devflow-kit 3.12.1 → 3.13.0

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to Devflow will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.13.0] - 2026-11-04
+
+### Added
+
+- **`devflow tdd --enable | --disable | --status`** ([#758](https://github.com/dean0x/devflow/issues/758)). The switch is on by default. With it off, the installed Code agent has no test-first text and no `devflow:test-driven-development` preload, the installed Triage agent no longer says that the Code agent works test-first, and the skill is not installed; the other test rules stay. The switch changes only the installed files, through the same build variants and converge as `devflow curation` and `devflow compliance`; no spawn or settings line carries it. A plain re-init keeps it, and `devflow init --reset` turns it back on. With no install manifest the command records nothing and exits 1.
+
+### Changed
+
+- **devflow ships a `Plan` agent that replaces Claude Code's built-in Plan** ([#756](https://github.com/dean0x/devflow/issues/756)). It runs on Opus at high effort, reads the code without editing it, names the lowest workable rung for each step, and never drops input validation, security checks, data-loss guards, fail-closed paths or the tests of these. `/plan` Phase 10 uses it, and so does plan mode when Claude Code delegates research to the Plan subagent. `init` skips it and warns when you already own a `Plan` agent, `uninstall` removes only devflow's copy, and `devflow agents --set plan --model <model>` changes its model.
+- **`/plan` writes a lean artifact** ([#756](https://github.com/dean0x/devflow/issues/756)). The artifact keeps the acceptance criteria, the steps (each with its files, the callers and consumers to update, its Must lines and its rung), patterns, known limits and deferrals, PR guidance and the test plan, and drops the problem statement, scope, gap, integration, design-review and risk sections. Every accepted gap, design finding and risk becomes a Must line or a known limit. Phase 10 asks each Plan agent for one rung per step at every level, a revision replaces text and adds no section, and `/implement` hands the known limits to Evaluate, Test and a single Code agent, and the PR description lists them.
+- **The Architect and design review ask for less** ([#756](https://github.com/dean0x/devflow/issues/756)). The Architect flags a plan step that sits above the lowest rung that meets the acceptance criteria, and an option, layer or config key that has no ask. Design review flags a missing retry, compensation step or cache only when the plan names a concrete case: an external call in the change, a stated or measured hot path, or a repeated delivery. Missing error handling at a trust boundary or for data loss stays a finding.
+- **Code writes proportional tests, and review stops asking for speculative extras** ([#756](https://github.com/dean0x/devflow/issues/756)). Code writes one failing test first for each acceptance-criterion behaviour, adds an edge-case test only for a named case, and always tests trust boundaries, data loss, security and fail-closed paths. The testing, test-driven-development and quality-gates skills and the Harden agent ask for the same, and no prompt asks for the happy path, error cases and edge cases of every change. Review and the patterns skill ask for caching, retries, idempotency or compensation only when the diff shows a concrete case; a missing bound on an existing loop, retry or cache stays a finding. The test-first rule, the RED step and the bug-fix regression test stay.
+
+---
+
 ## [3.12.1] - 2026-11-01
 
 ### Fixed
@@ -2439,6 +2454,7 @@ devflow init
 ---
 
 [Unreleased]: https://github.com/dean0x/devflow/compare/v3.8.0...HEAD
+[3.13.0]: https://github.com/dean0x/devflow/compare/v3.12.1...v3.13.0
 [3.12.1]: https://github.com/dean0x/devflow/compare/v3.12.0...v3.12.1
 [3.12.0]: https://github.com/dean0x/devflow/compare/v3.11.0...v3.12.0
 [3.11.0]: https://github.com/dean0x/devflow/compare/v3.10.0...v3.11.0

package/dist/agents/architect.md

@@ -18,17 +18,17 @@ tools:
 
 # Architect Agent
 
-You are a design analysis specialist. You detect anti-patterns in implementation plans.
+You are a design analysis specialist.
 
 ## Input
 
 The orchestrator provides:
-- **Artifacts**: Design documents, specifications, issue bodies, or implementation plans to analyze
+- **Artifacts**: Design documents, specifications, issue bodies or plans to analyze
 
-**Worktree Support**: If `WORKTREE_PATH` is provided, follow the `devflow:worktree-support` skill for path resolution. If omitted, use cwd.
+**Worktree Support**: With `WORKTREE_PATH`, resolve paths by the `devflow:worktree-support` skill; without it, use cwd.
 
 - **DECISIONS_CONTEXT** (optional): Compact index of active ADR/PF entries for this repository (pre-rendered to `.devflow/curation/index.md` in its main worktree). `(none)` when absent. Use `devflow:apply-decisions` to Read full bodies on demand.
-- **FEATURE_KNOWLEDGE** (optional): Per KB, the Rules bullets most relevant to the feature, the KB path and a heading index, for pattern-aware gap analysis. Read the indexed sections for the architecture you build on — design additions that fit existing structure. Follow `devflow:apply-feature-knowledge`.
+- **FEATURE_KNOWLEDGE** (optional): Per KB, the Rules bullets most relevant to the feature, the KB path and a heading index, for pattern-aware analysis. Read the indexed sections for the architecture you build on, so that additions fit it. Follow `devflow:apply-feature-knowledge`.
 
