devflow-kit 3.0.1 → 3.1.0

package/dist/cli/commands/proxy.js

@@ -2,11 +2,11 @@
  * devflow proxy — Enable, disable, and check status of external model routing
  * (GPT models via your OpenAI/Codex subscription).
  *
- * applies ADR-013: CLI-layer module; all core logic lives in src/core/proxy-state.ts
+ * CLI-layer module; all core logic lives in src/core/proxy-state.ts
  *   and src/core/agent-models.ts.
- * avoids PF-014: never process.exit() inside a finally-guarded scope; use return
- *   from the async action handler for all early-exit paths.
- * avoids PF-001: hook output strings use fixed templates; port number interpolation
+ * Never process.exit() inside a finally-guarded scope (it would skip the finally);
+ *   use return from the async action handler for all early-exit paths.
+ * Hook output strings use fixed templates; port number interpolation
  *   is acceptable (digit-validated integer, not user-controlled content).
  *
  * Branding note: "subswitch" must NEVER appear in user-visible strings. Internal
@@ -117,7 +117,7 @@ const UNKNOWN_MODEL_WINDOW_ENV = 'CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFOR
  * Mutate a parsed Settings object in place: set ANTHROPIC_BASE_URL to our relay
  * and set UNKNOWN_MODEL_WINDOW_ENV to '1'.
  *
- * D-P4-1: Each condition is evaluated independently (PF-015 — no short-circuit that
+ * D-P4-1: Each condition is evaluated independently (no short-circuit that
  * skips the second write when the first reports no change).
  *
  * Returns true when the object was changed by either assignment.
@@ -127,7 +127,7 @@ function _applyProxyEnvToObject(settings, port) {
     s.env = s.env ?? {};
     const env = s.env;
     const newUrl = proxyBaseUrl(port);
-    // D-P4-1: evaluate each condition independently before combining (avoids PF-015 short-circuit)
+    // D-P4-1: evaluate each condition independently before combining (no short-circuit)
     const urlChanged = env.ANTHROPIC_BASE_URL !== newUrl;
     const windowVarChanged = env[UNKNOWN_MODEL_WINDOW_ENV] !== '1';
     env.ANTHROPIC_BASE_URL = newUrl;
@@ -149,8 +149,8 @@ function _applyProxyEnvToObject(settings, port) {
  *   - uninstall     → proxy.json.port (or DEFAULT_PROXY_PORT)
  *
  * D-P4-1: URL ownership gates the URL delete only; the window var is always ours to
- * remove (applies PF-015, ADR-003). Each outcome is evaluated into a local and OR-ed
- * afterwards — never short-circuit composed inline (PF-015).
+ * remove. Each outcome is evaluated into a local and OR-ed
+ * afterwards — never short-circuit composed inline.
  *
  * Returns true when the object was changed by either deletion.
  */
@@ -163,7 +163,7 @@ function _stripProxyEnvFromObject(settings, managedPort) {
     // managed the proxy — `proxyJsonExists()` — and the enable caller is taking ownership
     // of the key anyway, so reaching this line means the value is Devflow's to remove.
     // Removal is therefore unconditional: unlike ANTHROPIC_BASE_URL (port-scoped below),
-    // this key has no foreign value to protect. (applies PF-015, ADR-003)
+    // this key has no foreign value to protect.
     const hadWindowVar = env[UNKNOWN_MODEL_WINDOW_ENV] !== undefined;
     delete env[UNKNOWN_MODEL_WINDOW_ENV];
     let removedUrl = false;
@@ -174,7 +174,7 @@ function _stripProxyEnvFromObject(settings, managedPort) {
     }
     if (Object.keys(env).length === 0)
         delete s.env;
-    return removedUrl || hadWindowVar; // OR the locals — never compose with || inline (PF-015)
+    return removedUrl || hadWindowVar; // OR the locals — never compose with || inline
 }
 // ─── Pure env functions (exported for testing and cross-module reuse) ─────────
 /**
@@ -234,7 +234,7 @@ export function readProxyEnvState(settingsJson, port) {
  */
 export function addProxyHooks(settings, devflowDir) {
     const command = runHookCommand(devflowDir, PROXY_HOOK_MARKER);
-    // Evaluate each event into its own local — never short-circuit (PF-015).
+    // Evaluate each event into its own local — never short-circuit.
     const [addedSession, addedPrompt] = PROXY_HOOK_EVENTS.map((event) => ensureHook(settings, event, isProxyHook, { hooks: [{ type: 'command', command, timeout: 15 }] }));
     return addedSession || addedPrompt;
 }
@@ -246,7 +246,7 @@ export function addProxyHooks(settings, devflowDir) {
  * Mutates settings in place. Returns true when any hook was removed.
  */
 export function removeProxyHooks(settings) {
-    // Evaluate each event into its own local — never short-circuit (PF-015).
+    // Evaluate each event into its own local — never short-circuit.
     const [removedSession, removedPrompt] = PROXY_HOOK_EVENTS.map((event) => removeHooks(settings, event, isProxyHook));
     return removedSession || removedPrompt;
 }
@@ -503,7 +503,7 @@ export async function realHttpGet(url, timeoutMs) {
 /** Production doctor subprocess implementation. */
 async function realSpawnDoctor(binPath, env, timeoutMs, logFile) {
     // openProxyLog: 0700 parent dir + 0600 file creation + best-effort chmod for
-    // pre-existing wider modes (SEC-2). Non-fatal on chmod failure per PF-009.
+    // pre-existing wider modes (SEC-2). Non-fatal on chmod failure.
