create-flowdular 0.6.1 → 0.6.3

package/agent-template/.agents/skills/module-new/SKILL.md

@@ -14,7 +14,7 @@ Two ways to land the same module: the sandbox (a brief, specialist turns, gates
 
 With an approved `schemaVersion: 2` spec, the specification is the requirement document and you do not go looking for one. Read the spec, the files on this skill's touch list, and `.ai/references/catalog` for shape. Do not scan `modules/` or `packages/`; `.ai/platform-capabilities.md` answers what the platform provides, and the reference module answers what the code looks like.
 
-Anything the spec does not say is a spec defect, not a decision you make. A missing field, an unstated conflict behaviour, an undefined state transition, a screen without columns: report it back. In the sandbox that is `HANDOFF: business-manager - <what is missing>`; on a host it is a question to the user. Never fill the gap with a plausible guess, and never implement anything listed in `outOfScope[]`.
+Anything the spec does not say is a spec defect, not a decision you make. A missing field, an unstated conflict behaviour, an undefined state transition, a screen without columns: report it back. In the sandbox that is a `questions` block the operator answers, and the business manager records an answer that changes the spec for a new approval before you continue; on a host it is a question to the user. Never fill the gap with a plausible guess, and never implement anything listed in `outOfScope[]`.
 
 Every `acceptanceScenarios[]` entry maps to at least one test in `tests/`. A scenario with no test is unfinished work, and the scenario id belongs in the test name so the mapping is readable.
 

package/agent-template/.agents/skills/module-update/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 
 With an approved `schemaVersion: 2` spec delta, the specification is the requirement document. Read the spec, the module itself, the touch list for the change class below, and `.ai/references/catalog` for shape. Do not scan `modules/` or `packages/`: `.ai/platform-capabilities.md` answers what the platform provides.
 
-Anything the delta does not say is a spec defect, not your decision. Report it back (`HANDOFF: business-manager - <what is missing>` in the sandbox, a question to the user on a host) instead of guessing, and never implement an item the spec parks in `outOfScope[]`. Every new or changed `acceptanceScenarios[]` entry maps to at least one test, with the scenario id in the test name.
+Anything the delta does not say is a spec defect, not your decision. Report it back (a `questions` block in the sandbox, which the business manager turns into a spec delta for a new approval when the answer changes the spec; a question to the user on a host) instead of guessing, and never implement an item the spec parks in `outOfScope[]`. Every new or changed `acceptanceScenarios[]` entry maps to at least one test, with the scenario id in the test name.
 
 The spec-element to file mapping is the table in `module-new`; the change classes below are the same mapping arranged by what you are changing.
 

package/agent-template/.agents/skills/perf-audit/SKILL.md

@@ -93,6 +93,6 @@ Complexity to state in the review: for each new data structure and loop on a req
 ## Pitfalls
 
 - `LIKE` or `=` against `lower(column)` cannot use a plain `(tenant_id, column)` index; store a normalized column (`sku_normalized`) as `.ai/references/catalog` does, or add an expression index on `lower(column)`.
-- `ORDER BY lower(name)` (`Flowdular/official-modules`, `modules/parties`) cannot use the `(tenant_id, name, id)` index for the sort; acceptable at current sizes, name it if parties grow.
+- `ORDER BY lower(name)` cannot use a `(tenant_id, name, id)` index for the sort; acceptable at small sizes, name it once the table grows.
 - A `Kpi` that shows `items.length` after loading the full list is O(rows) network per dashboard load.
 - Never change behaviour in a performance commit; keep the functional tests green and add none that assert internal call counts.

package/agent-template/.ai/agents/README.md

@@ -8,9 +8,9 @@ Two families of role prompts live here. They share one front matter schema (`id`
 
 What the front matter does at run time:
 
-- `gates`: enforced. After a turn that changed files, the sandbox runs `dependencies` plus these gates (`packages/sandbox/src/server/turns.ts`, `runSessionGates`), workspace gates once and module gates per draft module. Ids must come from `packages/sandbox/src/server/gates.ts`: `spec-schema`, `module-schema`, `dependencies`, `typecheck`, `tests`, `format`. An unknown id is dropped silently. The failing gate's command and output go into the fix prompt.
+- `gates`: enforced. After a turn that changed files, the sandbox runs `dependencies` plus these gates (`packages/sandbox/src/server/turns.ts`, `runSessionGates`), workspace gates once and module gates per draft module. Ids must come from `packages/sandbox/src/server/gates.ts`: `spec-schema`, `module-schema`, `dependencies`, `typecheck`, `tests`, `format`. An unknown id is dropped silently. A gate whose last result did not pass also runs after every turn until it passes, and every gate but `auto-review` runs after a turn that wrote a file it checks (`reads` in `gates.ts`) once the module has its `module.json`. A failure is repaired by a role whose `allowedPaths` cover the file the fix goes in (`packages/sandbox/src/server/gate-repair.ts`), with the reported errors in the fix prompt.
 - `allowedPaths`: enforced after every turn. Globs relative to the active draft module are shown to the agent as "Paths you may write" and captured before the driver starts. A write outside that allowlist fails the turn, is quarantined as evidence and is restored before formatting, gates, checkpoints, preview or delivery can observe it (`packages/sandbox/src/server/path-guard.ts`, `turns.ts`).
-- `handoff`: enforced. A `HANDOFF:` line is honoured only when it names a role in this list and not the role itself (`packages/sandbox/src/server/planning.ts`); otherwise the state routing decides and the transcript says why. The team list in the instruction is built from this list.
+- `handoff`: enforced. A `HANDOFF:` line is honoured only when it names a role in this list and not the role itself (`packages/sandbox/src/server/planning.ts`); otherwise the state routing decides and the transcript says why. When the line names module files the finishing role may not write, the next turn goes to a role whose `allowedPaths` cover one of them, or the chain stops when no role's do. The team list in the instruction is built from this list.
 - `id`, `name`, `purpose`: composed into the instruction after `SANDBOX_AGENT_CONTRACT`, before the session facts.
 
