devflow-kit 2.5.0 → 3.0.0

package/src/assets/commands/dynamic-tickets.mds

@@ -8,8 +8,8 @@ output-dir: dist/commands
 @import { ticket_body_template } from "./_partials/_ticket_template.mds"
 @import { factory_shape } from "./_partials/_factory.mds"
 @import { evidence_policy } from "./_partials/_evidence_policy.mds"
-
-{authoring_preamble()}
+@import { docs_root } from "./_partials/_docs_root.mds"
+{{authoring_preamble()}}
 
 ---
 
@@ -17,14 +17,14 @@ output-dir: dist/commands
 
 This command instructs you to construct and run a Claude Code dynamic Workflow that converts an initiative description or specification document into a fully reviewed, wave-structured ticket slate — reusing devflow's agents via `agentType`.
 
-{agent_roster()}
+{{agent_roster()}}
 
-{agent_caveats()}
+{{agent_caveats()}}
 
 ---
 
 **Requires:** initiative description or spec document path; tracker access only for filing the issues, which the Git agent resolves
-**Produces:** ticket `.md` files at `.devflow/docs/tickets/\{slug\}/\{ts\}/`, `tracking-issue.md`
+**Produces:** ticket `.md` files at `{worktree}/.devflow/docs/tickets/{slug}/{ts}/`, `tracking-issue.md`
 
 ---
 
@@ -34,8 +34,8 @@ Before authoring, verify:
 
 1. **Workflow tool available:** if the `Workflow` tool is not in your available tools, STOP and tell the user: "The Workflow tool is not available in this session. dynamic-tickets requires Claude Code's dynamic workflow runtime."
 2. **`agentType` support:** confirmed available (spike F5, 2026-06-11). If spawned agents return no results, check that devflow is installed (`devflow init` has been run).
-3. **Tracker paths:** filing, when it runs, happens after the workflow and through the Git agent, which resolves the configured tracker and its access itself and reports `TRACEABILITY: DEGRADED (\{reason\})` for an issue it cannot file — that ticket stays a local `.md` file. No tracker CLI is checked here.
-4. **No-remote path:** with no remote, the ticket files are still written to `.devflow/docs/tickets/\{slug\}/\{ts\}/`; whatever the Git agent cannot file without one, it reports as DEGRADED.
+3. **Tracker paths:** filing, when it runs, happens after the workflow and through the Git agent, which resolves the configured tracker and its access itself and reports `TRACEABILITY: DEGRADED ({reason})` for an issue it cannot file — that ticket stays a local `.md` file. No tracker CLI is checked here.
+4. **No-remote path:** with no remote, the ticket files are still written to `{worktree}/.devflow/docs/tickets/{slug}/{ts}/`; whatever the Git agent cannot file without one, it reports as DEGRADED.
 
 ---
 
@@ -47,7 +47,11 @@ Before you write the workflow script:
 
 **Produces:** EVIDENCE_POLICY, ISSUE_REQUIRED, APPLY_CONVENTIONS, REQUIRE_NON_AUTHOR_APPROVAL
 
-{evidence_policy()}
+{{evidence_policy()}}
+
+{{docs_root()}}
+
+Pass `{worktree}` to the workflow as its `root` argument.
 
 **1. Apply decisions context**
 
@@ -92,7 +96,8 @@ const constraints = args.constraints || "";
 const DECISIONS_CONTEXT = args.decisionsContext || "";   // injected before authoring
 const slug = args.slug || initiative.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 40);
 const ts = new Date().toISOString().slice(0,16).replace(/[-:T]/g, (c) => c === 'T' ? '_' : c === ':' ? '' : c);
-const OUTDIR = `.devflow/docs/tickets/${slug}/${ts}`;
+const ROOT = args.root;  // {worktree} from Pre-authoring setup: the checkout's toplevel, never cwd
+const OUTDIR = `${ROOT}/.devflow/docs/tickets/${slug}/${ts}`;
 
 // Phase 1: Draft — one Design agent per ticket, all in parallel
 const drafts = await phase("draft", () =>
@@ -194,7 +199,7 @@ The six-phase pipeline above never files an issue. Filing happens here, at the c
 1. **Order and bound.** The tracking issue first, then each ticket file in dependency order: a ticket after every ticket its `**Depends on:**` line names, slate order (the workflow's `ticketPaths`) otherwise. One Git spawn at a time, never in parallel, and at most 50 spawns in all: a file past the cap is reported `not filed (cap 50)`.
 2. **Spawn**, once per file. A ticket's `REQUIREMENTS` opens with the two lines the wave reads from its issue body, each on its own line:
    - `**Wave:** N` — the file's wave number when it is digits only, else no Wave line.
-   - `**Depends on:**` with each entry, a ticket title or file name, replaced by the reference step 3 wrote as that ticket's `**Issue:**` line — comma-separated, or `none`. An entry naming no ticket already filed in this run — unfiled, unknown, or written as a reference — ⇒ `TRACEABILITY: DEGRADED (unresolved dependency "\{entry\}")`, and that ticket is not filed: a dependency is never dropped.
+   - `**Depends on:**` with each entry, a ticket title or file name, replaced by the reference step 3 wrote as that ticket's `**Issue:**` line — comma-separated, or `none`. An entry naming no ticket already filed in this run — unfiled, unknown, or written as a reference — ⇒ `TRACEABILITY: DEGRADED (unresolved dependency "{entry}")`, and that ticket is not filed: a dependency is never dropped.
 