 ## Apply Decisions
 
@@ -37,13 +37,14 @@ Follow `devflow:apply-decisions` on the `DECISIONS_CONTEXT` index. A finding tha
 ## Responsibilities
 
 1. **Apply design review** — Scan the artifacts with all 6 rules of the preloaded `devflow:design-review` skill.
-2. **Assess confidence (0-100%)** — For each finding, assess certainty. Report at 80%+, suggest at 60-79%, drop below 60%. 80%+ means the evidence is cited directly; 60-79% means the finding depends on context that the artifacts do not show.
-3. **Cite evidence** — Every finding must reference specific text from the provided artifacts using direct quotes or line references. Never invent evidence that the artifacts do not hold.
-4. **Write findings to output** — Format findings clearly with severity, confidence, evidence, and a concrete resolution.
+2. **Assess confidence (0-100%)** — Report a finding at 80%+ (evidence cited directly), suggest it at 60-79% (it depends on context the artifacts do not show), drop it below 60%.
+3. **Cite evidence** — Quote the artifacts or cite a line for every finding. Never invent evidence.
+4. **Write findings to output** — Give each finding a severity, confidence, evidence and a resolution.
+5. **Minimum lens** — Flag a step above the lowest rung that meets the acceptance criteria, and name that rung (not needed, reuse, standard library, installed dependency, one-line change, new code). Flag an option, layer or config key with no ask and no concrete case. Never flag a trust-boundary, security, data-loss or fail-closed guard, or its test.
 
 ## Plan writing
 
-When the prompt asks you to write an implementation plan, write it; the findings Output below does not apply. First run `d="${CLAUDE_CONFIG_DIR:-}"; case "$d" in /*) ;; *) d="$HOME/.claude" ;; esac; printf '%s\n' "$d"` in Bash and Read `<that directory>/skills/devflow:gap-analysis/SKILL.md`. Write the plan the prompt describes: close the gaps that skill names, avoid the 6 anti-patterns, and return the shape the prompt names.
+When the prompt asks for an implementation plan, write it; the findings Output below does not apply. First run `d="${CLAUDE_CONFIG_DIR:-}"; case "$d" in /*) ;; *) d="$HOME/.claude" ;; esac; printf '%s\n' "$d"` in Bash and Read `<that directory>/skills/devflow:gap-analysis/SKILL.md`. Write the plan the prompt describes: close the gaps that skill names, avoid the 6 anti-patterns.
 
 ## Output
 
@@ -87,5 +88,5 @@ Report cap: final message at most about 1,500 tokens; longer material goes to a
 
 **Escalate to orchestrator:**
 - Context documents are missing or unreadable
-- Fundamental ambiguity that cannot be resolved without user input
+- Ambiguity that only the user can resolve
 - Artifacts reference external systems not present in the provided context

package/dist/agents/code.md

@@ -42,7 +42,7 @@ You receive from orchestrator:
 - **PUSH** (optional): `true` (default) | `false` — when false, commit only; orchestrator owns push/CI gate
 - **DECISIONS_CONTEXT** (optional): Compact index of active ADR/PF entries
 - **BASE_BRANCH**: Branch this feature branch was created from
-- **EXECUTION_PLAN**: Synthesized plan with steps, files, tests
+- **EXECUTION_PLAN**: Plan with steps, files, tests
 - **PATTERNS**: Codebase patterns to follow
 - **OPERATION** (optional): `implement` (default when absent) | `issue-fix` — selects operating mode; every spawn passes it as the first prompt line. Any other value returns BLOCKED, naming it, and changes nothing.
 - **ISSUES** (when OPERATION: issue-fix): FIX_NOW issues from the Triage agent
@@ -52,10 +52,10 @@ You receive from orchestrator:
 **Worktree Support**: With `WORKTREE_PATH`, resolve paths by the `devflow:worktree-support` skill; without it, use cwd.
 
 **Sequential execution context** (when chaining multiple Code agents):
-- **PRIOR_PHASE_SUMMARY**: Implementation summary from previous Code agent (see format below)
+- **PRIOR_PHASE_SUMMARY**: Summary from the previous Code agent (format in Handoff)
 - **FILES_FROM_PRIOR_PHASE**: Files created that must be read and understood
 - **HANDOFF_REQUIRED**: true if another Code agent follows this one
-- **HANDOFF_FILE** (optional): Path to the branch-scoped handoff file: read the one section of the phase before yours, and append your own section when HANDOFF_REQUIRED=true
+- **HANDOFF_FILE** (optional): Path to the branch-scoped handoff file (steps 1 and 6 below)
 
 ## Responsibilities
 
@@ -68,9 +68,9 @@ You receive from orchestrator:
 
 2. **Implement the plan**: Follow the execution steps and the existing patterns. Type everything. Use Result types if the codebase uses them.
 