     const logFd = await openProxyLog(logFile);
     try {
         return await new Promise((resolve) => {
@@ -558,7 +558,7 @@ async function realSpawnDoctor(binPath, env, timeoutMs, logFile) {
  * Centralises the three private implementations so both runEnable and init.ts
  * can consume them without byte-identical inline copies.
  *
- * applies ADR-013: pure configuration factory; I/O implementations factored once.
+ * Pure configuration factory; I/O implementations factored once.
  */
 export function buildRealPreflightDeps(opts) {
     const { settingsPath, onWarn, swallowSettingsReadError = false } = opts;
@@ -599,7 +599,7 @@ export function buildRealPreflightDeps(opts) {
  *   - OS-level spawn error (EMFILE, ENOMEM, EAGAIN) — always handled via the
  *     injected onError callback, never an uncaught exception
  *
- * avoids PF-014: no process.exit() — returns Result; caller decides error handling.
+ * No process.exit() — returns Result; caller decides error handling.
  */
 export async function spawnRelayAndWaitForPort(port, binPath, configPath, logPath, pidPath, adopted, deps) {
     if (adopted) {
@@ -784,7 +784,7 @@ async function applyEnableSettingsPass(settingsPath, devflowDir, port) {
  *   -n  no host-name resolution  -P  no port-name resolution
  *   -sTCP:LISTEN  only LISTEN-state sockets  -t  PIDs only
  *
- * avoids PF-001: fixed argument array — port is validated as a safe integer
+ * Fixed argument array — port is validated as a safe integer
  *   by the caller before this function is invoked; it is never interpolated
  *   into a shell string.
  *
@@ -855,8 +855,8 @@ async function readPidFile(pidPath) {
  *
  * applies D-EFR-5: signal 0 and health check are independent facts; lsof
  *   binds the pid-file PID to the port owner before any signal is sent.
- * avoids PF-009: all sub-operations are non-fatal; a kill failure never aborts disable.
- * avoids PF-014: never process.exit() inside a finally-guarded scope.
+ * All sub-operations are non-fatal; a kill failure never aborts disable.
+ * Never process.exit() inside a finally-guarded scope (it would skip the finally).
  *
  * @param deps  Optional injectable dependencies (default: real lsof implementation).
  *              Provide a stub in tests to exercise every branch without a real binary.
@@ -1211,7 +1211,7 @@ async function runStatus() {
         }
     }
     // External models registry (cache-only, zero spawns — avoids multi-second silent pause in --status)
-    const cacheDir = modelCacheDir(devflowDir); // authoritative path from cache.ts (avoids PF-013)
+    const cacheDir = modelCacheDir(devflowDir); // authoritative path from cache.ts
     const catalog = getExternalModelsCached(cacheDir);
     p.log.info(formatExternalModelsLine(catalog, logPath));
     // Log path
@@ -1236,7 +1236,7 @@ async function runEnable(portOption) {
     const configPath = path.join(devflowDir, 'proxy-routing.json');
     const logPath = path.join(devflowDir, 'logs', 'proxy.log');
     const pidPath = path.join(devflowDir, 'proxy.pid');
-    const cacheDir = modelCacheDir(devflowDir); // authoritative path from cache.ts (avoids PF-013)
+    const cacheDir = modelCacheDir(devflowDir); // authoritative path from cache.ts
     // Step 1: Read prior proxy.json (remembered port); --port flag overrides
     const priorStateResult = await readProxyState(devflowDir);
     const priorPort = priorStateResult.ok ? priorStateResult.value.port : DEFAULT_PROXY_PORT;
@@ -1260,7 +1260,7 @@ async function runEnable(portOption) {
     await rotateProxyLogIfLarge(logPath);
     // Read existing routing config to preserve user-added anthropic/limits/logLevel/providers
     // blocks. A missing or malformed file falls back to clean defaults inside
-    // buildRoutingConfigJson (non-fatal; avoids PF-009).
+    // buildRoutingConfigJson (non-fatal).
     let existingRoutingContent;
     try {
         existingRoutingContent = await fs.readFile(configPath, 'utf-8');
@@ -1389,7 +1389,7 @@ async function runEnable(portOption) {
     s.message('Warming model cache...');
     await discoverExternalModels(cacheDir, logPath).catch(() => { });
     s.stop(color.green('External model routing enabled'));
-    // D-P4-1 / PF-022: applies-on-restart — env var takes effect only for new sessions
+    // D-P4-1: applies-on-restart — env var takes effect only for new sessions
     p.log.info(color.dim('Context-window enforcement disabled for relay-routed models — applies to new Claude Code sessions'));
     if (adopted) {
         p.log.info(`Relay already running on port ${port} — adopted`);
@@ -1476,7 +1476,7 @@ async function runDisable() {
     p.log.success('External model routing disabled');
     // Step 5: Terminate the relay process.
     // Identity is confirmed via TCP + health before signalling — a recycled PID
-    // must never be killed. avoids PF-009: all sub-operations are non-fatal.
+    // must never be killed. All sub-operations are non-fatal.
     const spawnLockPath = path.join(devflowDir, '.proxy-spawn.lock');
     const terminateResult = await terminateRelay(pidPath, spawnLockPath, managedPort);
     switch (terminateResult) {

