devflow-kit 3.7.0 → 3.9.0

package/dist/commands/resolve.md

@@ -72,7 +72,7 @@ For each worktree:
 2. **If `--review {timestamp}` provided:** use that specific directory (not supported in multi-worktree mode)
 3. **Otherwise:** sort directories by name descending (timestamps are naturally sortable), scan the 10 most recent directories only. Select the first that contains `review-summary.md` (complete review)
 4. **If latest directory already has `resolution-summary.md`:** the review is resolved — check bug-analysis fallback (step 5b).
-5. **Legacy fallback:** if no timestamped subdirectories exist but flat `*.md` files do in `{worktree}/.devflow/docs/reviews/{branch-slug}/`, read them directly (backwards compatible).
+5. **Legacy fallback:** if no timestamped subdirectories exist but flat `*.md` files do in `{worktree}/.devflow/docs/reviews/{branch-slug}/`, read them directly.
 
 **5b. Bug analysis fallback** — if no qualifying review directory found (no reviews exist, or all resolved):
 - List directories in `{worktree}/.devflow/docs/bug-analysis/{branch-slug}/`
@@ -86,21 +86,21 @@ Set `TARGET_DIR` to the selected review or bug-analysis directory path, and `TAR
 
 #### Step 0d: Load Project Decisions
 
-**Produces:** DECISIONS_CONTEXT, FEATURE_KNOWLEDGE, FEATURE_KNOWLEDGE_RULES, EVIDENCE_POLICY, ISSUE_REQUIRED, APPLY_CONVENTIONS, REQUIRE_NON_AUTHOR_APPROVAL, REVIEW_PUBLICATION, RESOLUTION_TS
+**Produces:** DECISIONS_CONTEXT, FEATURE_KNOWLEDGE, FEATURE_KNOWLEDGE_RULES, EVIDENCE_POLICY, ISSUE_REQUIRED, APPLY_CONVENTIONS, REQUIRE_NON_AUTHOR_APPROVAL, REVIEW_PUBLICATION, RESOLUTION_TS, GATE_LEVEL
 
-**Resolve the settings line** once per worktree root, reusing a line this run already resolved for the same root. `{root}` is the worktree the values are for — the repository root when the run has one worktree:
+**Resolve the settings line** once per worktree root, reusing a line this run already resolved for the same root. `{root}` is the worktree the values are for — the repository root in a one-worktree run:
 
 ```bash
 node "$HOME/.devflow/scripts/resolve-settings.cjs" "{root}" 2>/dev/null; echo "exit=$?"
 ```
 
-Accept the output only when it is exactly two lines: `exit=0` last and, before it, one line of the form `TRACKER=<github|jira|linear> TRACKER_SOURCE=<project|personal|machine|default> TRACKER_WARN=<none|mismatch|invalid> SITE=<none|https://<host>> KEY=<none|<key>> REVIEW_PUBLICATION=<off|auto|full> COMPLIANCE=<off|generic|<id>[,<id>…]> MEMORY=<on|off> LEARNING=<on|off> KNOWLEDGE=<on|off> GATE_LEVEL=<full|standard|lean>` — these fields, in this order, nothing else, where `<host>` is a lowercase dotted host name alone, `<key>` is 2–10 of `A-Z`, `0-9` and `_` starting with a letter, and each `<id>` is one of `gdpr`, `hipaa`, `pci-dss`, `soc2`, `iso-27001`, `sox`. **Anything else** (a non-zero exit, no line, extra text, or a missing, reordered or unlisted field or value) ⇒ use `TRACKER=github TRACKER_SOURCE=default TRACKER_WARN=invalid SITE=none KEY=none REVIEW_PUBLICATION=off COMPLIANCE=generic MEMORY=on LEARNING=on KNOWLEDGE=off GATE_LEVEL=full` instead.
+Accept the output only when it is exactly two lines: `exit=0` last and, before it, one line of the form `TRACKER=<github|jira|linear> TRACKER_SOURCE=<project|personal|machine|default> TRACKER_WARN=<none|mismatch|invalid> SITE=<none|https://<host>> KEY=<none|<key>> REVIEW_PUBLICATION=<off|auto|full> COMPLIANCE=<off|generic|<id>[,<id>…]> MEMORY=<on|off> CURATION=<on|off> KNOWLEDGE=<on|off> GATE_LEVEL=<full|standard|lean>` — these fields, in this order, nothing else, where `<host>` is a lowercase dotted host name alone, `<key>` is 2–10 of `A-Z`, `0-9` and `_` starting with a letter, and each `<id>` is one of `gdpr`, `hipaa`, `pci-dss`, `soc2`, `iso-27001`, `sox`. **Anything else** (a non-zero exit, no line, extra text, or a missing, reordered or unlisted field or value) ⇒ use `TRACKER=github TRACKER_SOURCE=default TRACKER_WARN=invalid SITE=none KEY=none REVIEW_PUBLICATION=off COMPLIANCE=generic MEMORY=off CURATION=off KNOWLEDGE=off GATE_LEVEL=full` instead.
 
 The accepted line is the only source of these values.
 
 ### Load DECISIONS_CONTEXT
 
-When the settings line says `LEARNING=off`, set `DECISIONS_CONTEXT` to `(none)` and skip this step, locating no ledger and reading no index.
+When the settings line says `CURATION=off`, set `DECISIONS_CONTEXT` to `(none)` and skip this step, locating no ledger and reading no index.
 
 The decisions ledger belongs to the repository, not to one checkout: a linked worktree reads the main worktree's copy, a subdirectory session the repository root's. Locate it with ONE git call, run from the start directory — `WORKTREE_PATH` if provided, otherwise cwd (`devflow:worktree-support`):
 
@@ -114,11 +114,11 @@ Line 1 is the checkout's toplevel, line 2 the common git directory. A git older
 2. **The toplevel** — line 1, or on an older git the line after the echoed flag.
 3. **The start directory itself** — when the command failed or printed no absolute toplevel (outside a git repository).
 