-3. **Write tests**: Cover the happy path, error cases and edge cases of new behaviour, in the existing test patterns.
+3. **Write tests**: Write one failing test first for each acceptance-criterion behaviour (else each behaviour your steps' Must lines name). Add an edge-case test only for a named, concrete case. Always test trust boundaries, data loss, security and fail-closed paths.
 
-4. **Run tests**: Fix any failures; the tests you run must pass before you proceed.
+4. **Run tests**: Fix any failures; the tests you run must pass.
    **Gate ownership:** Run the targeted tests for your change in its TDD cycle, plus one affected-tests run after your last edit. In a fix mode, compile and run the named failing or regression tests. Never the full suite. Batch fixes: one build check per batch, not per edit. Only Validate runs the full suite.
 
 5. **Commit and push**: Create atomic commits with clear messages. Reference TASK_ID. Push to remote UNLESS `PUSH: false`. Before you commit, check the staged diff of every file you commit: no secrets or tokens in logs or debug output.
@@ -99,7 +99,7 @@ You fix the issues the Triage agent marked FIX_NOW. Do not re-litigate dispositi
 
 ## Handoff
 
-**If HANDOFF_REQUIRED=true**, end with the section you appended to `HANDOFF_FILE` (the orchestrator passes it on as PRIOR_PHASE_SUMMARY):
+**If HANDOFF_REQUIRED=true**, end with the section you appended to `HANDOFF_FILE`:
 
 ```markdown
 ## Phase {N} Implementation Summary

package/dist/agents/design.md

@@ -27,12 +27,12 @@ You are a design analysis specialist. You detect gaps in design documents, speci
 
 The orchestrator provides:
 - **Focus**: Which aspect to analyze: completeness, architecture, security, performance, compliance, consistency, or dependencies
-- **Artifacts**: Design documents, specifications, issue bodies, or implementation plans to analyze
+- **Artifacts**: Design documents, specifications, issue bodies or plans to analyze
 
-**Worktree Support**: If `WORKTREE_PATH` is provided, follow the `devflow:worktree-support` skill for path resolution. If omitted, use cwd.
+**Worktree Support**: With `WORKTREE_PATH`, resolve paths by the `devflow:worktree-support` skill; without it, use cwd.
 
 - **DECISIONS_CONTEXT** (optional): Compact index of active ADR/PF entries for this repository (pre-rendered to `.devflow/curation/index.md` in its main worktree). `(none)` when absent. Use `devflow:apply-decisions` to Read full bodies on demand.
-- **FEATURE_KNOWLEDGE** (optional): Per KB, the Rules bullets most relevant to the feature, the KB path and a heading index, for pattern-aware gap analysis. Read the indexed sections for the architecture you build on — design additions that fit existing structure. Follow `devflow:apply-feature-knowledge`.
+- **FEATURE_KNOWLEDGE** (optional): Per KB, the Rules bullets most relevant to the feature, the KB path and a heading index, for pattern-aware analysis. Read the indexed sections for the architecture you build on, so that additions fit it. Follow `devflow:apply-feature-knowledge`.
 
 ## Apply Decisions
 
@@ -41,9 +41,9 @@ Follow `devflow:apply-decisions` on the `DECISIONS_CONTEXT` index. A finding tha
 ## Responsibilities
 
 1. **Apply gap analysis** — Scan the provided artifacts with the detection patterns of the preloaded `devflow:gap-analysis` skill. Apply only the patterns for your assigned focus.
-2. **Assess confidence (0-100%)** — For each finding, assess certainty. Report at 80%+, suggest at 60-79%, drop below 60%. 80%+ means the evidence is cited directly; 60-79% means the finding depends on context that the artifacts do not show.
-3. **Cite evidence** — Every finding must reference specific text from the provided artifacts using direct quotes or line references. Never invent evidence that the artifacts do not hold.
-4. **Write findings to output** — Format findings clearly with severity, confidence, evidence, and a concrete resolution.
+2. **Assess confidence (0-100%)** — Report a finding at 80%+ (evidence cited directly), suggest it at 60-79% (it depends on context the artifacts do not show), drop it below 60%.
+3. **Cite evidence** — Quote the artifacts or cite a line for every finding. Never invent evidence.
+4. **Write findings to output** — Give each finding a severity, confidence, evidence and a resolution.
 
 ## Output
 
@@ -87,5 +87,5 @@ Report cap: final message at most about 1,500 tokens; longer material goes to a
 
 **Escalate to orchestrator:**
 - Context documents are missing or unreadable
-- Fundamental ambiguity that cannot be resolved without user input
+- Ambiguity that only the user can resolve
 - Artifacts reference external systems not present in the provided context

package/dist/agents/harden.md

@@ -1,6 +1,6 @@
 ---
 name: Harden
-description: Self-review after the Code agent. Checks the implementation against 9 quality pillars and fixes the issues.
+description: Self-review after the Code agent. Checks 9 quality pillars and fixes the issues.
 model: opus
 effort: medium
 skills:
@@ -33,7 +33,7 @@ disallowedTools:
 
 # Harden Agent
 
-You evaluate the implementation against the 9 quality pillars and fix the issues you find.
+You evaluate the implementation against the 9 quality pillars and fix the issues.
 
 ## Input Context
 
@@ -53,7 +53,7 @@ Follow the `devflow:apply-decisions` skill: check that the implementation is con
 
 ## Responsibilities
 
-1. **Gather changes**: Read all files in FILES_CHANGED, together in one turn.
+1. **Gather changes**: Read all files in FILES_CHANGED.
 
 2. **Evaluate P0 pillars** (Design, Functionality, Security) and fix every issue.
 
@@ -61,11 +61,11 @@ Follow the `devflow:apply-decisions` skill: check that the implementation is con
 
 4. **Evaluate P1 pillars** (Complexity, Error Handling, Tests) and fix every issue.
 
-5. **Evaluate P2** (Documentation): Fix if straightforward. Naming and Consistency belong to the Polish agent: report them as SKIP.
+5. **Evaluate P2** (Documentation): Fix if straightforward.
 
 6. **Commit fixes**: If any changes were made, create a commit with message "fix: address self-review issues".
 
-7. **Report status**: Return the report below. The status is PASS when no change was needed, FIXED when you committed fixes and every P0 and P1 is fixed, and BLOCKED when a P0 cannot be fixed in scope.
+7. **Report status**: The status is PASS when no change was needed, FIXED when you committed fixes and every P0 and P1 is fixed, and BLOCKED when a P0 cannot be fixed in scope.
 
 **Gate ownership:** Run only a test file you added or changed, once. Only Validate runs the full suite.
 
@@ -79,8 +79,6 @@ Code-scanning runs in the Code agent; do not scan here.
 
 ## Output
 
-Return structured completion status:
-
 ```markdown
 ## Self-Review Report
 