 The five roles and who takes the first turn: `business-manager` for both a new module and a change to an existing module. For a change, it updates the copied specification first and leaves it as `draft` or `in-review`. The operator approval route changes the current text to `approved` and records its exact hash. Any later edit makes the hash stale and routes back to approval before `backend-engineer`, `ux-designer`, `frontend-engineer` or `agentic-engineer` may implement (`planSpecGateHandoff` in `planning.ts`, `isSpecApproved` in `spec.ts`).

package/agent-template/.ai/agents/sandbox/agentic-engineer.md

@@ -29,4 +29,4 @@ The allowed tool list is a maximum. Effective authority also requires tenant bin
 
 Module-owned agents require a tenant provider/model binding, retained definition revisions and an exact tool ceiling. Never pin provider credentials or use wildcard tools. Procedures stored by agents.core are business data, unrelated to coding skills.
 
-If the requested surface needs a missing endpoint/service, hand off to backend. If a permission or acceptance scenario is missing, hand off to the business manager for a spec delta and renewed approval. Never edit another module or platform package from this session.
+If the requested surface needs a missing endpoint/service, hand off to backend. If a permission, tool or acceptance scenario the work needs is not in the approved spec, ask for it with a questions block (Session); never add it yourself. Never edit another module or platform package from this session.

package/agent-template/.ai/agents/sandbox/backend-engineer.md

@@ -43,4 +43,4 @@ Test observable behavior: successful operations, validation bounds, 401/403, uni
 
 Operator sample data comes from the sample-data tool or reference/sample-data.json. Derive tests/fixtures/\*.json and preview/seed.json from its shape with invented names, contacts and identifiers. src/preview.ts exports an idempotent seed({ tenantId, accountId, data, databases }) that writes through the module repository. A spec research section reads research-fixtures.json and each adapter its adapters/<id>.recorded.json; never declare a live adapter.
 
-Leave client files to the frontend engineer and tools/business-agent definitions to the agentic engineer. If their required service surface is missing, finish it here before handing off. Do not change permissions or business requirements without renewed spec approval.
+Leave client files to the frontend engineer and tools/business-agent definitions to the agentic engineer. If their required service surface is missing, finish it here before handing off. Implement only what the approved spec states. Never add an error code, field, permission, state or behaviour it does not define, not even as the cautious choice: ask for it with a questions block (Session) and leave it unbuilt.

package/agent-template/.ai/agents/sandbox/business-manager.md

@@ -16,12 +16,10 @@ You own specification decisions and locale terminology, never implementation. Us
 
 Write schemaVersion 2: entities with typed fields (never id, tenantId or createdAt) and states, screens, actions, widgets, settings, agentTools, plus outOfScope and decisions. Fill decisions for every choice, including the platform defaults you proposed. The capability card is closed: anything it lists as missing goes to outOfScope with the business decision, never into a scenario. v1 specs stay valid.
 
-When a decision is missing, end the reply with exactly one fenced block tagged questions holding {"questions":[{"id":"Q-1","question":"...","options":["..."],"recommended":"...","allowFreeText":true}]} and nothing after it. Stay within the limits the sandbox enforces: at most 12 questions, each 1 to 400 characters; at most 8 options per question, each 1 to 120 characters; recommended is one of the options; no line breaks inside a value; the whole block at most 8000 characters. A block outside them comes back to you once with the reason. The operator answers in a form and the replies arrive next turn as a Decisions section.
-
 For an edit, compare against base/modules/<dir>/spec/module.yaml and make the smallest delta covering the brief. Start new specs as draft; change an existing approved spec to draft or in-review before editing requirements. Never set approved: only the operator records approval of the exact hash. Later edits invalidate it.
 
 State actors, records, ownership, permissions, uniqueness, failure behavior and observable acceptance scenarios. Do not invent business facts. Include success, denial and cross-tenant cases. The schema rejects unknown keys: express navigation and failure decisions inside invariants and acceptanceScenarios.
 
 Put the primary entity's read/manage permissions first: the scaffold builds that entity, while later permissions only become constants. Capability and dependency declarations must describe the approved module, not guessed future work. Define matching terminology for each declared locale.
 
-Do not write TypeScript, module.json or package.json. Hand a complete specification to backend or UX, explicitly noting that implementation awaits exact-hash approval. If a business decision is missing, end with HANDOFF: none and the question.
+Do not write TypeScript, module.json or package.json. Hand a complete specification to backend or UX, explicitly noting that implementation awaits exact-hash approval. If a business decision is missing, ask it with a questions block (Session) and end with HANDOFF: none.

package/agent-template/.ai/agents/sandbox/frontend-engineer.md

@@ -25,4 +25,4 @@ Use the canonical createClientContribution entry. Navigation must point at an ex
 
 Records own the page, with create/edit in a Drawer. Reuse TableCard and Table, including widths, loading and empty states. Use translated copy, all five states, and no hardcoded design values. Inspect the rendered screen before handoff.
 
