cfsa-antigravity 2.4.0 → 2.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cfsa-antigravity",
-  "version": "2.4.0",
+  "version": "2.6.0",
   "description": "CFSA Pipeline — Constraint-First Specification Architecture for AI agents. Production-grade from line one.",
   "scripts": {
     "changeset": "changeset",

package/template/.agent/kit-sync.md

@@ -1,6 +1,6 @@
 # Kit Sync State
 
 upstream: https://github.com/RepairYourTech/cfsa-antigravity
-last_synced_commit: d5fb37b9e886719e436a6ca52bb9c94ab839acb6
-last_synced_at: 2026-03-16T23:22:30Z
-kit_version: 2.4.0
+last_synced_commit: 3b681461bb17210e795e7a4d05a3393ba1e57438
+last_synced_at: 2026-03-17T01:38:22Z
+kit_version: 2.6.0

package/template/.agent/workflows/create-prd-compile.md

@@ -53,6 +53,8 @@ Document the agreed approach:
 4. **Spec layers** — IA → BE → FE pipeline
 5. **Quality gates** — What must pass before merge
 
+Write the completed `## Development Methodology` section to `docs/plans/architecture-draft.md` immediately after user confirmation.
+
 ## 9. Phasing strategy
 
 Load the CI/CD skill(s) from the cross-cutting section per the skill loading protocol.
@@ -77,6 +79,8 @@ Each phase should have a rough timeline estimate and must pass the full validati
 
 Refine based on discussion before proceeding.
 
+Write the completed `## Phasing Strategy` section to `docs/plans/architecture-draft.md` immediately after user confirmation.
+
 ## 9.5. Lock project directory structure
 
 Based on the locked tech stack, generate a canonical directory tree.

package/template/.agent/workflows/create-prd-security.md

@@ -76,6 +76,8 @@ Refine based on discussion before proceeding.
 
 If the security model confirmed a specific security framework or compliance approach (e.g., crypto patterns, custom HSM approach), read `.agent/workflows/bootstrap-agents.md` and invoke `/bootstrap-agents SECURITY=[confirmed value]` to provision additional skills. Note: surface-triggered security skills (`owasp-web-security`, `csp-cors-headers`, `input-sanitization`, `api-security-checklist`, `dependency-auditing`, `desktop-security-sandboxing`) are provisioned automatically by bootstrap when surfaces are confirmed in `/create-prd-stack` — no manual fire needed for those.
 
+Write the completed `## Security Model` section to `docs/plans/architecture-draft.md` immediately after user confirmation. Do not wait for later steps.
+
 ## 6.5. Attack Surface Review
 
 Read .agent/skills/security-scanning-security-hardening/SKILL.md and follow its Attack Surface Review Protocol for each surface confirmed in /create-prd-stack. Apply Universal checks to all projects, then surface-specific checks conditionally.
@@ -84,6 +86,8 @@ Read .agent/skills/security-scanning-security-hardening/SKILL.md and follow its
 - "Are there any attack vectors I've missed for your specific domain?"
 - "Do the OWASP mechanisms look correct, or are any of them actually handled differently?"
 
+Write the completed `## Security — Attack Surface` section to `docs/plans/architecture-draft.md` immediately after user confirmation.
+
 ## 7. Integration points
 
 For each external service:
@@ -93,6 +97,8 @@ For each external service:
 3. **Fallback strategy** — Graceful degradation plan
 4. **Cost model** — Pricing tier, expected usage
 
+Write the completed `## Integration Points` section to `docs/plans/architecture-draft.md` immediately after user confirmation.
+
 ## 7.5. Observability Architecture
 
 Read .agent/skills/logging-best-practices/SKILL.md and follow its Observability Architecture Interview — all 5 decisions (logging, tracing, alerting, dashboards, retention) must be confirmed. Fire bootstrap per the skill's instructions for each confirmed tool.
@@ -101,7 +107,7 @@ Read .agent/skills/logging-best-practices/SKILL.md and follow its Observability
 - "Are these logging levels and PII exclusions correct for your compliance requirements?"
 - "Are the alerting thresholds appropriate for your expected traffic?"
 