@@ -119,4 +117,4 @@ Report cap: final message at most about 1,500 tokens; longer material goes to a
 - Security vulnerability that needs design reconsideration
 - Functionality issue that invalidates the implementation approach
 
-Fix every other fixable P0 and P1 issue yourself, missing tests for new code included.
+Fix every other fixable P0 and P1 issue yourself, missing tests for an acceptance-criterion behaviour (else each behaviour the diff adds) or a trust-boundary, data-loss, security or fail-closed path included.

package/dist/agents/review.md

@@ -74,21 +74,21 @@ Follow `devflow:apply-decisions` on the `DECISIONS_CONTEXT` index. A finding tha
 
 ## Responsibilities
 
-1. **Load focus skill**: Before any analysis, invoke the Skill tool: `Skill(skill="devflow:{FOCUS}")` (substituting your assigned focus area). If the Skill invocation fails, proceed with the review using your built-in knowledge — the focus skill provides additional detection patterns but is not required for a useful review.
+1. **Load focus skill**: Before any analysis, invoke the Skill tool: `Skill(skill="devflow:{FOCUS}")` (substituting your assigned focus area). If the Skill call fails, review without it.
 2. **Identify changed lines** - Read the diff from `DIFF_FILE` when passed, else run `git diff {DIFF_RANGE}`
 3. **Apply 3-category classification** - Sort issues by where they occur
 4. **Apply focus-specific analysis** - Use pattern skill detection rules from the loaded skill file
 5. **Assign severity** - CRITICAL, HIGH, MEDIUM, LOW based on impact
 6. **Assess confidence** - Assign 0-100% confidence to each finding (see Confidence Scale below)
-7. **Filter by confidence** - Only report findings ≥80% in main sections; lower-confidence items go to Suggestions
+7. **Filter by confidence** - Report findings ≥80% in Blocking, Should-Fix and Pre-existing; 60-79% go to Suggestions; drop findings below 60%
 8. **Self-verify findings** — For each finding at ≥80% confidence (CRITICAL, HIGH, or MEDIUM):
    If the flagged lines are already visible in the diff output, skip the Read — the diff is
    sufficient for verification. Otherwise, Read the code at the flagged file:line as a
    ranged read of 30 lines either side, never the whole file. If the issue is already
    handled (guard clause, try/catch, validation present), downgrade to Suggestions or drop.
    If Read fails or line is out of range, retain finding at original confidence.
-9. **Consolidate similar issues** - Group related findings to reduce noise (see Consolidation Rules)
-10. **Generate report** - File:line references with suggested fixes
+9. **Consolidate similar issues** (see Consolidation Rules)
+10. **Generate report**
 11. **Determine merge recommendation** - Based on blocking issues
 
 ## Confidence Scale
@@ -102,13 +102,12 @@ Assess how certain you are that each finding is a real issue (not a false positi
 | 60-79% | Medium | Plausible issue, but depends on context you may not fully see |
 | < 60% | Low | Possible concern, but likely a matter of style or interpretation |
 
