create-flowdular 0.2.4 → 0.2.5

package/agent-template/.ai/blueprints/edit-module/required-files.yaml

@@ -0,0 +1,80 @@
+schemaVersion: 1
+# The module already exists; these must still be present after the change.
+required:
+  - module.json
+  - package.json
+  - spec/module.yaml
+  - src/index.ts
+  - src/acl/permissions.ts
+  - src/api/endpoints.ts
+  - src/platform.ts
+  - src/server/index.ts
+  - src/client/index.ts
+  - tests/module.test.ts
+stable:
+  - src/platform.ts exports createServerComposition
+  - src/client/index.ts exports createClientContribution
+  - every name exported from src/index.ts, src/server/index.ts, src/client/index.ts
+byChange:
+  endpoint:
+    - 'src/services/*.ts'
+    - 'src/api/endpoints.ts'
+    - 'src/client/api.ts'
+    - 'tests/module.test.ts'
+    - 'spec/module.yaml'
+  table:
+    - 'src/services/migration.ts'
+    - 'src/services/database-repository.ts'
+    - 'migrations/000N_{module}_{name}.up.sql'
+    - 'migrations/000N_{module}_{name}.down.sql'
+    - 'src/domain/types.ts'
+    - 'tests/module.test.ts'
+    - 'spec/module.yaml'
+  column:
+    - 'src/services/migration.ts'
+    - 'src/services/database-repository.ts'
+    - 'migrations/000N_{module}_{name}.up.sql'
+    - 'migrations/000N_{module}_{name}.down.sql'
+    - 'src/domain/types.ts'
+    - 'src/api/endpoints.ts'
+    - 'src/client/*.tsrx'
+    - 'tests/module.test.ts'
+    - 'spec/module.yaml'
+  screen:
+    - 'src/client/XView.tsrx'
+    - 'src/client/contribution.tsrx'
+    - 'src/client/index.ts'
+  widget:
+    - 'src/client/*.tsrx'
+    - 'src/client/contribution.tsrx'
+  permission:
+    - 'spec/module.yaml'
+    - 'src/acl/permissions.ts'
+    - 'src/api/endpoints.ts'
+    - 'src/client/contribution.tsrx'
+  setting:
+    - 'src/settings.ts'
+    - 'src/platform.ts'
+    - 'src/server/runtime.ts'
+    - 'spec/module.yaml'
+  cross-module-read:
+    - 'module.json'
+    - 'spec/module.yaml'
+    - 'package.json'
+    - 'src/services/*.ts'
+  agent-tool:
+    - 'src/agent/tools.ts'
+    - 'src/platform.ts'
+    - 'tests/agent-tools.test.ts'
+    - 'spec/module.yaml'
+    - 'package.json'
+  business-agent:
+    - 'src/agent/agents.ts'
+    - 'src/platform.ts'
+    - 'tests/business-agents.test.ts'
+    - 'spec/module.yaml'
+    - 'module.json'
+    - 'package.json'
+  fix:
+    - 'tests/module.test.ts'
+    - 'the owning file'

package/agent-template/.ai/blueprints/edit-module/spec-requirements.yaml

@@ -0,0 +1,15 @@
+schemaVersion: 1
+status:
+  allowed:
+    - draft
+    - approved
+    - in-review
+requiredKeys:
+  - acceptanceScenarios
+onChange:
+  specVersion: bump patch for fix, minor for endpoint, table, column, screen, widget, permission, cross-module-read
+  acceptanceScenarios: one new scenario per new behaviour, id pattern ^[A-Z][A-Z0-9-]+$
+  invariants: one new sentence per new rule (uniqueness, range, tenancy)
+  permissions: new ids must also appear in src/acl/permissions.ts and be granted with auth sync-scopes
+  dependencies: a cross-module read adds the owning module id and range
+  settings: a new setting gets an invariant or scenario naming its key, type, default and bounds