-This is the rule the learning hooks apply, so you read the index the Curate agent writes.
+This is the rule the curation hooks apply, so you read the index the Curate agent writes.
 
 **Step 1 — Read the pre-rendered index:**
 
-Attempt to read `{ledger}/.devflow/learning/index.md`.
+Attempt to read `{ledger}/.devflow/curation/index.md`.
 
 - If the file exists and contains non-empty content: use that content as `DECISIONS_CONTEXT`.
 - If the file is absent or empty: set `DECISIONS_CONTEXT` to `(none)`.
@@ -216,6 +216,12 @@ Resolve this per worktree — unlike the evidence policy above, the settings lin
 
 Set it per worktree, from that worktree's lens, and pass that worktree's `COMPLIANCE_DIRECTIVE` to each of its Code and Fix spawns, on a line of its own.
 
+**Gate level.** Each worktree keeps its own `GATE_LEVEL`. When any is `standard` or `lean`, once per run, run `d="${CLAUDE_CONFIG_DIR:-}"; case "$d" in /*) ;; *) d="$HOME/.claude" ;; esac; printf '%s\n' "$d"` in Bash and Read `<that directory>/skills/devflow:agent-references/references/commands/resolve-levels.md` with the Read tool, and apply each row to the phase it names, as the reference says.
+
+- No row or rule overrides the next two lines.
+- If the Read fails, or the file has no `## Phases` heading with the `| Phase | standard | lean |` header, or a row breaks its grammar, apply no row in any worktree, keep every `GATE_LEVEL` and say `level reference unreadable: no level rows applied`.
+- No level changes the Triage security gate or the ESCALATED route. The Verification Gate, the CI gate and the compliance directive run at every level.
+
 **Mint `RESOLUTION_TS` once per run:** `date -u +%Y-%m-%dT%H:%M:%SZ`. Every worktree reuses it — the resolution comment's dedup marker is searched per PR, so one run key keeps a retry of this run deduplicated while the next /resolve on the same PR posts. Phase 5 writes it as the summary's `**Date**:` and Phase 9b-2 passes it, so the local file and the posted marker agree.
 
 ### Phase 1: Parse Issues
@@ -287,13 +293,15 @@ Follow devflow:apply-feature-knowledge for FEATURE_KNOWLEDGE."
 
 Wait for Triage agent to complete before proceeding. Parse verdict ledger from Triage agent output:
 - **ESCALATED**: Security issues requiring human escalation
-- **FIX_NOW**: Valid issues assigned to Code agents (with risk tier: Standard | Careful)
+- **FIX_NOW**: Valid issues assigned to Code agents (with risk tier: Standard | Careful | `Standard, prose only: edit text alone; agent instructions count as logic; if this issue needs a logic change, leave it unedited and name it`; any other value counts as Careful). SCOPE gives one `{id}: {tier}` line per issue.
 - **FALSE_POSITIVE**: Issues the Review agent got wrong (with cited evidence)
 - **BY_DESIGN**: Intentional code (with a recorded decision, stated in words, or a code doc citation)
 - **FIX_SEPARATE**: Valid but out of blast-radius scope (must become manage-debt ticket)
 - **TECH_DEBT**: Architectural overhaul only — LAST RESORT
 - **DUPLICATE**: Collapsed duplicate issue — carries `duplicate_of: <primary-id>` referencing the non-DUPLICATE primary; inherits the primary's outcome
 
+A ledger `### Summary` line `- Tiers: not applied (…)` is the level note.
+
 Collect every decision and pitfall the Triage agent's Reasoning columns state, in its words — the resolution summary is posted, so it never carries an ADR/PF ID.
 
 **Triage agent completeness assertion:** Verify the parsed ledger against ISSUES before proceeding:
@@ -309,10 +317,10 @@ Collect every decision and pitfall the Triage agent's Reasoning columns state, i
 **Produces:** BATCHES
 **Requires:** TRIAGE_RESULTS
 
-If FIX_NOW list is empty: skip to Phase 5 — write full summary (Phase 5), run manage-debt (Phase 9) if FIX_SEPARATE/TECH_DEBT exist, run thread resolution + resolution comment (Phase 9b), run merge readiness (Phase 9c), display results (Phase 10).
+If FIX_NOW list is empty: skip to Phase 5, then run Phases 9, 9b, 9c and 10.
 
 Otherwise, batch FIX_NOW issues for Code agent execution. **DUPLICATE issues are never dispatched** — they inherit the primary's outcome:
-- **Same-file issues** → one batch (one Code agent per file, sequential for same-file pairs)
+- **Same-file issues** → one batch (one Code agent per file)
 - **Distinct-file issues** → parallel Code agents
 - **Max 5 issues per batch** — chunk large sets
 
@@ -344,24 +352,27 @@ Spawn distinct-file batch Code agents **in a single message** (parallel). Sequen
 Collect from each Code agent:
 - `{status, commitShas, unresolved}` per batch
 - `## Verification` block (commands run + results)
+- An unresolved prose-only issue that Code names as needing a logic change, and whose type is not `security` → FIX_SEPARATE in TRIAGE_RESULTS, Reason `needs a logic change`; every other unresolved issue stays Blocked
 
 ### Phase 5: Write resolution-summary.md
 
 **Produces:** RESOLUTION_FILE (early write for compaction safety)
-**Requires:** TRIAGE_RESULTS, CODE_AGENT_RESULTS, TARGET_DIR, TARGET_DIR_REL, BRANCH_INFO, RESOLUTION_TS
+**Requires:** TRIAGE_RESULTS, CODE_AGENT_RESULTS, TARGET_DIR, TARGET_DIR_REL, BRANCH_INFO, RESOLUTION_TS, GATE_LEVEL
 
-**Immediately write `resolution-summary.md`** to `{TARGET_DIR}` using the Write tool. Do this now — not in Phase 9 — while results are fresh in context. This ensures the record is persisted even if later phases (Polish, Verification Gate, CI gate, Tech Debt) trigger context compaction.
+**Immediately write `resolution-summary.md`** to `{TARGET_DIR}` using the Write tool.
 
