arcane-cli 0.14.0 → 0.15.1

package/dist/assets/.arcane/governance/testing-standards.md

@@ -1,158 +1,158 @@
----
-title: Testing Standards
-audience: both
-last_updated: YYYY-MM-DD
-status: active
-tags: [testing, qa, coverage, standards, lince]
----
-
-# Testing Standards
-
-Framework selection, coverage thresholds, and test evidence requirements across all your projects.
-
-## Executive Summary
-
-- Every tech stack has a designated test framework — no ambiguity.
-- New code requires 80% unit test coverage; critical paths require 95%.
-- Lince (QA Lead) must sign off on test evidence before any ticket moves to "Resolved."
-- Test evidence is required in every PR: results, coverage report, known limitations.
-
----
-
-## Frameworks Per Stack
-
-| Stack | Framework | Assertion Library | Runner | Who Writes | Who Validates |
-|-------|-----------|------------------|--------|-----------|---------------|
-| .NET 10 (backend) | xUnit | FluentAssertions | `dotnet test` | Lafayette | Lince |
-| Arduino/C++ (firmware) | PlatformIO Unity | Unity assertions | `pio test` | Lafayette + a partner | Lince |
-| Flutter (mobile) | flutter_test + integration_test | expect matchers | `flutter test` | Mercurio | Lince |
-| Node.js (agent tools, bots) | Vitest | Vitest matchers (chai-compatible) | `npx vitest run` | Lafayette | Lince |
-| Terraform (IaC) | terraform validate + Checkov | Policy-as-code rules | `checkov -d .` | Prospero | Merlin |
-| Markdown docs (Arcane) | markdownlint + markdown-link-check | Lint rules | `markdownlint .` | Any agent | Prospero |
-
-### Why These Frameworks
-
-- **xUnit** — .NET ecosystem default; best LLM training coverage; clean fixture model.
-- **FluentAssertions** — human-readable assertions; better failure messages than Assert.
-- **PlatformIO Unity** — the dominant embedded C/C++ test framework; runs on host (no hardware needed for unit tests).
-- **flutter_test** — Flutter's built-in; widget testing + integration_test for full-app scenarios.
-- **Vitest** — modern, fast, ESM-native; Jest-compatible API but better performance.
-- **Checkov** — policy-as-code scanner for Terraform; catches security misconfigurations before apply.
-- **markdownlint** — catches formatting issues, broken links, inconsistent heading levels.
-
----
-
-## Coverage Thresholds
-
-| Category | Minimum Coverage | Examples |
-|----------|-----------------|----------|
-| **Standard code** | 80% | Business logic, data access, UI components, API handlers |
-| **Critical paths** | 95% | Authentication, payment processing, IoT firmware commands, calibration protocols, encryption/signing |
-
-### What Counts as "Critical"
-
-- **Authentication and authorization** — login, token validation, permission checks
-- **Payment processing** — any code that touches money or billing
-- **IoT firmware commands** — device provisioning, calibration, OTA updates
-- **Encryption and signing** — key generation, message signing, certificate validation
-- **Data integrity** — database migrations, schema changes, backup/restore
-
-### What Doesn't Count Toward Coverage
-
-- Auto-generated code (EF migrations, gRPC stubs, Swagger output)
-- Framework boilerplate (startup.cs routing, middleware registration)
-- Configuration-only files (appsettings.json, terraform.tfvars)
-
----
-
-## Test Evidence Requirements
-
-Every PR must include:
-
-1. **Test results** — pass/fail output from the test runner (screenshot or CI log link)
-2. **Coverage report** — line/branch coverage percentage (from `dotnet test --collect`, `flutter test --coverage`, etc.)