    Its `## Summary` paragraph follows, less any line opening with either label.
 
@@ -203,13 +208,13 @@ Agent(subagent_type="Git"):
 "OPERATION: ensure-traceable-issue
 TASK_DESCRIPTION: {the ticket's title, or the tracking issue's H1}
 REQUIREMENTS: {the ticket's **Wave:** and **Depends on:** lines, then its ## Summary paragraph; or the tracking issue's ## Context}
-PLAN_ARTIFACT_PATH: {the ticket or tracking-issue file path}
-WORKTREE_PATH: {WORKTREE_PATH when provided; omit otherwise}"
+PLAN_ARTIFACT_PATH: {the ticket or tracking-issue file path, relative to {worktree}}
+WORKTREE_PATH: {worktree}"
 ```
 
-3. **Capture** `**Issue**: \{ISSUE_REF\}` and `**Status**:` from the spawn's `## Issue Traced` Output.
-   - `CREATED` or `ENRICHED`, with a reference that matches `^(#[1-9][0-9]\{0,8\}|[A-Z][A-Z0-9_]\{0,9\}-[1-9][0-9]\{0,8\})$` as a whole ⇒ insert `**Issue:** \{ISSUE_REF\}` with the Edit tool: in a ticket file as the line directly after its `**Depends on:**` line, in `tracking-issue.md` as the line directly after its H1. Change nothing else in the file.
-   - A reference of any other shape ⇒ `TRACEABILITY: DEGRADED (issue reference "\{ref\}" does not match any tracker reference grammar)`, and no line.
+3. **Capture** `**Issue**: {ISSUE_REF}` and `**Status**:` from the spawn's `## Issue Traced` Output.
+   - `CREATED` or `ENRICHED`, with a reference that matches `^(#[1-9][0-9]{0,8}|[A-Z][A-Z0-9_]{0,9}-[1-9][0-9]{0,8})$` as a whole ⇒ insert `**Issue:** {ISSUE_REF}` with the Edit tool: in a ticket file as the line directly after its `**Depends on:**` line, in `tracking-issue.md` as the line directly after its H1. Change nothing else in the file.
+   - A reference of any other shape ⇒ `TRACEABILITY: DEGRADED (issue reference "{ref}" does not match any tracker reference grammar)`, and no line.
    - `DEGRADED (rate limited)` ⇒ stop filing: this file and every file after it are reported `not filed`. Any other DEGRADED ⇒ that file gets no line; report it and go on to the next.
 4. **Report** each file's `**Issue:**` reference, or `not filed` and why, with every `TRACEABILITY: DEGRADED` line step 2 and the spawns produced.
 
@@ -221,7 +226,7 @@ WORKTREE_PATH: {WORKTREE_PATH when provided; omit otherwise}"
 
 Every ticket artifact must use this shape:
 
-{ticket_body_template()}
+{{ticket_body_template()}}
 
 ---
 
@@ -229,17 +234,17 @@ Every ticket artifact must use this shape:
 
 The pipeline above implements this general shape:
 
-{factory_shape()}
+{{factory_shape()}}
 
 ---
 
 ### Artifact paths
 
-Tickets → `.devflow/docs/tickets/\{slug\}/\{ts\}/\{ticket-slug\}.md`
+Tickets → `{worktree}/.devflow/docs/tickets/{slug}/{ts}/{ticket-slug}.md`
 
-Tracking issue → `.devflow/docs/tickets/\{slug\}/\{ts\}/tracking-issue.md`
+Tracking issue → `{worktree}/.devflow/docs/tickets/{slug}/{ts}/tracking-issue.md`
 
-Honor the `WORKTREE_PATH` prefix when provided: all artifact paths become `\{WORKTREE_PATH\}/.devflow/docs/tickets/...`.
+`{worktree}` is the docs root resolved in Pre-authoring setup (it honours `WORKTREE_PATH` when provided).
 
 Timestamps follow the devflow `YYYY-MM-DD_HHMM` convention (date and time separated by an underscore, e.g. `2026-06-12_1148`). The `ts` variable in the workflow script generates this format.
 

package/src/assets/commands/explore.mds

@@ -4,7 +4,6 @@ output-dir: dist/commands
 ---
 @import { knowledge_writeback } from "./_partials/_knowledge.mds"
 @import { decisions_load } from "./_partials/_decisions.mds"
-
 # Explore Command
 
 Explore a codebase area by spawning parallel agents for flow tracing, dependency mapping, and pattern analysis. Findings are synthesized into structured output with file:line references, with optional feature knowledge created as a byproduct.
@@ -30,7 +29,7 @@ Explore a codebase area by spawning parallel agents for flow tracing, dependency
 
 **Produces:** DECISIONS_CONTEXT
 
-{decisions_load()}
+{{decisions_load()}}
 
 The orchestrator uses `DECISIONS_CONTEXT` locally when framing exploration — prior decisions and pitfalls suggest specific areas to investigate. Follow `devflow:apply-decisions` to Read full entry bodies on demand. **Do NOT pass `DECISIONS_CONTEXT` to Explore sub-agents** — decisions context stays in the orchestrator, not in the investigation workers.
 
@@ -87,12 +86,12 @@ Present findings to user. Use AskUserQuestion to offer focused follow-up explora
 **Requires:** MERGED_FINDINGS, DECISIONS_CONTEXT
 **Produces:** FEATURE_KNOWLEDGE_STATUS (created | skipped)
 
-1. Check if matching feature knowledge already exists by reading `\{worktree\}/.devflow/features/index.md` (or globbing frontmatter if absent). If covered → skip
-2. Use AskUserQuestion: "No feature knowledge exists for \{explored area\}. Create one to capture these patterns?"
+1. Check if matching feature knowledge already exists by reading `{worktree}/.devflow/features/index.md` (or globbing frontmatter if absent). If covered → skip
+2. Use AskUserQuestion: "No feature knowledge exists for {explored area}. Create one to capture these patterns?"
 3. If user declines → set FEATURE_KNOWLEDGE_STATUS = skipped
 4. If user accepts: proceed with write-back below.
 
-{knowledge_writeback()}
+{{knowledge_writeback()}}
 
 Set FEATURE_KNOWLEDGE_STATUS = created (if agent spawned) or skipped.
 

package/src/assets/commands/implement.mds

@@ -4,11 +4,12 @@ output-dir: dist/commands
 ---
 @import { knowledge_load, knowledge_writeback } from "./_partials/_knowledge.mds"
 @import { decisions_load } from "./_partials/_decisions.mds"
+@import { docs_root } from "./_partials/_docs_root.mds"
 @import { evidence_policy, evidence_exception } from "./_partials/_evidence_policy.mds"
 @import { issue_ref_grammar, issue_capture_contract } from "./_partials/_tracker.mds"
 @import { test_plan_line } from "./_partials/_plan_contract.mds"
 @import { publication_gate } from "./_partials/_publication.mds"
-
+@import "./_partials/_compliance.mds" as compliance
 # Implement Command
 
 Orchestrate a single task through implementation by spawning specialized agents. The orchestrator only spawns agents and passes context - all work is done by agents.
@@ -30,7 +31,7 @@ Orchestrate a single task through implementation by spawning specialized agents.
 - Task description: "implement JWT auth"
 - Empty: use conversation context
 