 Set `Tracked` for FIX_SEPARATE and TECH_DEBT items to `(pending)` — to be backfilled after Phase 9 manage-debt (or `TRACEABILITY: DEGRADED ({reason})` if manage-debt degrades).
 
 DUPLICATE issues are listed **only** in `## Duplicates` — never in `## Fixed Issues`, `## False Positives`, `## By Design`, `## Fix Separately`, `## Deferred to Tech Debt`, `## Escalations`, or `## Blocked`. A duplicate of a FALSE_POSITIVE primary therefore leaves only the primary in the `False Positive` row and the `## False Positives` section; the same holds for every other outcome the duplicate inherits.
 
-Use the template from the Output Artifact section below.
+Open each Issue cell with its severity in brackets when it has one, as `[HIGH]`.
+
+Use the template from the Output Artifact section below. Put text not for public posting in a final `## Private notes` section.
 
 ### Phase 6: Polish
 
 **Produces:** POLISH_RESULT
-**Requires:** CODE_AGENT_RESULTS
+**Requires:** CODE_AGENT_RESULTS, GATE_LEVEL
 
 If any fixes were made, spawn Polish agent to refine the changed code:
 
@@ -423,7 +434,7 @@ git -C {worktree} push
 
 **If `fork_no_push` is set:** do not push. Record `Push: skipped — cannot push to fork` under `## Verification`, and skip Phase 8 — no pushed commit exists for CI to check.
 
-**Route after push:** VERIFICATION_STATUS = PASS → continue to Phase 8 (CI gate). VERIFICATION_STATUS = FAILED → skip Phase 8; proceed directly to Phase 9 (manage-debt), then Phase 9b (thread resolution + resolution comment), then Phase 9c (merge readiness), then Phase 10 (report). VERIFICATION_STATUS = SKIPPED → skip Phase 8 (no fixes applied); proceed to Phase 9 (manage-debt), then Phase 9b (thread resolution + resolution comment), then Phase 9c (merge readiness, when non-author approval is required), then Phase 10 (report).
+**Route after push:** VERIFICATION_STATUS = PASS → continue to Phase 8 (CI gate). FAILED or SKIPPED → skip Phase 8 and continue with Phase 9 and the later phases in order.
 
 ### Phase 8: CI Status Gate (Conditional)
 
@@ -593,7 +604,7 @@ If the script prints a `TRACEABILITY: DEGRADED` line: warn, proceed to Phase 10.
 
 ### Phase 10: Report
 
-**Requires:** BRANCH_INFO, TARGET_DIR, PR_COMMENT, THREAD_RESOLUTION_RESULT
+**Requires:** BRANCH_INFO, TARGET_DIR, PR_COMMENT, THREAD_RESOLUTION_RESULT, GATE_LEVEL
 
 The resolution summary was already written to `{TARGET_DIR}/resolution-summary.md` in Phase 5 (updated by Phase 7, Phase 9 and Phase 9b-1). Display results to the user:
 
@@ -603,6 +614,7 @@ The resolution summary was already written to `{TARGET_DIR}/resolution-summary.m
 **Branch**: {branch}
 **Reviews Processed**: {n} reports from {TARGET_DIR}
 **Total Issues**: {n}
+**Gate level**: {GATE_LEVEL, with any level note}
 
 ### Results
 | Outcome | Count |
@@ -648,14 +660,6 @@ In multi-worktree mode, report results per worktree with aggregate summary.
 
 ### Feature Knowledge Write-Back (Conditional)
 
-Resolve `{worktree}` as the checkout's toplevel, because feature knowledge bases are committed with the branch (D-PROMPT-ROOT): from the start directory — `WORKTREE_PATH` if provided, otherwise cwd (`devflow:worktree-support`) — run
-
-```bash
-git -C "{start}" rev-parse --show-toplevel
-```
-
-and use its one-line output. If the command fails (outside a git repository), `{worktree}` is the start directory itself. All paths below are relative to `{worktree}`.
-
 **Step 1 — Check the opt-out gate, with `{root}` = `{worktree}`:** take the settings line resolved above for that root, resolving it with the settings block when this run has not yet.
 