-**Threshold**: Only report findings with ≥80% confidence in Blocking, Should-Fix, and Pre-existing sections. Findings with 60-79% confidence go to the Suggestions section. Findings < 60% are dropped entirely.
-
 ## Consolidation Rules
 
 1. **Group similar issues** — If 3+ instances of the same pattern appear (e.g., "missing error handling" in multiple functions), consolidate into 1 finding listing all locations rather than N separate findings
 2. **Skip stylistic preferences** — Do not flag formatting, naming style, or code organization choices unless they violate explicit project conventions found in CLAUDE.md, .editorconfig, or linter configs
 3. **Skip issues in unchanged code** — Pre-existing issues in lines you did NOT change should only be reported if CRITICAL severity (security vulnerabilities, data loss risks)
+4. **Skip speculative asks** — In every focus, do not ask for caching, retries, idempotency or compensation unless the diff shows a concrete case (an external call, a stated or measured hot path, a repeated delivery). A missing bound on an existing loop, retry or cache stays a finding. A partial write that can lose data, a trust boundary and a fail-closed path need no case.
 
 ## Cross-Cycle Awareness
 

package/dist/cli/commands/init-seed.js

@@ -25,6 +25,7 @@ export const FEATURE_DEFAULTS = {
     rules: true,
     proxy: false,
     behavior: false,
+    tdd: true,
     compliance: { enabled: false, frameworks: [] },
     tracker: { provider: DEFAULT_TRACKER_PROVIDER },
     gateLevel: undefined,
@@ -48,6 +49,8 @@ export function resolveSeedFeatures(manifest) {
     const proxy = manifest?.features.proxy ?? FEATURE_DEFAULTS.proxy;
     // D-BEHAVIOR-OPT-IN: a manifest from before the switch has no key — it seeds the default (off).
     const behavior = manifest?.features.behavior ?? FEATURE_DEFAULTS.behavior;
+    // The tdd switch: a manifest from before it reads on (readManifest), so re-init keeps what the machine holds.
+    const tdd = manifest?.features.tdd ?? FEATURE_DEFAULTS.tdd;
     // Return a fresh object so callers never hold a reference to FEATURE_DEFAULTS.compliance.
     // Without the spread, `manifest?.features.compliance ?? FEATURE_DEFAULTS.compliance` returns
     // the module-level default by reference — downstream mutation would corrupt it process-wide.
@@ -65,7 +68,7 @@ export function resolveSeedFeatures(manifest) {
     // into the default, and init would then write the default over a value the
     // fold reads as the strictest level.
     const gateLevel = manifest?.features.gateLevel;
-    return { ambient, memory, hud, knowledge, curation, rules, proxy, behavior, compliance, tracker, gateLevel };
+    return { ambient, memory, hud, knowledge, curation, rules, proxy, behavior, tdd, compliance, tracker, gateLevel };
 }
 /**
  * Resolve the flag record for the init seed.
@@ -326,6 +329,7 @@ export function applyCliToggles(base, toggles) {
         rules: toggles.rules ?? base.rules,
         proxy: toggles.proxy ?? base.proxy,
         behavior: toggles.behavior ?? base.behavior,
+        tdd: toggles.tdd ?? base.tdd,
         compliance: toggles.compliance ?? base.compliance,
         tracker: toggles.tracker ?? base.tracker,
         gateLevel: base.gateLevel,