-3. **Known limitations** — document any untested edge cases or deferred scenarios
-4. **Agent attribution** — if an agent wrote the tests, include standard commit trailers
-
-### PR Template (Test Section)
-
-```markdown
-## Test Evidence
-
-**Test runner output:**
-[paste or link to CI output]
-
-**Coverage:**
-- Overall: XX%
-- Critical paths: XX%
-
-**Known limitations:**
-- [any untested scenarios]
-
-**Agent trailers:**
-- Agent: [agent name]
-- Model: [model]
-- Provider: [provider]
-```
-
----
-
-## Test Types
-
-### Unit Tests (Required)
-
-- Test individual functions/methods in isolation
-- Mock external dependencies (DB, API, hardware)
-- Fast execution (< 1 second per test)
-- Run on every commit and in CI
-
-### Integration Tests (Recommended)
-
-- Test component interactions (API → DB, mobile → backend)
-- Use real dependencies where practical (in-memory DB, test containers)
-- Run in CI on PR creation and merge
-
-### End-to-End Tests (For UI Stories)
-
-- Test complete user workflows
-- Use browser automation (Playwright for web, Flutter integration_test for mobile)
-- Run in CI on merge to main (not on every commit — too slow)
-
-### Firmware Tests ({BUSINESS_NAME}-Specific)
-
-- Host-based unit tests via PlatformIO Unity (no hardware required)
-- Hardware-in-the-loop tests for calibration validation (requires physical device)
-- BLE protocol tests via mock transport
-
----
-
-## Quality Gate in Ticket Lifecycle
-
-Adapt the ticket lifecycle policy to your tracker:
-
-The **Code Review → QA** transition now requires:
-
-1. All unit tests pass (CI green)
-2. Coverage meets thresholds (80% standard / 95% critical)
-3. No HIGH-severity review findings unresolved
-4. Lince signs off with test evidence linked to the work item
-
-The **QA → Resolved** transition requires:
-
-1. Integration tests pass (if applicable)
-2. Manual verification for UI stories (screenshot or recording)
-3. Known limitations documented in work item
-4. Lince marks ticket as validated
-
----
-
-## Agent Responsibilities
-
-| Agent | Testing Role |
-|-------|-------------|
-| **Lafayette** | Writes unit + integration tests for .NET backend, Node.js tools, firmware |
-| **Mercurio** | Writes unit + widget + integration tests for mobile (Flutter) |
-| **Adelaide** | Writes unit + E2E tests for frontend (Blazor/React) |
-| **Lince** | Validates all test evidence; signs off on QA gates; runs adversarial test review |
-| **Prospero** | Maintains CI pipelines that run tests; configures Checkov for Terraform; maintains markdownlint config |
-| **Merlin** | Reviews test architecture decisions; validates Terraform policy compliance |
+---
+title: Testing Standards
+audience: both
+last_updated: YYYY-MM-DD
+status: active
+tags: [testing, qa, coverage, standards, lince]
+---
+
+# Testing Standards
+
+Framework selection, coverage thresholds, and test evidence requirements across all your projects.
+
+## Executive Summary
+
+- Every tech stack has a designated test framework — no ambiguity.
+- New code requires 80% unit test coverage; critical paths require 95%.
+- Lince (QA Lead) must sign off on test evidence before any ticket moves to "Resolved."
+- Test evidence is required in every PR: results, coverage report, known limitations.
+
+---
+
+## Frameworks Per Stack
+
+| Stack | Framework | Assertion Library | Runner | Who Writes | Who Validates |
+|-------|-----------|------------------|--------|-----------|---------------|
+| .NET 10 (backend) | xUnit | FluentAssertions | `dotnet test` | Lafayette | Lince |
+| Arduino/C++ (firmware) | PlatformIO Unity | Unity assertions | `pio test` | Lafayette + a partner | Lince |
+| Flutter (mobile) | flutter_test + integration_test | expect matchers | `flutter test` | Mercurio | Lince |
+| Node.js (agent tools, bots) | Vitest | Vitest matchers (chai-compatible) | `npx vitest run` | Lafayette | Lince |
+| Terraform (IaC) | terraform validate + Checkov | Policy-as-code rules | `checkov -d .` | Prospero | Merlin |
+| Markdown docs (Arcane) | markdownlint + markdown-link-check | Lint rules | `markdownlint .` | Any agent | Prospero |
+
+### Why These Frameworks
+
+- **xUnit** — .NET ecosystem default; best LLM training coverage; clean fixture model.
+- **FluentAssertions** — human-readable assertions; better failure messages than Assert.
+- **PlatformIO Unity** — the dominant embedded C/C++ test framework; runs on host (no hardware needed for unit tests).
+- **flutter_test** — Flutter's built-in; widget testing + integration_test for full-app scenarios.
+- **Vitest** — modern, fast, ESM-native; Jest-compatible API but better performance.
+- **Checkov** — policy-as-code scanner for Terraform; catches security misconfigurations before apply.