-{issue_ref_grammar()}
+{{issue_ref_grammar()}}
 
 > **Tip**: For best results, run `/plan` first to produce a design artifact, then pass it to `/implement`.
 
@@ -42,7 +43,7 @@ When the user explicitly asks to re-validate, re-check, or re-run quality gates
 
 1. **Branch safety check**: If on a protected branch (main, master, develop, etc.), run Phase 1 to create/switch to a work branch. If already on a work branch, skip Phase 1.
 2. **Skip Phase 2** — no Code agent needed, user already made changes.
-3. **Detect FILES_CHANGED**: `git diff --name-only \{base_branch\}...HEAD`
+3. **Detect FILES_CHANGED**: `git diff --name-only {base_branch}...HEAD`
 4. **Run Phases 3-8** — full quality gate pipeline on detected changes.
 5. **Proceed to Phase 10** (Create PR), **Phase 10b** (Evidence) and **Phase 11** (Report).
 
@@ -56,7 +57,9 @@ If the user prompt does NOT match re-validation, proceed with the full pipeline
 
 Record the current branch name as `BASE_BRANCH` - this will be the PR target.
 
-{evidence_policy()}
+{{docs_root()}}
+
+{{evidence_policy()}}
 
 **Plan Document Handling** (when $ARGUMENTS is a path ending in `.md`):
 1. Read the plan document from the path provided
@@ -118,33 +121,33 @@ visible, a silently discarded request is not.
 - `BASE_BRANCH`: Branch this feature was created from (for PR target)
 - `ISSUE_NUMBER`: the provider-canonical issue identifier for this task — the same value the Git agent emits as `ISSUE_ID` (if provided, or created by the Git agent's issue-first step in setup-task)
 
-{issue_capture_contract()}
+{{issue_capture_contract()}}
 
 **Ticket link, only when `ISSUE_REQUIRED` is `true`:** when the capture above holds no `ISSUE_PR_LINK` (absent, or `(none)`), ask with AskUserQuestion before any Code spawn — "No tracker issue is linked to this task. Record a self-attested exception, or stop?" — offering exactly these two options:
 - **Record an exception** — the user gives the reason as free text. Render it with the grammar below, as kind `ticket-link`; when the rendered reason is empty, ask for it once more, and stop as below if it is empty again.
-- **Stop** — report `BLOCKED (no ticket link)`, name the branch setup-task created (`TASK_ID`) and `BASE_BRANCH` so it can be reused or removed, and give the remedy: create or link the tracker issue and re-run `/implement` with its reference, or — for a team that does not want ticket links — commit `.devflow/policy.json` as `\{"version":1,"evidencePolicy":"standard"\}` on the default branch; a machine with compliance enabled still resolves `required` whatever that file says. Spawn nothing further.
+- **Stop** — report `BLOCKED (no ticket link)`, name the branch setup-task created (`TASK_ID`) and `BASE_BRANCH` so it can be reused or removed, and give the remedy: create or link the tracker issue and re-run `/implement` with its reference, or — for a team that does not want ticket links — commit `.devflow/project.json` as `{"version":1,"evidence":"standard"}` on the default branch; a machine with compliance enabled still resolves `required` whatever that file says. Spawn nothing further.
 
-{evidence_exception()}
+{{evidence_exception()}}
 
-**Record the exception at once**, before any Code spawn: write the rendered section as the `## Evidence Exceptions` section of `.devflow/docs/handoff-\{branch_slug\}.md`, creating the file if absent, and set `PR_EXCEPTIONS` to that section. The file is its one home until the PR exists: every later write to the file keeps the section byte-identical, every PR-creating Code spawn passes it verbatim as `PR_EXCEPTIONS`, and the file is deleted only once the PR exists — after the PR-creating Phase 2 Code agent under SINGLE_CODE_AGENT and SEQUENTIAL_CODE_AGENTS, after Phase 10 under PARALLEL_CODE_AGENTS. With no exception recorded, `PR_EXCEPTIONS` is `(none)`.
+**Record the exception at once**, before any Code spawn: write the rendered section as the `## Evidence Exceptions` section of `{worktree}/.devflow/docs/handoff-{branch_slug}.md`, creating the file if absent, and set `PR_EXCEPTIONS` to that section. The file is its one home until the PR exists: every later write to the file keeps the section byte-identical, every PR-creating Code spawn passes it verbatim as `PR_EXCEPTIONS`, and the file is deleted only once the PR exists — after the PR-creating Phase 2 Code agent under SINGLE_CODE_AGENT and SEQUENTIAL_CODE_AGENTS, after Phase 10 under PARALLEL_CODE_AGENTS. With no exception recorded, `PR_EXCEPTIONS` is `(none)`.
 
-**Test plan.** Before any Code spawn, give the task a test plan in the evidence file `.devflow/docs/evidence-\{branch_slug\}.md` (`EVIDENCE_FILE`) — unlike the handoff file, it stays after the PR exists. It holds up to three sections, in this order and nothing else: `## Test Plan`; `## Evidence Exceptions`, a byte copy of `PR_EXCEPTIONS` present only while that is not `(none)`; and `## Claims`, always last, so every claim is appended at the end of the file. Create the file if absent; if it exists, replace its `## Test Plan` and `## Evidence Exceptions` sections and keep `## Claims` byte-identical.
+**Test plan.** Before any Code spawn, give the task a test plan in the evidence file `{worktree}/.devflow/docs/evidence-{branch_slug}.md` (`EVIDENCE_FILE`) — unlike the handoff file, it stays after the PR exists. It holds up to three sections, in this order and nothing else: `## Test Plan`; `## Evidence Exceptions`, a byte copy of `PR_EXCEPTIONS` present only while that is not `(none)`; and `## Claims`, always last, so every claim is appended at the end of the file. Create the file if absent; if it exists, replace its `## Test Plan` and `## Evidence Exceptions` sections and keep `## Claims` byte-identical.
 
 Write the `## Test Plan` section: when `$ARGUMENTS` is a plan document with a `## Test Plan` section, copy that section's lines verbatim; otherwise write one TP line per acceptance criterion the plan, the issue or the task text states, numbered from `TP-1`. Never invent a criterion, and word every scenario yourself in plain words: the lines reach the PR body, so a scenario holds no `#`, `@` or `/` — no issue reference, mention, closing keyword target or URL — and the files a TP covers go in its `files:` field. Each line follows the TP-line contract:
 
-{test_plan_line()}
+{{test_plan_line()}}
 
 Check the section:
 