package/dist/cli/commands/init.js

@@ -54,6 +54,7 @@ import { formatTrackerSummary, shouldRunTrackerStep, runTrackerStep, buildClackT
 import { buildClackGateLevelPrompts, carriedGateLevel, formatGateLevelRow, formatGateLevelSummary, readStoredGateLevel, resolveGateLevelForInit, resolveGateLevelInitState, } from './gate-level-prompts.js';
 import { shouldRunAttributionStep, runAttributionStep, buildClackAttributionPrompts, applyAttributionAnswer, attributionSeedFrom, } from './attribution-prompts.js';
 import { convergeVariantAxes, describePostingLeft, installedVersionMatches, readRunningVersion } from '../../targets/claude-code/curation-install.js';
+import { VARIANT_AXES, machineSwitches } from '../../core/curation-variants.js';
 import { POSTING_OFF_NOTICE, installRecordFor, postingNoticeDue, readInstalledVariants } from '../../core/installed-variants.js';
 import { auditAndRecordClaudeMd, formatClaudeMdAuditNote, formatClaudeMdAuditUnavailable, } from '../../core/claude-md-audit.js';
 import * as os from 'os';
@@ -594,6 +595,7 @@ export function buildHudOnlyManifest(existing, version, now, refusedGateLevel) {
             ambient: false, memory: false, hud: true, knowledge: false,
             curation: false, rules: false, flags: {}, proxy: false,
             behavior: false,
+            tdd: true,
             compliance: { enabled: false, frameworks: [] },
             // The exported default, not a literal — the one constant every other
             // module reads, so a moved default moves here too.
@@ -1099,6 +1101,10 @@ export const initCommand = new Command('init')
     // → false (FEATURE_DEFAULTS.behavior); re-inits and the Recommended path keep the prior
     // manifest value; only --behavior/--no-behavior and the Advanced wizard change it.
     let behaviorEnabled = seed.features.behavior;
+    // tdd: a machine switch init only carries: the seed holds the prior manifest value (on when the
+    // manifest has none, and under --reset), and no flag or wizard step changes it. `devflow tdd`
+    // is the only command that changes the value; `init --reset` turns it back on.
+    const tddEnabled = seed.features.tdd;
     // compliance: manifest-group (like proxy); seed from prior manifest value.
     // CLI override applied below in both Recommended and Advanced paths.
     let complianceEnabled = seed.features.compliance.enabled;
@@ -1836,6 +1842,15 @@ export const initCommand = new Command('init')
         hadComplianceRule = true;
     }
     catch { /* absent — no legacy artifact */ }
+    // The SETTLED switches, after the flag, the prompt and the seed have all had their say
+    // (D-LEARNING-VARIANT-INSTALL), never a raw seed or a repository's narrowing: built once here
+    // and passed whole to the install, the converge and the install record, so the files installed
+    // and the manifest written at the end of init cannot disagree about them.
+    const switches = machineSwitches({
+        curation: curationEnabled,
+        compliance: { enabled: complianceEnabled },
+        tdd: tddEnabled,
+    });
     // Install via file copy
     let installReport;
     const installWarnings = [];
@@ -1850,14 +1865,9 @@ export const initCommand = new Command('init')
             rulesMap,
             isPartialInstall: !!options.plugin,
             spinner: s,
-            // The SETTLED switch, after the flag, the prompt and the seed have all had
-            // their say (D-LEARNING-VARIANT-INSTALL): the files installed here and the
-            // manifest written at the end of init cannot disagree about it.
-            curation: curationEnabled,
-            // The SETTLED compliance switch, never a raw seed or a repository's narrowing: the
-            // variant follows the machine switch alone, and with it off the install refuses
-            // before it writes a file when the variant files are not all there.
-            compliance: complianceEnabled,
+            // With compliance off the install refuses before it writes a file when the variant
+            // files are not all there.
+            switches,
             trackerServers,
             // Non-fatal install notices with no other channel (skipped symlinks in the
             // generated reference tree, mode-normalisation failures) reach the user rather
@@ -1873,10 +1883,10 @@ export const initCommand = new Command('init')
         backupReport.print();
         process.exit(1);
     }
-    // The one converge for both switches (D-LEARNING-VARIANT-INSTALL, AC-27): the file copy
+    // The one converge for every switch (D-LEARNING-VARIANT-INSTALL, AC-27): the file copy
     // above installed the variant of everything IT installed; on a `--plugin` install the
     // other plugins' files, already on disk, may still be another variant (this run may
-    // have flipped a switch), and the apply-decisions skill is removed here when the copy
+    // have flipped a switch), and a skill an off switch gates is removed here when the copy
     // skipped it on a partial install. It also converges the compliance skill and rule, so
     // enabling or disabling compliance during init needs no separate devflow compliance run.
     // Rewrites only what is installed. Warn-not-abort: a failure is a warning here and the
@@ -1885,19 +1895,15 @@ export const initCommand = new Command('init')
     const variantConverge = await convergeVariantAxes({
         claudeDir,
         devflowDir,
-        manifest: {
-            features: {
-                curation: curationEnabled,
-                compliance: { enabled: complianceEnabled, frameworks: complianceFrameworks },
-                rules: rulesEnabled,
-            },
-        },
+        switches,
+        frameworks: complianceFrameworks,
+        rulesEnabled,
         plugins: effectivePlugins,
         warn: (msg) => installWarnings.push(msg),
         backups,
     });
     if (verbose && variantConverge.converged) {
-        p.log.info(`Curation ${curationEnabled ? 'on' : 'off'}, compliance ${complianceEnabled ? 'on' : 'off'} variants: ` +
+        p.log.info(`Variants (${VARIANT_AXES.map(axis => `${axis} ${switches[axis] ? 'on' : 'off'}`).join(', ')}): ` +
             `${variantConverge.commandsRewritten.length} command(s) and ${variantConverge.agentsRewritten.length} agent(s) ` +
             `rewritten, ${variantConverge.unchanged} already current`);
     }
@@ -2457,7 +2463,7 @@ export const initCommand = new Command('init')
     }
     // Write installation manifest for upgrade tracking (non-fatal — install already succeeded)
     const now = new Date().toISOString();
-    const installRecord = installRecordFor(variantConverge.converged, { curation: curationEnabled, compliance: complianceEnabled });
+    const installRecord = installRecordFor(variantConverge.converged, switches);
     const manifestData = {
         version,
         // Resolved above, before the install, because the skills install set is
@@ -2485,6 +2491,8 @@ export const initCommand = new Command('init')
             // overridden by --behavior/--no-behavior and the Advanced wizard. The rule file was
             // converged above to match it.
             behavior: behaviorEnabled,
+            // The tdd switch, carried from the prior manifest (on under --reset).
+            tdd: tddEnabled,
             // Resolved compliance state — seeded from prior manifest, overridden by CLI flags
             // and Advanced wizard selection. convergeComplianceArtifacts was called above.
             // normalizeFrameworks: dedup + filter unknowns before persisting.