-For TSRX, loop keys can read only the loop item: precompute a key on each item if it needs props or local state. Test pure mapping/filtering logic in .ts helpers. Ask the backend engineer for missing endpoints or fields, or UX for an unresolved screen decision; do not invent either.
+For TSRX, loop keys can read only the loop item: precompute a key on each item if it needs props or local state. Test pure mapping/filtering logic in .ts helpers. Ask the backend engineer for an endpoint or field the spec defines but the server lacks, or UX for an unresolved screen decision. Never invent a business decision the approved spec does not make (a field, state, permission or behaviour): ask for it with a questions block (Session).

package/agent-template/.ai/agents/sandbox/ux-designer.md

@@ -20,4 +20,4 @@ Specify loading, empty, error, populated and denied states. Use TableCard with a
 
 Use shared primitives and tokens. A missing primitive may be a small module-local component, flagged for possible promotion. Do not restyle ui-\* classes. Reference existing translation keys; hand missing locale terms to the business manager because translations/ is outside your write scope.
 
-Inspect the rendered result for overflow, alignment and duplicate labels. Hand the skeleton to frontend for data wiring, or ask the business manager for missing business decisions.
+Inspect the rendered result for overflow, alignment and duplicate labels. Hand the skeleton to frontend for data wiring. Ask a missing business decision with a questions block (Session), never in prose.

package/agent-template/.ai/policies/model-routing.yaml

@@ -50,7 +50,8 @@ profiles:
 # Who takes the first sandbox turn (planning.ts classifyByRules) and how the
 # next role is chosen (planHandoff): the HANDOFF line when it names a
 # registered role, otherwise routeRole by module state, and a failed gate
-# always returns to the same role.
+# goes to the role whose write paths cover the file its fix goes in
+# (gate-repair.ts).
 routing:
   new-module: business-manager
   edit-module: business-manager

package/agent-template/.ai/policies/task-budgets.yaml

@@ -33,7 +33,7 @@ sandbox:
     messageLength: 1 to 20000 characters (packages/sandbox/src/server/turns.ts)
     briefLength: at least 8 characters (planning.ts assertBrief)
     gateTimeout: 5 minutes per gate, output capped at 12000 characters (gates.ts)
-    gateFailure: the same role repairs; at most maxRepairLoops consecutive repair turns per chain, then the chain returns to the operator
+    gateFailure: a role whose write paths cover the failing file repairs, a repair that changed nothing is not repeated by the same role, and a gate that failed runs after every turn until it passes; at most maxRepairLoops consecutive repair turns per chain, then the chain returns to the operator
     byokReads: 400 listed files, 128 KB per read (packages/coding-agent/src/drivers/byok.ts)
   review:
     chainedTurns: stop and read the transcript after four automatic handoffs on one brief

package/agent-template/.ai/references/catalog/migrations/0001_catalog_core.up.sql

@@ -17,5 +17,5 @@ CREATE INDEX IF NOT EXISTS catalog_items_tenant_sku_idx
 ALTER TABLE catalog_items ENABLE ROW LEVEL SECURITY;
 ALTER TABLE catalog_items FORCE ROW LEVEL SECURITY;
 CREATE POLICY catalog_items_tenant_policy ON catalog_items
-  USING (tenant_id = current_setting('coreloom.tenant_id', true))
-  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+  USING (tenant_id = current_setting('flowdular.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('flowdular.tenant_id', true));

package/agent-template/.ai/references/catalog/migrations/0002_catalog_history.up.sql

@@ -16,5 +16,5 @@ CREATE UNIQUE INDEX IF NOT EXISTS catalog_items_history_tenant_record_version_id
 ALTER TABLE catalog_items_history ENABLE ROW LEVEL SECURITY;
 ALTER TABLE catalog_items_history FORCE ROW LEVEL SECURITY;
 CREATE POLICY catalog_items_history_tenant_policy ON catalog_items_history
-  USING (tenant_id = current_setting('coreloom.tenant_id', true))
-  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+  USING (tenant_id = current_setting('flowdular.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('flowdular.tenant_id', true));

package/agent-template/.ai/references/catalog/migrations/0003_catalog_history_service_actors.up.sql

@@ -32,5 +32,5 @@ ON CONFLICT DO NOTHING;
 ALTER TABLE catalog_items_history_v2 ENABLE ROW LEVEL SECURITY;
 ALTER TABLE catalog_items_history_v2 FORCE ROW LEVEL SECURITY;
 CREATE POLICY catalog_items_history_v2_tenant_policy ON catalog_items_history_v2
-  USING (tenant_id = current_setting('coreloom.tenant_id', true))
-  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+  USING (tenant_id = current_setting('flowdular.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('flowdular.tenant_id', true));

package/agent-template/.ai/references/catalog/migrations/0004_catalog_idempotency_ledger.up.sql

@@ -15,5 +15,5 @@ CREATE INDEX IF NOT EXISTS catalog_idempotency_ledger_tenant_operation_idx
 ALTER TABLE catalog_idempotency_ledger ENABLE ROW LEVEL SECURITY;
 ALTER TABLE catalog_idempotency_ledger FORCE ROW LEVEL SECURITY;
 CREATE POLICY catalog_idempotency_ledger_tenant_policy ON catalog_idempotency_ledger
-  USING (tenant_id = current_setting('coreloom.tenant_id', true))
-  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+  USING (tenant_id = current_setting('flowdular.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('flowdular.tenant_id', true));

package/agent-template/.ai/references/catalog/module.json

@@ -13,11 +13,11 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.8.0"
+			"range": "^0.9.0"
 		},
 		{
 			"id": "auth.core",
-			"range": "^0.13.0"
+			"range": "^0.14.0"
 		},
 		{
 			"id": "exports.core",
@@ -33,5 +33,5 @@
 	"tenancy": "required",
 	"locales": ["en", "pl"],
 	"stability": "experimental",
-	"platformApi": "^0.1.0"
+	"platformApi": "^0.2.0"
 }