 ```bash
-node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/verify-evidence.cjs" check tp .devflow/docs/evidence-{branch_slug}.md; echo "exit=$?"
+node "$HOME/.devflow/scripts/verify-evidence.cjs" check tp "{worktree}/.devflow/docs/evidence-{branch_slug}.md"; echo "exit=$?"
 ```
 
 `exit=0` passes. On any other result, rewrite the section once — the script names the failing line and its code on stderr — and check again. Still failing, or no line to write, means the test plan is **missing**: drop the `## Test Plan` section from the file.
 
 **Missing test plan, only when `EVIDENCE_POLICY` is `required`:** when the check above leaves the test plan missing, ask with AskUserQuestion before any Code spawn — "No test plan could be written for this task. Record a self-attested exception, or stop?" — offering exactly these two options:
-- **Record an exception** — the user gives the reason as free text. Render it with the exception grammar above, as kind `test-plan`; when the rendered reason is empty, ask for it once more, and stop as below if it is empty again. Add the rendered line to the `## Evidence Exceptions` section of `.devflow/docs/handoff-\{branch_slug\}.md` — after any `ticket-link` line, creating the section and the file when absent — and set `PR_EXCEPTIONS` to that section, under the same rules as the record above.
-- **Stop** — report `BLOCKED (no test plan)`, name `TASK_ID` and `BASE_BRANCH` so the branch can be reused or removed, and give the remedy: state the acceptance criteria in the task, the issue or a `/plan` document (its `## Test Plan` section is copied) and re-run `/implement`, or — for a team that does not want test plans enforced — commit `.devflow/policy.json` as `\{"version":1,"evidencePolicy":"standard"\}` on the default branch; a machine with compliance enabled still resolves `required` whatever that file says. Spawn nothing further.
+- **Record an exception** — the user gives the reason as free text. Render it with the exception grammar above, as kind `test-plan`; when the rendered reason is empty, ask for it once more, and stop as below if it is empty again. Add the rendered line to the `## Evidence Exceptions` section of `{worktree}/.devflow/docs/handoff-{branch_slug}.md` — after any `ticket-link` line, creating the section and the file when absent — and set `PR_EXCEPTIONS` to that section, under the same rules as the record above.
+- **Stop** — report `BLOCKED (no test plan)`, name `TASK_ID` and `BASE_BRANCH` so the branch can be reused or removed, and give the remedy: state the acceptance criteria in the task, the issue or a `/plan` document (its `## Test Plan` section is copied) and re-run `/implement`, or — for a team that does not want test plans enforced — commit `.devflow/project.json` as `{"version":1,"evidence":"standard"}` on the default branch; a machine with compliance enabled still resolves `required` whatever that file says. Spawn nothing further.
 
 When `EVIDENCE_POLICY` is `standard`, a missing test plan is never asked about: carry `Test plan: missing` to the Phase 11 report.
 
@@ -153,19 +156,19 @@ When `EVIDENCE_POLICY` is `standard`, a missing test plan is never asked about:
 - `PR_TEST_PLAN_BLOCK` — when the test plan is present and this render ends in `exit=0`, its stdout byte for byte without that `exit=` line; `(none)` otherwise:
 