package/dist/cli/commands/tdd.js

@@ -0,0 +1,230 @@
+/**
+ * devflow tdd — the machine switch for the test-first text of the installed Code agent.
+ *
+ * `features.tdd` in ~/.devflow/manifest.json (absent = on) picks which installed files carry the
+ * TDD text: with it on, the Code agent preloads the test-driven-development skill and its test
+ * step says "write one failing test first"; with it off, the skill folder is not installed and the
+ * Code agent keeps its test rules (one test per behaviour, trust boundaries, data loss, security,
+ * fail-closed paths) without the test-first wording. Nothing reads the switch at run time: it only
+ * decides which files this machine installs.
+ *
+ * `--enable` and `--disable` write the switch under the manifest lock, then run the one converge
+ * for every variant axis (applyVariantToggle) and report. A converge that is skipped (no readable
+ * manifest, a version skew) or that does not finish clean exits non-zero; the switch write is not
+ * rolled back, so `devflow init` finishes the job. `--status` prints the switch, the gated skill
+ * and what the install record says the installed prompts hold.
+ *
+ * The core (applyTddChange, readTddStatus) returns a Result and prints nothing; the command action
+ * renders it. That keeps the business logic free of throws and of terminal output.
+ */
+import { Command } from 'commander';
+import * as p from '@clack/prompts';
+import color from 'picocolors';
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import { isMachineFeatureOn, writeMachineFeature } from '../../core/feature-switch.js';
+import { readGateManifest } from '../../core/gate-level.js';
+import { readInstalledVariants, variantRecordStatus } from '../../core/installed-variants.js';
+import { TDD_GATED_SKILLS, prefixSkillName } from '../../core/plugins.js';
+import { getClaudeDirectory, getDevFlowDirectory } from '../../targets/claude-code/claude-paths.js';
+import { applyVariantToggle, describePostingLeft, describeVariantConverge, readRunningVersion, } from '../../targets/claude-code/curation-install.js';
+import { openBackupSessionOrFail, runWithBackupReport } from './backup-session.js';
+/**
+ * The one action the flags ask for: null when none is given (the command prints its usage), an
+ * error when more than one is, because `--enable --disable` has no meaning.
+ */
+export function resolveTddAction(options) {
+    const asked = [];
+    if (options.enable === true)
+        asked.push('enable');
+    if (options.disable === true)
+        asked.push('disable');
+    if (options.status === true)
+        asked.push('status');
+    if (asked.length > 1) {
+        return { ok: false, error: 'Use only one of --enable, --disable and --status.' };
+    }
+    return { ok: true, value: asked[0] ?? null };
+}
+const stateWord = (enabled) => (enabled ? 'on' : 'off');
+/**
+ * Apply one change of the tdd switch: write the switch, then run the one converge for every axis,
+ * which records the installed variants after a clean run (applyVariantToggle does that last step).
+ *
+ * The switch comes first, so whatever the converge does next the machine's choice is on disk. A
+ * converge that is skipped, or that leaves a file or the skill unconverged, exits 1 and says that
+ * the switch stays recorded. Returns a result and never throws; the record of the backup session
+ * prints once, as the change returns, ahead of the messages.
+ */
+export function applyTddChange(opts) {
+    return runWithBackupReport(opts.backups, () => applyChange(opts));
+}
+async function applyChange(opts) {
+    const { claudeDir, devflowDir, enabled, runningVersion, packageRoot, warn, backups } = opts;
+    const recorded = await writeMachineFeature(devflowDir, 'tdd', enabled);
+    if (!recorded.ok) {
+        return {
+            messages: [{ level: 'error', text: 'Devflow is not installed on this machine. Run `devflow init` first.' }],
+            exitCode: 1,
+        };
+    }
+    const recordedLine = { level: 'info', text: `The tdd switch is recorded as ${stateWord(enabled)}.` };
+    const outcome = await applyVariantToggle({
+        claudeDir,
+        devflowDir,
+        axis: 'tdd',
+        enabled,
+        runningVersion,
+        warn,
+        packageRoot,
+        backups,
+    });
+    switch (outcome.kind) {
+        case 'skipped':
+            return { messages: [recordedLine, { level: 'error', text: outcome.message }], exitCode: 1 };
+        case 'converged': {
+            if (!outcome.result.converged) {
+                return {
+                    messages: [
+                        recordedLine,
+                        { level: 'error', text: 'The installed files were not all converged onto the tdd switch (see the warnings above). Run `devflow init` to finish.' },
+                        ...describePostingLeft(outcome.result.posting).map((text) => ({ level: 'warn', text })),
+                    ],
+                    exitCode: 1,
+                };
+            }
+            const messages = [{
+                    level: 'success',
+                    text: enabled