package/agent-template/.ai/blueprints/edit-module/steps.yaml

@@ -0,0 +1,115 @@
+schemaVersion: 1
+steps:
+  - id: spec
+    role: business-manager
+    action: Update the specification or write its minimal delta first; add the acceptance scenario and invariant, bump specVersion, and leave status draft or in-review for the operator.
+    inputs:
+      - 'brief'
+      - 'base/spec/module.yaml'
+    outputs:
+      - 'spec/module.yaml'
+  - id: approve
+    role: orchestrator
+    action: Show the spec delta and record the operator approval of its exact content hash. Any later spec edit or request for changes invalidates that module's approval and blocks its implementation again; a module added to the session needs its own approved hash.
+    inputs:
+      - 'spec/module.yaml'
+    outputs:
+      - 'approved spec hash'
+    gates:
+      - 'spec-schema'
+  - id: read
+    role: backend-engineer
+    action: After approval, read the whole module (spec, acl, endpoints, services, client, tests) and the base copy before changing implementation.
+    inputs:
+      - 'approved spec hash'
+      - 'modules/{module}/**'
+    outputs: []
+  - id: classify
+    role: backend-engineer
+    action: Name the change class (endpoint, table, column, screen, widget, permission, setting, cross-module-read, fix) and take its touch list from required-files.yaml byChange.
+    inputs:
+      - 'brief'
+    outputs:
+      - 'touch list'
+  - id: server
+    role: backend-engineer
+    action: Service method, repository SQL with WHERE tenant_id = ?, numbered ledger migration for a schema change, endpoint with access, resolveIdentity, sessionMutationDenial, readJsonObject; tests for denial and isolation.
+    inputs:
+      - 'touch list'
+    outputs:
+      - 'src/services/*.ts'
+      - 'src/api/endpoints.ts'
+      - 'migrations/*.sql'
+      - 'tests/module.test.ts'
+    gates:
+      - 'module-schema'
+      - 'dependencies'
+      - 'typecheck'
+      - 'tests'
+      - 'format'
+  - id: client
+    role: frontend-engineer
+    action: api.ts call, form field or column, contribution entry for a new screen or widget, client logic test.
+    inputs:
+      - 'src/api/endpoints.ts'
+    outputs:
+      - 'src/client/**'
+      - 'tests/*.test.ts'
+    gates:
+      - 'dependencies'
+      - 'typecheck'
+      - 'tests'
+      - 'format'
+  - id: agent-surface
+    role: agentic-engineer
+    action: When the approved delta asks for a tool or module-owned business agent, follow agent-tool-design or business-agent-design, register it during composition, and test exact tool ceilings, tenant isolation, live permission refusal, and revision behavior.
+    inputs:
+      - 'approved spec hash'
+      - 'src/api/endpoints.ts'
+      - 'src/services/*.ts'
+    outputs:
+      - 'src/agent/tools.ts when tools are required'
+      - 'src/agent/agents.ts when a business agent is required'
+      - 'src/platform.ts'
+      - 'tests/agent-tools.test.ts'
+      - 'tests/business-agents.test.ts'
+      - 'module.json'
+      - 'package.json'
+    gates:
+      - 'module-schema'
+      - 'dependencies'
+      - 'typecheck'
+      - 'tests'
+      - 'format'
+  - id: versions
+    role: backend-engineer
+    action: Keep module.json and package.json versions equal to the operator-approved specVersion without changing the approved spec content.
+    inputs:
+      - 'approved spec hash'
+    outputs:
+      - 'module.json'
+      - 'package.json'
+    gates:
+      - 'module-schema'
+  - id: land
+    role: orchestrator
+    action: 'Sandbox: verify the current spec hash still equals the operator-approved hash, then eject (gates per module, copy and removals, pnpm install, auth sync-scopes, platform typecheck; stops at the first failed step). Direct path: pnpm verify, pull request; auth sync-scopes --apply when a permission was added.'
+    inputs:
+      - 'modules/{module}/**'
+    outputs:
+      - 'modules/{module}/**'
+    gates:
+      - 'spec-schema'
+      - 'module-schema'
+      - 'dependencies'
+      - 'typecheck'
+      - 'tests'
+      - 'format'
+  - id: review
+    role: reviewer
+    action: Diff against base, exact approved spec hash unchanged, exported names unchanged, versions bumped together, and migration runner evidence covers fresh apply plus adoption of an existing database.
+    inputs:
+      - 'diff'
+      - 'gate evidence'
+    outputs:
+      - 'review report'