-After the security model (Step 6) is completed and confirmed, write the `## Security Model` section to `docs/plans/architecture-draft.md`. After the attack surface review (Step 6.5) is completed and confirmed, write the `## Security — Attack Surface` section to `docs/plans/architecture-draft.md`. After the integration points (Step 7) are completed and confirmed, write the `## Integration Points` section to `docs/plans/architecture-draft.md`. After the observability architecture (Step 7.5) is completed and confirmed, write the `## Observability Architecture` section to `docs/plans/architecture-draft.md`. Do not wait until the end — write each section as it is completed.
+Write the completed `## Observability Architecture` section to `docs/plans/architecture-draft.md` immediately after user confirmation.
 
 ### Propose next step
 

package/template/.agent/workflows/ideate-discover.md

@@ -29,6 +29,19 @@ Read `.agent/skills/idea-extraction/SKILL.md` — follow the Recursive Domain Ex
 
 Read `## Expansion Mode` and `## Structural Classification` from `docs/plans/ideation/ideation-index.md`.
 
+## 2.5. Read Engagement Tier
+
+Read `## Engagement Tier` from `docs/plans/ideation/ideation-index.md`. Apply gate behavior rules for this session:
+
+| Tier | Structural gates (domain maps, classification, sub-domain structure) | Product gates (personas, MoSCoW, feature scope, competitive positioning) |
+|------|----------------------------------------------------------------------|-------------------------------------------------------------------------|
+| 🤖 **Auto** | Auto-confirm: apply Deep Think, write reasoning to feature files, proceed | Auto-confirm: apply Deep Think, write reasoning to feature files, proceed |
+| 🤝 **Hybrid** | Auto-confirm: apply Deep Think, write reasoning to feature files, proceed | **Pause for user**: present findings, wait for explicit confirmation |
+| 💬 **Interactive** | **Pause for user**: present findings, wait for explicit confirmation | **Pause for user**: present findings, wait for explicit confirmation |
+
+> [!IMPORTANT]
+> **Auto-confirmed gates must still write.** When a gate is auto-confirmed, the agent writes the Deep Think reasoning and decision to the relevant file immediately — just as if the user had confirmed it. The file trail must be identical regardless of tier. This ensures the Auto tier review checkpoint in `ideate-validate` has full traceability.
+
 ### Full Mode (recommended for 3+ domains)
 
 #### Level 0 — Global Domain Map
@@ -42,7 +55,7 @@ Read `## Expansion Mode` and `## Structural Classification` from `docs/plans/ide
    - In the relevant parent's CX file (surface CX or global CX)
    - In `ideation-cx.md` if cross-surface
 5. Update `ideation-index.md` structure map with paths
-6. **Gate**: Present domain map. User confirms before Level 1.
+6. **Gate** *(structural)*: Present domain map. **Interactive/Hybrid**: User confirms before Level 1. **Auto**: Auto-confirm with Deep Think reasoning written to `ideation-index.md`.
 
 #### Level 1 — Domain Breadth Sweep
 
@@ -57,7 +70,7 @@ For each domain (dependency order — foundational first):
 5. Note cross-cuts in the domain's CX file
 6. **NEW DOMAINS DISCOVERED?** → Classify, create, update index, loop to Level 0
 7. Mark domain status as `[BREADTH]`
-8. **Gate**: Pause after EACH domain. "Here's what I mapped for [Domain]. Missing anything?" After ALL: "All domains at BREADTH. Ready to drill?"
+8. **Gate** *(structural)*: Pause after EACH domain. **Interactive/Hybrid**: "Here's what I mapped for [Domain]. Missing anything?" After ALL: "All domains at BREADTH. Ready to drill?" **Auto**: Auto-confirm with Deep Think reasoning written to domain index.
 
 #### Level 2+ — Vertical Drilling
 
@@ -71,9 +84,9 @@ For each domain (dependency order), for each child:
 6. Cross-cuts with evidence → add to parent's CX file with synthesis questions
 7. **Feature reveals 2+ interacting capabilities?** → Run **Promotion Protocol** (convert .md to folder)
 8. **NEW DOMAINS DISCOVERED?** → Loop to Level 0
-9. When Deep Think yields zero hypotheses AND user confirms → mark `[EXHAUSTED]`
+9. When Deep Think yields zero hypotheses AND user confirms (or auto-confirms for Auto tier) → mark `[EXHAUSTED]`
 10. Status propagation: all children `[EXHAUSTED]` → node is `[EXHAUSTED]`
-11. **Gate**: Pause after each domain is drilled.
+11. **Gate** *(product)*: Pause after each domain is drilled. **Interactive**: Full review. **Hybrid**: Pause for review. **Auto**: Auto-confirm with Deep Think reasoning written to domain index.
 
