devflow-kit 3.6.0 → 3.8.0

package/dist/cli/commands/memory.js

@@ -40,7 +40,7 @@ const MEMORY_HOOK_CONFIG = {
  *
  * D-EXACT-HOOK-OWNER (hooks.ts): matched as command ENDINGS under any directory —
  * the v1 (≤ v1.2) direct `.sh` scripts, then the retired `run-hook` markers of the
- * prompt-capture, learning, decisions, knowledge-refresh, sidecar and dream
+ * prompt-capture, curation, decisions, knowledge-refresh, sidecar and dream
  * pipelines — never as substrings, so a user's hook that mentions one is theirs.
  */
 const LEGACY_HOOK_SUFFIXES = {
@@ -56,6 +56,24 @@ const LEGACY_HOOK_SUFFIXES = {
         'sidecar-evaluate', 'dream-evaluate',
     ].map(runHookSuffix),
 };
+/**
+ * The lowest Claude Code the memory worker runs on: the lowest version on which the
+ * worker's write was measured to be limited to its staged file (2026-10-15,
+ * docs/reference/platform-assumptions.md). Below it the worker does not run and logs one
+ * line. `background-memory-update` holds the same value as MEMORY_MIN_PERMISSION_VERSION;
+ * a test holds the two equal.
+ */
+export const MEMORY_MIN_PERMISSION_VERSION = '2.1.269';
+/** The note `devflow init` shows at its working-memory step. */
+export function workingMemoryNote() {
+    return ('Preserves session context across /clear, restarts, and context\n' +
+        'compaction. Clear your session at any point and resume right\n' +
+        'where you left off.\n\n' +
+        'Runs a background agent on session stop that consumes additional\n' +
+        'tokens. Consider skipping if token usage is a concern.\n' +
+        `Needs Claude Code ${MEMORY_MIN_PERMISSION_VERSION} or newer.\n` +
+        'Applies to every project.');
+}
 /** D-EXACT-HOOK-OWNER: the current memory hook for `marker` (hooks.ts). */
 function isMemoryHook(marker) {
     return devflowHookOwner([marker]);
@@ -147,7 +165,7 @@ export function convergeMemoryHooks(settingsJson, enabled, devflowDir) {
  * --no-memory` and `devflow memory --disable`. Refused, deleting nothing, when
  * `.devflow` or `.devflow/memory` under `projectRoot` is a symbolic link
  * (D-CLI-NO-SYMLINK). ENOENT-tolerant; any other error propagates to the command
- * boundary, like drainLearningQueue.
+ * boundary, like drainCurationQueue.
  */
 export async function drainMemoryQueue(projectRoot) {
     const memoryDir = getMemoryDir(projectRoot);

package/dist/cli/commands/prompt-io.js

@@ -9,8 +9,45 @@
  * D-PROMPT-IO: WizardPromptIO is the base DI seam for all two-action wizard
  * steps (note + boolean select). Modules that add a third prompt extend this
  * interface with an intersection type (e.g. CompliancePromptIO).
+ *
+ * The shared wizard gate predicate (shouldRunPromptedWizardStep) lives here too,
+ * beside the seam every prompted step already imports.
  */
 import * as p from '@clack/prompts';
+// ── Shared gate predicate ─────────────────────────────────────────────────────
+/**
+ * Determines whether a wizard step that runs on both wizard paths should run for a
+ * given init invocation.
+ *
+ * Gate table (key on modePromptShown, never on the mode name):
+ *
+ *   --recommended flag / !isTTY fallback             → no (promptless contract preserved)
+ *   Interactive mode-prompt → Recommended            → yes (modePromptShown=true)
+ *   --advanced flag / re-init (banner path)          → yes (mode='advanced', isTTY=true)
+ *   Interactive mode-prompt → Advanced               → yes (modePromptShown=true)
+ *   Any path with the step's CLI flag                → no (hasCliOverride wins)
+ *
+ * A step that wires only the Recommended path is dead on every re-init, because re-init
+ * is Advanced-only by construction, so each step calls this predicate from both paths.
+ * The gate-level step delegates here. The attribution step is Advanced-only by design
+ * and does not use this table.
+ *
+ * Pure predicate — no side effects, fully testable without a TTY.
+ */
+export function shouldRunPromptedWizardStep(input) {
+    if (input.hasCliOverride)
+        return false;
+    if (!input.isTTY)
+        return false;
+    // Advanced path: non-TTY has already exit-1'd, so isTTY=true here → always run.
+    // Covers: --advanced flag, re-init banner path, interactive-prompt → advanced.
+    if (input.mode === 'advanced')
+        return true;
+    // Recommended path: only run when the Setup-mode p.select actually ran
+    // (user made an active choice). --recommended flag and !isTTY fallback never set
+    // modePromptShown=true, preserving their promptless contracts.
+    return input.modePromptShown;
+}
 // ── Shared clack adapters ─────────────────────────────────────────────────────
 /** Real clack adapter for the note prompt. */
 export function clackNote(message, title) {