package/agent-template/.ai/references/catalog/package.json

@@ -30,8 +30,8 @@
 	},
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/Flowdular/official-modules.git",
-		"directory": "modules/catalog"
+		"url": "git+https://github.com/Flowdular/flowdular.git",
+		"directory": ".ai/references/catalog"
 	},
 	"files": [
 		"src",

package/agent-template/.ai/references/catalog/spec/module.yaml

@@ -12,9 +12,9 @@ capabilities:
   - translations
 dependencies:
   - id: system.core
-    range: ^0.8.0
+    range: ^0.9.0
   - id: auth.core
-    range: ^0.13.0
+    range: ^0.14.0
   - id: exports.core
     range: ^0.2.0
 requires:
@@ -26,7 +26,7 @@ locales:
   - pl
 invariants:
   - Persistence runs on the shared asynchronous database contract. The module receives a leased PostgreSQL handle from platform composition, never a driver or a connection string, and declares explicit PostgreSQL SQL for every statement and migration.
-  - PostgreSQL item, history, and idempotency ledger tables enable and force row-level security with USING and WITH CHECK policies bound to transaction-local coreloom.tenant_id, and the runtime role holds neither SUPERUSER nor BYPASSRLS. Migrations use a separate lease.
+  - PostgreSQL item, history, and idempotency ledger tables enable and force row-level security with USING and WITH CHECK policies bound to transaction-local flowdular.tenant_id, and the runtime role holds neither SUPERUSER nor BYPASSRLS. Migrations use a separate lease.
   - Every catalog item is owned by exactly one tenant and every query uses the trusted tenant identifier.
   - SKU is unique inside a tenant and is never used as tenancy authority.
   - Monetary values are stored as integer minor units with an explicit ISO currency code.

package/agent-template/.ai/references/catalog/src/client/CatalogItemForm.tsrx

@@ -47,7 +47,7 @@ export function CatalogItemForm(props: CatalogItemFormProps) @{
 							name="name"
 							value={name}
 							onInput={(event) => setName(event.currentTarget.value)}
-							minlength={2}
+							minLength={2}
 							maxLength={160}
 							autoFocus
 							required
@@ -113,7 +113,7 @@ export function CatalogItemForm(props: CatalogItemFormProps) @{
 							name="currency"
 							value={currency}
 							onInput={(event) => setCurrency(event.currentTarget.value)}
-							minlength={3}
+							minLength={3}
 							maxLength={3}
 							required
 						/>

package/agent-template/.ai/references/catalog/src/services/migration.ts

@@ -26,8 +26,8 @@ CREATE INDEX IF NOT EXISTS catalog_items_tenant_sku_idx
 ALTER TABLE catalog_items ENABLE ROW LEVEL SECURITY;
 ALTER TABLE catalog_items FORCE ROW LEVEL SECURITY;
 CREATE POLICY catalog_items_tenant_policy ON catalog_items
-  USING (tenant_id = current_setting('coreloom.tenant_id', true))
-  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+  USING (tenant_id = current_setting('flowdular.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('flowdular.tenant_id', true));
 `;
 
 export const CATALOG_MIGRATION_002_HISTORY = `CREATE TABLE IF NOT EXISTS catalog_items_history (
@@ -48,8 +48,8 @@ CREATE UNIQUE INDEX IF NOT EXISTS catalog_items_history_tenant_record_version_id
 ALTER TABLE catalog_items_history ENABLE ROW LEVEL SECURITY;
 ALTER TABLE catalog_items_history FORCE ROW LEVEL SECURITY;
 CREATE POLICY catalog_items_history_tenant_policy ON catalog_items_history
-  USING (tenant_id = current_setting('coreloom.tenant_id', true))
-  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+  USING (tenant_id = current_setting('flowdular.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('flowdular.tenant_id', true));
 `;
 
 export const CATALOG_MIGRATION_003_HISTORY_SERVICE_ACTORS = `CREATE TABLE IF NOT EXISTS catalog_items_history_v2 (
@@ -86,8 +86,8 @@ ON CONFLICT DO NOTHING;
 ALTER TABLE catalog_items_history_v2 ENABLE ROW LEVEL SECURITY;
 ALTER TABLE catalog_items_history_v2 FORCE ROW LEVEL SECURITY;
 CREATE POLICY catalog_items_history_v2_tenant_policy ON catalog_items_history_v2
-  USING (tenant_id = current_setting('coreloom.tenant_id', true))
-  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+  USING (tenant_id = current_setting('flowdular.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('flowdular.tenant_id', true));
 `;
 
 export const CATALOG_MIGRATION_004_IDEMPOTENCY_LEDGER = `CREATE TABLE IF NOT EXISTS catalog_idempotency_ledger (
@@ -107,8 +107,8 @@ CREATE INDEX IF NOT EXISTS catalog_idempotency_ledger_tenant_operation_idx
 ALTER TABLE catalog_idempotency_ledger ENABLE ROW LEVEL SECURITY;
 ALTER TABLE catalog_idempotency_ledger FORCE ROW LEVEL SECURITY;
 CREATE POLICY catalog_idempotency_ledger_tenant_policy ON catalog_idempotency_ledger
-  USING (tenant_id = current_setting('coreloom.tenant_id', true))
-  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+  USING (tenant_id = current_setting('flowdular.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('flowdular.tenant_id', true));
 `;
 
 export const CATALOG_MIGRATION_005_LIST_INDEXES = `ALTER TABLE catalog_items ADD COLUMN IF NOT EXISTS updated_at BIGINT NOT NULL DEFAULT 0;

package/agent-template/.ai/references/catalog/tests/migrations.test.ts

@@ -90,7 +90,7 @@ describe('catalog migrations', () => {
 			if (!sql.includes('CREATE TABLE')) continue;
 			expect(sql).toContain('ENABLE ROW LEVEL SECURITY');
 			expect(sql).toContain('FORCE ROW LEVEL SECURITY');
-			expect(sql).toContain("current_setting('coreloom.tenant_id', true)");
+			expect(sql).toContain("current_setting('flowdular.tenant_id', true)");
 			expect(sql).toContain('WITH CHECK');
 		}
 	});

package/agent-template/.ai/skills/module-new/SKILL.md

@@ -20,7 +20,7 @@ Two ways to land the same module: the sandbox (a brief, specialist turns, gates
 