 ```bash
-node "${DEVFLOW_DIR:-$HOME/.devflow}/scripts/verify-evidence.cjs" render --plan .devflow/docs/evidence-{branch_slug}.md; echo "exit=$?"
+node "$HOME/.devflow/scripts/verify-evidence.cjs" render --plan "{worktree}/.devflow/docs/evidence-{branch_slug}.md"; echo "exit=$?"
 ```
 
-- `EVIDENCE_FILE` — `.devflow/docs/evidence-\{branch_slug\}.md`, its `## Evidence Exceptions` section now a byte copy of `PR_EXCEPTIONS` (absent when that is `(none)`).
+- `EVIDENCE_FILE` — `{worktree}/.devflow/docs/evidence-{branch_slug}.md`, its `## Evidence Exceptions` section now a byte copy of `PR_EXCEPTIONS` (absent when that is `(none)`).
 
-{publication_gate()}
-Phase 10b passes the resolved value to `update-pr-evidence`, which decides what each value means for the evidence comment.
+{{publication_gate()}}
+Phase 10b passes the resolved value to `update-pr-evidence`, which decides what each value means for the evidence comment. From the same line: {{compliance.compliance_frameworks()}} Pass it to every Code spawn.
 
-{decisions_load()}
+{{decisions_load()}}
 
 Pass to Code agent (Phase 2) and Scrutinize agent (Phase 5).
 
-{knowledge_load()}
+{{knowledge_load()}}
 
 ### Phase 2: Implement
 
@@ -199,10 +202,11 @@ CREATE_PR: true
 DOMAIN: {detected domain or 'fullstack'}
 FEATURE_KNOWLEDGE: {feature_knowledge}
 DECISIONS_CONTEXT: {decisions_context}
+COMPLIANCE_FRAMEWORKS: {COMPLIANCE_FRAMEWORKS}
 PR_DESCRIPTION_GUIDANCE: {pr_description_guidance}
 ISSUE_NUMBER: {ISSUE_ID captured in Phase 1, or (none)}
 ISSUE_PR_LINK: {ISSUE_PR_LINK captured in Phase 1, or (none)}
-PR_EXCEPTIONS: {the ## Evidence Exceptions section of .devflow/docs/handoff-{branch_slug}.md verbatim, or (none)}
+PR_EXCEPTIONS: {the ## Evidence Exceptions section of {worktree}/.devflow/docs/handoff-{branch_slug}.md verbatim, or (none)}
 PR_TEST_PLAN_BLOCK: {PR_TEST_PLAN_BLOCK from Phase 1 verbatim, or (none)}"
 ```
 