package/dist/cli/commands/uninstall.js

@@ -31,6 +31,8 @@ import { stripFlags } from '../../core/flags.js';
 import { stripDevflowTeammateModeFromJson } from '../../core/teammate-mode-cleanup.js';
 import { getPackageRoot, isContainedIn } from '../../core/paths.js';
 import { firstSymbolicLink } from '../../core/linked-path.js';
+import { MANIFEST_LOCK_NAME, MANIFEST_LOCK_STALE_MARK } from '../../core/manifest-lock.js';
+import { CURATION_TUNING_FILE_NAME, LEGACY_NAMES, MOVE_JOURNAL_SUFFIX, MOVE_LOCK_PREFIX, MOVE_LOCK_SUFFIX } from '../../core/project-paths.js';
 import { restampInstalledCommands } from '../../targets/claude-code/language-stamp.js';
 import { installCommandsAndAgents } from '../../targets/claude-code/installer.js';
 /**
@@ -489,8 +491,10 @@ export function userContentPaths(devflowDir) {
             const name = `${TRACKER_LEGACY_CONVENTIONS_FILE}.${id}.bak`;
             return { relPath: name, label: `${name} (previous issue tracker conventions)` };
         }),
-        // learning.json — global curate agent tuning config
-        { relPath: 'learning.json', label: 'learning.json' },
+        // The global curate agent tuning config, under both its names: the new name on an
+        // upgraded machine, and the old name, which a downgraded machine can still hold.
+        { relPath: CURATION_TUNING_FILE_NAME, label: CURATION_TUNING_FILE_NAME },
+        { relPath: LEGACY_NAMES.tuningFile, label: LEGACY_NAMES.tuningFile },
         // hud.json — user HUD enable/disable preference and display config
         { relPath: 'hud.json', label: 'hud.json (HUD configuration)' },
     ];
@@ -527,6 +531,54 @@ export async function enumerateUserDevFlowContent(devflowDir) {
     }
     return items;
 }
+/** `text` as a regular-expression source, every character literal. */
+function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** The name of a move lock or journal: the shared prefix, a 16-digit lowercase hex key, then `suffix`. */
+function moveFileShape(suffix) {
+    return new RegExp(`^${escapeRegExp(MOVE_LOCK_PREFIX)}[0-9a-f]{16}${escapeRegExp(suffix)}$`);
+}
+/**
+ * The curation move's lock, one directory per ledger root, taken directly in the machine
+ * directory: `.curation-move-<16 lowercase hex>.lock`. The store builds the name from a
+ * hash of the real ledger root, so the names exist only on disk. The prefix and the
+ * suffix are the ones the path helpers hold (project-paths.ts).
+ */
+const CURATION_MOVE_LOCK_SHAPE = moveFileShape(MOVE_LOCK_SUFFIX);
+/**
+ * The curation move's journal, one regular file per ledger root, beside the lock:
+ * `.curation-move-<16 lowercase hex>.journal`, with the same key as the lock. It exists
+ * only while a set move is unfinished, and a crash leaves it behind. A file named
+ * `.curation-move.journal` inside a project's old ledger folder is no journal of the
+ * move and is not matched here.
+ */
+const CURATION_MOVE_JOURNAL_SHAPE = moveFileShape(MOVE_JOURNAL_SUFFIX);
+/**
+ * The manifest lock, a directory in the machine directory (manifest-lock.ts), and the
+ * directory a stale break moves aside: `manifest.json.lock` and
+ * `manifest.json.lock.stale-<digits>-<12 lowercase hex>`. A holder that dies in its
+ * critical section leaves the first, a break whose removal failed leaves the second.
+ */
+const MANIFEST_LOCK_SHAPE = new RegExp(`^${escapeRegExp(MANIFEST_LOCK_NAME)}(?:${escapeRegExp(MANIFEST_LOCK_STALE_MARK)}[0-9]+-[0-9a-f]{12})?$`);
+/** Whether `child` of `devflowDir` is a real directory (a link is not followed). */
+async function isRealDirectory(devflowDir, child) {
+    try {
+        return (await fs.lstat(path.join(devflowDir, child))).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether `child` of `devflowDir` is a regular file (a link is not followed). */
+async function isRegularFile(devflowDir, child) {
+    try {
+        return (await fs.lstat(path.join(devflowDir, child))).isFile();
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Expand `installArtifactPaths` against real disk.
  *
@@ -553,8 +605,15 @@ export async function resolveInstallArtifactPaths(devflowDir) {
             }
         }
         for (const child of children) {
-            if (child.startsWith(entry.relPath))
-                resolved.push({ relPath: child, isDir: entry.isDir });
+            if (!child.startsWith(entry.relPath))
+                continue;
+            if (entry.shape !== undefined && !entry.shape.test(child))
+                continue;
+            if (entry.realDirOnly === true && !(await isRealDirectory(devflowDir, child)))
+                continue;