 #### Cross-Cut Synthesis (Continuous)
 

package/template/.agent/workflows/ideate-extract.md

@@ -19,7 +19,7 @@ pipeline:
 
 Classify the user's input, create the fractal `ideation/` folder structure, and load skills.
 
-**Prerequisite**: If invoked standalone (not from `/ideate`), verify the user has provided input — either an `@file` reference or a verbal description. If no input is provided, prompt: "What would you like to build? Describe your idea, or provide a file with `/ideate-extract @path/to/file.md`."
+**Prerequisite**: If standalone, verify user provided input via `@file` or verbal. If none, prompt: \"What would you like to build? Provide a file or describe your idea.\"
 
 ---
 
@@ -170,27 +170,30 @@ For each concept classified as **domain** in the confirmed table:
 - **Thin document**: Create domain folders with depth markers on feature files.
 - **Verbal / one-liner**: Create domain folders with scaffolding. Feature files are `[SURFACE]`.
 
-## 1.6. User Intent Check (ALL input types)
+## 1.6. Engagement Tier Selection (ALL input types)
 
-Read `.agent/skills/brainstorming/SKILL.md` and follow its methodology.
+All three tiers are available for all input types. Present with the recommended default for this input type (Rich/Thin/Chat → Hybrid, Verbal → Interactive):
 
-After seeding, present a summary and ask how the user wants to proceed. Present all options:
+> **How involved do you want to be?**
+> 1. 🤖 **Auto** — I explore independently via Deep Think. You review at the end.
+> 2. 🤝 **Hybrid** *(recommended)* — Structural stuff auto, product decisions pause for you.
+> 3. 💬 **Interactive** — I pause at every gate. Full interview mode.
 
-1. **Full exploration** *(recommended for 3+ domains)* — Recursive breadth-before-depth with Deep Think
-2. **Process as-is** — Proceed with what's captured; fill gaps as they arise
-3. **Expand vertically** — Drill deeper into existing features
-4. **Expand horizontally** — Add new feature domains not yet covered
-5. **Explore cross-cutting concerns** — Map how existing features interact
-6. **Combination** — User specifies dimensions and order
-7. **Audit ambiguity first** — Run inline check before deciding
+**Wait for user answer.** Write the engagement tier to `ideation-index.md` under `## Engagement Tier` immediately.
 
-**Wait for user answer — do not assume.**
+## 1.6.5. Expansion Mode Selection (ALL input types)
 
-## 1.7. Expansion Mode Routing
+Present expansion mode options:
 
-Write the expansion mode to `ideation-index.md` per the super-index template.
+1. **Full exploration** *(recommended for 3+ domains)* — Breadth-before-depth with Deep Think
+2. **Process as-is** — Proceed with what's captured
+3. **Expand vertically** — Drill deeper into existing features
+4. **Expand horizontally** — Add new domains
+5. **Cross-cutting concerns** — Map feature interactions
+6. **Combination** — User specifies dimensions and order
+7. **Audit ambiguity first** — Inline check before deciding
 
-This flag is read by `ideate-discover.md` to shape exploration behavior.
+**Wait for user answer.** Write expansion mode to `ideation-index.md` under `## Expansion Mode` immediately.
 
 ## 2. Load skills
 

package/template/.agent/workflows/ideate-validate.md

@@ -23,6 +23,14 @@ Explore constraints, verify domain exhaustion, and compile the vision summary.
 