@@ -224,11 +228,12 @@ CREATE_PR: false
 DOMAIN: {phase 1 domain, e.g., 'backend'}
 FEATURE_KNOWLEDGE: {feature_knowledge}
 DECISIONS_CONTEXT: {decisions_context}
+COMPLIANCE_FRAMEWORKS: {COMPLIANCE_FRAMEWORKS}
 PR_DESCRIPTION_GUIDANCE: {pr_description_guidance}
 ISSUE_NUMBER: {ISSUE_ID captured in Phase 1, or (none)}
 ISSUE_PR_LINK: {ISSUE_PR_LINK captured in Phase 1, or (none)}
 HANDOFF_REQUIRED: true
-HANDOFF_FILE: .devflow/docs/handoff-{branch_slug}.md"
+HANDOFF_FILE: {worktree}/.devflow/docs/handoff-{branch_slug}.md"
 ```
 
 **Phase 2+ Code agents** (after prior phase completes):
@@ -245,16 +250,17 @@ PRIOR_PHASE_SUMMARY: {summary from previous Code agent}
 FILES_FROM_PRIOR_PHASE: {list of files created}
 FEATURE_KNOWLEDGE: {feature_knowledge}
 DECISIONS_CONTEXT: {decisions_context}
+COMPLIANCE_FRAMEWORKS: {COMPLIANCE_FRAMEWORKS}
 PR_DESCRIPTION_GUIDANCE: {pr_description_guidance}
 ISSUE_NUMBER: {ISSUE_ID captured in Phase 1, or (none)}
 ISSUE_PR_LINK: {ISSUE_PR_LINK captured in Phase 1, or (none)}
-PR_EXCEPTIONS: {the ## Evidence Exceptions section of .devflow/docs/handoff-{branch_slug}.md verbatim, or (none)}
+PR_EXCEPTIONS: {the ## Evidence Exceptions section of {worktree}/.devflow/docs/handoff-{branch_slug}.md verbatim, or (none)}
 PR_TEST_PLAN_BLOCK: {PR_TEST_PLAN_BLOCK from Phase 1 verbatim, or (none)}
 HANDOFF_REQUIRED: {true if not last phase}
-HANDOFF_FILE: .devflow/docs/handoff-{branch_slug}.md"
+HANDOFF_FILE: {worktree}/.devflow/docs/handoff-{branch_slug}.md"
 ```
 
-**Handoff Protocol**: Each sequential Code agent receives the prior Code agent's implementation summary via PRIOR_PHASE_SUMMARY and FILES_FROM_PRIOR_PHASE. The Code agent's built-in branch orientation step handles git log scanning, file reading, and pattern discovery automatically. After each Code agent with HANDOFF_REQUIRED=true completes, write its phase summary to `.devflow/docs/handoff-\{branch_slug\}.md` using the Write tool (survives context compaction), keeping any `## Evidence Exceptions` section byte-identical. Delete `.devflow/docs/handoff-\{branch_slug\}.md` once the PR exists — after the final Code agent, which creates it, completes (cleanup).
+**Handoff Protocol**: Each sequential Code agent receives the prior Code agent's implementation summary via PRIOR_PHASE_SUMMARY and FILES_FROM_PRIOR_PHASE. The Code agent's built-in branch orientation step handles git log scanning, file reading, and pattern discovery automatically. After each Code agent with HANDOFF_REQUIRED=true completes, write its phase summary to `{worktree}/.devflow/docs/handoff-{branch_slug}.md` using the Write tool (survives context compaction), keeping any `## Evidence Exceptions` section byte-identical. Delete `{worktree}/.devflow/docs/handoff-{branch_slug}.md` once the PR exists — after the final Code agent, which creates it, completes (cleanup).
 