+- **markdownlint** — catches formatting issues, broken links, inconsistent heading levels.
+
+---
+
+## Coverage Thresholds
+
+| Category | Minimum Coverage | Examples |
+|----------|-----------------|----------|
+| **Standard code** | 80% | Business logic, data access, UI components, API handlers |
+| **Critical paths** | 95% | Authentication, payment processing, IoT firmware commands, calibration protocols, encryption/signing |
+
+### What Counts as "Critical"
+
+- **Authentication and authorization** — login, token validation, permission checks
+- **Payment processing** — any code that touches money or billing
+- **IoT firmware commands** — device provisioning, calibration, OTA updates
+- **Encryption and signing** — key generation, message signing, certificate validation
+- **Data integrity** — database migrations, schema changes, backup/restore
+
+### What Doesn't Count Toward Coverage
+
+- Auto-generated code (EF migrations, gRPC stubs, Swagger output)
+- Framework boilerplate (startup.cs routing, middleware registration)
+- Configuration-only files (appsettings.json, terraform.tfvars)
+
+---
+
+## Test Evidence Requirements
+
+Every PR must include:
+
+1. **Test results** — pass/fail output from the test runner (screenshot or CI log link)
+2. **Coverage report** — line/branch coverage percentage (from `dotnet test --collect`, `flutter test --coverage`, etc.)
+3. **Known limitations** — document any untested edge cases or deferred scenarios
+4. **Agent attribution** — if an agent wrote the tests, include standard commit trailers
+
+### PR Template (Test Section)
+
+```markdown
+## Test Evidence
+
+**Test runner output:**
+[paste or link to CI output]
+
+**Coverage:**
+- Overall: XX%
+- Critical paths: XX%
+
+**Known limitations:**
+- [any untested scenarios]
+
+**Agent trailers:**
+- Agent: [agent name]
+- Model: [model]
+- Provider: [provider]
+```
+
+---
+
+## Test Types
+
+### Unit Tests (Required)
+
+- Test individual functions/methods in isolation
+- Mock external dependencies (DB, API, hardware)
+- Fast execution (< 1 second per test)
+- Run on every commit and in CI
+
+### Integration Tests (Recommended)
+
+- Test component interactions (API → DB, mobile → backend)
+- Use real dependencies where practical (in-memory DB, test containers)
+- Run in CI on PR creation and merge
+
+### End-to-End Tests (For UI Stories)
+
+- Test complete user workflows
+- Use browser automation (Playwright for web, Flutter integration_test for mobile)
+- Run in CI on merge to main (not on every commit — too slow)
+
+### Firmware Tests ({BUSINESS_NAME}-Specific)
+
+- Host-based unit tests via PlatformIO Unity (no hardware required)
+- Hardware-in-the-loop tests for calibration validation (requires physical device)
+- BLE protocol tests via mock transport
+
+---
+
+## Quality Gate in Ticket Lifecycle
+
+Adapt the ticket lifecycle policy to your tracker:
+
+The **Code Review → QA** transition now requires:
+
+1. All unit tests pass (CI green)
+2. Coverage meets thresholds (80% standard / 95% critical)
+3. No HIGH-severity review findings unresolved
+4. Lince signs off with test evidence linked to the work item
+
+The **QA → Resolved** transition requires:
+
+1. Integration tests pass (if applicable)
+2. Manual verification for UI stories (screenshot or recording)
+3. Known limitations documented in work item
+4. Lince marks ticket as validated
+
+---
+
+## Agent Responsibilities
+
+| Agent | Testing Role |
+|-------|-------------|
+| **Lafayette** | Writes unit + integration tests for .NET backend, Node.js tools, firmware |
+| **Mercurio** | Writes unit + widget + integration tests for mobile (Flutter) |
+| **Adelaide** | Writes unit + E2E tests for frontend (Blazor/React) |
+| **Lince** | Validates all test evidence; signs off on QA gates; runs adversarial test review |
+| **Prospero** | Maintains CI pipelines that run tests; configures Checkov for Terraform; maintains markdownlint config |
+| **Merlin** | Reviews test architecture decisions; validates Terraform policy compliance |

package/dist/assets/.arcane/governance/universal-agent-rules.md

@@ -1,108 +1,108 @@
----
-title: Universal Agent Rules — Single Source of Truth
-audience: ai
-status: active
-tags: [rules, governance, ai-agents, multi-client]
----
-
-# Universal Agent Rules
-
-These rules apply to **every AI agent and tool** working in this repository, regardless of client (GitHub Copilot, Claude Code, Codex, your agent runtime, or any future tool). This file is the canonical source; client-specific instruction files reference this document and add client-specific behavior on top.