package/agent-template/.ai/blueprints/new-module/README.md

@@ -0,0 +1,7 @@
+# new-module
+
+Create a module from an approved `spec/module.yaml`. The sandbox labels these sessions `new-module@1.0.0` (`packages/sandbox/src/server/routes.ts`); the same blueprint applies when a person or a coding tool follows `.ai/skills/module-new/SKILL.md` at the repository root.
+
+Roles, in order: `business-manager` writes the spec and stops for approval; `backend-engineer` builds the server from `pnpm flowdular module new` output; `ux-designer` and `frontend-engineer` build the screen; `agentic-engineer` joins when the brief asks for agent tools or a module-owned business agent. Gates are the six sandbox gates. The change reaches the platform through eject (sandbox) or `pnpm flowdular module enable <id> --apply` (direct path; the command grants the module's scopes as its last step), then a pull request.
+
+Files in this directory describe the contract; `blueprint.json` is the only one validated by `pnpm flowdular blueprint validate --all`, and `packages/cli/src/validation.ts` checks that the others exist. Nothing executes `steps.yaml` or `gates.yaml`.

package/agent-template/.ai/blueprints/new-module/allowed-paths.yaml

@@ -0,0 +1,27 @@
+schemaVersion: 1
+write:
+  - modules/{module}/**
+deny:
+  - platform/**
+  - packages/**
+  - infra/**
+  - .github/**
+  - docs/**
+  - specs/**
+  - .ai/**
+  - flowdular.json
+  - pnpm-workspace.yaml
+  - modules/!({module})/**
+# Written only by CLI commands, never by hand. The eject and the direct path
+# both run the commands; the files still travel in the same commit.
+cliOwned:
+  - path: flowdular.json
+    command: pnpm flowdular module enable <id> --apply
+  - path: platform/package.json
+    command: pnpm flowdular module enable <id> --apply
+  - path: platform/src/generated/modules.server.ts
+    command: pnpm flowdular module sync --apply
+  - path: platform/src/generated/modules.client.ts
+    command: pnpm flowdular module sync --apply
+  - path: pnpm-lock.yaml
+    command: pnpm install

package/agent-template/.ai/blueprints/new-module/blueprint.json

@@ -0,0 +1,20 @@
+{
+	"$schema": "../../../packages/contracts/schemas/blueprint.schema.json",
+	"schemaVersion": 1,
+	"architecture": "0.2.0",
+	"owner": "platform-architecture",
+	"status": "approved",
+	"id": "new-module",
+	"version": "1.0.0",
+	"risk": "workspace-write",
+	"agentRoles": [
+		"business-manager",
+		"backend-engineer",
+		"ux-designer",
+		"frontend-engineer",
+		"agentic-engineer"
+	],
+	"executorProfiles": ["sandbox-specialist", "repo-agent"],
+	"requiredReviewers": ["reviewer"],
+	"requiresApprovedSpec": true
+}

package/agent-template/.ai/blueprints/new-module/examples/invalid/input-spec-outside-modules.json

@@ -0,0 +1,4 @@
+{
+	"moduleId": "inventory.core",
+	"specPath": "platform/spec/module.yaml"
+}

package/agent-template/.ai/blueprints/new-module/examples/invalid/plan-unknown-gate.json

@@ -0,0 +1,8 @@
+{
+	"blueprint": "new-module@1.0.0",
+	"moduleId": "inventory.core",
+	"specDigest": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+	"allowedPaths": ["modules/inventory/**"],
+	"steps": ["scaffold"],
+	"gates": ["lint"]
+}

package/agent-template/.ai/blueprints/new-module/examples/valid/input.json

@@ -0,0 +1,5 @@
+{
+	"moduleId": "inventory.core",
+	"specPath": "modules/inventory/spec/module.yaml",
+	"brief": "Track stock locations per tenant with a read and a manage scope."
+}

package/agent-template/.ai/blueprints/new-module/examples/valid/plan.json

@@ -0,0 +1,22 @@
+{
+	"blueprint": "new-module@1.0.0",
+	"moduleId": "inventory.core",
+	"specDigest": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+	"allowedPaths": ["modules/inventory/**"],
+	"steps": [
+		"spec",
+		"scaffold",
+		"server",
+		"client",
+		"tests",
+		"enable-and-grant"
+	],
+	"gates": [
+		"spec-schema",
+		"module-schema",
+		"dependencies",
+		"typecheck",
+		"tests",
+		"format"
+	]
+}