+            if (entry.realFileOnly === true && !(await isRegularFile(devflowDir, child)))
+                continue;
+            resolved.push({ relPath: child, isDir: entry.isDir });
         }
     }
     return resolved;
@@ -621,6 +680,18 @@ export function installArtifactPaths(devflowDir) {
         // A prefix, because the names exist only on disk. Content is a scrubbed copy
         // that was never placed, so it is machine state like the three above.
         { relPath: TRACKER_STAGED_PREFIX, isPrefix: true },
+        // The curation move's per-root lock directory. A crash between taking the lock and
+        // releasing it leaves one behind, and its name carries a hash that exists only on disk.
+        // Only a real directory of exactly that shape goes; the move's skip markers sit under
+        // logs/ and go with it.
+        { relPath: MOVE_LOCK_PREFIX, isPrefix: true, isDir: true, shape: CURATION_MOVE_LOCK_SHAPE, realDirOnly: true },
+        // The move's journal beside it. A crash between two renames of the ledger set leaves
+        // one behind. Only a regular file of exactly that shape goes.
+        { relPath: MOVE_LOCK_PREFIX, isPrefix: true, shape: CURATION_MOVE_JOURNAL_SHAPE, realFileOnly: true },
+        // The manifest lock, and the directory a stale break moved aside. A crash inside the
+        // critical section leaves the first; a failed cleanup leaves the second, whose name
+        // carries a pid and a random suffix. Only a real directory of exactly that shape goes.
+        { relPath: MANIFEST_LOCK_NAME, isPrefix: true, isDir: true, shape: MANIFEST_LOCK_SHAPE, realDirOnly: true },
         // per-project hook logs (logs/{project-slug}/) AND global logs — remove the
         // whole logs/ tree; covers proxy.log, debug logs, and any project-slug dirs.
         { relPath: 'logs', isDir: true },
@@ -644,7 +715,8 @@ export function installArtifactPaths(devflowDir) {
  * so an entry here is deleted even when the user answers "no" to the full wipe.
  * User-authored state (everything in `userContentPaths`: skill/rule shadows,
  * preference-profile.md, the tracker conventions with the legacy tracker.md and
- * its backups, learning.json, hud.json) is removed only by the confirmed full-dir rm.
+ * its backups, the global tuning file under both names, hud.json) is removed only by
+ * the confirmed full-dir rm.
  * agent-models.json is an INSTALL ARTIFACT (stale per-agent overrides silently
  * re-apply to renamed/deleted agents on reinstall — AC-P1-F4) and therefore
  * belongs in this list, not in enumerateUserDevFlowContent.
@@ -953,7 +1025,7 @@ export async function refreshRetainedCommandsAndAgents(opts) {
             plugins: retained,
             agentsMap: buildAssetMaps(retained).agentsMap,
             claudeDir,
-            learning: manifest.features.learning,
+            curation: manifest.features.curation,
             trackerServers: effectiveTrackerServers(manifest.features.tracker),
             warn: (msg) => p.log.warn(msg),
         });
@@ -1073,7 +1145,7 @@ export async function runSelectivePhaseForScope(opts) {
  * FULL PHASE (per scope): revert agent model overrides, remove all Devflow
  * assets from the scope, then perform scope-appropriate devflowDir cleanup.
  *
- * Local scope: remove only install artifacts — project data (memory, learning,
+ * Local scope: remove only install artifacts — project data (memory, curation,
  *   docs, features) is always preserved under the git root.
  * User scope: interactive TTY with user-authored content → confirm before wiping
  *   ~/.devflow/; non-interactive or no user content → artifacts-only.
@@ -1115,11 +1187,11 @@ export async function runFullPhaseForScope(opts) {
     await removeAllDevFlow(claudeDir, devflowScriptsDir, verbose, mayChange);
     if (scope === 'local') {
         // Local scope: devflowDir is gitRoot/.devflow/ which holds project data
-        // (memory, learning, features, docs, config.json). Never remove those —
+        // (memory, curation, features, docs, config.json). Never remove those —
         // only remove install artifacts: scripts/ (done above) + manifest.json and
         // the other Devflow-generated artifacts (see removeDevFlowInstallArtifacts).
         await removeDevFlowInstallArtifacts(devflowDir, verbose, mayChange);
-        p.log.info('Local project data (memory, learning, features, docs) preserved');
+        p.log.info('Local project data (memory, curation, features, docs) preserved');
     }
     else {
         // User scope (devflowDir = ~/.devflow/): offer full cleanup behind a confirm gate

