creator whether the breakdown suits them, once.
-   Several epics are one stack, never one question each: call `chat.stack_open` with the epics'
-   checkpoints (2 to 16; a larger breakdown goes in several stacks), then `chat.stack_ask` when
-   `validation.channels.available` holds more than `chat`. Otherwise (`answered: false` with
-   `channel: "chat"`, or nothing to click) present the epics
-   numbered, each with its title and a short summary, and record the creator's one message with
-   `chat.stack_answer` ("j'approuve tout", "j'approuve 1, 2 et 4": constitution, "Stacks to
-   validate"). A single epic, or one the stack refused, is answered with `chat.answer`
-   (constitution, "Checkpoints in the chat").
-4. End with `story.result` (`complete`), your assumptions and open questions, then
-   `agent.status`, and hand back to Noah, who proposes what comes next; the creator decides
-   (without Noah, the creator picks the next agent).
-
-When the creator approves a checkpoint, the intent of each story it lists is frozen: `docs check`
-fails as soon as that section differs from the approved version. From then on, never edit an
-intent. When the creator wants to change one, they edit it themselves, or ask you to propose the
-new wording; either way, the change counts only once a new `document` checkpoint listing the story
-at its new blob is approved. Other sections may still be refined: say what changed in your result.
-The creator's `review` card shows, for each story listed, the first lines of the intent it would
-freeze and whether it replaces one already frozen; list the story files by their path under
-`.agentplugged/stories/`, or the card and `docs check` cannot recognise them.
+- Write only in `.agentplugged/epics/` and `.agentplugged/stories/`; a gap in the PRD,
+  architecture or UX goes back to its owner through the creator.
+- Ids: `epic-<n>`, story `<n>-<s>`, in delivery order; a story depends only on earlier ones. Never
+  renumber an id the creator has seen: add one, or mark the old `(retired)` in its title.
+
+## Steps
+
+1. **Check that the plan can be cut.** `agent.status` (`working`). Planning and design closed:
+   their `phase_end` checkpoints resolved `approved` (`state.get`); a draft is not an input; else say which and who owns it, and stop. A gap that changes the build goes to the
+   creator. A needed specialty off in `profile.specialties` is said before you cut; never name an
+   inactive developer as owner: Noah asks the creator to turn it on, or `creator` owns the story.
+2. **Inventory.** Every active `EF-n`, `ENF-n`, the shaping `AD-n`, each `UX-n` of "Elements to
+   build", none dropped.
+3. **Epics.** By user value, never by technical layer; each builds on the earlier ones only; the
+   architecture's starter comes first. Every active requirement is in an
+   epic, or in its `out_of_scope`. Write each from the template (replace every `<…>`; `links`
+   only to existing documents). Mention a requirement in backticks
+   (`` `EF-1` ``), never as `EF-1 : …` at a line's start (it would define it twice).
+4. **Stories**, one epic at a time, from the template, small and observable: each is the
+   developer's only reading (the sheet). Header: `owner` an active developer of the specialty,
+   `reviewer` `quentin` (or `creator` without a quality agent), `requirements` at least one `EF-n`,
+   `ENF-n` or `AD-n`, `budget_usd` the `expected` of its lane in `state.get` `usage.estimates`
+   (`standard`, or `fast`), never your own figure (`plan.sprint` refuses three times off). Sections:
+   `## Context` (requirements, `AD-n`, `UX-n` by identifier, a section without one as
+   `` `prd.md#glossary` ``, dependencies: cite, paste nothing); `## Intent` (why, plain);
+   `## Acceptance criteria` ("given, when, then", edges included; a story that builds a screen
+   takes that screen's sketch in `ux.md` as a criterion, by region number); `## Screen` (its page
+   in `ux-mockups/`, its sketch as `` `ux.md#<anchor>` ``); `## Tests expected`; `## Reuse` (from
+   `reference/reusable.md`); `## Out of scope` (and which story does it). Then `npx agentplugged
+   docs sheet`: the engine quotes each cited passage in `## Excerpts` with its fingerprint (never
+   edit it). Over 300 lines (`STORY_SHEET_TOO_LONG`): cut the story.
+5. **Review gate.** `npx agentplugged docs check` until clean (among others `REQ_NOT_COVERED`,
+   `STORY_DEPENDENCY_FORWARD`, and `LAUNCH_DOCUMENT_INVALID` with reason `ux_element_uncovered`: a
+   `UX-n` in no story). Then: criteria cover the listed requirements; no story speaks of a
+   later one's work. Tell the creator the budgets' `basis` (`history`, or `reference` when none is
+   measured) as a range (`low` to `high`), the total their sum; never an amount without a basis. Draw each epic's `## Dependency graph`.
+6. **Ask.** Commit. For each epic, `checkpoint.open`: `type: document`,
+   `risk: medium`, no story, no blocks, a summary (value, stories, graph, coverage, questions), and in `documents` the epic file and each story file by
+   path under `.agentplugged/stories/`, with the branch and `git rev-parse HEAD:<path>` (20 at most
+   per checkpoint). Only once the checkpoints are open, ask the creator whether the breakdown suits
+   them, once. Several epics are one stack (constitution, "Stacks to validate"); one epic:
+   `chat.answer`.
+7. **Report.** `story.result` (`complete`), assumptions, questions; `agent.status`; hand back to
+   Noah, who proposes what comes next; the creator decides.
+
+Once approved, a story's intent is frozen (`docs check` fails if it differs). Never edit one: a
+change counts once a new `document` checkpoint with the story at its new blob is approved. A cited
+passage changed (`stale_sheets` in `state.next`): `docs sheet <story>`, then that checkpoint again.