 ---
 
+## 7.5. Read Engagement Tier
+
+Read `## Engagement Tier` from `docs/plans/ideation/ideation-index.md`. Apply to gates in this shard:
+
+- **Auto**: Steps 8 (constraints, metrics, competitive positioning) → agent self-interviews using Deep Think, writes answers to files. Step 10.5 (below) provides a review checkpoint before compilation.
+- **Hybrid**: Steps 8 product decisions → pause for user. Structural checks → auto.
+- **Interactive**: All steps pause for user confirmation.
+
 ## 8. Constraints and metrics
 
 Read `.agent/skills/idea-extraction/SKILL.md` and follow its Deep Think Protocol.
@@ -40,7 +48,11 @@ Explore constraints with the user. Write to `docs/plans/ideation/meta/constraint
 
 **Deep Think**: "Based on the product type and user personas, what constraints would I expect that haven't been mentioned? For example, does this product handle payments (PCI)? Does it serve minors (COPPA)? Does it store health data (HIPAA)?"
 
-Write constraints to `meta/constraints.md`. If the surface classification changed, update `ideation-index.md` `## Structural Classification` section.
+**Interactive/Hybrid**: Present each constraint question to user, wait for answers. Write each confirmed constraint to `meta/constraints.md` immediately.
+
+**Auto**: Self-interview using Deep Think. Write all answers with reasoning to `meta/constraints.md` immediately. Mark each answer as `[AUTO-CONFIRMED]` for traceability.
+
+If the surface classification changed, update `ideation-index.md` `## Structural Classification` section.
 
 ### Success metrics
 
@@ -113,6 +125,19 @@ If proportionality fails, return to `/ideate-discover` for the under-explored ar
 
 ---
 
+## 10.5. Auto Tier Review Checkpoint (Auto tier only)
+
+If engagement tier is **Auto**, present a comprehensive review before compilation:
+
+1. **List all auto-confirmed decisions** with their Deep Think reasoning — from domain classification, feature drilling, constraints, personas, competitive positioning
+2. **Highlight any `[AUTO-CONFIRMED]` entries** in `meta/constraints.md`, `meta/personas.md`, and `meta/competitive-landscape.md`
+3. **Present for review**: "I explored your idea independently. Here's everything I decided and why. Override anything before I compile the vision."
+4. **Wait for user response.** Apply any overrides. Write corrections to files immediately.
+
+For **Hybrid** and **Interactive** tiers, skip this step — the user already confirmed during exploration.
+
+---
+
 ## 11. Compile vision document
 
 Read `.agent/skills/prd-templates/references/vision-template.md` for the output template.

package/template/.agent/workflows/ideate.md

@@ -29,7 +29,26 @@ shards: [ideate-extract, ideate-discover, ideate-validate]
 | One-liner / verbal | User describes idea in chat, no files | Interview (deep) — builds vision from scratch domain by domain |
 | Full exploration | Any input with 3+ domains | Full — Recursive breadth-before-depth with Deep Think protocol, cross-cut detection active throughout |
 
-**Quality guarantee**: All input types produce the **same output quality** using the same fractal structure. The ideation output from a one-liner is structurally identical to one from a rich document. Every node has an index, CX file, and children. Every feature has a Role Lens. Only the amount of interview work differs.
+### Engagement Tiers
+
+After input classification, the user chooses how much involvement they want. All tiers are available for all input types — the pipeline recommends a default but the user picks.
+
+| Tier | Gate behavior | Default for |
+|------|---------------|-------------|
+| 🤖 **Auto** | Pipeline uses Deep Think to self-interview at every gate. User reviews compiled output at the end. | — |
+| 🤝 **Hybrid** | Structural/mechanical gates auto-confirm. Product decisions (personas, MoSCoW, competitive positioning, constraints) pause for user. | Rich doc, thin doc, chat transcript |
+| 💬 **Interactive** | Every gate pauses for explicit user confirmation. | Verbal / one-liner |
+
+**Full matrix — Input × Tier:**
+
+| Input Type | 🤖 Auto | 🤝 Hybrid | 💬 Interactive |
+|---|---|---|---|
+| Rich document | AI extracts + self-interviews gaps | AI extracts, pauses for product calls | AI extracts, pauses at every gate |
+| Thin document | AI expands all domains independently | AI expands, pauses for product calls | AI expands with user at every step |
+| Chat transcript | AI filters noise + self-interviews | AI filters, pauses for product calls | AI filters with user validation |
+| Verbal / one-liner | AI generates vision from scratch via Deep Think | AI generates, pauses for product calls | Full traditional interview |
+
+**Quality guarantee**: All input types and engagement tiers produce the **same output quality** using the same fractal structure. The ideation output from an Auto one-liner is structurally identical to an Interactive rich document. Every node has an index, CX file, and children. Every feature has a Role Lens. Only the amount of human involvement differs.
 