package/dist/cli.js

@@ -11,7 +11,7 @@ import { skillsCommand } from './cli/commands/skills.js';
 import { hudCommand } from './cli/commands/hud.js';
 import { flagsCommand } from './cli/commands/flags.js';
 import { knowledgeCommand } from './cli/commands/knowledge/index.js';
-import { learningCommand } from './cli/commands/learning.js';
+import { curationCommand } from './cli/commands/curation.js';
 import { rulesCommand } from './cli/commands/rules.js';
 import { debugCommand } from './cli/commands/debug.js';
 import { securityCommand } from './cli/commands/security.js';
@@ -21,6 +21,7 @@ import { agentsCommand } from './cli/commands/agents.js';
 import { complianceCommand } from './cli/commands/compliance.js';
 import { behaviorCommand } from './cli/commands/behavior.js';
 import { trackerCommand } from './cli/commands/tracker.js';
+import { gatesCommand } from './cli/commands/gates.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Read version from package.json
@@ -41,7 +42,7 @@ program.addCommand(skillsCommand);
 program.addCommand(hudCommand);
 program.addCommand(flagsCommand);
 program.addCommand(knowledgeCommand);
-program.addCommand(learningCommand);
+program.addCommand(curationCommand);
 program.addCommand(rulesCommand);
 program.addCommand(debugCommand);
 program.addCommand(securityCommand);
@@ -51,6 +52,7 @@ program.addCommand(agentsCommand);
 program.addCommand(complianceCommand);
 program.addCommand(behaviorCommand);
 program.addCommand(trackerCommand);
+program.addCommand(gatesCommand);
 // Handle no command (bare `devflow`) or unknown subcommand.
 // When Commander sees an unrecognised first argument it does not route to any
 // registered subcommand; instead the root action fires with that argument