-
-See also: [[README]], [[DECISIONS]], [[governance/git-conventions|Git Conventions]], [[agents/agent-policies|Agent Policies]].
-
----
-
-## Non-Negotiable Safety Rules
-
-1. **Never access an encrypted or cross-OS volume you are not authorized to touch.** Do not suggest, execute, or recommend any action that would mount, read, or probe a drive outside the agent's authorized environment. This rule stands as defense-in-depth regardless of encryption status.
-
-2. **No root commands without justification.** Do not generate or suggest commands that run as root unless explicitly scoped and justified. The agent runtime should run as a dedicated non-root user by design. See [[security/hardening-checklist|Hardening Checklist]].
-
-3. **No secrets on the command line.** Never pass API keys, tokens, or secrets on the command line, in chat, or in config files. Use SecretRef (env vars) and `read -s` for interactive input.
-
-4. **This is a production system.** No "fix it later" shortcuts. No experimental changes without rollback plans.
-
----
-
-## Documentation Rules
-
-5. **Update `last_updated` frontmatter** whenever you edit a document. Every document must have YAML frontmatter with `audience`, `status`, `last_updated`, and `tags`.
-
-6. **Log significant decisions in [[DECISIONS]].** Use the next sequential ADR number. Format: Date, Status, Context, Decision, Reasoning, Rejected alternatives.
-
-7. **Use wiki-links for cross-references** (e.g., `[[DECISIONS#ADR-NNN|Short Title]]`, `[[journal/YYYY-MM-DD-topic-slug|Session Label]]`). This enables knowledge graph visualization.
-
-8. **Use Mermaid for diagrams** (` ```mermaid ` blocks) for all flow charts, architecture diagrams, and sequence diagrams. Directory trees stay as plain code blocks.
-
-9. **Journal files use date-prefix naming:** `journal/YYYY-MM-DD-topic-slug.md` for chronological sorting.
-
----
-
-## Git Rules
-
-10. **Never auto-commit during interactive sessions.** Stage changes and present the proposed commit message for human approval before executing `git commit`. This applies to Copilot, Claude Code, Codex, and any other interactive AI tool. The human decides when to commit. Exception: autonomous agents at Magus+ power level may self-commit within approved scope.
-
-11. **Use Conventional Commits format** for all commit messages: `type(scope): description`. See [[governance/git-conventions|Git Conventions]] for types, scopes, and examples.
-
-12. **Agent attribution trailers** are required on agent-authored commits (`Agent`, `Model`, `Provider`). See [[governance/git-conventions#agent-attribution-model|Attribution Model]].
-
-13. **For runtime config changes** (anything touching the agent runtime's config files or service restarts): do NOT commit supporting docs until the user has confirmed the change is working. Stage and present — but wait for explicit approval after testing.
-
-14. **Never commit directly to main.** All work — human or agent — happens on topic branches. Humans use `type/short-description`; agents use `{agent-slug}/type/short-description`. Main receives changes only through PR completion, not local direct merges. See [[governance/git-conventions#branch-discipline|Branch Discipline]].
-
----
-
-## Recommendation Guardrails (ADR-034)
-
-15. **Flag actionable recommendations.** Any recommendation that could lead to a purchase, subscription, account creation, or irreversible action must: (a) be flagged explicitly, (b) use verified current information — never assume or fabricate, (c) present free/no-cost alternatives when they exist, (d) state confidence level if based on general knowledge. For >$50 or contracts, require explicit confirmation. See [[agents/agent-policies#actionable-recommendation-policy-adr-034|Full Policy]].
-
----
-
-## Screenshot Curation
-
-15. **Curate screenshots — not every screenshot needs saving.** Use these heuristics:
-    - **Save** when it shows a completed setup, config state, UI result, or evidence of a problem/fix.
-    - **Save** when the user explicitly says "save this" or "add this to docs."
-    - **Save key decision points and final states** in multi-step flows; skip intermediate steps.