 With an approved `schemaVersion: 2` spec, the specification is the requirement document and you do not go looking for one. Read the spec, the files on this skill's touch list, and `.ai/references/catalog` for shape. Do not scan `modules/` or `packages/`; `.ai/platform-capabilities.md` answers what the platform provides, and the reference module answers what the code looks like.
 
-Anything the spec does not say is a spec defect, not a decision you make. A missing field, an unstated conflict behaviour, an undefined state transition, a screen without columns: report it back. In the sandbox that is `HANDOFF: business-manager - <what is missing>`; on a host it is a question to the user. Never fill the gap with a plausible guess, and never implement anything listed in `outOfScope[]`.
+Anything the spec does not say is a spec defect, not a decision you make. A missing field, an unstated conflict behaviour, an undefined state transition, a screen without columns: report it back. In the sandbox that is a `questions` block the operator answers, and the business manager records an answer that changes the spec for a new approval before you continue; on a host it is a question to the user. Never fill the gap with a plausible guess, and never implement anything listed in `outOfScope[]`.
 
 Every `acceptanceScenarios[]` entry maps to at least one test in `tests/`. A scenario with no test is unfinished work, and the scenario id belongs in the test name so the mapping is readable.
 

package/agent-template/.ai/skills/module-update/SKILL.md

@@ -17,7 +17,7 @@ when: A brief names an existing module, or a sandbox session is labelled edit-mo
 
 With an approved `schemaVersion: 2` spec delta, the specification is the requirement document. Read the spec, the module itself, the touch list for the change class below, and `.ai/references/catalog` for shape. Do not scan `modules/` or `packages/`: `.ai/platform-capabilities.md` answers what the platform provides.
 
-Anything the delta does not say is a spec defect, not your decision. Report it back (`HANDOFF: business-manager - <what is missing>` in the sandbox, a question to the user on a host) instead of guessing, and never implement an item the spec parks in `outOfScope[]`. Every new or changed `acceptanceScenarios[]` entry maps to at least one test, with the scenario id in the test name.
+Anything the delta does not say is a spec defect, not your decision. Report it back (a `questions` block in the sandbox, which the business manager turns into a spec delta for a new approval when the answer changes the spec; a question to the user on a host) instead of guessing, and never implement an item the spec parks in `outOfScope[]`. Every new or changed `acceptanceScenarios[]` entry maps to at least one test, with the scenario id in the test name.
 
 The spec-element to file mapping is the table in `module-new`; the change classes below are the same mapping arranged by what you are changing.
 

package/agent-template/.ai/skills/perf-audit/SKILL.md

@@ -99,6 +99,6 @@ Complexity to state in the review: for each new data structure and loop on a req
 ## Pitfalls
 
 - `LIKE` or `=` against `lower(column)` cannot use a plain `(tenant_id, column)` index; store a normalized column (`sku_normalized`) as `.ai/references/catalog` does, or add an expression index on `lower(column)`.
-- `ORDER BY lower(name)` (`Flowdular/official-modules`, `modules/parties`) cannot use the `(tenant_id, name, id)` index for the sort; acceptable at current sizes, name it if parties grow.
+- `ORDER BY lower(name)` cannot use a `(tenant_id, name, id)` index for the sort; acceptable at small sizes, name it once the table grows.
 - A `Kpi` that shows `items.length` after loading the full list is O(rows) network per dashboard load.
 - Never change behaviour in a performance commit; keep the functional tests green and add none that assert internal call counts.

package/agent-template/.claude/skills/module-new/SKILL.md

@@ -14,7 +14,7 @@ Two ways to land the same module: the sandbox (a brief, specialist turns, gates
 
 With an approved `schemaVersion: 2` spec, the specification is the requirement document and you do not go looking for one. Read the spec, the files on this skill's touch list, and `.ai/references/catalog` for shape. Do not scan `modules/` or `packages/`; `.ai/platform-capabilities.md` answers what the platform provides, and the reference module answers what the code looks like.
 
-Anything the spec does not say is a spec defect, not a decision you make. A missing field, an unstated conflict behaviour, an undefined state transition, a screen without columns: report it back. In the sandbox that is `HANDOFF: business-manager - <what is missing>`; on a host it is a question to the user. Never fill the gap with a plausible guess, and never implement anything listed in `outOfScope[]`.
+Anything the spec does not say is a spec defect, not a decision you make. A missing field, an unstated conflict behaviour, an undefined state transition, a screen without columns: report it back. In the sandbox that is a `questions` block the operator answers, and the business manager records an answer that changes the spec for a new approval before you continue; on a host it is a question to the user. Never fill the gap with a plausible guess, and never implement anything listed in `outOfScope[]`.
 