package/dist/commands/bug-analysis.md

@@ -3,7 +3,7 @@ description: Proactive bug finding with static and semantic analysis — hunts r
 ---
 # Bug Analysis Command
 
-Run a proactive bug analysis on the current branch by combining static analysis tools with parallel semantic analyzers, then synthesizing results into an actionable bug report. Supports incremental analysis, timestamped report directories, and `/resolve` compatibility.
+Run a proactive bug analysis on the current branch by combining static analysis tools with parallel semantic analyzers, then synthesizing results into an actionable bug report.
 
 ## Usage
 
@@ -55,16 +55,16 @@ Agent(subagent_type="Git", run_in_background=false):
 PR_TEST_PLAN_BLOCK: {PR_TEST_PLAN_BLOCK verbatim, or (none)}
 APPLY_CONVENTIONS: {APPLY_CONVENTIONS}
 Validate branch, commit if needed, push, create PR if needed.
-Return: branch, base_branch, branch-slug, PR#"
+Return: branch, base_branch, base_ref, branch-slug, PR#"
 ```
 
-**Extract from response:** `branch`, `base_branch`, `branch_slug`, `pr_number`.
+**Extract from response:** `branch`, `base_branch`, `base_ref`, `branch_slug`, `pr_number`. Stop with cause and fix when the Base line reads (rejected) or `branch_slug` does not match the slug pattern above; name the Git agent's fix, never your own, and for the slug the allowed characters, never its value.
 
 **Fetch PR body** (after extracting `pr_number`):
 ```bash
 PR_DESCRIPTION=$(gh pr view {pr_number} --json body --jq '.body' 2>/dev/null || echo "(none)")
 ```
-If `pr_number` is absent or the command fails, set `PR_DESCRIPTION` to `(none)`.
+If `pr_number` is absent, set `PR_DESCRIPTION` to `(none)`.
 
 ### Phase 2: Static Analysis
 
@@ -75,14 +75,15 @@ If `pr_number` is absent or the command fails, set `PR_DESCRIPTION` to `(none)`.
 **Produces:** DIFF_RANGE, ANALYSIS_DIR
 **Requires:** BRANCH_INFO
 
-1. Check `{worktree}/.devflow/docs/bug-analysis/{branch-slug}/.last-analysis-head`:
+1. Check `{gd}/devflow/bug-analysis/{branch-slug}/.last-analysis-head`, `{gd}` being what `git -C "{worktree}" rev-parse --absolute-git-dir` prints:
    - **If exists AND `--full` NOT set:**
-     - Read the SHA from the file
-     - Verify reachable: `git cat-file -t {sha}` — if exit code non-zero (rebase invalidated SHA), fall through to full
+     - The stored analysis head is checked as a commit ID: use it only when it is exactly 40 or 64 lowercase hex, else take the full-range path
+     - Verify reachable: `git -C "{worktree}" cat-file -t {sha}` must print `commit`; if not (rebase invalidated SHA), take the full-range path
      - If SHA == current HEAD → "No new commits since last analysis. Use --full for a full re-analysis." Stop.
      - Set `DIFF_RANGE` to `{sha}...HEAD`
-   - **If not exists, unreachable SHA, or `--full`:**
-     - Set `DIFF_RANGE` to `{base_branch}...HEAD`
+   - **Full-range path (no marker, or `--full`):**
+     - Stop as for a (rejected) Base line unless `base_ref` is 40 or 64 hex.
+     - Set `DIFF_RANGE` to `{base_ref}...HEAD`
 2. Generate timestamp: `YYYY-MM-DD_HHMM`. If directory already exists (same-minute collision), append seconds (`YYYY-MM-DD_HHMMSS`).
 3. Create timestamped analysis directory: `mkdir -p "{worktree}/.devflow/docs/bug-analysis/{branch-slug}/{timestamp}/"`
 4. Set `ANALYSIS_DIR` to that path.
@@ -95,7 +96,7 @@ If `pr_number` is absent or the command fails, set `PR_DESCRIPTION` to `(none)`.
 CHANGED_FILES=$(git diff --name-only {DIFF_RANGE})
 ```
 