package/dist/cli/commands/rules.js

@@ -114,7 +114,7 @@ async function printRulesList(claudeDir, devflowDir) {
  * Returns which tier seeded: 'installed' | 'source' | 'none'.
  * Creates the shadow directory before copying.
  *
- * D35 — seedRuleShadow tiers (applies ADR-010):
+ * D35 — seedRuleShadow tiers:
  *   Tier 1 — installed rule at rulesTarget/{name}.md (fastest path when rules are enabled).
  *             SKIPPED for FEATURE_OWNED_RULES: the installed file is already stamped
  *             (${DEVFLOW_COMPLIANCE_FRAMEWORKS} replaced with label text), so seeding from
@@ -198,9 +198,10 @@ async function handleRuleUnshadow(name, allRules, devflowDir) {
  * Compliance convergence runs unconditionally — convergeComplianceArtifacts handles the
  * disabled case by removing stale artifacts, so no enabled-gate is needed here. Running
  * converge regardless of the rules-install outcome ensures that a rules-install failure
- * cannot leave compliance artifacts in a half-converged state (avoids PF-015 violation).
+ * cannot leave compliance artifacts in a half-converged state.
  *
- * Applies PF-009: warn-not-throw on per-item compliance convergence failure.
+ * Warn-not-throw on per-item compliance convergence failure, so a convergence
+ * failure never undoes the rules install.
  */
 export async function runRulesEnable(claudeDir, devflowDir) {
     const rulesTarget = path.join(claudeDir, 'rules', 'devflow');
@@ -241,7 +242,7 @@ export async function runRulesEnable(claudeDir, devflowDir) {
     // disabled case itself (removes stale artifacts). Running this regardless of installFailed
     // prevents a rules-install failure from leaving the compliance rule in a stale state.
     // rulesEnabledOverride reflects the actual settled state: false when install failed so the
-    // compliance rule is not installed into a wiped, rules-disabled directory (avoids PF-015).
+    // compliance rule is not installed into a wiped, rules-disabled directory.
     try {
         await convergeFromManifest({
             claudeDir,
@@ -252,7 +253,7 @@ export async function runRulesEnable(claudeDir, devflowDir) {
         });
     }
     catch (err) {
-        // PF-009: warn-not-abort — compliance convergence failure does not undo rules install
+        // Warn-not-abort — compliance convergence failure does not undo rules install
         p.log.warn(`Compliance rule convergence failed — rules installed but compliance rule may be stale: ${err instanceof Error ? err.message : String(err)}`);
     }
 }

