devflow-kit 3.5.0 → 3.6.0

package/src/assets/skills/agent-references/SKILL.md

@@ -11,22 +11,26 @@ allowed-tools: Read
 <!-- D-AGENT-REFS: a reference-only skill. It holds text that one agent mode needs and the
      other modes do not, so the agent body stays small and the spawn reads one file on demand.
      D-MODE-BY-PATH: Synthesize reads exactly one synthesize/{mode}.md by explicit path.
-     D-MAINTAIN-ON-DUE: Learning reads learning/maintain.md only after claim-due hands out an entry. -->
+     D-MAINTAIN-ON-DUE: Curate reads curate/maintain.md only after claim-due hands out an entry.
+     D-CMD-REF-HAND: a command moves a rare branch here (hand-authored, byte for byte) and keeps only
+     the condition and the read path, so a run that never takes the branch never carries its text.
+     Only text with no learning arm and no Git-spawn fence moves. -->
 
 ## Iron Law
 
 > **READ BY EXPLICIT PATH ONLY; NEVER PRELOAD**
 >
-> An agent that owns a file here names its full path in its own body and reads it with the
-> Read tool when its mode needs it. No agent `skills:` list and no plugin preload names this
-> skill: a preload would put every file in every spawn and undo the saving.
+> An agent or command that owns a file here names its full path in its own body and reads it with
+> the Read tool when its mode or branch needs it. No agent `skills:` list, no plugin `requires:`
+> and no preload names this skill: a preload would put every file in every spawn and undo the saving.
 
 ## Files
 
 | Path under `references/` | Owner | Read when |
 |--------------------------|-------|-----------|
 | `synthesize/{mode}.md` | Synthesize | The prompt's `Mode:` line names `{mode}` |
-| `learning/maintain.md` | Learning | `claim-due` hands out at least one entry |
+| `curate/maintain.md` | Curate | `claim-due` hands out at least one entry |
+| `commands/{name}.md` | The command named in the file | The command's condition for that branch holds |
 
 The installed directory is `${CLAUDE_CONFIG_DIR:-$HOME/.claude}/skills/devflow:agent-references/`.
 The model never invokes this skill: `disable-model-invocation: true` keeps it out of the

package/src/assets/skills/agent-references/references/commands/implement-evidence-asks.md