package/agent-template/.ai/blueprints/new-module/gates.yaml

@@ -0,0 +1,30 @@
+schemaVersion: 1
+# Ids equal GateId in packages/sandbox/src/server/gates.ts. The sandbox runs the
+# gates a role lists in its front matter after every turn that changed files;
+# from the repository root run the command column yourself. Nothing executes
+# this file; it documents the contract.
+gates:
+  - id: spec-schema
+    command: pnpm flowdular spec validate --all --json
+    sandbox: pnpm flowdular spec validate --all --json --root <session workspace>
+    required: true
+  - id: module-schema
+    command: pnpm flowdular module validate --json
+    sandbox: pnpm flowdular module validate --json --root <session workspace>
+    required: true
+  - id: dependencies
+    command: 'grep the imports under src/** and compare with package.json dependencies (no CLI command yet)'
+    sandbox: checkDeclaredDependencies(modulePath) in packages/sandbox/src/server/dependencies.ts, run after every turn that changed files, plus a pnpm install when a package.json changed
+    required: true
+  - id: typecheck
+    command: pnpm --filter @flowdular/module-{module} typecheck
+    sandbox: node_modules/.bin/tsrx-tsc --noEmit -p tsconfig.json (cwd module)
+    required: true
+  - id: tests
+    command: pnpm --filter @flowdular/module-{module} test
+    sandbox: node_modules/.bin/vitest run --passWithNoTests (cwd module; zero tests still pass)
+    required: true
+  - id: format
+    command: pnpm format:check
+    sandbox: prettier --check . (cwd module)
+    required: true

package/agent-template/.ai/blueprints/new-module/input.schema.json

@@ -0,0 +1,21 @@
+{
+	"$schema": "https://json-schema.org/draft/2020-12/schema",
+	"type": "object",
+	"additionalProperties": false,
+	"required": ["moduleId", "specPath"],
+	"properties": {
+		"moduleId": {
+			"type": "string",
+			"pattern": "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)+$"
+		},
+		"specPath": {
+			"type": "string",
+			"pattern": "^modules/[a-z0-9-]+/spec/module\\.yaml$"
+		},
+		"brief": {
+			"type": "string",
+			"minLength": 8,
+			"maxLength": 20000
+		}
+	}
+}

package/agent-template/.ai/blueprints/new-module/plan.schema.json

@@ -0,0 +1,58 @@
+{
+	"$schema": "https://json-schema.org/draft/2020-12/schema",
+	"type": "object",
+	"additionalProperties": false,
+	"required": [
+		"blueprint",
+		"moduleId",
+		"specDigest",
+		"allowedPaths",
+		"steps",
+		"gates"
+	],
+	"properties": {
+		"blueprint": {
+			"const": "new-module@1.0.0"
+		},
+		"moduleId": {
+			"type": "string",
+			"pattern": "^[a-z][a-z0-9-]*(\\.[a-z][a-z0-9-]*)+$"
+		},
+		"specDigest": {
+			"type": "string",
+			"pattern": "^sha256:[a-f0-9]{64}$"
+		},
+		"allowedPaths": {
+			"type": "array",
+			"minItems": 1,
+			"items": {
+				"type": "string",
+				"pattern": "^modules/[a-z0-9-]+/"
+			},
+			"uniqueItems": true
+		},
+		"steps": {
+			"type": "array",
+			"minItems": 1,
+			"items": {
+				"type": "string"
+			}
+		},
+		"gates": {
+			"type": "array",
+			"minItems": 1,
+			"items": {
+				"type": "string",
+				"enum": [
+					"spec-schema",
+					"module-schema",
+					"dependencies",
+					"typecheck",
+					"tests",
+					"format"
+				]
+			},
+			"uniqueItems": true
+		}
+	}
+}