package/dist/cli/commands/tracker-prompts.js

@@ -1,13 +1,13 @@
 /**
  * Tracker prompt helpers for devflow init.
  *
- * CLI-layer module (ADR-013): prompt-rendering logic lives in src/cli/commands/,
+ * CLI-layer module: prompt-rendering logic lives in src/cli/commands/,
  * core business logic stays in src/core/tracker.ts.
  *
- * avoids PF-029: the wizard gate keys on `modePromptShown` (was the Setup-mode
+ * The wizard gate keys on `modePromptShown` (was the Setup-mode
  * p.select prompt actually shown?), never on the mode name, so --recommended
  * (flag, no prompt) and the non-TTY fallback preserve their promptless contracts.
- * avoids PF-014: runTrackerStep never calls process.exit() or throws — callers
+ * runTrackerStep never calls process.exit() or throws — callers
  * own the cancel idiom (p.cancel + process.exit(0)), keeping try/finally safe.
  * The shared DI seam (PromptOutcome, WizardPromptIO, clackNote, clackSelect) is
  * defined once in prompt-io.ts and imported here, never re-declared.
@@ -55,7 +55,7 @@ export function formatTrackerSummary(provider) {
 /**
  * Determines whether the tracker wizard step should run for a given init invocation.
  *
- * Gate table (per PF-029: key on modePromptShown, never on the mode name):
+ * Gate table (key on modePromptShown, never on the mode name):
  *
  *   --recommended flag / !isTTY fallback             → no (promptless contract preserved)
  *   Interactive mode-prompt → Recommended            → yes (modePromptShown=true)
@@ -102,14 +102,14 @@ export function buildClackTrackerPrompts() {
  *   1. Note — "Current setting: …" header then the provider catalogue.
  *   2. Provider select — labelled GitHub / Jira / Linear with hints, seeded from
  *      the prior state. `p.select`, never `p.confirm`: Enter-through must be an
- *      INFORMED keep of a named provider, not a y/N reflex (PF-029).
+ *      INFORMED keep of a named provider, not a y/N reflex.
  *
  * Returns:
  *   {kind:'resolved', state, messages} — step completed; `state` is the chosen
  *     TrackerFeatureState; `messages` are emitted by the caller.
  *   {kind:'cancelled'} — user pressed Escape; caller runs p.cancel + process.exit(0).
  *
- * Invariants (PF-014):
+ * Invariants:
  *   - Never calls process.exit(), never throws.
  *   - The returned state is always a fresh object, never the seed.
  *   - All I/O is routed through the `prompts` parameter (injectable for tests).

package/dist/cli/commands/tracker.js

@@ -3,19 +3,19 @@
  *
  * D-TRACKER-PAIR [DR-25]: `src/core/tracker.ts` (domain) +
  *   `src/cli/commands/tracker.ts` (CLI) mirrors the `compliance.ts` pair
- *   exactly; ADR-013's pure-core / I/O-target split is the reason both names
- *   exist. A reviewer meeting several `tracker*` files in one commit otherwise
- *   has no signal that the duplication is deliberate.
+ *   exactly; the split of pure core logic (src/core/) from the I/O layer is the
+ *   reason both names exist. A reviewer meeting several `tracker*` files in one
+ *   commit otherwise has no signal that the duplication is deliberate.
  *
- * Applies ADR-013: CLI-layer module; the provider domain, the strict parser and
+ * CLI-layer module; the provider domain, the strict parser and
  *   the ~/.devflow file lifecycle all live in src/core/tracker.ts.
  * The manifest holds the MACHINE default. A repository may select its own
  *   provider in its committed `.devflow/project.json` (resolved by
  *   resolve-settings.cjs); `--status` names it on an `Effective:` line when one
  *   does, and `--set` never touches it.
- * Avoids PF-015: --set converges the sentinel in BOTH directions, so flipping
+ * --set converges the sentinel in BOTH directions, so flipping
  *   back to github removes what flipping away wrote.
- * Avoids PF-009: a failed re-arm or sentinel step warns, it never aborts.
+ * A failed re-arm or sentinel step warns, it never aborts.
  */
 import { Command } from 'commander';
 import { promises as fs } from 'fs';
@@ -31,7 +31,7 @@ import { prefixSkillName } from '../../core/plugins.js';
 /**
  * Read the provenance header of `~/.devflow/tracker/{provider}.md`.
  *
- * Never throws (PF-014): an absent, unreadable, or non-regular path is `absent`.
+ * Never throws: an absent, unreadable, or non-regular path is `absent`.
  * Only the bounded head of the file is read and only the leading frontmatter
  * block is scanned — through the one frontmatter parser the migration also uses —
  * and nothing read here is trusted: every value is rendered through
@@ -52,7 +52,7 @@ export async function readTrackerProvenance(devflowDir, provider) {
  * every install carries them all (D-INSTALL-ALL-PROVIDERS) — rather than listing
  * the directory: the question a user asks `--status` is "can the agent load what
  * it is told to load?", and a stray file in the tree is not an answer to it.
- * Never throws (PF-014).
+ * Never throws.
  */
 export async function readTrackerMechanics(claudeDir) {
     const root = path.join(claudeDir, 'skills', prefixSkillName(SKILL_REFS_SKILL_NAME), 'references');
@@ -227,7 +227,7 @@ export const trackerCommand = new Command('tracker')
         // undocumented dotfile. Every other --status in this CLI is a pure read,
         // so this one reports the write it makes as a line of the note below — a
         // machine-state change the output does not mention is a change the user
-        // cannot audit. Non-fatal exactly as on the --set path (avoids PF-009): a
+        // cannot audit. Non-fatal exactly as on the --set path: a
         // failed re-arm warns, it never aborts the report the user asked for.
         const statusRearm = await rearmTrackerInference(devflowDir);
         const inference = statusRearm.ok