 Transform a raw idea into comprehensive, structured ideation output through exhaustive recursive exploration with the Deep Think protocol.
 
@@ -63,9 +82,9 @@ Check whether `docs/plans/ideation/ideation-index.md` already exists.
 
 | # | Shard | What It Does |
 |---|-------|-------------|
-| 1 | [`ideate-extract`](.agent/workflows/ideate-extract.md) | Classifies input, determines structural classification (4 shapes), creates fractal `ideation/` folder structure using Node Classification Gate, seeds domain folders, runs user intent check, sets expansion mode, loads skills |
-| 2 | [`ideate-discover`](.agent/workflows/ideate-discover.md) | Recursive breadth-before-depth exploration with Deep Think. Creates fractal nodes (folders with index + CX) and leaf feature files (with Role Lens). Hierarchical CX detection active throughout. |
-| 3 | [`ideate-validate`](.agent/workflows/ideate-validate.md) | Constraints, metrics, competitive positioning, leaf-node exhaustion check, fractal structure compliance, vision summary compilation |
+| 1 | [`ideate-extract`](.agent/workflows/ideate-extract.md) | Classifies input, determines structural classification (4 shapes), creates fractal `ideation/` folder structure using Node Classification Gate, seeds domain folders, asks engagement tier + expansion mode, loads skills |
+| 2 | [`ideate-discover`](.agent/workflows/ideate-discover.md) | Recursive breadth-before-depth exploration with Deep Think. Gate behavior controlled by engagement tier. Creates fractal nodes (folders with index + CX) and leaf feature files (with Role Lens). Hierarchical CX detection active throughout. |
+| 3 | [`ideate-validate`](.agent/workflows/ideate-validate.md) | Constraints, metrics, competitive positioning, leaf-node exhaustion check, fractal structure compliance, vision summary compilation. Auto tier gets a review checkpoint before compilation. |
 
 ---
 
@@ -73,7 +92,7 @@ Check whether `docs/plans/ideation/ideation-index.md` already exists.
 
 ### Step 1 — Run `.agent/workflows/ideate-extract.md`
 
-Classifies the user's input (rich doc, thin PRD, chat transcript, verbal), determines structural classification (single-surface, multi-surface-shared, multi-product-hub, multi-product-peer), checks for existing ideation folder (re-run check), creates the fractal `docs/plans/ideation/` folder structure using the Node Classification Gate, runs user intent check to determine expansion mode, sets the expansion mode flag in `ideation-index.md`, and loads skills.
+Classifies the user's input (rich doc, thin PRD, chat transcript, verbal), determines structural classification (single-surface, multi-surface-shared, multi-product-hub, multi-product-peer), checks for existing ideation folder (re-run check), creates the fractal `docs/plans/ideation/` folder structure using the Node Classification Gate, asks user to choose engagement tier (Auto/Hybrid/Interactive) and expansion mode, writes both to `ideation-index.md` immediately, and loads skills.
 
 ### Step 2 — Run `.agent/workflows/ideate-discover.md`
 

package/template/.agent/workflows/write-architecture-spec-design.md

@@ -82,6 +82,9 @@ Read `.agent/skills/brainstorming/SKILL.md` and use it to explore any remaining
 
 > **Authoring pattern for Steps 2–7**: After designing each section, (1) present it to the user with the targeted review questions listed below, (2) refine based on their feedback, (3) write the completed section to `docs/plans/ia/[shard-name].md` immediately — do not batch writes until Step 8.
 
+> [!IMPORTANT]
+> **Write-as-you-go is mandatory.** Each section (Steps 2–7) must be written to `docs/plans/ia/[shard-name].md` immediately after user confirmation. If the conversation truncates, all confirmed sections must survive on disk. Never hold confirmed content in-memory waiting for a later write step.
+
 ## 2. Map all interactions
 
 For each feature in the shard, document:
@@ -92,6 +95,8 @@ For each feature in the shard, document:
 
 **Review questions**: "Does this capture all the ways a user touches this domain?" / "Are there admin/system-initiated actions I'm missing?" / "What happens in each failure case?"
 