 If the settings line says `KNOWLEDGE=off`, skip write-back entirely. The machine switch (`devflow knowledge --disable`), the repository and the personal settings can each turn knowledge off, and none can turn it back on (D-FEATURES-NARROW-ONLY). The fail-closed line says `KNOWLEDGE=off` too, so an unresolvable line skips write-back.
@@ -703,21 +707,18 @@ When the Knowledge agent reports `KB_COMMIT: skipped (detached HEAD)`, the files
 /resolve (orchestrator - spawns agents only)
 │
 ├─ Phase 0: Worktree Discovery & Pre-flight
-├─ Phase 1: Parse issues from TARGET_DIR + extract confidence %
+├─ Phase 1: Parse issues from TARGET_DIR
 ├─ Phase 1b: Fetch external threads (evidence policy required)
 ├─ Phase 2: Global Triage [Triage agent, opus, single agent]
-├─ Phase 3: Batch FIX_NOW issues (skip if empty; DUPLICATE issues never dispatched)
-├─ Phase 4: Fix [Code agent × N, OPERATION: issue-fix, PUSH: false]
+├─ Phase 3: Batch FIX_NOW issues
+├─ Phase 4: Fix [Code agent × N]
 ├─ Phase 5: Write resolution-summary.md (compaction safety; Tracked = "(pending)" or "(pending — TRACEABILITY: DEGRADED)" if manage-debt degrades)
-├─ Phase 6: Polish [Polish agent]
+├─ Phase 6: Polish
 ├─ Phase 7: Verification Gate [Validate agent, haiku] + push + Fix agent validation-fix loop ≤2
-├─ Phase 8: CI Status Gate (conditional — skipped if no fixes or verification FAILED)
+├─ Phase 8: CI Status Gate (conditional)
 ├─ Phase 9: Git agent (manage-debt) — FIX_SEPARATE + TECH_DEBT → backfill Tracked={ISSUE_REF} (or TRACEABILITY: DEGRADED on failure)
 │
-├─ Phase 9b: Thread resolution + resolution comment
-│  ├─ Step 9b-0: verify-evidence.cjs --stale-out → ≤1 Test agent on the stale TPs (wrapped) — only after this run's push
-│  ├─ Step 9b-1: Git agent (resolve-review-threads) — evidence policy required
-│  ├─ Step 9b-2: Git agent (post-resolution-summary, REVIEW_PUBLICATION) — always-on
+├─ Phase 9b: 9b-0 Test agent (stale TPs), 9b-1/9b-2 Git agent (threads, resolution comment)
 │  └─ Step 9b-3: verify-evidence.cjs publish (inline, no Git spawn) — only when the head moved
 │
 ├─ Phase 9c: verify-evidence.cjs readiness (inline, no Git spawn) — non-author approval required, report-only
@@ -730,27 +731,23 @@ When the Knowledge agent reports `KB_COMMIT: skipped (detached HEAD)`, the files
 | Case | Handling |
 |------|----------|
 | No reviews exist | Check bug-analysis fallback (Step 0c-5b); if also absent, error and suggest `/code-review` or `/bug-analysis` |
-| All false positives | Normal completion, report shows 0 fixes |
 | Fix attempt fails | Revert changes, mark BLOCKED, continue others |
 | Issue dependencies | Sequential chain, skip dependents if predecessor blocked |
-| No actionable issues | Report "No issues to resolve" |
-| Latest review already resolved | Check bug-analysis fallback (Step 0c-5b); if also absent, skip worktree and suggest `/code-review` or `/bug-analysis` |
+| No issues parsed | Report "No issues to resolve" |
 | `--review {timestamp}` in multi-worktree mode | Not supported — use `--path` + `--review` to target specific worktree + review |
 | gh/GitHub absent | manage-debt degrades (`TRACEABILITY: DEGRADED ({reason})`); Tracked stays `(pending — TRACEABILITY: DEGRADED ({reason}))` — recorded, not dropped |
 | `EVIDENCE_POLICY` is `standard` | Phases 1b and 9b-step-1 are skipped; post-resolution-summary (Phase 9b step 2) still runs if a PR is known |
 | `REQUIRE_NON_AUTHOR_APPROVAL` is `false` | Phase 9c is skipped and reported as SKIPPED |
-| Public repo (`auto` mode) | Git agent probes visibility, posts counts-only STUB comment; full resolution report stays local |
 | `reviewPublication: off` | Git agent skips posting the resolution comment (OFF) — except that, only when `EVIDENCE_POLICY` is `required`, Step 0d passes `stub` and a counts-only STUB comment posts |
-| Fork PR this run cannot push to (no maintainer edits, no push access of its own) | validate-branch emits `TRACEABILITY: DEGRADED (cannot push to fork)` → `fork_no_push`: Phase 7 skips the push, Phase 8 is skipped, 9b-1 records FIXED threads as DEGRADED instead of citing unpushed commits; 9b-2 still posts the resolution comment; the head did not move, so 9b-0 and 9b-3 are skipped |
+| Fork PR this run cannot push to | `TRACEABILITY: DEGRADED (cannot push to fork)` → `fork_no_push`: no push in Phase 7, Phase 8 skipped, 9b-1 records FIXED threads as DEGRADED, 9b-2 still posts; the head did not move, so 9b-0 and 9b-3 are skipped |
 | The PR has no trusted evidence record | 9b-0 finds no vouched-for stale line, so no Test agent runs; 9b-3 still refreshes the block and comment, every TP without a claim reading `UNVERIFIED` |
 | A CI run behind a claim has expired (~90 days) | The TP reads `INDETERMINATE` — never verified, never failed — until a claim at a newer SHA settles it |
 
 ## Principles
 
 1. **Orchestration only** - Command spawns agents, doesn't do git/resolve work itself
-2. **No agent grades its own homework** - Triage agent validates, Code agents fix, Validate agent verifies
-3. **Git agent for git work** - All git operations go through Git agent; the CI wait, the evidence refresh and the merge-readiness check are inline scripts (plumbing, no model work)
-4. **Traceability-aware** - Policy-gated ops (thread fetch/resolve, merge readiness) are skipped cleanly when the evidence policy does not ask for them; resolution comment (Phase 9b-2) is always-on; test-plan evidence is re-verified (≤1 Test agent) and refreshed only when this run moved the head (Steps 9b-0, 9b-3)
+2. **Git agent for git work** - All git operations go through Git agent; inline scripts are plumbing
+3. **Traceability-aware** - Policy-gated ops are skipped cleanly when the evidence policy does not ask for them; resolution comment (Phase 9b-2) is always-on; test-plan evidence is re-verified (≤1 Test agent) and refreshed only when this run moved the head (Steps 9b-0, 9b-3)
 
 ## Output Artifact
 
@@ -763,6 +760,7 @@ Written in Phase 5 (Collect Results) to `{TARGET_DIR}/resolution-summary.md`:
 **Date**: {RESOLUTION_TS}
 **Review**: {TARGET_DIR_REL}
 **Command**: /resolve
+**Gate level**: {GATE_LEVEL, with any level note}
 
 ## Decisions Citations
 

package/dist/commands/self-review.md

@@ -24,19 +24,19 @@ Detect changed files and build context:
 4. Build TASK_DESCRIPTION from recent commit messages or branch name
 5. Record `HEAD_BEFORE` (`git rev-parse HEAD`) now, before Polish runs — Phase 3 compares against it
 