package/dist/cli/commands/uninstall.js

@@ -178,7 +178,7 @@ export function formatDryRunPlan(assets) {
  *   - "prompt"  — interactive (isTTY=true); caller should ask the user
  *
  * @D1 Non-interactive-preserve invariant: when isTTY is false the result is
- * always "preserve", never "prompt" — avoids PF-004 half-applied-state hazard.
+ * always "preserve", never "prompt" — avoids a half-applied-state hazard.
  */
 export function resolveSecurityRemovalDecision(opts) {
     if (!opts.anySecurityPresent || opts.keepDocs)
@@ -193,7 +193,7 @@ export function resolveSecurityRemovalDecision(opts) {
  *
  * A cancel (user presses Ctrl-C on this prompt) is treated as decline: the
  * .devflow/ directory is preserved and the uninstall continues with the remaining
- * steps rather than aborting via process.exit() (applies PF-014, applies ADR-003).
+ * steps rather than aborting via process.exit().
  *
  * PURE — no I/O, fully testable.
  *
@@ -233,8 +233,8 @@ export function partitionProjectData(entries) {
  * realpaths, so macOS's `/var` → `/private/var` and a symlinked HOME still match.
  *
  * A `.devflow` that is a symbolic link to anywhere else is skipped too, and never
- * followed: its target is a directory devflow cannot prove it wrote (applies
- * ADR-024), so a confirmed cleanup must not empty it — nor unlink a link the user made.
+ * followed: its target is a directory devflow cannot prove it wrote, so a
+ * confirmed cleanup must not empty it — nor unlink a link the user made.
  */
 export async function resolveProjectDataPlan(opts) {
     if (opts.gitRoot === null)
@@ -320,9 +320,9 @@ export function formatProjectDataPlan(plan) {
  * @D5 Precondition guard: any anomalous devflowDir falls back to 'artifacts-only' rather
  * than throwing — business logic must not throw (engineering rule). The explicit guard
  * makes the invariant present in production code, not only in tests (reliability rule).
- * @D6 avoids PF-014: the caller must NOT process.exit() after a cancel/decline response;
+ * @D6 The caller must NOT process.exit() after a cancel/decline response;
  * removeAllDevFlow has already run by the time the prompt fires, so removeDevFlowInstallArtifacts
- * must execute on every non-confirm path to leave a clean end-state (applies ADR-003).
+ * must execute on every non-confirm path to leave a clean end-state.
  * @D7 keepDocs gate: when the caller passes --keep-docs, the entire ~/.devflow dir cleanup
  * prompt is suppressed — artifacts-only regardless of isTTY or userContent. This prevents
  * --keep-docs from triggering prompts about skill shadows or preference-profile.md.
@@ -517,7 +517,7 @@ export function installArtifactPaths(devflowDir) {
         { relPath: 'agent-models.json' },
         // cost history — auto-generated session telemetry, not user-authored.
         // The whole costs/ tree is removed so sessions/ and archive.jsonl cannot
-        // drift from their write sites in src/hud/cost-history.ts (avoids PF-013).
+        // drift from their write sites in src/hud/cost-history.ts.
         { relPath: 'costs', isDir: true },
         // proxy artifacts
         { relPath: 'proxy.json' },
@@ -545,7 +545,7 @@ export function installArtifactPaths(devflowDir) {
         { relPath: 'logs', isDir: true },
         // Model-discovery + HUD component caches. hudCacheDir() is the authoritative
         // accessor for the cache/ parent (modelCacheDir() resolves beneath it), so the
-        // removal site stays byte-locked to the write sites (avoids PF-013).
+        // removal site stays byte-locked to the write sites.
         { relPath: path.relative(devflowDir, hudCacheDir(devflowDir)), isDir: true },
     ];
 }
@@ -579,7 +579,7 @@ export async function removeDevFlowInstallArtifacts(devflowDir, verbose) {
     catch (error) {
         p.log.warn(`Could not remove manifest.json: ${error}`);
     }
-    // Proxy install artifacts — remove non-fatally (per-item failure isolation, avoids PF-009)
+    // Proxy install artifacts — remove non-fatally (per-item failure isolation)
     // Inform the user if a proxy relay process is still running (never kill — informational only).
     try {
         const pidContent = await fs.readFile(path.join(devflowDir, 'proxy.pid'), 'utf-8');
@@ -594,7 +594,7 @@ export async function removeDevFlowInstallArtifacts(devflowDir, verbose) {
         }
     }
     catch { /* proxy.pid absent or unreadable — non-fatal */ }
-    // All install artifacts removed non-fatally (avoids PF-009). Resolved against
+    // All install artifacts removed non-fatally. Resolved against
     // disk first, so a per-run staging basename is a real path by the time the
     // containment guard below sees it.
     for (const artifact of await resolveInstallArtifactPaths(devflowDir)) {
@@ -654,7 +654,7 @@ export async function isDevFlowInstalled(claudeDir) {
  * scope directories, intersected with what actually exists on disk.
  *
  * Extracted from the dry-run loop body so the enumeration logic is
- * independently testable (avoids PF-018: tests must exercise the production
+ * independently testable (tests must exercise the production
  * path, not only the pure helper functions).
  *
  * Coverage matches removeAllDevFlow exactly:
@@ -664,7 +664,7 @@ export async function isDevFlowInstalled(claudeDir) {