+Write the completed `## Interactions` section to `docs/plans/ia/[shard-name].md` immediately after user confirmation.
+
 ## 3. Define contracts
 
 Read `.agent/skills/prd-templates/references/skill-loading-protocol.md` and load the API Design skill(s) from the cross-cutting section.
@@ -104,6 +109,8 @@ For each interaction, define the contract shape:
 
 **Review questions**: "Are there fields I'm missing from these requests/responses?" / "Are these error codes specific enough?"
 
+Write the completed `## Contracts` section to `docs/plans/ia/[shard-name].md` immediately after user confirmation.
+
 ## 4. Design data models
 
 Read `.agent/skills/prd-templates/references/skill-loading-protocol.md` and load the Databases skill(s) for this shard's surface. Also load:
@@ -115,6 +122,8 @@ Define for each entity: tables/collections, fields, types, relationships, indexe
 
 **Review questions**: "Does this schema capture everything this domain needs to store?" / "Are the relationships and cardinalities correct?" / "Are there derived/computed fields I should account for?"
 
+Write the completed `## Data Models` section to `docs/plans/ia/[shard-name].md` immediately after user confirmation.
+
 > **Decision recording**: For non-trivial data model decisions (schema approach, denormalization trade-offs, index strategy), read `.agent/skills/session-continuity/protocols/06-decision-analysis.md` and follow the **Decision Effect Analysis Protocol**.
 
 ## 5. Design access control
@@ -129,6 +138,8 @@ Read .agent/skills/security-scanning-security-hardening/SKILL.md and apply its a
 
 **Review questions**: "Can you think of a scenario where a user should be blocked that this matrix allows?" / "Can you think of a scenario where a user should be allowed that this matrix blocks?"
 
+Write the completed `## Access Control` section to `docs/plans/ia/[shard-name].md` immediately after user confirmation.
+
 > **Decision recording**: For access control architecture decisions (role hierarchy, ownership model, escalation paths), read `.agent/skills/session-continuity/protocols/06-decision-analysis.md` and follow the **Decision Effect Analysis Protocol**. Record to `memory/decisions.md`.
 
 ## 5.5. Accessibility specifications
@@ -139,12 +150,16 @@ Read `.agent/skills/accessibility/references/ia-spec-checklist.md` and follow it
 
 **If surfaces are `api`, `cli`, or `extension` only:** Write `"Not applicable — no visual surfaces"` in the `## Accessibility` section.
 
+Write the completed `## Accessibility` section to `docs/plans/ia/[shard-name].md` immediately after user confirmation.
+
 ## 6. Design event schemas (if applicable)
 
 - Event name, payload shape, emitter, consumers
 - Async vs sync processing
 - Retry semantics
 
+Write the completed `## Event Schemas` section to `docs/plans/ia/[shard-name].md` immediately after user confirmation (if applicable).
+
 ## 7. Document edge cases
 
 Read .agent/skills/resolve-ambiguity/SKILL.md and follow its methodology.

package/template/AGENTS.md

@@ -154,6 +154,7 @@ Rules in `.agent/rules/` are **always active** — they apply to every task, eve
 3. **Contract-first** — `{{CONTRACT_LIBRARY}}` schema → failing test → implementation (never reverse)
 4. **TDD: failing test before code** — Red → Green → Refactor, every slice, every surface
 5. **Security-first** — PII never leaks, inputs validated, secrets server-side only
+6. **Write decisions to disk immediately** — Every confirmed decision is written to its output file the moment the user confirms it. Never batch decisions in-memory across a long conversation. If the conversation truncates, all confirmed work must survive on disk.
 
 ### Decision Tree
 

package/template/GEMINI.md

@@ -155,6 +155,7 @@ Rules in `.agent/rules/` are **always active** — they apply to every task, eve
 3. **Contract-first** — `{{CONTRACT_LIBRARY}}` schema → failing test → implementation (never reverse)
 4. **TDD: failing test before code** — Red → Green → Refactor, every slice, every surface
 5. **Security-first** — PII never leaks, inputs validated, secrets server-side only
+6. **Write decisions to disk immediately** — Every confirmed decision is written to its output file the moment the user confirms it. Never batch decisions in-memory across a long conversation. If the conversation truncates, all confirmed work must survive on disk.
 
 ### Decision Tree