-Store result as `CHANGED_FILES` — used throughout Steps 2d and Phase 4 to avoid repeated git invocations and ensure consistency.
+Store as `CHANGED_FILES`; Steps 2d and Phase 4 read it. A non-zero diff exit stops.
 
 If output is empty → "No changes to analyze." Stop.
 
@@ -124,7 +125,7 @@ Skip if `--no-static` flag provided or all tools unavailable.
 
 Run available tools on the changed files (from `CHANGED_FILES` computed in Step 2b).
 
-**Semgrep and Snyk run in parallel** — launch both in the background, then wait for both before proceeding to CodeQL. CodeQL is conditional and sequential (it needs Semgrep/Snyk results to decide whether to run).
+**Semgrep and Snyk run in parallel** — launch both in the background, then wait for both before proceeding to CodeQL. CodeQL is conditional and sequential.
 
 **Semgrep** (if available):
 ```bash
@@ -135,11 +136,9 @@ Parse SARIF output → extract findings.
 
 **Snyk Code** (if available):
 ```bash
-# Run a single project-level scan; filter SARIF results programmatically to CHANGED_FILES before LLM processing.
-# Per-file invocation via xargs would invoke snyk O(n) times and --file is for dependency scanning, not source code.
+# One project-level scan (a per-file xargs run would invoke snyk O(n) times; --file is for dependency scans).
 SNYK_SARIF=$(timeout 300 snyk code test --sarif 2>/dev/null)
-# Programmatic filter: keep only results whose file path appears in CHANGED_FILES.
-# This is defense-in-depth — filtering at the data layer before the LLM agent sees any output.
+# Programmatic filter: keep only results whose file path is in CHANGED_FILES — defense-in-depth, before the LLM agent sees any output.
 SNYK_FILTERED=$(echo "$SNYK_SARIF" | jq --argjson files "$(echo "$CHANGED_FILES" | jq -R . | jq -s .)" \
   '.runs[].results |= map(select(.locations[].physicalLocation.artifactLocation.uri as $uri | $files | index($uri) != null))' \
   2>/dev/null || echo "$SNYK_SARIF")
@@ -165,7 +164,7 @@ trap - EXIT INT TERM
 ```
 Parse `CODEQL_SARIF` → extract findings. If database creation fails, `CODEQL_EXIT` is non-zero — skip CodeQL findings and note it. The `trap` guarantees cleanup on SIGTERM/SIGINT/EXIT so orphaned temp directories do not accumulate across interrupted sessions.
 
-**Normalize** all findings to unified table, cap at top 50 by severity. Truncate each Description entry to 200 characters maximum to bound the serialized size of `STATIC_FINDINGS`:
+**Normalize** all findings to unified table, cap at top 50 by severity. Truncate each Description entry to 200 characters maximum:
 
 | Tool | File:Line | CWE | Severity | Title | Description |
 |------|-----------|-----|----------|-------|-------------|
@@ -187,13 +186,13 @@ If no tool produced findings: set `STATIC_FINDINGS` to `(none)`.
 node "$HOME/.devflow/scripts/resolve-settings.cjs" "{root}" 2>/dev/null; echo "exit=$?"
 ```
 