+                        ? 'TDD enabled: the Code agent and the test-driven-development skill carry the test-first rules.'
+                        : 'TDD disabled: the test-first rules and the test-driven-development skill are not installed. ' +
+                            'The test rules for trust boundaries, data loss, security and fail-closed paths stay.',
+                }];
+            const changed = describeVariantConverge(outcome.result, 'tdd', enabled);
+            if (changed !== null)
+                messages.push({ level: 'info', text: `Installed prompts: ${changed}` });
+            return { messages, exitCode: 0 };
+        }
+        default: {
+            const unhandled = outcome;
+            return { messages: [{ level: 'error', text: `Unhandled toggle outcome ${JSON.stringify(unhandled)}` }], exitCode: 1 };
+        }
+    }
+}
+async function pathExists(file) {
+    try {
+        await fs.access(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Read the switch, the gated skill and the install record. Writes nothing. Never throws. */
+export async function readTddStatus(opts) {
+    // The raw read heals nothing: readManifest would rewrite a manifest that holds a legacy key.
+    const read = await readGateManifest(opts.devflowDir);
+    if (read.kind !== 'object')
+        return { ok: false, error: 'not-installed' };
+    const enabled = isMachineFeatureOn(read.raw, 'tdd');
+    return {
+        ok: true,
+        value: {
+            enabled,
+            skillInstalled: await pathExists(path.join(opts.claudeDir, 'skills', prefixSkillName(TDD_GATED_SKILLS[0]))),
+            record: variantRecordStatus(readInstalledVariants(read.raw.installedVariants), 'tdd', enabled),
+        },
+    };
+}
+function recordLine(record) {
+    switch (record) {
+        case 'on':
+            return color.green('on');
+        case 'off':
+            return color.dim('off');
+        case 'mismatch':
+            return color.yellow('mismatch (run devflow init)');
+        case 'unknown':
+            return color.yellow('unknown (run devflow init)');
+        default: {
+            const unhandled = record;
+            return unhandled;
+        }
+    }
+}
+function logMessage(message) {
+    switch (message.level) {
+        case 'success':
+            p.log.success(message.text);
+            break;
+        case 'info':
+            p.log.info(message.text);
+            break;
+        case 'warn':
+            p.log.warn(message.text);
+            break;
+        case 'error':
+            p.log.error(message.text);
+            break;
+        default: {
+            const unhandled = message.level;
+            void unhandled;
+            break;
+        }
+    }
+}
+function renderStatus(result) {
+    if (!result.ok) {
+        p.log.error(`Devflow is not installed on this machine. Run ${color.cyan('devflow init')} first.`);
+        process.exitCode = 1;
+        return;
+    }
+    const { enabled, skillInstalled, record } = result.value;
+    p.log.info(`State:    ${enabled ? color.green('enabled') : color.yellow('disabled')}`);
+    p.log.info(`Skill:    ${skillInstalled ? color.green('installed') : color.dim('not installed')}`);
+    p.log.info(`Prompts:  ${recordLine(record)}`);
+}
+export const tddCommand = new Command('tdd')
+    .description('Manage the test-first (TDD) text of the installed Code agent')
+    .option('--enable', 'Install the Code agent with the test-first rules and the test-driven-development skill')
+    .option('--disable', 'Install the Code agent without the test-first rules, and remove the test-driven-development skill')
+    .option('--status', 'Show whether the test-first text is on and what is installed')
+    .action(async (options) => {
+    const resolved = resolveTddAction(options);
+    if (!resolved.ok) {
+        p.log.error(resolved.error);
+        process.exitCode = 1;
+        return;
+    }
+    const action = resolved.value;
+    if (action === null) {
+        p.log.info('Usage: devflow tdd --enable | --disable | --status');
+        return;
+    }
+    const claudeDir = getClaudeDirectory();
+    const devflowDir = getDevFlowDirectory();
+    p.intro(color.cyan(action === 'status' ? 'TDD Status' : `${action === 'enable' ? 'Enable' : 'Disable'} TDD`));
+    if (action === 'status') {
+        renderStatus(await readTddStatus({ claudeDir, devflowDir }));
+        p.outro('');
+        return;
+    }
+    // The session comes before the first change. Without a shipped set the command changes nothing.
+    const backups = await openBackupSessionOrFail({ claudeDir, devflowDir });
+    if (backups === null)
+        return;
+    const applied = await applyTddChange({
+        claudeDir,
+        devflowDir,
+        enabled: action === 'enable',
+        runningVersion: await readRunningVersion(),
+        warn: (msg) => p.log.warn(msg),
+        backups,
+    });
+    for (const message of applied.messages)
+        logMessage(message);
+    if (applied.exitCode !== 0)
+        process.exitCode = applied.exitCode;
+    p.outro('');
+});
+//# sourceMappingURL=tdd.js.map