@@ -0,0 +1,35 @@
+# Implement: evidence asks
+
+Read by `/implement` Phase 1 (D-CMD-REF-HAND). "The grammar below", "the exception grammar above" and "the record above" name sections of this file. Any other "above" means the Phase 1 text before the step that sent you here.
+
+## Ticket link ask
+
+**Ticket link, only when `ISSUE_REQUIRED` is `true`:** when the capture above holds no `ISSUE_PR_LINK` (absent, or `(none)`), ask with AskUserQuestion before any Code spawn — "No tracker issue is linked to this task. Record a self-attested exception, or stop?" — offering exactly these two options:
+- **Record an exception** — the user gives the reason as free text. Render it with the grammar below, as kind `ticket-link`; when the rendered reason is empty, ask for it once more, and stop as below if it is empty again.
+- **Stop** — report `BLOCKED (no ticket link)`, name the branch setup-task created (`TASK_ID`) and `BASE_BRANCH` so it can be reused or removed, and give the remedy: create or link the tracker issue and re-run `/implement` with its reference, or — for a team that does not want ticket links — commit `.devflow/project.json` as `{"version":1,"evidence":"standard"}` on the default branch; a machine with compliance enabled still resolves `required` whatever that file says. Spawn nothing further.
+
+## Exception grammar
+
+**Render each evidence exception** as one line under a `## Evidence Exceptions` heading, in exactly this shape:
+
+```markdown
+## Evidence Exceptions
+- `<kind>` self-attested by @<login> at <utc>: <reason>
+```
+
+- `<kind>` is one of `ticket-link` or `test-plan` — a closed set; no other kind is ever rendered, and the section holds each kind at most once.
+- `@<login>` is `@` followed by the output of `gh api user --jq .login` when that output matches `^[A-Za-z0-9][A-Za-z0-9-]{0,38}$`. On any other output, or a failed call, it is `(login unavailable)` instead, with no `@`.
+- `<utc>` is the output of `date -u +%Y-%m-%dT%H:%M:%SZ`.
+- `<reason>` is the user's own words, made inert: replace every character outside printable ASCII (newlines and tabs included) with a space, remove every `<`, `>`, `` ` ``, `[`, `]`, `\`, `/`, `#`, `@`, `&` and `$`, collapse runs of spaces, trim, keep the first 200 characters, and trim again. A reason that is empty after this is no reason.
+
+Note: the section reaches a public PR body. The Code agent re-checks every line against this shape before it pastes, and the body's D11 scrub is the reason's secret scrub — rendering filters no secrets. A rendered reason carries no HTML or comment markers, link or image syntax, @-mentions, `#N` or full-URL references (no `/` survives), entities or shell-expansion characters; plain emphasis and `www.` or `GH-N` autolinks can remain — the requester authors the reason.
+
+## Record the exception
+
+**Record the exception at once**, before any Code spawn: write the rendered section as the `## Evidence Exceptions` section of `{worktree}/.devflow/docs/handoff-{branch_slug}.md`, creating the file if absent, and set `PR_EXCEPTIONS` to that section. The file is its one home until the PR exists: every later write to the file keeps the section byte-identical, the Phase 9 Git spawn passes it verbatim as `PR_EXCEPTIONS`, and the file is deleted only once the PR exists — after Phase 9, under every strategy. With no exception recorded, `PR_EXCEPTIONS` is `(none)`.
+
+## Missing test plan ask
+
+**Missing test plan, only when `EVIDENCE_POLICY` is `required`:** when the check above leaves the test plan missing, ask with AskUserQuestion before any Code spawn — "No test plan could be written for this task. Record a self-attested exception, or stop?" — offering exactly these two options:
+- **Record an exception** — the user gives the reason as free text. Render it with the exception grammar above, as kind `test-plan`; when the rendered reason is empty, ask for it once more, and stop as below if it is empty again. Add the rendered line to the `## Evidence Exceptions` section of `{worktree}/.devflow/docs/handoff-{branch_slug}.md` — after any `ticket-link` line, creating the section and the file when absent — and set `PR_EXCEPTIONS` to that section, under the same rules as the record above.
+- **Stop** — report `BLOCKED (no test plan)`, name `TASK_ID` and `BASE_BRANCH` so the branch can be reused or removed, and give the remedy: state the acceptance criteria in the task, the issue or a `/plan` document (its `## Test Plan` section is copied) and re-run `/implement`, or — for a team that does not want test plans enforced — commit `.devflow/project.json` as `{"version":1,"evidence":"standard"}` on the default branch; a machine with compliance enabled still resolves `required` whatever that file says. Spawn nothing further.

package/src/assets/skills/agent-references/references/commands/implement-revalidate.md

@@ -0,0 +1,15 @@
+# Implement: re-validation
+
+Read by `/implement` when the user asks to re-validate (D-CMD-REF-HAND).
+
+## Continuation path
+
+When the user explicitly asks to re-validate, re-check, or re-run quality gates after making their own changes:
+
+1. **Branch safety check**: If on a protected branch (main, master, develop, etc.), run Phase 1 to create/switch to a work branch. If already on a work branch, skip Phase 1.
+2. **Skip Phase 2** — no Code agent needed, user already made changes.
+3. **Detect FILES_CHANGED**: `git diff --name-only {base_branch}...HEAD`
+4. **Run Phases 3-8** — Polish, Self-Review, Alignment, the one full Validate, QA Testing and the conditional Re-Validate, on the detected changes.
+5. **Proceed to Phase 9** (Open PR), **Phase 11** (Evidence) and **Phase 12** (Report).
+
+If the user prompt does NOT match re-validation, proceed with the full pipeline below.

package/src/assets/skills/agent-references/references/synthesize/bug-analysis.md

@@ -1,6 +1,6 @@
 ## Mode: Bug Analysis
 
-Synthesize outputs from multiple Diagnose agents into a single actionable bug report.
+Synthesize outputs from multiple Debug agents into a single actionable bug report.
 