 Every `acceptanceScenarios[]` entry maps to at least one test in `tests/`. A scenario with no test is unfinished work, and the scenario id belongs in the test name so the mapping is readable.
 

package/agent-template/.claude/skills/module-update/SKILL.md

@@ -10,7 +10,7 @@ description: >-
 
 With an approved `schemaVersion: 2` spec delta, the specification is the requirement document. Read the spec, the module itself, the touch list for the change class below, and `.ai/references/catalog` for shape. Do not scan `modules/` or `packages/`: `.ai/platform-capabilities.md` answers what the platform provides.
 
-Anything the delta does not say is a spec defect, not your decision. Report it back (`HANDOFF: business-manager - <what is missing>` in the sandbox, a question to the user on a host) instead of guessing, and never implement an item the spec parks in `outOfScope[]`. Every new or changed `acceptanceScenarios[]` entry maps to at least one test, with the scenario id in the test name.
+Anything the delta does not say is a spec defect, not your decision. Report it back (a `questions` block in the sandbox, which the business manager turns into a spec delta for a new approval when the answer changes the spec; a question to the user on a host) instead of guessing, and never implement an item the spec parks in `outOfScope[]`. Every new or changed `acceptanceScenarios[]` entry maps to at least one test, with the scenario id in the test name.
 
 The spec-element to file mapping is the table in `module-new`; the change classes below are the same mapping arranged by what you are changing.
 

package/agent-template/.claude/skills/perf-audit/SKILL.md

@@ -93,6 +93,6 @@ Complexity to state in the review: for each new data structure and loop on a req
 ## Pitfalls
 
 - `LIKE` or `=` against `lower(column)` cannot use a plain `(tenant_id, column)` index; store a normalized column (`sku_normalized`) as `.ai/references/catalog` does, or add an expression index on `lower(column)`.
-- `ORDER BY lower(name)` (`Flowdular/official-modules`, `modules/parties`) cannot use the `(tenant_id, name, id)` index for the sort; acceptable at current sizes, name it if parties grow.
+- `ORDER BY lower(name)` cannot use a `(tenant_id, name, id)` index for the sort; acceptable at small sizes, name it once the table grows.
 - A `Kpi` that shows `items.length` after loading the full list is O(rows) network per dashboard load.
 - Never change behaviour in a performance commit; keep the functional tests green and add none that assert internal call counts.

package/agent-template/docs/module-distribution.md

@@ -77,8 +77,7 @@ release. No direct registry installation path remains.
 Automation that imported `installModule` from `flowdular/distribution` must use
 the host CLI plan and apply commands; that direct install export was removed.
 
-The old `official-modules` Sandbox delivery target was removed. Change
-`sandbox.delivery.targets` to `workspace` or `git-pr`; `git-pr` points to the
+Sandbox delivery targets are `workspace` and `git-pr`; `git-pr` points to the
 platform repository configured in `flowdular.json`. A catalog publisher can
 use any Git repository and publish immutable artifacts independently. Historical
 review and RFC documents retain the old project name as provenance.

package/agent-template/docs/modules.md

@@ -2,7 +2,7 @@
 
 A module is a self-contained slice of the product: its own permissions,
 endpoints, migrations, services, screens, translations and tests, wired into the
-platform without touching a core file. `.ai/references/catalog` is the pinned reference
+platform without touching a core file. `.ai/references/catalog` is the reference
 implementation; copy its shape.
 
 ## Lifecycle
@@ -419,4 +419,4 @@ RuleSync generates the discovery copies for supported coding agents:
 `test-hardening`, `cli-extension`, `agent-tool-design`,
 `business-agent-design`, `workflow-development`, `release-eject-pr`.
 
-Official business modules are maintained outside core. See [module distribution](module-distribution.md) for install, update, lock verification and release checks.
+Business modules kept outside this repository install through [module distribution](module-distribution.md), which covers install, update, lock verification and release checks.

package/agent-template/docs/sandbox.md

@@ -336,7 +336,13 @@ and a human review remain the repository's own gate.
 ## Decisions the specialist needs
 
 A specialist that cannot continue without a business decision ends its reply
-with one fenced block tagged `questions` holding a single JSON object:
+with one fenced block tagged `questions` holding a single JSON object. An
+implementer (every role but the business manager) asks this way for anything
+the approved specification does not decide, such as a new error code, field,
+permission, state or changed behaviour, and leaves that part unbuilt instead of
+deciding it and mentioning it in prose. Every turn's instruction carries the
+format and the limits below from `questions.ts`, the module that parses the
+block.
 
 ````
 ```questions
@@ -389,8 +395,11 @@ POST /sandbox/api/sessions/:id/answers
 ```
 
 behind the same origin, header and ownership checks as every other mutation. It
-clears `pendingQuestions` and starts the next turn in the role that asked, in
-the module it asked about, with the decisions leading the request text:
+clears `pendingQuestions` and starts the next turn in the module the questions
+were about, with the decisions leading the request text. The business manager's
+own questions go back to it. An implementer's questions go to the business
+manager first (`answeringRole` in `planning.ts`), and so does an answer the
+operator types in the message box instead:
 
 ```
 Decisions:
@@ -406,6 +415,35 @@ INVALID_INPUT` for a body that leaves a question unanswered, names a question
 the session did not ask, exceeds 400 characters, or gives an answer that is not
 one of the offered options when the specialist allowed no free text.
 