-Accept the output only when it is exactly two lines: `exit=0` last and, before it, one line of the form `TRACKER=<github|jira|linear> TRACKER_SOURCE=<project|personal|machine|default> TRACKER_WARN=<none|mismatch|invalid> SITE=<none|https://<host>> KEY=<none|<key>> REVIEW_PUBLICATION=<off|auto|full> COMPLIANCE=<off|generic|<id>[,<id>…]> MEMORY=<on|off> LEARNING=<on|off> KNOWLEDGE=<on|off>` — these fields, in this order, nothing else, where `<host>` is a lowercase dotted host name alone, `<key>` is 2–10 of `A-Z`, `0-9` and `_` starting with a letter, and each `<id>` is one of `gdpr`, `hipaa`, `pci-dss`, `soc2`, `iso-27001`, `sox`. **Anything else** (a non-zero exit, no line, extra text, or a missing, reordered or unlisted field or value) ⇒ use `TRACKER=github TRACKER_SOURCE=default TRACKER_WARN=invalid SITE=none KEY=none REVIEW_PUBLICATION=off COMPLIANCE=generic MEMORY=on LEARNING=on KNOWLEDGE=off` instead.
+Accept the output only when it is exactly two lines: `exit=0` last and, before it, one line of the form `TRACKER=<github|jira|linear> TRACKER_SOURCE=<project|personal|machine|default> TRACKER_WARN=<none|mismatch|invalid> SITE=<none|https://<host>> KEY=<none|<key>> REVIEW_PUBLICATION=<off|auto|full> COMPLIANCE=<off|generic|<id>[,<id>…]> MEMORY=<on|off> CURATION=<on|off> KNOWLEDGE=<on|off> GATE_LEVEL=<full|standard|lean>` — these fields, in this order, nothing else, where `<host>` is a lowercase dotted host name alone, `<key>` is 2–10 of `A-Z`, `0-9` and `_` starting with a letter, and each `<id>` is one of `gdpr`, `hipaa`, `pci-dss`, `soc2`, `iso-27001`, `sox`. **Anything else** (a non-zero exit, no line, extra text, or a missing, reordered or unlisted field or value) ⇒ use `TRACKER=github TRACKER_SOURCE=default TRACKER_WARN=invalid SITE=none KEY=none REVIEW_PUBLICATION=off COMPLIANCE=generic MEMORY=on CURATION=on KNOWLEDGE=off GATE_LEVEL=full` instead.
 
-The accepted line is the only source of these values: the script alone folds the committed `.devflow/project.json`, the personal `.devflow/config.json` and the machine manifest.
+The accepted line is the only source of these values.
 
 ### Load DECISIONS_CONTEXT
 
-When the settings line says `LEARNING=off`, set `DECISIONS_CONTEXT` to `(none)` and skip this step, locating no ledger and reading no index.
+When the settings line says `CURATION=off`, set `DECISIONS_CONTEXT` to `(none)` and skip this step, locating no ledger and reading no index.
 
 The decisions ledger belongs to the repository, not to one checkout: a linked worktree reads the main worktree's copy, a subdirectory session the repository root's. Locate it with ONE git call, run from the start directory — `WORKTREE_PATH` if provided, otherwise cwd (`devflow:worktree-support`):
 
@@ -207,11 +206,11 @@ Line 1 is the checkout's toplevel, line 2 the common git directory. A git older
 2. **The toplevel** — line 1, or on an older git the line after the echoed flag.
 3. **The start directory itself** — when the command failed or printed no absolute toplevel (outside a git repository).
 
-This is the rule the learning hooks apply, so you read the index the Curate agent writes.
+This is the rule the curation hooks apply, so you read the index the Curate agent writes.
 
 **Step 1 — Read the pre-rendered index:**
 
-Attempt to read `{ledger}/.devflow/learning/index.md`.
+Attempt to read `{ledger}/.devflow/curation/index.md`.
 