 **Input:**
 - **ANALYSIS_BASE_DIR**: Timestamped directory containing `{focus}.md` files and `static-findings.md`

package/src/assets/skills/apply-decisions/SKILL.md

@@ -14,12 +14,14 @@ allowed-tools: Read, Bash
 > Cite only IDs that appear verbatim in DECISIONS_CONTEXT. If an ADR/PF ID is not
 > in the index, do not cite it. If an entry looks relevant but you haven't Read its
 > full body, do not cite it. Fabricated citations are worse than no citations.
+>
+> DECISIONS_CONTEXT may be a slice; read the full index at the named path only when your work leaves the slice's scope.
 
 ## 5-Step Algorithm
 
 ### Step 1: Scan the index
 
-One line per active entry: its ID (`ADR-NNN` or `PF-NNN`), a title, then a status tag and/or, after `—`, its area or scope. The footer names the decisions and pitfalls files.
+One line per active entry: its ID (`ADR-NNN` or `PF-NNN`), a title, then a status tag and/or, after `—`, its area or scope. A slice leads with `(slice: N of M entries — full index: <path>)`.
 
 ### Step 2: Identify plausibly-relevant entries
 
@@ -27,13 +29,13 @@ Pick entries whose title, area or scope overlaps the files you touch (a matching
 
 ### Step 3: Read the full body
 
-Find the entry's heading line in the file the footer names, then Read only that section:
+Find the entry's heading in the file the footer names:
 
 ```bash
 command grep -nF '## ADR-NNN:' "{worktree-from-footer}/.devflow/learning/decisions.md"
 ```
 
-For a pitfall use `## PF-NNN:` and `pitfalls.md`. Read with `offset` at the printed line and a `limit` of about 25, stopping at the next `## `. The footer is the single source of truth for paths; the ledger is git-ignored, so only a shell search finds the line. A `verified` date is when the entry was last confirmed true; none means unconfirmed. Cite only after reading the body and confirming it applies.
+For a pitfall use `## PF-NNN:` and `pitfalls.md`. Read with `offset` at the printed line and a `limit` of about 25, stopping at the next `## `. The footer is the single source of truth for paths; the ledger is git-ignored, so search by shell. A `verified` date is the last confirmation; none means unconfirmed.
 
 ### Step 4: Cite inline — in-session handoffs only
 
@@ -43,7 +45,7 @@ Anything committed, pushed or posted states the rule in words, never its ID (cod
 
 ### Step 5: Use verbatim IDs only
 
-Cite only IDs in `DECISIONS_CONTEXT`; never guess or rebuild one. When nothing clearly applies, cite nothing.
+Cite only IDs in the index; never guess or rebuild one. When nothing clearly applies, cite nothing.
 
 ## Skip Guard
 

package/src/assets/skills/docs-framework/SKILL.md

@@ -38,7 +38,7 @@ All generated documentation lives under `.devflow/docs/` at the checkout's tople
 ├── bug-analysis/{branch-slug}/         # /bug-analysis, per branch
 │   ├── .last-analysis-head            # HEAD SHA of the last analysis (incremental)
 │   └── {timestamp}/
-│       ├── {focus}.md                 # Diagnose agent report
+│       ├── {focus}.md                 # Debug agent report
 │       ├── static-findings.md         # Raw static analysis tool output
 │       ├── bug-analysis-summary.md    # Synthesize agent output
 │       └── resolution-summary.md      # /resolve (evidence.md and stale-plan.md as in reviews)
@@ -142,7 +142,7 @@ ensure_docs_dir() { mkdir -p "$(get_docs_root)/.devflow/docs/$1"; }
 ### Who Writes What
 