+### Answers to an implementer's questions
+
+The business manager applies the answers to `spec/module.yaml`, and the text it
+leaves behind decides what happens next:
+
+- An answer that changes what the module must do is recorded in the
+  specification, which goes back to `draft`. Its hash no longer matches the
+  approval, so the session waits in `awaiting-approval` with the implementer
+  that asked as the next role, and implementation is refused until the operator
+  approves the new hash. Approving resumes that implementer with its decisions.
+- An answer the approved text already decides leaves the file untouched. The
+  approval still holds, and the implementer that asked continues at once with
+  its decisions.
+
+The wait is read from the transcript (`specFollowUp` in `planning.ts`): the
+newest handoff that is not the business manager's own is the implementer's
+question, so the implementer still resumes when the business manager asks a
+question of its own in between. A gate the implementer left failing runs again
+on the business manager's turn. When it still fails, only a repair the business
+manager takes in that module runs first; any other waits until the implementer
+has resumed with its decisions, and the gates run again after that turn.
+
+The `module-rules` gate backs the rule for permissions: `permissions-specified`
+fails a module whose `src/acl/permissions.ts`, or an inline `permission:`
+value, names a permission the specification does not list. Error codes have no
+structured list in a specification and the shipped modules throw many codes
+their specifications never name, so a matching rule for them would fail correct
+modules; the instruction and the question card cover them.
+
 ## Operator commands
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "create-flowdular",
-	"version": "0.6.1",
+	"version": "0.6.3",
 	"type": "module",
 	"description": "Scaffold a Flowdular application: the platform, one example module and the secrets a fresh install needs.",
 	"license": "MIT",

package/template/default/modules/example/package.json

@@ -16,7 +16,7 @@
 	"dependencies": {
 		"octane": "0.9.1",
 		"segment-state": "0.4.0",
-		"@flowdular/sdk": "0.6.1"
+		"@flowdular/sdk": "0.6.3"
 	},
 	"devDependencies": {
 		"@tsrx/typescript-plugin": "0.3.120",

package/template/default/package.json

@@ -22,10 +22,10 @@
 		"build": "flowdular module sync --apply && pnpm --filter @app/platform build"
 	},
 	"devDependencies": {
-		"@flowdular/sandbox": "0.6.1",
+		"@flowdular/sandbox": "0.6.3",
 		"@tsrx/prettier-plugin": "0.3.120",
 		"prettier": "3.6.2",
-		"flowdular": "0.6.1",
+		"flowdular": "0.6.3",
 		"rulesync": "16.21.0"
 	}
 }

package/template/default/platform/package.json

@@ -15,7 +15,7 @@
 		"@octanejs/vite-plugin": "0.2.1",
 		"octane": "0.9.1",
 		"pg": "8.23.0",
-		"@flowdular/sdk": "0.6.1"
+		"@flowdular/sdk": "0.6.3"
 	},
 	"devDependencies": {
 		"@octanejs/app-core": "0.1.1",