  *      - Prefixed (devflow:name): live registry ∪ LEGACY_SKILL_NAMES.
  *      - Bare (name or devflow-name legacy): LEGACY_SKILL_NAMES ONLY.
  *        ~/.claude/skills/ is shared; bare dirs for live-registry skill names
- *        are by construction foreign to Devflow (avoids PF-012).
+ *        are by construction foreign to Devflow.
  *   3. manifest.json (removed separately in removeDevFlowInstallArtifacts).
  *   4. Every artifact path from installArtifactPaths(devflowDir) — the single
  *      source of truth shared with the real removal loop.
@@ -688,7 +688,7 @@ export async function enumerateDryRunExtras(claudeDir, devflowDir) {
         catch { /* absent */ }
     }
     // 2. Skills: enumerate ALL removal candidates that exist on disk.
-    // Mirrors removeAllDevFlow's split-pass approach (avoids PF-012 + PF-018):
+    // Mirrors removeAllDevFlow's split-pass approach:
     //   Prefixed: live registry ∪ LEGACY_SKILL_NAMES ∪ FEATURE_OWNED_SKILLS
     //   Bare: LEGACY_SKILL_NAMES only — shared skills/ dir; live-registry bare
     //         dirs are by construction foreign to Devflow.
@@ -923,7 +923,7 @@ export async function runFullPhaseForScope(opts) {
             });
             if (p.isCancel(confirmFullCleanup)) {
                 // removeAllDevFlow already ran — clean up the manifest to leave a consistent
-                // state. avoids PF-014: process.exit() here would skip removeDevFlowInstallArtifacts,
+                // state. process.exit() here would skip removeDevFlowInstallArtifacts,
                 // leaving a stale manifest.json that points to assets no longer on disk.
                 await removeDevFlowInstallArtifacts(devflowDir, verbose);
                 p.log.info(`${devflowDir} preserved (full removal cancelled; removing scripts and install artifacts only)`);
@@ -945,7 +945,7 @@ export async function runFullPhaseForScope(opts) {
  *
  * D-UNINSTALL-CARVE-OUT: DEVFLOW_TRACKED_PATHS are never removed. `--keep-docs`,
  * a non-interactive run, a decline and a cancel all leave the directory untouched,
- * and a cancel continues the uninstall rather than exiting (avoids PF-014). The
+ * and a cancel continues the uninstall rather than exiting. The
  * directory itself is removed only when nothing tracked was in it.
  */
 async function runProjectDataStep(plan, gates) {
@@ -1412,7 +1412,7 @@ export async function removeAllDevFlow(claudeDir, devflowScriptsDir, verbose) {
     }
     // Remove Devflow skill directories.
     // ~/.claude/skills/ is shared with other tools; the two passes use different
-    // name sets to avoid deleting foreign dirs (avoids PF-012):
+    // name sets to avoid deleting foreign dirs:
     //
     //   Prefixed pass (devflow:name): live registry ∪ LEGACY_SKILL_NAMES ∪ FEATURE_OWNED_SKILLS.
     //     prefixSkillName() is idempotent for already-prefixed legacy entries.
@@ -1421,7 +1421,7 @@ export async function removeAllDevFlow(claudeDir, devflowScriptsDir, verbose) {
     //   Bare pass (name or devflow-name legacy): LEGACY_SKILL_NAMES ONLY.
     //     A bare dir whose name matches a live-registry skill is by construction
     //     foreign to Devflow (the devflow: namespace shipped in dcecda3, 2026-03-30).
-    //     A bare 'compliance/' dir is also foreign (not in LEGACY_SKILL_NAMES) — PF-012.
+    //     A bare 'compliance/' dir is also foreign (not in LEGACY_SKILL_NAMES).
     const prefixedSkillNames = new Set([...getAllSkillNames(), ...LEGACY_SKILL_NAMES, ...FEATURE_OWNED_SKILLS]);
     const skillsDir = path.join(claudeDir, 'skills');
     let skillsRemoved = 0;
@@ -1472,7 +1472,7 @@ export async function removeAllDevFlow(claudeDir, devflowScriptsDir, verbose) {
  * cleaned up promptly rather than accumulating on disk.
  *
  * knownNames spans ALL plugins for each asset type so assets belonging to
- * plugins NOT being uninstalled are never swept (avoids PF-012).
+ * plugins NOT being uninstalled are never swept.
  *
  * Removals are announced only under `verbose`, but removal FAILURES always warn:
  * a swept-but-not-actually-removed agent or command keeps loading in Claude Code,
@@ -1546,7 +1546,7 @@ export async function removeSelectedPlugins(claudeDir, plugins, verbose, install
         // exclusively by the frozen LEGACY_SKILL_NAMES pass in removeAllDevFlow and
         // in init.ts; live-registry skills never had bare installs (the devflow:
         // namespace shipped in dcecda3, 2026-03-30), so a bare dir for a current
-        // registry name is by construction foreign (avoids PF-012).
+        // registry name is by construction foreign.
         try {
             await fs.rm(path.join(skillsDir, prefixSkillName(skill)), { recursive: true, force: true });
         }
@@ -1568,7 +1568,7 @@ export async function removeSelectedPlugins(claudeDir, plugins, verbose, install
     // Registry-diff sweep: agents, commands, AND skills — named step (A6).
     // Removes any orphaned files whose names left the registry (retired, renamed,
     // or deleted from all plugins). Spans ALL plugins so assets belonging to
-    // non-selected plugins are never swept (avoids PF-012).
+    // non-selected plugins are never swept.
     await sweepDevflowNamespaces(claudeDir, verbose);
 }
 //# sourceMappingURL=uninstall.js.map