package/agent-template/.ai/blueprints/new-module/required-files.yaml

@@ -0,0 +1,73 @@
+schemaVersion: 1
+# What .ai/references/catalog has and packages/cli/src/module-sync.ts needs. The
+# scaffold (pnpm flowdular module new) writes most of these; check the dry run.
+required:
+  - module.json
+  - package.json
+  - tsconfig.json
+  - spec/module.yaml
+  - src/index.ts
+  - src/acl/permissions.ts
+  - src/api/endpoints.ts
+  - src/client/index.ts
+  - src/services/index.ts
+  - migrations/README.md
+  - translations/en.json
+  - tests/module.test.ts
+manifest:
+  module.json:
+    - platform.server: true when capabilities include api
+    - platform.client: true when capabilities include client
+    - version equals spec specVersion and package.json version
+  package.json:
+    exports:
+      - '.'
+      - ./client
+      - ./server
+      - ./platform
+  src/platform.ts:
+    - createServerComposition(context) returns routes, optional settings (defineModuleSettings), optional start() and optional dispose()
+    - context carries auth, settings (ModuleSettingsRuntime), agentTools (PlatformToolRegistry), agentDefinitions (PlatformAgentRegistry) and capabilities (PlatformCapabilityRegistry)
+conditional:
+  api:
+    whenCapability: api
+    required:
+      - src/platform.ts
+      - src/server/index.ts
+      - src/server/runtime.ts
+      - src/domain/types.ts
+  database:
+    whenCapability: database
+    required:
+      - src/services/migration.ts
+      - src/services/repository.ts
+      - src/services/database-repository.ts
+      - migrations/0001_{module}_core.up.sql
+      - migrations/0001_{module}_core.down.sql
+  no-database:
+    whenCapabilityAbsent: database
+    required:
+      - src/services/memory-repository.ts
+  client:
+    whenCapability: client
+    required:
+      - src/client/contribution.tsrx
+      - src/client/api.ts
+      - src/client/state.ts
+  cli:
+    whenCapability: cli
+    required:
+      - src/cli/commands.json
+      - src/cli/index.ts
+  translations:
+    whenCapability: translations
+    required:
+      - translations/{locale}.json for every declared locale
+  business-agent:
+    whenBriefRequests: module-owned business agent
+    required:
+      - src/agent/agents.ts
+      - tests/business-agents.test.ts
+      - agents.core in spec/module.yaml and module.json dependencies
+      - '@flowdular/module-agents in package.json dependencies'
+      - context.agentDefinitions.register(...) in src/platform.ts

package/agent-template/.ai/blueprints/new-module/spec-requirements.yaml

@@ -0,0 +1,30 @@
+schemaVersion: 1
+# Every key below exists in packages/contracts/schemas/module-spec.schema.json.
+status:
+  allowed:
+    - approved
+requiredKeys:
+  - invariants
+  - permissions
+  - dataOwnership
+  - acceptanceScenarios
+byCapability:
+  api:
+    permissions: one read and one manage id per entity, pattern <module>.<entity>.read|manage
+  database:
+    invariants: tenancy and uniqueness rules stated in sentences
+    dataOwnership: what this module owns and what it reads through another module
+  client:
+    acceptanceScenarios: a list scenario and a create scenario name the screen states
+dependencies:
+  required:
+    - id: system.core
+      range: ^0.1.0
+    - id: auth.core
+      range: ^0.1.0
+acceptanceScenarios:
+  minimum: 4
+  mustInclude:
+    - denial (401 or 403 before repository access)
+    - tenant isolation
+    - create with a stable conflict code when uniqueness exists