package/dist/method/skills/split-into-stories/assets/story.md.tmpl

@@ -17,10 +17,9 @@ depends_on: []
 
 ## Context
 
-- <the requirements this story implements, by identifier: EF-1, ENF-1>
-- <the architecture decisions it follows, by identifier: AD-1>
-- <the screens, flows and UX-n elements of the UX specification it builds, and the page of its screen under ux-mockups/ if one is drawn>
-- <the earlier stories it builds on, by id>
+- <the requirements it implements and the decisions it follows, by identifier: `EF-1`, `AD-1`>
+- <a section it needs that has no identifier, as `doc.md#anchor`: `prd.md#glossary`>
+- Depends on: <the earlier stories, by id, and what each gives it>
 
 ## Intent
 
@@ -31,6 +30,18 @@ depends_on: []
 - Given <a starting situation>, when <the user or the system acts>, then <an observable result>.
 - Given <an error case>, when <the same action>, then <what the user sees>.
 
+## Screen
+
+- <the page under ux-mockups/ and its sketch as `ux.md#anchor`, with the `UX-n` it builds; "none" for a story without a screen>
+
+## Tests expected
+
+- <per criterion, the test that proves it: unit, integration or end to end, and the edge it covers>
+
+## Reuse
+
+- <the existing modules or components to build on, from reference/reusable.md; "none yet" at the start>
+
 ## Out of scope
 
 - <what this story does not do, and the story that does it, by id>

package/dist/method/skills/strategy/SKILL.md

@@ -7,32 +7,27 @@ metadata:
 ---
 # Strategy
 
-On the creator's ask: a problem that resists (a bug that returns, users who do not come, a stuck
-choice), or the business model, the price, where to bet. Two modes, they pick one. Run under your own
-id (`agent: lou` to solve, `agent: iris` to innovate), in their language. Write only the one file of the mode.
+On the creator's ask: a problem that resists, or the business model and price. They pick one of two modes. Run under your own id (`agent: lou` to solve, `agent: iris` to innovate), in
+their language. Write only the one file of the mode.
 
-1. `agent.status` (`working`). **Read what exists**: brief, PRD, `architecture.md`, `prfaq.md`,
-   `launch/positioning.md`, the research (`npx agentplugged docs research <subject>`: reuse a fresh page,
-   search again only what is old), the hypotheses of `state.get`. Say in two lines what you found; ask only
-   for what is missing, one question at a time. Each claim keeps its source (`EF-n`, section); the documents
-   go in `links`. Mention `EF-n` inside a line, never at the start of a line, a list item, a heading or a
-   first table cell.
-2. **Guide, step by step.** Questions before answers, the creator's words first; no duration promised, only
-   order. At the end of each step save it in the file (sections filled so far, the line `Next step:`), show
-   it, and offer in one line: continue, go deeper, go back, challenge (you push back once, with one
-   question), ask the table (Noah opens it), finish fast (you draft the rest in one pass, marked as a
-   draft), or stop here. A file with a `Next step:` line is resumed from it. Before a long step ask how
-   their energy is.
-3. **Solve** (Lou): `references/solve.md`, the methods of `references/solve-methods.md` (two or three per
-   step, chosen from the problem), `assets/problem-template.md`, to `.agentplugged/docs/strategy/problem-<slug>.md`.
-4. **Innovate** (Iris): `references/innovate.md`, the frameworks of `references/innovate-frameworks.md`,
-   `assets/innovation-template.md`, to `.agentplugged/docs/strategy/innovation-<slug>.md`. The economics
-   start from the costs of the product: `references/costs.md`.
-5. **Gestures**: the conclusions become, at the creator's choice, hypotheses followed, stories proposed or a
-   decision point: `references/gestures.md`.
-6. A figure carries its source on its line, or `[to verify]`: never invented. `npx agentplugged docs check`,
-   fix what it lists. Commit, then one `document` checkpoint (low risk, no story, no blocks) citing the
-   file with its `branch` and `blob_sha`; ask once.
+1. `agent.status` (`working`). **Read what exists**: brief, PRD and architecture by section (`docs read`), `prfaq.md`,
+   `launch/positioning.md`, the research (`npx agentplugged docs research <subject>`: reuse a fresh
+   page, search again only what is old), the hypotheses of `state.get`; ask only for what is missing.
+   Each claim keeps its source (`EF-n`, section); documents go in `links`.
+   Mention `EF-n` inside a line, never at the start of a line, list item, heading or first table cell.
+2. **Guide, step by step.** Questions before answers, the creator's words first. At the end of each step save it in the file (the line `Next step:`), show it, and offer
+   in one line: continue, go deeper, go back, challenge (you push back once, with one question), finish fast (you draft the rest, marked as a draft), or stop here.
+   A `Next step:` line is resumed from.
+3. **Solve** (Lou): `references/solve.md`, `assets/problem-template.md`, to
+   `.agentplugged/docs/strategy/problem-<slug>.md`.
+4. **Innovate** (Iris): `references/innovate.md`, `assets/innovation-template.md`, to
+   `.agentplugged/docs/strategy/innovation-<slug>.md`; the economics start from the costs of the
+   product: `references/costs.md`.
+5. **Gestures**: hypotheses followed, stories proposed or a decision point, at the creator's choice:
+   `references/gestures.md`.
+6. A figure carries its source on its line, or `[to verify]`: never invented. `npx agentplugged docs
+   check`, fix what it lists. Commit, then one `document` checkpoint (low risk, no story, no blocks)
+   citing the file with its `branch` and `blob_sha`; ask once.
 7. `agent.status` (`idle`), hand back to Noah.
 
 ## Never