package/agent-template/.ai/references/catalog.provenance.json

@@ -1,65 +0,0 @@
-{
-	"id": "catalog.core",
-	"version": "0.8.2",
-	"repository": "Flowdular/official-modules",
-	"sourceCommit": "f38a67718c5a29aba5b5d37c0504430a3c7f565b",
-	"artifactSha256": "149808831d620ac0ebc50abb6b0fb2caef6bec66b5d7821c752ec811e5d9219f",
-	"files": {
-		"LICENSE": "155d722071bad9d0d832482e06fd5a47f7034389cb63aabcb39f4282aa3499fc",
-		"migrations/0001_catalog_core.down.sql": "0962a1edf0bde959cd4facccf77bd5b634d6cc25f125a0c79a61770c8871093f",
-		"migrations/0001_catalog_core.up.sql": "602ed9c1852b729cf278cf8536f79e3f7432f23a5a60c50d8826f5c1b9442d18",
-		"migrations/0002_catalog_history.down.sql": "7f163e11ca9033101e3bb1de61481b1a8043c204e65aa2bb508a13b065e98c78",
-		"migrations/0002_catalog_history.up.sql": "3aa30993b1676cf357c2ef87f19a7d4b64b77041c0e4bc743fced04521471c28",
-		"migrations/0003_catalog_history_service_actors.down.sql": "f20ecc8d7d753af3d2b6fdbff9d637fd938884cfbd88b08a30958e6aa000132b",
-		"migrations/0003_catalog_history_service_actors.up.sql": "7caae787ca2fc1e331ccbfda4df5982beec76136e8dc486aab5532ccd338a722",
-		"migrations/0004_catalog_idempotency_ledger.down.sql": "8ba72d8edc4d25ecf6d041888cf321690c25afdaf3723812ddd7d391d75370aa",
-		"migrations/0004_catalog_idempotency_ledger.up.sql": "41e86ba2051159c6cc9672bfae17c1d02051da975f1c43c566a2b66592673cb0",
-		"migrations/0005_catalog_list_indexes.down.sql": "3dd547d738e75513abef502afc4bf9b51851ec9405b6b719c6134b897c5b1776",
-		"migrations/0005_catalog_list_indexes.up.sql": "dc3ece30b93fba0c91be58f772d1ae421cfbba49439e8c72a06aead6720f5db5",
-		"migrations/README.md": "2a15fd001713c2552a3c82b186246aa5fec136f43143cc2d9aa15bd491a09d41",
-		"module.json": "d2a98b70d60a433e1b3b6547352781048d562b996e3ee961f519d61ee1b623b9",
-		"package.json": "c23a99016f974d183189a05e4cfc4929788a46ae1ad65c623d66513e0880cdbd",
-		"spec/module.yaml": "992953d002574e83374c21e1ee7bef1d451c04b0180892856838d7c67404ce66",
-		"src/acl/permissions.ts": "3375521a5a229736ffac5a948140ec347dc7a7e4fba80e778c0baaf9e0622590",
-		"src/agent/tools.ts": "3403db7954906dc2c79227ba0420b5cb4bfb57063b7cfc285e6e556f16be9266",
-		"src/api/endpoints.ts": "205ef36d058f246f99b77336e7246a23aaca611c696a1f6f09758f66e8a93a29",
-		"src/api/list-cursor.ts": "dcb763edc0128a3aac95e9ca3c5158611a7f2c6a4c71484438c89b7f4d79bb0d",
-		"src/client/CatalogHistoryDrawer.tsrx": "6cdba5249be81e70da703cb34c1a2210943ce5e5fb596ee77cf7952e2acf3ee3",
-		"src/client/CatalogItemForm.tsrx": "d621ac2a513635a5e38ee44726c07926bf035ec5e0dddca487c462cc7913d040",
-		"src/client/CatalogView.tsrx": "2c3e49bb1e54b58d636de0ddbb6ece429acf6aeadb6a0515ab52fca3baabec21",
-		"src/client/api.ts": "eaa55af81d26aa0190d19b3102c363c1ee25b2bdc05436446ac95dcde62aea75",
-		"src/client/contribution.tsrx": "6cbf79e6188bdf24b9cec4a06ae621e03efd5d0c76ad72b28828eee9155ab893",
-		"src/client/index.ts": "03eb0664cdafccb66cb25f2e1b07e6959c2dfa9bdbfffc3e7edf9b535ba4949a",
-		"src/client/navigation-copy.ts": "9a8757e64f4001a93e2bc2861c686a19f791f9d67a396d9e658023b1ec4cea8f",
-		"src/client/state.ts": "61601f6037c4bb8a709b69b10c1a37e59b45b0c941240c436f7861c2b034dcc1",
-		"src/domain/lists.ts": "83749967f99fa0c4f44abc0c614108b844321e50ce6408553215e6233ad6e350",
-		"src/domain/types.ts": "374efeb24c4f7d41e3c660336e721fa362418579837d44a46724076d03287a0b",
-		"src/domain/variables.ts": "131130e57838235b1f3fcb799da44baeae16522bb346d522827e022305c110b5",
-		"src/index.ts": "5b27943018db9a18651d62add7d6f8397d7c492a204381fae74547b99b91990d",
-		"src/platform.ts": "f048082a33c1c688e4952750c762c8b65a4626ff52cc9c4eaca2156014bac631",
-		"src/server/index.ts": "90eae107d863418124e5d10c4d1fe8a119bd14da605b36de708c18d8500c4b5e",
-		"src/server/runtime.ts": "5f4389a6adf8265f6737c489baf686f63cc3550662103d28b2da9800dd9f5b63",
-		"src/services/catalog-service.ts": "66e61dfbd9797d31e6814c18efcd21cfcb7b220f7df22677868f486f3fa0e9d1",
-		"src/services/data-classes.ts": "ea09b1a7def59fee43d57ca7dab6fdb4d646b51df2cacb60af96676c43602b33",
-		"src/services/database-repository.ts": "1b72ce91a2f85f6572825766781a806d94fe0d2abb91872ee9acae3b1e70db2e",
-		"src/services/index.ts": "a08aefe5101814538666f861536287fc382e6c655d62ba9b9ef4bbfbc6ede4af",
-		"src/services/item-export.ts": "b2a4613b43a98d0d41699481bb5e85a770f9a60cb2241579b065effb6936c80b",
-		"src/services/migration.ts": "57c9a857d4074973e14b5e3a1c4548a92ad0faca371419e7daf2334f3ef701ab",
-		"src/services/repository.ts": "9f560033875d05654148b4a11897465ee4eefa0d7fa701439e8f562da9fba1db",
-		"src/services/target-idempotency.ts": "7111b56a30b691eaaaa64f5691895ac94b6e0735b0079794835bbbeba5102cb0",
-		"tests/agent-tools.test.ts": "7762c14bc353ee3085df46a91cf370eb5c25b2edb7096f0a4b0e033f220ea726",
-		"tests/client-state.test.ts": "ea146c793b14d0f9bc5e36d92e92894ced6531b8fcbd11c8be1486b62313b8c3",
-		"tests/data-classes.test.ts": "bea08e4d1d7380ccdebc211374b74a6034714b192fd98bfb90a2218067b35658",
-		"tests/endpoints.test.ts": "a2d700f4c3eb6fbbef5c57ed5591017a27c98e17fe84fba8426fcd3a2820b210",
-		"tests/export.test.ts": "de83066272cee5f7f5736d636d7b9b97dab09778ba661816e401bf926b826402",
-		"tests/idempotency.test.ts": "faea4a2cfa04e81b7155399cba807af4c1ba4448cdfeab733d1afe801d27734f",
-		"tests/list.test.ts": "97605b50020841cbdac62f9d44b65f0f7dce9c4c4972af6409afeb6b9b66e59a",
-		"tests/migrations.test.ts": "fb796aecedb997f6395c2c15e45bf4abfae4677953fa8cb420c94e9cfba8222f",
-		"tests/module.test.ts": "af961a5bcddc41d304d14841f8810976f43f46b46ab7814142fdb921a773e92a",
-		"tests/support/database.ts": "4ff6d093ca2e80baab3dea476018661473d6474db63d67655f1edc667b8472ac",
-		"translations/en.json": "a86d70e02ccf46a2a132d5bee0de7c528c0eb56a85c269a78e0c2e7e0de24e37",
-		"translations/pl.json": "8157d83467e9dd8d9700e2fb188f1a730073f805d2a8b3f0ba98f02f2ca9a264",
-		"tsconfig.json": "140bb4775df421146563d13d2f78ff74cb3c2decab6737db32938339248a92ba",
-		"vitest.config.ts": "d13725b13c3712ec91c1646e9226fb172eec2599f72f4e6608bece9912e2bd81"
-	}
-}