 ---
 
@@ -273,6 +279,7 @@ CREATE_PR: false
 DOMAIN: {subtask 1 domain}
 FEATURE_KNOWLEDGE: {feature_knowledge}
 DECISIONS_CONTEXT: {decisions_context}
+COMPLIANCE_FRAMEWORKS: {COMPLIANCE_FRAMEWORKS}
 PR_DESCRIPTION_GUIDANCE: {pr_description_guidance}
 ISSUE_NUMBER: {ISSUE_ID captured in Phase 1, or (none)}
 ISSUE_PR_LINK: {ISSUE_PR_LINK captured in Phase 1, or (none)}"
@@ -287,6 +294,7 @@ CREATE_PR: false
 DOMAIN: {subtask 2 domain}
 FEATURE_KNOWLEDGE: {feature_knowledge}
 DECISIONS_CONTEXT: {decisions_context}
+COMPLIANCE_FRAMEWORKS: {COMPLIANCE_FRAMEWORKS}
 PR_DESCRIPTION_GUIDANCE: {pr_description_guidance}
 ISSUE_NUMBER: {ISSUE_ID captured in Phase 1, or (none)}
 ISSUE_PR_LINK: {ISSUE_PR_LINK captured in Phase 1, or (none)}"
@@ -319,14 +327,15 @@ Run build, typecheck, lint, test. Report pass/fail with failure details."
    - Spawn Code agent with fix context:
    ```
    Agent(subagent_type="Code"):
-   "TASK_ID: \{task-id\}
+   "TASK_ID: {task-id}
    TASK_DESCRIPTION: Fix validation failures
    OPERATION: validation-fix
-   VALIDATION_FAILURES: \{parsed failures from Validate agent\}
+   VALIDATION_FAILURES: {parsed failures from Validate agent}
    SCOPE: Fix only the listed failures, no other changes
    CREATE_PR: false
-   ISSUE_NUMBER: \{ISSUE_ID captured in Phase 1, or (none)\}
-   ISSUE_PR_LINK: \{ISSUE_PR_LINK captured in Phase 1, or (none)\}"
+   ISSUE_NUMBER: {ISSUE_ID captured in Phase 1, or (none)}
+   ISSUE_PR_LINK: {ISSUE_PR_LINK captured in Phase 1, or (none)}
+   COMPLIANCE_FRAMEWORKS: {COMPLIANCE_FRAMEWORKS}"
    ```
    - Loop back to Phase 3 (re-validate)
 4. If `validation_retry_count > 2`: Report failures to user and halt
@@ -421,19 +430,20 @@ Validate alignment with request and plan. Report ALIGNED or MISALIGNED with deta
    - Spawn Code agent to fix misalignments:
    ```
    Agent(subagent_type="Code"):
-   "TASK_ID: \{task-id\}
+   "TASK_ID: {task-id}
    TASK_DESCRIPTION: Fix alignment issues
    OPERATION: alignment-fix
-   MISALIGNMENTS: \{structured misalignments from Evaluate agent\}
+   MISALIGNMENTS: {structured misalignments from Evaluate agent}
    SCOPE: Fix only the listed misalignments, no other changes
    CREATE_PR: false
-   ISSUE_NUMBER: \{ISSUE_ID captured in Phase 1, or (none)\}
-   ISSUE_PR_LINK: \{ISSUE_PR_LINK captured in Phase 1, or (none)\}"
+   ISSUE_NUMBER: {ISSUE_ID captured in Phase 1, or (none)}
+   ISSUE_PR_LINK: {ISSUE_PR_LINK captured in Phase 1, or (none)}
+   COMPLIANCE_FRAMEWORKS: {COMPLIANCE_FRAMEWORKS}"
    ```
    - Spawn Validate agent to verify fix didn't break tests:
    ```
    Agent(subagent_type="Validate", model="haiku"):
-   "FILES_CHANGED: \{files modified by fix Code agent\}
+   "FILES_CHANGED: {files modified by fix Code agent}
    VALIDATION_SCOPE: changed-only"
    ```
    - If Validate agent FAIL: Report to user
@@ -468,19 +478,20 @@ After every Test agent run — PASS or FAIL, first run or retry — append its T
    - Spawn Code agent to fix QA failures:
    ```
    Agent(subagent_type="Code"):
-   "TASK_ID: \{task-id\}
+   "TASK_ID: {task-id}
    TASK_DESCRIPTION: Fix QA test failures
    OPERATION: qa-fix
-   QA_FAILURES: \{structured failures from Test agent\}
+   QA_FAILURES: {structured failures from Test agent}
    SCOPE: Fix only the listed failures, no other changes
    CREATE_PR: false
-   ISSUE_NUMBER: \{ISSUE_ID captured in Phase 1, or (none)\}
-   ISSUE_PR_LINK: \{ISSUE_PR_LINK captured in Phase 1, or (none)\}"
+   ISSUE_NUMBER: {ISSUE_ID captured in Phase 1, or (none)}
+   ISSUE_PR_LINK: {ISSUE_PR_LINK captured in Phase 1, or (none)}
+   COMPLIANCE_FRAMEWORKS: {COMPLIANCE_FRAMEWORKS}"
    ```
    - Spawn Validate agent to verify fix didn't break tests:
    ```
    Agent(subagent_type="Validate", model="haiku"):
-   "FILES_CHANGED: \{files modified by fix Code agent\}
+   "FILES_CHANGED: {files modified by fix Code agent}
    VALIDATION_SCOPE: changed-only"
    ```
    - If Validate agent FAIL: Report to user
@@ -500,7 +511,7 @@ Strategy-conditional: run when the PR already exists — **SINGLE_CODE_AGENT** a
 3. **If NO_PR or NO_CI** → skip: "No PR/CI configured, skipping CI validation." Proceed to Phase 10.
 4. **If PENDING** → poll every 60 seconds (global budget, see step 7). Re-spawn Git agent each poll. If PASSING → proceed. If still PENDING after budget exhausted → report "CI still running — verify manually before merging" and proceed.
 5. **If INDETERMINATE** → poll as PENDING within the same budget. If still INDETERMINATE after budget exhausted → report "CI status unknown — verify manually before merging" and proceed.
-6. **If FAILING** → report failing checks. Spawn `Agent(subagent_type="Code")` to fix CI failures based on check names and failure context. After fix, push and re-check. Max 2 fix attempts. If still failing → report failures and proceed.
+6. **If FAILING** → report failing checks. Spawn `Agent(subagent_type="Code")` with `COMPLIANCE_FRAMEWORKS` to fix CI failures based on check names and failure context. After fix, push and re-check. Max 2 fix attempts. If still failing → report failures and proceed.
 7. **Total budget**: max 10 polls and max 2 fix attempts across all check/fix cycles combined. If budget exhausted, report current status and proceed.
 <!-- /PATTERN: ci-status-gate -->
 