-**Resolve the settings line** once per worktree root, reusing a line this run already resolved for the same root. `{root}` is the worktree the values are for — the repository root when the run has one worktree:
+**Resolve the settings line** once per worktree root, reusing a line this run already resolved for the same root. `{root}` is the worktree the values are for — the repository root in a one-worktree run:
 
 ```bash
 node "$HOME/.devflow/scripts/resolve-settings.cjs" "{root}" 2>/dev/null; echo "exit=$?"
 ```
 
-Accept the output only when it is exactly two lines: `exit=0` last and, before it, one line of the form `TRACKER=<github|jira|linear> TRACKER_SOURCE=<project|personal|machine|default> TRACKER_WARN=<none|mismatch|invalid> SITE=<none|https://<host>> KEY=<none|<key>> REVIEW_PUBLICATION=<off|auto|full> COMPLIANCE=<off|generic|<id>[,<id>…]> MEMORY=<on|off> LEARNING=<on|off> KNOWLEDGE=<on|off> GATE_LEVEL=<full|standard|lean>` — these fields, in this order, nothing else, where `<host>` is a lowercase dotted host name alone, `<key>` is 2–10 of `A-Z`, `0-9` and `_` starting with a letter, and each `<id>` is one of `gdpr`, `hipaa`, `pci-dss`, `soc2`, `iso-27001`, `sox`. **Anything else** (a non-zero exit, no line, extra text, or a missing, reordered or unlisted field or value) ⇒ use `TRACKER=github TRACKER_SOURCE=default TRACKER_WARN=invalid SITE=none KEY=none REVIEW_PUBLICATION=off COMPLIANCE=generic MEMORY=on LEARNING=on KNOWLEDGE=off GATE_LEVEL=full` instead.
+Accept the output only when it is exactly two lines: `exit=0` last and, before it, one line of the form `TRACKER=<github|jira|linear> TRACKER_SOURCE=<project|personal|machine|default> TRACKER_WARN=<none|mismatch|invalid> SITE=<none|https://<host>> KEY=<none|<key>> REVIEW_PUBLICATION=<off|auto|full> COMPLIANCE=<off|generic|<id>[,<id>…]> MEMORY=<on|off> CURATION=<on|off> KNOWLEDGE=<on|off> GATE_LEVEL=<full|standard|lean>` — these fields, in this order, nothing else, where `<host>` is a lowercase dotted host name alone, `<key>` is 2–10 of `A-Z`, `0-9` and `_` starting with a letter, and each `<id>` is one of `gdpr`, `hipaa`, `pci-dss`, `soc2`, `iso-27001`, `sox`. **Anything else** (a non-zero exit, no line, extra text, or a missing, reordered or unlisted field or value) ⇒ use `TRACKER=github TRACKER_SOURCE=default TRACKER_WARN=invalid SITE=none KEY=none REVIEW_PUBLICATION=off COMPLIANCE=generic MEMORY=off CURATION=off KNOWLEDGE=off GATE_LEVEL=full` instead.
 
 The accepted line is the only source of these values.
 
 ### Load DECISIONS_CONTEXT
 
-When the settings line says `LEARNING=off`, set `DECISIONS_CONTEXT` to `(none)` and skip this step, locating no ledger and reading no index.
+When the settings line says `CURATION=off`, set `DECISIONS_CONTEXT` to `(none)` and skip this step, locating no ledger and reading no index.
 
 The decisions ledger belongs to the repository, not to one checkout: a linked worktree reads the main worktree's copy, a subdirectory session the repository root's. Locate it with ONE git call, run from the start directory — `WORKTREE_PATH` if provided, otherwise cwd (`devflow:worktree-support`):
 
@@ -50,11 +50,11 @@ Line 1 is the checkout's toplevel, line 2 the common git directory. A git older
 2. **The toplevel** — line 1, or on an older git the line after the echoed flag.
 3. **The start directory itself** — when the command failed or printed no absolute toplevel (outside a git repository).
 
-This is the rule the learning hooks apply, so you read the index the Curate agent writes.
+This is the rule the curation hooks apply, so you read the index the Curate agent writes.
 
 **Step 1 — Read the pre-rendered index:**
 
-Attempt to read `{ledger}/.devflow/learning/index.md`.
+Attempt to read `{ledger}/.devflow/curation/index.md`.
 
 - If the file exists and contains non-empty content: use that content as `DECISIONS_CONTEXT`.
 - If the file is absent or empty: set `DECISIONS_CONTEXT` to `(none)`.
@@ -214,14 +214,6 @@ Display summary:
 
 ### Feature Knowledge Write-Back (Conditional)
 
-Resolve `{worktree}` as the checkout's toplevel, because feature knowledge bases are committed with the branch (D-PROMPT-ROOT): from the start directory — `WORKTREE_PATH` if provided, otherwise cwd (`devflow:worktree-support`) — run
-
-```bash
-git -C "{start}" rev-parse --show-toplevel
-```
-
-and use its one-line output. If the command fails (outside a git repository), `{worktree}` is the start directory itself. All paths below are relative to `{worktree}`.
-
 **Step 1 — Check the opt-out gate, with `{root}` = `{worktree}`:** take the settings line resolved above for that root, resolving it with the settings block when this run has not yet.
 