package/agent-template/.ai/blueprints/new-module/steps.yaml

@@ -0,0 +1,138 @@
+schemaVersion: 1
+steps:
+  - id: spec
+    role: business-manager
+    action: Write spec/module.yaml with status draft, schema-valid, with permissions and acceptance scenarios; stop for approval.
+    inputs:
+      - 'brief'
+    outputs:
+      - 'spec/module.yaml'
+    gates:
+      - 'spec-schema'
+  - id: approve
+    role: operator
+    action: Set status to approved (sandbox approve button or a human edit). No agent does this.
+    inputs:
+      - 'spec/module.yaml'
+    outputs:
+      - 'spec/module.yaml'
+  - id: scaffold
+    role: orchestrator
+    action: pnpm flowdular module new <id> --spec modules/<dir>/spec/module.yaml --apply (the sandbox runs it; at the root run the dry run first). Writes the composition entries, a list and a create endpoint, table or memory repository, view, api, state and tests for the first entity; other permissions get constants only.
+    inputs:
+      - 'spec/module.yaml'
+      - 'translations/*.json'
+    outputs:
+      - 'module.json'
+      - 'package.json'
+      - 'tsconfig.json'
+      - 'src/platform.ts'
+      - 'src/server/*.ts'
+      - 'src/acl/permissions.ts'
+      - 'src/api/endpoints.ts'
+      - 'src/domain/types.ts'
+      - 'src/services/*.ts'
+      - 'src/client/*.ts'
+      - 'src/client/*.tsrx'
+      - 'migrations/0001_*.sql'
+      - 'tests/module.test.ts'
+      - 'translations/*.json'
+  - id: server
+    role: backend-engineer
+    action: 'Extend the scaffold with the real domain: fields, validation and stable error codes, uniqueness rules and indexes, further endpoints and entities, settings and server tests per the module-new skill.'
+    inputs:
+      - 'spec/module.yaml'
+      - 'reference/example-module'
+    outputs:
+      - 'src/acl/permissions.ts'
+      - 'src/domain/types.ts'
+      - 'src/services/*.ts'
+      - 'src/server/*.ts'
+      - 'src/api/endpoints.ts'
+      - 'src/platform.ts'
+      - 'src/index.ts'
+      - 'migrations/0001_*.sql'
+      - 'tests/module.test.ts'
+      - 'module.json'
+      - 'package.json'
+    gates:
+      - 'module-schema'
+      - 'dependencies'
+      - 'typecheck'
+      - 'tests'
+      - 'format'
+  - id: screen
+    role: ux-designer
+    action: Skeleton of the record screen and drawer form with the five states, on @flowdular/ui only.
+    inputs:
+      - 'spec/module.yaml'
+      - 'reference/design-system.md'
+    outputs:
+      - 'src/client/XView.tsrx'
+      - 'src/client/XForm.tsrx'
+    gates:
+      - 'typecheck'
+      - 'format'
+  - id: client
+    role: frontend-engineer
+    action: createClientContribution(context) in src/client/index.ts, contribution.tsrx, api.ts with csrf and content-type, state.ts, data wiring, widget, client logic tests.
+    inputs:
+      - 'src/api/endpoints.ts'
+      - 'src/client/XView.tsrx'
+    outputs:
+      - 'src/client/index.ts'
+      - 'src/client/contribution.tsrx'
+      - 'src/client/api.ts'
+      - 'src/client/state.ts'
+      - 'tests/*.test.ts'
+      - 'package.json'
+    gates:
+      - 'dependencies'
+      - 'typecheck'
+      - 'tests'
+      - 'format'
+  - id: agent-surface
+    role: agentic-engineer
+    action: Only when the approved spec asks for agent tools or a module-owned business agent; follow agent-tool-design for tools and business-agent-design for defineAgent behavior, register both during composition, and prove the exact capability ceiling and refusals.
+    inputs:
+      - 'spec/module.yaml'
+      - 'src/api/endpoints.ts'
+    outputs:
+      - 'src/agent/tools.ts when tools are required'
+      - 'src/agent/agents.ts when a business agent is required'
+      - 'src/platform.ts'
+      - 'tests/agent-tools.test.ts'
+      - 'tests/business-agents.test.ts'
+      - 'package.json'
+      - 'module.json'
+    gates:
+      - 'spec-schema'
+      - 'module-schema'
+      - 'dependencies'
+      - 'typecheck'
+      - 'tests'
+  - id: land
+    role: orchestrator
+    action: 'Sandbox: eject (gates per module, copy and removals, pnpm install, module enable with scope grant, auth sync-scopes, platform typecheck, restart note). Direct path: module enable --apply (grants scopes), pnpm verify, pull request.'
+    inputs:
+      - 'modules/{module}/**'
+    outputs:
+      - 'flowdular.json'
+      - 'platform/package.json'
+      - 'platform/src/generated/modules.server.ts'
+      - 'platform/src/generated/modules.client.ts'
+    gates:
+      - 'spec-schema'
+      - 'module-schema'
+      - 'dependencies'
+      - 'typecheck'
+      - 'tests'
+      - 'format'
+  - id: review
+    role: reviewer
+    action: Review against the spec, AGENTS.md and the reviewer checklist; findings by severity; no fixes in the same run.
+    inputs:
+      - 'diff'
+      - 'gate evidence'
+    outputs:
+      - 'review report'

package/agent-template/.ai/blueprints/release/README.md

@@ -0,0 +1,5 @@
+# release
+
+Move a finished change into the platform: a sandbox eject, a pull request from a working tree, or a version tag that builds the container (`.github/workflows/container.yml` on `v*.*.*`). Procedure and conventions: `.ai/skills/release-eject-pr/SKILL.md`.
+
+The release writes nothing by hand. `pnpm flowdular module enable` (which also grants the module's scopes), `pnpm flowdular module sync`, `pnpm install` and `pnpm flowdular auth sync-scopes` produce every non-module file in the commit, and the pull request body names the command for each. An eject stops at the first failed step and removes the files a session deleted. Gates are the repository gates CI runs: `pnpm verify`, `pnpm build`, `pnpm audit --prod --audit-level high`.