-    - **Don't save** external reference material, transient troubleshooting, or items marked "just for reference."
-    - **When ambiguous, save it** — easier to delete than to re-paste.
-    - Saved screenshots go to `assets/screenshots/YYYY-MM-DD/` with descriptive lowercase-with-dashes filenames.
-    - Never save screenshots containing secrets, API keys, tokens, or PII.
-
----
-
-## Naming Conventions
-
-16. **Three naming tiers — never mix them:**
-
-| Tier | What | Style | Examples |
-|------|------|-------|---------|
-| Machines | Physical hardware | Iconic character names | Atlas, Voyager |
-| AI Agents | Autonomous agents | Persona name + role title | Merlin — CTO, Kellar — Product Ops |
-| Systems/Services | DBs, APIs, tools | Functional `[slug]-[function]` | `inventory-api`, `orders-worker` |
-
-17. **Projects and repos follow a consistent naming convention.** Pick one (TitleCase or kebab-case) and apply it uniformly across your org.
-
----
-
-## Operational Rules
-
-18. **TODO.md is a scratchpad.** Resolved items move to the relevant doc, then get deleted from TODO.md.
-
-19. **After any onboarding or config wizard**, re-validate authentication and network-exposure settings — wizards can silently downgrade security settings.
-
-20. **For repo path requests**, perform read-only discovery before claiming "no access." Use [[agents/agent-approved-paths|Agent Approved Paths Registry]].
-
----
-
-## Client-Specific Instruction Locations
-
-| Client | Instruction File | Notes |
-|--------|-----------------|-------|
-| GitHub Copilot | `.github/copilot-instructions.md` | Auto-loaded by Copilot in workspace |
-| Claude Code (CLI) | `CLAUDE.md` | Auto-loaded by Claude Code in repo root |
-| Codex | `AGENTS.md` | Auto-loaded by Codex in repo root |
-| Your agent runtime | [[agents/agent-policies]] | Loaded via agent config |
-| Ad-hoc chat clients | [[ai-context/portable-bootstrap]] | Copy-paste into conversation |
-| Any new tool | This file | Read this, then follow links above |
+---
+title: Universal Agent Rules — Single Source of Truth
+audience: ai
+status: active
+tags: [rules, governance, ai-agents, multi-client]
+---
+
+# Universal Agent Rules
+
+These rules apply to **every AI agent and tool** working in this repository, regardless of client (GitHub Copilot, Claude Code, Codex, your agent runtime, or any future tool). This file is the canonical source; client-specific instruction files reference this document and add client-specific behavior on top.
+
+See also: [[README]], [[DECISIONS]], [[governance/git-conventions|Git Conventions]], [[agents/agent-policies|Agent Policies]].
+
+---
+
+## Non-Negotiable Safety Rules
+
+1. **Never access an encrypted or cross-OS volume you are not authorized to touch.** Do not suggest, execute, or recommend any action that would mount, read, or probe a drive outside the agent's authorized environment. This rule stands as defense-in-depth regardless of encryption status.
+
+2. **No root commands without justification.** Do not generate or suggest commands that run as root unless explicitly scoped and justified. The agent runtime should run as a dedicated non-root user by design. See [[security/hardening-checklist|Hardening Checklist]].
+
+3. **No secrets on the command line.** Never pass API keys, tokens, or secrets on the command line, in chat, or in config files. Use SecretRef (env vars) and `read -s` for interactive input.
+
+4. **This is a production system.** No "fix it later" shortcuts. No experimental changes without rollback plans.
+
+---
+
+## Documentation Rules
+
+5. **Update `last_updated` frontmatter** whenever you edit a document. Every document must have YAML frontmatter with `audience`, `status`, `last_updated`, and `tags`.
+
+6. **Log significant decisions in [[DECISIONS]].** Use the next sequential ADR number. Format: Date, Status, Context, Decision, Reasoning, Rejected alternatives.
+
+7. **Use wiki-links for cross-references** (e.g., `[[DECISIONS#ADR-NNN|Short Title]]`, `[[journal/YYYY-MM-DD-topic-slug|Session Label]]`). This enables knowledge graph visualization.
+
+8. **Use Mermaid for diagrams** (` ```mermaid ` blocks) for all flow charts, architecture diagrams, and sequence diagrams. Directory trees stay as plain code blocks.