 If the settings line says `KNOWLEDGE=off`, skip write-back entirely. The machine switch (`devflow knowledge --disable`), the repository and the personal settings can each turn knowledge off, and none can turn it back on (D-FEATURES-NARROW-ONLY). The fail-closed line says `KNOWLEDGE=off` too, so an unresolvable line skips write-back.

package/dist/core/area-pause-notice.js

@@ -0,0 +1,44 @@
+/**
+ * @file area-pause-notice.ts
+ *
+ * The fixed notice of a paused area. When git tracks files in the folders of an area, or
+ * a `.git` entry stands and git did not answer, the area's feature reads and writes
+ * nothing there, and says so once at session start. The curation area covers the curation
+ * folder, the old ledger folder and the backup folders with one notice; the memory
+ * area covers the memory folder. Pure: no fs, no os, no process state.
+ *
+ * The words hold nothing from the repository: the area is a fixed enum, and no path,
+ * count or git output goes into them. The session start hook
+ * (src/assets/scripts/hooks/session-start-context) holds the curation words, and the
+ * memory session start hook (src/assets/scripts/hooks/session-start-memory) holds the
+ * memory words; tests/shell-hooks.test.ts requires each copy to agree with this module.
+ * The two commands a notice tells the user to run are listed in NOTICE_COMMAND_PHRASES in
+ * tests/guards/no-fsmonitor-index-read.test.ts, which holds every copy to them.
+ */
+const UNTRACK_STEPS = 'To find the files, run `git ls-files .devflow`. '
+    + 'Untrack them with `git rm --cached <file>`, then delete them if you did not make them. ';
+const RETRY_STEPS = 'The check runs again at the next session start. ';
+/** The notice of each paused area and reason, as one paragraph of short sentences. */
+export const AREA_PAUSE_NOTICE = {
+    curation: {
+        tracked: 'Devflow curation is paused for this project, because git tracks files in a curation data folder. '
+            + 'Devflow reads and writes nothing in these folders while git tracks files there. '
+            + UNTRACK_STEPS
+            + 'Run these commands in the main checkout.',
+        unknown: 'Devflow curation is paused for this project, because git did not answer whether it tracks files in a curation data folder. '
+            + 'Devflow reads and writes nothing in these folders until git answers. '
+            + RETRY_STEPS
+            + 'If this notice stays, check that git runs in this project.',
+    },
+    memory: {
+        tracked: 'Devflow memory is paused for this checkout, because git tracks files in the memory folder. '
+            + 'Devflow reads and writes nothing there while git tracks files there. '
+            + UNTRACK_STEPS
+            + 'Run these commands in this checkout.',
+        unknown: 'Devflow memory is paused for this checkout, because git did not answer whether it tracks files in the memory folder. '
+            + 'Devflow reads and writes nothing there until git answers. '
+            + RETRY_STEPS
+            + 'If this notice stays, check that git runs in this checkout.',
+    },
+};
+//# sourceMappingURL=area-pause-notice.js.map

package/dist/core/assets.js

@@ -1,13 +1,13 @@
 import { join } from 'path';
 import { getPackageRoot } from './paths.js';
 import { SKILL_REFS_OUTPUT_DIR } from './mds-variants.js';
-import { LEARNING_OFF_OUTPUT_DIR } from './learning-variants.js';
+import { CURATION_OFF_OUTPUT_DIR } from './curation-variants.js';
 /**
  * Flat skills source directory: src/assets/skills/{name}/
  * All plugins' skills live here directly (no per-plugin subdirectory).
  *
  * @param root - Package root to resolve against. Injectable so a caller working
- *   on a temp tree (the learning converge) reads the skill source from the same
+ *   on a temp tree (the curation converge) reads the skill source from the same
  *   root as the rest of its sources.
  */
 export function skillsDir(root = getPackageRoot()) {
@@ -41,42 +41,42 @@ export function scriptsDir() {
 /**
  * Compiled commands directory: dist/commands/
  * Single lookup directory for installed commands: one compiled file per `.mds`
- * command host in src/assets/commands/. A host that carries a learning arm also
- * has a learning-off variant (see learningOffDir).
+ * command host in src/assets/commands/. A host that carries a curation arm also
+ * has a curation-off variant (see curationOffDir).
  */
 export function commandsDir() {
     return join(getPackageRoot(), 'dist', 'commands');
 }
 /**
- * Learning-off variant directory: dist/learning-off/{commands,agents}/
+ * Curation-off variant directory: dist/curation-off/{commands,agents}/
  *
- * Holds the learning-off variant of each prompt that carries a learning arm
+ * Holds the curation-off variant of each prompt that carries a curation arm
  * (D-LEARNING-VARIANTS), and only those. Absent until the build has run, so every
  * reader tolerates its absence.
  *
- * The spelling comes from LEARNING_OFF_OUTPUT_DIR in learning-variants.ts, the
+ * The spelling comes from CURATION_OFF_OUTPUT_DIR in curation-variants.ts, the
  * build's own destination, rather than being retyped here.
  *
  * @param kind - Which prompt kind's variants.
  * @param root - Package root to resolve against (see agentsDir).
  */
-export function learningOffDir(kind, root = getPackageRoot()) {
-    return join(root, ...LEARNING_OFF_OUTPUT_DIR.split('/'), kind);
+export function curationOffDir(kind, root = getPackageRoot()) {
+    return join(root, ...CURATION_OFF_OUTPUT_DIR.split('/'), kind);
 }
 /**
  * Command source directories, MOST-PREFERRED FIRST.
  *
- * D-LEARNING-VARIANT-INSTALL: with learning off the learning-off variant comes
+ * D-LEARNING-VARIANT-INSTALL: with curation off the curation-off variant comes
  * first, so a host with an arm installs its off variant and a host with none falls
- * through to the one compiled file; with learning on the order is the normal
+ * through to the one compiled file; with curation on the order is the normal
  * single-directory lookup.
  *
- * @param learning - The machine's settled learning switch.
+ * @param curation - The machine's settled curation switch.
  * @param root - Package root to resolve against (see agentsDir).
  */
-export function commandSourceDirs(learning, root = getPackageRoot()) {
+export function commandSourceDirs(curation, root = getPackageRoot()) {
     const normal = join(root, 'dist', 'commands');
-    return learning ? [normal] : [learningOffDir('commands', root), normal];
+    return curation ? [normal] : [curationOffDir('commands', root), normal];
 }
 /**
  * Compiled agents directory: dist/agents/{name}.md
@@ -124,17 +124,17 @@ export function compiledSkillRefsDir(root = getPackageRoot()) {
  * The non-empty tuple makes an empty list a compile error at every call site:
  * an empty list would survive a `??` default and resolve to nothing.
  *
- * D-LEARNING-VARIANT-INSTALL: `learning: false` puts dist/learning-off/agents first,
- * for the installer and the converge only. The default (learning on) is the order
+ * D-LEARNING-VARIANT-INSTALL: `curation: false` puts dist/curation-off/agents first,
+ * for the installer and the converge only. The default (curation on) is the order
  * every other reader wants: the shipped defaults (model, effort) are the same in
  * both variants, so loadShippedAgentDefaults and the test harness keep reading the
- * learning-on tree.
+ * curation-on tree.
  *
  * @param root - Package root to resolve against (see agentsDir).
- * @param learning - The machine's settled learning switch; on by default.
+ * @param curation - The machine's settled curation switch; on by default.
  */
-export function agentSourceDirs(root = getPackageRoot(), learning = true) {
+export function agentSourceDirs(root = getPackageRoot(), curation = true) {
     const normal = [compiledAgentsDir(root), agentsDir(root)];
-    return learning ? normal : [learningOffDir('agents', root), ...normal];
+    return curation ? normal : [curationOffDir('agents', root), ...normal];
 }
 //# sourceMappingURL=assets.js.map