 - **Reviews**: the Review agents and the Synthesize agent (review mode) write into `reviews/{branch-slug}/{timestamp}/`; `/resolve` adds `resolution-summary.md` (Phase 5); `/code-review` overwrites `.last-review-head` with the HEAD SHA.
-- **Bug analysis**: the Diagnose agents and the Synthesize agent (bug-analysis mode) write into `bug-analysis/{branch-slug}/{timestamp}/`; `/bug-analysis` overwrites `.last-analysis-head` with the HEAD SHA.
+- **Bug analysis**: the Debug agents and the Synthesize agent (bug-analysis mode) write into `bug-analysis/{branch-slug}/{timestamp}/`; `/bug-analysis` overwrites `.last-analysis-head` with the HEAD SHA.
 - **Research**: the Research agents write `{type}.md`, and the Synthesize agent (research mode) writes `research-summary.md` through `RESEARCH_BASE_DIR`, both into `research/{topic-slug}/{timestamp}/`.
 - **Design**: `/plan` writes the design document; `/dynamic-plan` writes `design/{slug}/{timestamp}/`, `/dynamic-tickets` `tickets/{slug}/{timestamp}/`, `/dynamic-build` `waves/{slug}/{timestamp}/` and `evidence-wave-{slug}.md`.
 - **Handoff and evidence**: `/implement` writes `evidence-{branch-slug}.md`, which stays after the PR, and the handoff file, to which each Code agent appends one phase section and which is deleted once the PR exists.
@@ -176,7 +176,7 @@ This framework is used by:
 - **`/plan` and `/research`**: load it at the step that names the document, and build the path by its rules
 - **Commands that hand paths to agents** (`/code-review`, `/bug-analysis`, `/implement`, `/resolve`, the `/dynamic-*` commands): follow it, with the exceptions above
 - **Working Memory hooks**: Auto-maintains `.devflow/memory/WORKING-MEMORY.md`
-- **Learning agent**: background LLM agent (spawned via the session-start directive) promotes observations to ADRs/PFs via `assign-anchor`, which renders `decisions.md` / `pitfalls.md`
+- **Curate agent**: background LLM agent (spawned via the session-start directive) promotes observations to ADRs/PFs via `assign-anchor`, which renders `decisions.md` / `pitfalls.md`
 
 ---
 

package/src/assets/skills/qa/SKILL.md

@@ -109,7 +109,7 @@ When implementation includes web-facing changes (.tsx, .jsx, .html, routes, page
 
 | Level | Meaning | Action |
 |-------|---------|--------|
-| **BLOCKING** | Acceptance criterion violated — feature does not work as requested | Report FAIL — Code agent must fix |
+| **BLOCKING** | Acceptance criterion violated — feature does not work as requested | Report FAIL — Fix agent must fix |
 | **WARNING** | Edge case concern — feature works but edge behavior is unexpected | Report PASS with warnings — note for improvement |
 
 ---

package/src/assets/skills/quality-gates/SKILL.md

@@ -7,7 +7,7 @@ allowed-tools: Read, Grep, Glob, Edit, Write, Bash
 
 # Self-Review Framework
 
-Systematic self-review for the Scrutinize agent. Evaluate implementation against 9 pillars. **Fix issues, don't just report them.**
+Systematic self-review for the Harden agent. Evaluate implementation against 9 pillars. **Fix issues, don't just report them.**
 
 Based on [Google Engineering Practices](https://google.github.io/eng-practices/review/reviewer/looking-for.html).
 
@@ -26,7 +26,7 @@ Based on [Google Engineering Practices](https://google.github.io/eng-practices/r
 |----------|--------|---------|
 | **P0** | MUST fix | Design, Functionality, Security |
 | **P1** | SHOULD fix | Complexity, Error Handling, Tests |
-| **P2** | FIX if straightforward | Documentation (Naming and Consistency belong to the Simplify agent: report them as SKIP) |
+| **P2** | FIX if straightforward | Documentation (Naming and Consistency belong to the Polish agent: report them as SKIP) |
 
 ### P0 - Design
 Does the implementation fit the architecture? Follows existing patterns, respects layer boundaries, dependencies injected.
@@ -49,7 +49,7 @@ Errors handled explicitly? No swallowed exceptions, helpful messages, resources
 New code tested? Covers happy path, errors, edges. Tests behavior, not implementation.
 