package/dist/cli/flags-view/render.js

@@ -1,8 +1,8 @@
 /**
  * Pure TUI frame renderer for the devflow flags view.
  *
- * applies ADR-013: CLI-layer view module; zero fs/tty imports.
- * avoids PF-014: pure function, no process.exit(), no I/O.
+ * CLI-layer view module; zero fs/tty imports.
+ * Pure function, no process.exit(), no I/O.
  *
  * Layout (FIXED_ROWS = 10, viewport = state.viewportHeight — single owner):
  *   1  Title "  Devflow Flags"
@@ -59,14 +59,14 @@ export function computeViewportHeight(termRows) {
  *   non-boolean at devflow default → plain string
  *   non-boolean deviating from devflow default → bold string
  *
- * Colour vocabulary (one colour, one semantic — applies ADR-016's amendment lesson):
+ * Colour vocabulary (one colour, one semantic):
  *   cyan   = focus indicator (chevron wrapper ‹ › on the cursor row only)
  *   yellow = dirty indicator (unconditional ●) and boolean 'off'
  *   green  = boolean 'on'
  *   bold   = non-boolean value deviating from devflow default
  *
  * disk-sourced values are routed through sanitizeCell to prevent TAB/LF
- * layout breaks inside the fixed-width TUI cell (avoids PF-023).
+ * layout breaks inside the fixed-width TUI cell.
  */
 function formatValue(row) {
     const v = row.configuredValue;
@@ -151,7 +151,7 @@ function renderRow(row, isCursor, isEditing, editBuffer, editCaret, labelW, valu
     // so an inner RESET (e.g. from green('on')) does not kill the outer cyan.
     //   cyan('‹ ') + <styled-or-plain content> + cyan(' ›')
     // rather than cyan(`‹ ${content} ›`), which terminates the outer cyan at the
-    // inner RESET, leaving the closing chevron unstyled (applies ADR-016 amendment lesson).
+    // inner RESET, leaving the closing chevron unstyled.
     const chevronBudget = valueW - 4;
     let valueCell;
     if (isCursor && isEditing) {