package/dist/core/curate-tuning-config.js

@@ -1,7 +1,6 @@
 import * as fs from 'fs';
-import * as path from 'path';
 import { getDevFlowDirectory } from '../targets/claude-code/claude-paths.js';
-import { getCurateTuningConfigPath } from './project-paths.js';
+import { getCurateTuningConfigPath, getGlobalCurateTuningConfigPath } from './project-paths.js';
 const VALID_MODELS = new Set(['opus', 'sonnet', 'haiku']);
 function isValidModel(value) {
     return typeof value === 'string' && VALID_MODELS.has(value);
@@ -64,15 +63,15 @@ function readConfigFile(filePath) {
  *
  * Priority (highest wins): project config → global config → defaults.
  *
- * - Global:  `~/.devflow/learning.json`
- * - Project: `<ledgerRoot>/.devflow/learning/learning.json` — pass the ledger root
- *   (getLedgerRoot), where session-start-context reads it and `devflow learning
+ * - Global:  `~/.devflow/curation.json`
+ * - Project: `<ledgerRoot>/.devflow/curation/curation.json` — pass the ledger root
+ *   (getLedgerRoot), where session-start-context reads it and `devflow curation
  *   --configure` writes it (D-LEDGER-MAIN-WORKTREE).
  *
  * Invalid JSON in either file is silently ignored and treated as absent.
  */
 export function loadCurateTuningConfig(ledgerRoot) {
-    const globalConfigPath = path.join(getDevFlowDirectory(), 'learning.json');
+    const globalConfigPath = getGlobalCurateTuningConfigPath(getDevFlowDirectory());
     const projectConfigPath = getCurateTuningConfigPath(ledgerRoot);
     let config = { ...DEFAULTS };
     const globalJson = readConfigFile(globalConfigPath);

package/dist/core/curation-move-notice.js

@@ -0,0 +1,84 @@
+/**
+ * @file curation-move-notice.ts
+ *
+ * The notice for a project whose ledger still sits in the old folder: which line to
+ * show, the words of each, the fixed notice of a skipped move, and where the shell
+ * shim's markers for the project stand. The statusline (src/hud/components/curation-counts.ts)
+ * and `devflow curation` (src/cli/commands/curation.ts) both import it from here, so they
+ * say the same words and read the same markers, and neither imports the other.
+ *
+ * Reads the disk with one lstat per path, never follows a link and never opens the old
+ * ledger. The HUD runs it on every prompt, so it forks nothing and holds no state.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { LEGACY_NAMES, curationMoveMarkerKey } from './project-paths.js';
+import { MOVE_SKIP_NOTICE, isMoveSkipReason } from './curation-move-skip.js';
+/** The file suffix of each marker kind, as the shim writes it. */
+const MARKER_SUFFIX = {
+    refused: 'skip',
+    tracked: 'tracked',
+    unknown: 'unknown',
+};
+/**
+ * The marker the `curation-move` shim writes for the ledger root `root`:
+ * `<home>/.devflow/logs/curation-move.<key>.<suffix>`, the key being the root's
+ * {@link curationMoveMarkerKey}. Without `kind` it is the refusal marker (`refused`, the
+ * suffix `skip`). The shim builds the same paths in `_df_cm_markers`
+ * (src/assets/scripts/hooks/curation-move); tests/shell-hooks.test.ts runs that function
+ * and requires the two to agree for short, long and non-ASCII roots. Every marker stands
+ * outside the project, so a skipped move writes nothing into it.
+ */
+export function getCurationMoveMarkerPath(home, root, kind = 'refused') {
+    return path.join(home, '.devflow', 'logs', `curation-move.${curationMoveMarkerKey(root)}.${MARKER_SUFFIX[kind]}`);
+}
+/** Whether anything, a link included, sits at `target`. One lstat, never followed. */
+function exists(target) {
+    try {
+        fs.lstatSync(target);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** The markers {@link gatherMoveNotice} looks for, in the order it prefers them, and the notice each one means. */
+const MARKER_NOTICES = [
+    ['tracked', 'tracked'],
+    ['unknown', 'unknown'],
+    ['refused', 'refused'],
+];
+/**
+ * The one extra question of a project with no counts to show: does it still have the old
+ * ledger folder? One existence test. If it does, one more for each of the shim's markers
+ * under the key of this same root ({@link getCurationMoveMarkerPath}) says which notice
+ * applies. Null when the old folder is gone. The old ledger itself is never opened or counted.
+ */
+export function gatherMoveNotice(ledgerRoot, home) {
+    if (!exists(path.join(ledgerRoot, '.devflow', LEGACY_NAMES.folder)))
+        return null;
+    const found = MARKER_NOTICES.find(([kind]) => exists(getCurationMoveMarkerPath(home, ledgerRoot, kind)));
+    return found === undefined ? 'pointer' : found[1];
+}
+const MOVE_NOTICE_TEXT = {
+    pointer: 'run devflow init, or open Claude Code in this project after it',
+    refused: 'move refused, see the hook log',
+    tracked: 'move skipped, git tracks files in the .devflow data folders',
+    unknown: 'move skipped, git did not answer',
+};
+/**
+ * The one line the HUD prints for a notice. With `counts` (the entry counts, such as
+ * `2 decisions, 1 pitfall`) the notice follows them on the same line.
+ */
+export function formatMoveNotice(notice, counts) {
+    return counts === undefined ? `Curation: ${MOVE_NOTICE_TEXT[notice]}` : `Curation: ${counts}; ${MOVE_NOTICE_TEXT[notice]}`;
+}
+/**
+ * The text `devflow curation --status`, `--list` and `--show` print for a notice: the HUD's
+ * line, except that a skipped move gets its whole fixed notice (MOVE_SKIP_NOTICE),
+ * because these commands have room to say what to do.
+ */
+export function describeMoveNotice(notice) {
+    return isMoveSkipReason(notice) ? `Curation: ${MOVE_SKIP_NOTICE[notice]}` : formatMoveNotice(notice);
+}
+//# sourceMappingURL=curation-move-notice.js.map