 ### P2 - Naming and Consistency
-Owned by the Simplify agent, which applies the project's naming and style standards. Report both as SKIP; do not judge or fix them here.
+Owned by the Polish agent, which applies the project's naming and style standards. Report both as SKIP; do not judge or fix them here.
 
 ### P2 - Documentation
 Will others understand? Complex logic commented, public APIs documented, no outdated comments.
@@ -96,7 +96,7 @@ Check Design, Functionality, Security. If issues found and fixable, fix immediat
 Check Complexity, Error Handling, Tests. Fix issues found.
 
 ### Step 4: Evaluate P2 Pillars
-Check Documentation and fix it if straightforward. Naming and Consistency are the Simplify agent's: SKIP.
+Check Documentation and fix it if straightforward. Naming and Consistency are the Polish agent's: SKIP.
 
 ### Step 5: Generate Report
 Document status of each pillar, fixes applied, and overall readiness.
@@ -119,8 +119,8 @@ Document status of each pillar, fixes applied, and overall readiness.
 - Tests: PASS/FIXED
 
 ### P2 Pillars
-- Naming: SKIP (Simplify agent)
-- Consistency: SKIP (Simplify agent)
+- Naming: SKIP (Polish agent)
+- Consistency: SKIP (Polish agent)
 - Documentation: PASS/FIXED
 
 ### Summary
@@ -144,6 +144,6 @@ For complete report templates and examples:
 ## Integration
 
 Used by:
-- **Scrutinize agent**: Dedicated self-review in fresh context after the Code agent completes
+- **Harden agent**: Dedicated self-review in fresh context after the Code agent completes
 
 The self-review ensures implementations meet quality standards before external review, catching issues early.

package/src/assets/skills/quality-gates/references/report-template.md

@@ -48,8 +48,8 @@ Use this template when generating your self-review report.
 
 | Pillar | Status | Notes |
 |--------|--------|-------|
-| Naming | SKIP | Simplify agent |
-| Consistency | SKIP | Simplify agent |
+| Naming | SKIP | Polish agent |
+| Consistency | SKIP | Polish agent |
 | Documentation | PASS/FIXED | {details if fixed} |
 
 **Fixes Applied** (if any):
@@ -109,8 +109,8 @@ Add user profile update endpoint
 
 | Pillar | Status | Notes |
 |--------|--------|-------|
-| Naming | SKIP | Simplify agent |
-| Consistency | SKIP | Simplify agent |
+| Naming | SKIP | Polish agent |
+| Consistency | SKIP | Polish agent |
 | Documentation | PASS | JSDoc on public methods |
 
 ---
@@ -169,8 +169,8 @@ Implement order cancellation flow
 
 | Pillar | Status | Notes |
 |--------|--------|-------|
-| Naming | SKIP | Simplify agent |
-| Consistency | SKIP | Simplify agent |
+| Naming | SKIP | Polish agent |
+| Consistency | SKIP | Polish agent |
 | Documentation | FIXED | Added JSDoc explaining cancellation rules |
 
 **Fixes Applied**:
@@ -237,7 +237,7 @@ before implementing refund feature.
 |--------|--------|------------------------|
 | PASS | No issues found for this pillar | No change was needed |
 | FIXED | Issue found and resolved | Fixes were committed and every P0 and P1 is fixed |
-| SKIP | Naming and Consistency only - owned by the Simplify agent | - |
+| SKIP | Naming and Consistency only - owned by the Polish agent | - |
 | BLOCKED | Cannot fix - requires escalation | A P0 cannot be fixed in scope |
 
 ---