package/dist/cli/flags-view/state.js

@@ -1,20 +1,20 @@
 /**
  * Pure keypress reducer for the devflow flags TUI.
  *
- * applies ADR-013: CLI-layer view module; consumes src/core/ imports only.
- * applies ADR-016: one syntax, one semantic — value vocabulary.
- * avoids PF-014: pure functions only — no process.exit(), no I/O.
- * avoids PF-017: generic shell in tui/terminal.ts; this module is pure logic.
+ * CLI-layer view module; consumes src/core/ imports only.
+ * One syntax, one semantic — value vocabulary.
+ * Pure functions only — no process.exit(), no I/O.
+ * Generic shell in tui/terminal.ts; this module is pure logic.
  *
  * viewMode GLUE RULE: view-mode's neutralValue ('default') maps to null in the TUI.
  * `buildFlagRows` maps record value 'default' → null via `recordToTui` (core/flags.ts);
  * `collectFlagRecord` maps null → 'default' via `tuiToRecord` (core/flags.ts).
  * Number 0 is ACTIVE — null ≠ 0. Both functions live next to neutralValueOf, their
- * definition dependency (PF-017 one-shared-definition corollary).
+ * definition dependency, so there is one shared definition rather than per-consumer copies.
  *
  * Strict number parsing: leading/trailing whitespace and leading zeros are
  * invalid ('007' → error, ' 8' → error). This rejects pathological inputs
- * before they reach coerceFlagValue (applies PF-023).
+ * before they reach coerceFlagValue.
  *
  * Buffer hard cap: BUFFER_MAX_LEN = 64 chars (paste-flood guard).
  *
@@ -198,8 +198,8 @@ function enterEdit(state) {
  * Contract:
  *   - Empty buffer + allowUnset → commit null (unset)
  *   - Empty buffer + !allowUnset → error "Value is required"
- *   - For number/string flags: delegate to parseFlagValueInput (applies PF-023 —
- *     strict grammar enforced at the core sink, not per-caller). Error messages
+ *   - For number/string flags: delegate to parseFlagValueInput (strict grammar
+ *     enforced at the core sink, not per-caller). Error messages
  *     distinguish format failures (padded/hex/leading-zeros) from bounds failures.
  *   - parseFlagValueInput returns null on invalid input → stay editing + error
  */
@@ -230,7 +230,7 @@ function commitEdit(state) {
             };
         }
     }
-    // Number flag: parseFlagValueInput enforces strict decimal grammar (avoids PF-023).
+    // Number flag: parseFlagValueInput enforces strict decimal grammar.
     // Provide specific error messages to distinguish format from bounds failures.
     if (flagDef.kind === 'number') {
         if (buf !== buf.trim()) {

package/dist/cli/flags-view/terminal.js

@@ -1,10 +1,10 @@
 /**
  * Thin adapter — devflow flags TUI shell over the generic runTui driver.
  *
- * applies ADR-013: impure I/O shell in CLI layer; pure logic lives in state.ts/render.ts.
- * avoids PF-014: cleanup wired via Promise resolve — never process.exit() inside
- *   a finally-guarded scope.
- * avoids PF-017: thin adapter over the generic shell (src/cli/tui/terminal.ts).
+ * Impure I/O shell in CLI layer; pure logic lives in state.ts/render.ts.
+ * Cleanup wired via Promise resolve — never process.exit() inside
+ *   a finally-guarded scope (it would skip the finally).
+ * Thin adapter over the generic shell (src/cli/tui/terminal.ts).
  *
  * Public API:
  *   - runFlagsTui(initialRows, io?) → Promise<FlagsTuiResult>

package/dist/cli/tui/cells.js

@@ -1,7 +1,7 @@
 /**
  * Shared TUI cell helpers — shared by agents-view and flags-view.
  *
- * Applies PF-017: generified into a shared module rather than copy-adapted per consumer.
+ * Generified into a shared module rather than copy-adapted per consumer.
  * Pure functions, no I/O.
  */
 import { stripAnsi, truncate } from '../../core/ansi.js';

package/dist/cli/tui/terminal.js

@@ -1,10 +1,10 @@
 /**
  * Generic TUI shell — shared by agents-view and flags-view.
  *
- * applies ADR-013: impure I/O shell in CLI layer; pure logic lives in state + render.
- * avoids PF-014: cleanup wired via Promise resolve — never process.exit() inside
- *   a finally-guarded scope.
- * avoids PF-017: one generic shell, thin adapters per TUI — not copy-adapted per consumer.
+ * Impure I/O shell in CLI layer; pure logic lives in state + render.
+ * Cleanup wired via Promise resolve — never process.exit() inside
+ *   a finally-guarded scope (it would skip the finally).
+ * One generic shell, thin adapters per TUI — not copy-adapted per consumer.
  *
  * Bounded: MAX_KEYPRESSES = 50_000 hard limit (reliability rule — every loop bounded).
  *
@@ -268,8 +268,8 @@ export async function runTui(spec) {
          * A throw inside an EventEmitter listener does NOT reject the enclosing
          * promise — it escapes as an uncaughtException and kills the process with
          * cleanup() never having run, leaving raw mode and alt-screen set. Routing
-         * every handler failure through here keeps the PF-014 invariant (cleanup
-         * always runs) while still surfacing the error rather than swallowing it.
+         * every handler failure through here keeps the invariant that cleanup
+         * always runs, while still surfacing the error rather than swallowing it.
          */
         function fail(err) {
             cleanup();