@@ -523,8 +534,9 @@ CREATE_PR: true
 PR_DESCRIPTION_GUIDANCE: {pr_description_guidance}
 ISSUE_NUMBER: {ISSUE_ID captured in Phase 1, or (none)}
 ISSUE_PR_LINK: {ISSUE_PR_LINK captured in Phase 1, or (none)}
-PR_EXCEPTIONS: {the ## Evidence Exceptions section of .devflow/docs/handoff-{branch_slug}.md verbatim, or (none)}
-PR_TEST_PLAN_BLOCK: {PR_TEST_PLAN_BLOCK from Phase 1 verbatim, or (none)}"
+PR_EXCEPTIONS: {the ## Evidence Exceptions section of {worktree}/.devflow/docs/handoff-{branch_slug}.md verbatim, or (none)}
+PR_TEST_PLAN_BLOCK: {PR_TEST_PLAN_BLOCK from Phase 1 verbatim, or (none)}
+COMPLIANCE_FRAMEWORKS: {COMPLIANCE_FRAMEWORKS}"
 ```
 
 Its Responsibility 7 composes the body, pastes `ISSUE_PR_LINK`, `PR_EXCEPTIONS` and `PR_TEST_PLAN_BLOCK` through their paste gates and scrubs the body (D11) before `gh pr create`. This command renders no link line and creates no PR itself: the Git agent's Phase-1 rendering is the only one, forwarded verbatim.
@@ -552,10 +564,11 @@ Agent(subagent_type="Git"):
 PR_NUMBER: {number from PR_URL}
 EVIDENCE_FILE: .devflow/docs/evidence-{branch_slug}.md
 REVIEW_PUBLICATION: {REVIEW_PUBLICATION resolved in Phase 1, or auto}
+WORKTREE_PATH: {worktree}
 Update the PR's test-plan block and post its evidence comment."
 ```
 
-Omit the `EVIDENCE_FILE` line when that file does not exist. Capture the op's `## PR Evidence` block — its `EVIDENCE` line and its `**Body**:` / `**Comment**:` line — as `EVIDENCE_RESULT`, or its `TRACEABILITY: DEGRADED (\{reason\})` line. It never blocks: whatever it returns, continue to Phase 11.
+Omit the `EVIDENCE_FILE` line when that file does not exist. Capture the op's `## PR Evidence` block — its `EVIDENCE` line and its `**Body**:` / `**Comment**:` line — as `EVIDENCE_RESULT`, or its `TRACEABILITY: DEGRADED ({reason})` line. It never blocks: whatever it returns, continue to Phase 11.
 
 ### Phase 11: Report
 
@@ -563,13 +576,13 @@ Omit the `EVIDENCE_FILE` line when that file does not exist. Capture the op's `#
 
 Display completion summary with phase status, PR info, and next steps.
 
-Show the test plan's evidence from Phase 10b: `Test plan: \{VERIFIED-CI + ATTESTED-LOCAL\}/\{total\} verified (VERIFIED-CI \{n\}, ATTESTED-LOCAL \{n\})`, read from the `EVIDENCE` line and never inferred, then its `**Body**:` / `**Comment**:` line verbatim. Without an `EVIDENCE` line, show `Test plan: evidence unavailable`; with no test plan, `Test plan: missing`.
+Show the test plan's evidence from Phase 10b: `Test plan: {VERIFIED-CI + ATTESTED-LOCAL}/{total} verified (VERIFIED-CI {n}, ATTESTED-LOCAL {n})`, read from the `EVIDENCE` line and never inferred, then its `**Body**:` / `**Comment**:` line verbatim. Without an `EVIDENCE` line, show `Test plan: evidence unavailable`; with no test plan, `Test plan: missing`.
 
-If any Git agent output emitted `TRACEABILITY: DEGRADED (\{reason\})` lines during the run, or Phase 10b's push recorded one, surface them verbatim in the report under a `### Traceability` subsection so the user can act on them.
+If any Git agent output emitted `TRACEABILITY: DEGRADED ({reason})` lines during the run, or Phase 10b's push recorded one, surface them verbatim in the report under a `### Traceability` subsection so the user can act on them.
 
 If Phase 1 recorded an evidence exception, show its `## Evidence Exceptions` lines in the report.
 
-{knowledge_writeback()}
+{{knowledge_writeback()}}
 
 ## Architecture