+
+9. **Journal files use date-prefix naming:** `journal/YYYY-MM-DD-topic-slug.md` for chronological sorting.
+
+---
+
+## Git Rules
+
+10. **Never auto-commit during interactive sessions.** Stage changes and present the proposed commit message for human approval before executing `git commit`. This applies to Copilot, Claude Code, Codex, and any other interactive AI tool. The human decides when to commit. Exception: autonomous agents at Magus+ power level may self-commit within approved scope.
+
+11. **Use Conventional Commits format** for all commit messages: `type(scope): description`. See [[governance/git-conventions|Git Conventions]] for types, scopes, and examples.
+
+12. **Agent attribution trailers** are required on agent-authored commits (`Agent`, `Model`, `Provider`). See [[governance/git-conventions#agent-attribution-model|Attribution Model]].
+
+13. **For runtime config changes** (anything touching the agent runtime's config files or service restarts): do NOT commit supporting docs until the user has confirmed the change is working. Stage and present — but wait for explicit approval after testing.
+
+14. **Never commit directly to main.** All work — human or agent — happens on topic branches. Humans use `type/short-description`; agents use `{agent-slug}/type/short-description`. Main receives changes only through PR completion, not local direct merges. See [[governance/git-conventions#branch-discipline|Branch Discipline]].
+
+---
+
+## Recommendation Guardrails (ADR-034)
+
+15. **Flag actionable recommendations.** Any recommendation that could lead to a purchase, subscription, account creation, or irreversible action must: (a) be flagged explicitly, (b) use verified current information — never assume or fabricate, (c) present free/no-cost alternatives when they exist, (d) state confidence level if based on general knowledge. For >$50 or contracts, require explicit confirmation. See [[agents/agent-policies#actionable-recommendation-policy-adr-034|Full Policy]].
+
+---
+
+## Screenshot Curation
+
+15. **Curate screenshots — not every screenshot needs saving.** Use these heuristics:
+    - **Save** when it shows a completed setup, config state, UI result, or evidence of a problem/fix.
+    - **Save** when the user explicitly says "save this" or "add this to docs."
+    - **Save key decision points and final states** in multi-step flows; skip intermediate steps.
+    - **Don't save** external reference material, transient troubleshooting, or items marked "just for reference."
+    - **When ambiguous, save it** — easier to delete than to re-paste.
+    - Saved screenshots go to `assets/screenshots/YYYY-MM-DD/` with descriptive lowercase-with-dashes filenames.
+    - Never save screenshots containing secrets, API keys, tokens, or PII.
+
+---
+
+## Naming Conventions
+
+16. **Three naming tiers — never mix them:**
+
+| Tier | What | Style | Examples |
+|------|------|-------|---------|
+| Machines | Physical hardware | Iconic character names | Atlas, Voyager |
+| AI Agents | Autonomous agents | Persona name + role title | Merlin — CTO, Kellar — Product Ops |
+| Systems/Services | DBs, APIs, tools | Functional `[slug]-[function]` | `inventory-api`, `orders-worker` |
+
+17. **Projects and repos follow a consistent naming convention.** Pick one (TitleCase or kebab-case) and apply it uniformly across your org.
+
+---
+
+## Operational Rules
+
+18. **TODO.md is a scratchpad.** Resolved items move to the relevant doc, then get deleted from TODO.md.
+
+19. **After any onboarding or config wizard**, re-validate authentication and network-exposure settings — wizards can silently downgrade security settings.
+
+20. **For repo path requests**, perform read-only discovery before claiming "no access." Use [[agents/agent-approved-paths|Agent Approved Paths Registry]].
+
+---
+
+## Client-Specific Instruction Locations
+
+| Client | Instruction File | Notes |
+|--------|-----------------|-------|
+| GitHub Copilot | `.github/copilot-instructions.md` | Auto-loaded by Copilot in workspace |
+| Claude Code (CLI) | `CLAUDE.md` | Auto-loaded by Claude Code in repo root |
+| Codex | `AGENTS.md` | Auto-loaded by Codex in repo root |
+| Your agent runtime | [[agents/agent-policies]] | Loaded via agent config |
+| Ad-hoc chat clients | [[ai-context/portable-bootstrap]] | Copy-paste into conversation |
+| Any new tool | This file | Read this, then follow links above |