 - If the file exists and contains non-empty content: use that content as `DECISIONS_CONTEXT`.
 - If the file is absent or empty: set `DECISIONS_CONTEXT` to `(none)`.
@@ -355,13 +354,14 @@ Output: {ANALYSIS_DIR}/bug-analysis-summary.md"
 
 **Requires:** BRANCH_INFO, ANALYSIS_DIR
 
-1. Write current HEAD SHA to `{worktree}/.devflow/docs/bug-analysis/{branch-slug}/.last-analysis-head`
+1. In one Bash call run `M="$(git -C "{worktree}" rev-parse --absolute-git-dir)/devflow/bug-analysis/{branch-slug}" && mkdir -p "$M" && git -C "{worktree}" rev-parse HEAD > "$M/.last-analysis-head"`. A failed or refused write never stops the run and is not retried another way.
 2. Report to user:
 
 ```
 ## Bug Analysis Complete
 
 **Branch**: {branch} -> {base_branch}
+{any base `TRACEABILITY: DEGRADED` line from Phase 1, as returned}
 **Analysis**: {ANALYSIS_DIR}
 
 ### Risk Assessment: {risk_level}
@@ -397,11 +397,7 @@ Run `/resolve` to process and fix these findings.
 │  └─ Git agent (ensure-pr-ready)
 │
 ├─ Phase 2: Static Analysis
-│  ├─ Step 2a: Incremental detection + timestamp setup
-│  ├─ Step 2b: Check changed files (stop if none)
-│  ├─ Step 2c: Tool availability check
-│  └─ Step 2d: Tiered static analysis (semgrep → snyk → codeql)
-│              Write static-findings.md
+│  └─ 2a incremental range, 2b changed files (stop if none), 2c tools, 2d semgrep → snyk → codeql
 │
 ├─ Phase 3: Context Loading
 │  ├─ index.md (pre-rendered) → DECISIONS_CONTEXT
@@ -412,10 +408,7 @@ Run `/resolve` to process and fix these findings.
 │  └─ Detect active focuses (security + functional always; integration + usability conditional)
 │
 ├─ Phase 5: Bug Analysis (PARALLEL)
-│  ├─ Debug agent: security (+ STATIC_FINDINGS)
-│  ├─ Debug agent: functional
-│  ├─ Debug agent: integration (conditional)
-│  └─ Debug agent: usability (conditional)
+│  └─ Debug agent per active focus (security also reads STATIC_FINDINGS)
 │
 ├─ Phase 6: Synthesis
 │  └─ Synthesize agent (mode: bug-analysis)
@@ -431,16 +424,12 @@ Run `/resolve` to process and fix these findings.
 |------|----------|
 | No new commits since last analysis | Stop: "No new commits since last analysis. Use --full for a full re-analysis." |
 | Rebase invalidates `.last-analysis-head` SHA | `git cat-file -t` check fails → fallback to full diff |
-| Zero changed files in DIFF_RANGE | Stop: "No changes to analyze." |
+| Zero changed files in DIFF_RANGE with exit 0 | Stop: "No changes to analyze." |
 | Same-minute analysis collision | `mkdir` with seconds suffix (`YYYY-MM-DD_HHMMSS`) |
 | All static tools unavailable | Warn, proceed with semantic-only analysis |
 | `--no-static` flag | Skip Phase 2c and 2d entirely; `STATIC_FINDINGS=(none)` |
 | `--full` flag | Bypass incremental detection (Step 2a), run full diff from base |
 | CodeQL database creation fails | Skip CodeQL, note in output, continue with other tools |
-| Static tool produces no findings | `STATIC_FINDINGS=(none)` — normal, proceed with semantic analysis |
-| No plan artifact found | `PLAN_CONTEXT=(none)`, `ACCEPTANCE_RULES=(none)` — proceed without acceptance criteria |
-| `integration` focus skipped | Not spawned when only 1 directory changed |
-| `usability` focus skipped | Not spawned when no UI files changed |
 
 ## Resolve Compatibility