package/dist/core/curation-move-skip.js

@@ -0,0 +1,35 @@
+/**
+ * @file curation-move-skip.ts
+ *
+ * The fixed notice of a skipped move. The move leaves a project alone, and changes
+ * nothing, when git tracks files in a curation data folder (`tracked`) or when a
+ * `.git` entry stands and git did not answer (`unknown`). Pure: no fs, no os, no
+ * process state, so the init step (src/cli/commands/curation-move-step.ts) and the
+ * notice module (src/core/curation-move-notice.ts) can both import it.
+ *
+ * The words hold nothing from the repository. The two commands the notice tells the
+ * user to run are listed in NOTICE_COMMAND_PHRASES in
+ * tests/guards/no-fsmonitor-index-read.test.ts, which holds this file to them. The
+ * notice of a paused area is in src/core/area-pause-notice.ts.
+ */
+import { CURATION_DIR_NAME, LEGACY_NAMES } from './project-paths.js';
+const MOVE_DESCRIPTION = `devflow did not move the curation data of this project from .devflow/${LEGACY_NAMES.folder}/ to .devflow/${CURATION_DIR_NAME}/, `;
+/** The notice of each skip reason, as one paragraph of short sentences. */
+export const MOVE_SKIP_NOTICE = {
+    tracked: `${MOVE_DESCRIPTION}because git tracks files in a curation data folder. `
+        + 'To find them, run `git ls-files .devflow`. '
+        + 'Untrack them with `git rm --cached <file>`, and delete them if you did not make them. '
+        + 'Run these commands in the checkout that holds these folders.',
+    unknown: `${MOVE_DESCRIPTION}because git did not answer. `
+        + 'The move runs again at the next session start or the next init. '
+        + 'If this notice stays, check that git runs in this project.',
+};
+/**
+ * Whether `value` is a {@link MoveSkipReason}: a reason that has a notice. The members
+ * come from the keys of {@link MOVE_SKIP_NOTICE}, which the compiler requires to list
+ * every reason, so this module needs no runtime import of the move seam.
+ */
+export function isMoveSkipReason(value) {
+    return typeof value === 'string' && Object.hasOwn(MOVE_SKIP_NOTICE, value);
+}
+//# sourceMappingURL=curation-move-skip.js.map

package/dist/core/curation-move.js

@@ -0,0 +1,35 @@
+/**
+ * The CLI's view of the curation move — a typed seam onto the package's own
+ * `hooks/lib/curation-move.cjs`, never a second implementation of it.
+ *
+ * The one-time move of the old ledger folder to its new name lives in its own module,
+ * beside the store it builds on. `devflow init` and `devflow curation` reach it only
+ * through this seam: the module is loaded with the evidence-policy seam's `loadScript`
+ * from the package's own scripts directory and shape-checked against
+ * CURATION_MOVE_SURFACE; the interfaces below are TRANSCRIBED from the module's JSDoc
+ * and are this side's only shape authority (as for the store, see curation-store.ts).
+ */
+import { join } from 'path';
+import { scriptsDir } from './assets.js';
+import { loadScript } from './evidence-policy.js';
+/** The move module, relative to src/assets/scripts/ (and ~/.devflow/scripts/). */
+export const CURATION_MOVE_SCRIPT_NAME = join('hooks', 'lib', 'curation-move.cjs');
+/**
+ * Every key of CurationMoveModule and the runtime kind the loader requires of it.
+ * `satisfies` makes the compiler reject an interface key missing here.
+ */
+export const CURATION_MOVE_SURFACE = Object.freeze({
+    moveLedger: 'function',
+    sweepLedgerBackups: 'function',
+    backupPendingRows: 'function',
+    backupQueueFiles: 'function',
+});
+/**
+ * Load the curation move module from `dir` (default: the package's own scripts
+ * directory) and shape-check its surface. Never throws: a missing file is
+ * `not-found`; a module that throws on load or lacks a surface key is `unusable`.
+ */
+export function loadCurationMove(dir = scriptsDir()) {
+    return loadScript(join(dir, CURATION_MOVE_SCRIPT_NAME), CURATION_MOVE_SURFACE);
+}
+//# sourceMappingURL=curation-move.js.map