devmethod-ai 0.3.1 → 0.4.0

package/.agents/skills/devmethod-architecture/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: devmethod-architecture
+description: Discuss structural alternatives and record an explicit choice or delegation before dependent detail. Use for the DevMethod architecture command.
+---
+
+# DevMethod architecture
+
+Execute the `architecture` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `architecture` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Use [decision-architecture](../decision-architecture/SKILL.md) for this stage’s detailed procedure.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-correct-course/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: devmethod-correct-course
+description: Reconcile a scope or decision change with affected plans, tickets and evidence. Use for the DevMethod correct-course command.
+---
+
+# DevMethod correct-course
+
+Execute the `correct-course` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `correct-course` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-design/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: devmethod-design
+description: Create or apply product design using the existing design workflow and approved directions. Use for the DevMethod design command.
+---
+
+# DevMethod design
+
+Execute the `design` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `design` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Use [design-to-code](../design-to-code/SKILL.md) for this stage’s detailed procedure.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-explore/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: devmethod-explore
+description: Research existing solutions and discuss evidence, uncertainty and product direction. Use for the DevMethod explore command.
+---
+
+# DevMethod explore
+
+Execute the `explore` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `explore` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-frame/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: devmethod-frame
+description: Define product need, scope, exclusions and observable success criteria. Use for the DevMethod frame command.
+---
+
+# DevMethod frame
+
+Execute the `frame` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `frame` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-handoff/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: devmethod-handoff
+description: Record a dated, concise handoff linked to canonical mission state and evidence. Use for the DevMethod handoff command.
+---
+
+# DevMethod handoff
+
+Execute the `handoff` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `handoff` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Use [scoped-delivery](../scoped-delivery/SKILL.md) for this stage’s detailed procedure.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-implement/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: devmethod-implement
+description: Implement an authorized ticket, run relevant checks and review the resulting change. Use for the DevMethod implement command.
+---
+
+# DevMethod implement
+
+Execute the `implement` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `implement` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Use [scoped-delivery](../scoped-delivery/SKILL.md) for this stage’s detailed procedure.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-integrate/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: devmethod-integrate
+description: Prepare or perform authorized integration while respecting repository gates. Use for the DevMethod integrate command.
+---
+
+# DevMethod integrate
+
+Execute the `integrate` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `integrate` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Use [scoped-delivery](../scoped-delivery/SKILL.md) for this stage’s detailed procedure.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-next/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: devmethod-next
+description: Inspect real mission state and select the next authorized slice without starting it. Use for the DevMethod next command.
+---
+
+# DevMethod next
+
+Execute the `next` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `next` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Use [scoped-delivery](../scoped-delivery/SKILL.md) for this stage’s detailed procedure.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-plan/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: devmethod-plan
+description: Discuss delivery scope and organize useful milestones and executable tickets. Use for the DevMethod plan command.
+---
+
+# DevMethod plan
+
+Execute the `plan` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `plan` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Use [scoped-delivery](../scoped-delivery/SKILL.md) for this stage’s detailed procedure.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-ready/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: devmethod-ready
+description: Assess a ticket’s scope, dependencies and acceptance criteria without starting implementation. Use for the DevMethod ready command.
+---
+
+# DevMethod ready
+
+Execute the `ready` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `ready` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Use [scoped-delivery](../scoped-delivery/SKILL.md) for this stage’s detailed procedure.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-review/SKILL.md

@@ -0,0 +1,18 @@
+---
+name: devmethod-review
+description: Review actual code changes, contracts and evidence, execute relevant checks and report actionable findings. Use for the DevMethod review command.
+---
+
+# DevMethod review
+
+Execute the `review` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `review` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Use [scoped-delivery](../scoped-delivery/SKILL.md) for this stage’s detailed procedure.
+
+Follow [the review workflow](../scoped-delivery/references/review-workflow.md): inspect the actual diff and relevant interactions, execute applicable checks, and report findings with locations, impact, evidence and proposed corrections. Distinguish checked, failed and uninspected scope. Do not modify product code unless corrections were requested. Review artifacts may be written as part of the requested review.
+
+For a substantial review, use [the review record](../scoped-delivery/assets/REVIEW.md). A missing browser renderer or CLI does not block inspection or the findings report. The optional `devmethod review` shell utility presents existing results; invoking it or its fictional demo never performs this review.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-status/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: devmethod-status
+description: Report actual progress, evidence gaps and blockers without changing records or running checks. Use for the DevMethod status command.
+---
+
+# DevMethod status
+
+Execute the `status` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `status` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/devmethod-verify/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: devmethod-verify
+description: Execute missing or invalidated checks and report evidence for the inspected revision. Use for the DevMethod verify command.
+---
+
+# DevMethod verify
+
+Execute the `verify` stage now for the user's supplied ticket, mission, paths or revision. This is an agent workflow, not a shell command or a request for usage instructions. Do not ask the user to run npx or install a CLI to execute this stage.
+
+Read [the stage contract](../project-foundation/references/operating-commands.md) and [project context routing](../project-foundation/SKILL.md), then apply only `verify` and its relevant references. Preserve the supplied arguments, existing decisions, authorizations and stage scope. Reuse available context; clarify only a missing target that materially changes the work. Do not run other stages merely because they are suggested next.
+
+Use [scoped-delivery](../scoped-delivery/SKILL.md) for this stage’s detailed procedure.
+
+Return the concrete outcome, verification limits and one next command from the stage contract.

package/.agents/skills/project-foundation/SKILL.md

@@ -30,7 +30,7 @@ This kit formalizes a complete method: exploration → framing → design → ar
 
 For a new change, select the quick, standard, or major path using [work sizing](references/work-sizing.md). These paths select relevant stages; they do not add commands or require fourteen separate turns. A clear small fix can perform readiness, implementation, review, and verification together under existing authorization.
 
-Read [the operating commands](references/operating-commands.md) for any invocation with a stage, or to structure a new project, epic, or slice. In Codex, run `$project-foundation status`. In Claude Code or Cursor, run `/project-foundation status`. Replace `status` with the desired stage. The commands do not replace project commands.
+Read [the operating commands](references/operating-commands.md) for any invocation with a stage, or to structure a new project, epic, or slice. In Codex, select `$devmethod-status`; in Claude Code or Cursor, select `/devmethod-status`. Each installed stage has a `devmethod-<stage>` entry, including `devmethod-review`. Existing `project-foundation <stage>` invocations remain supported. Execute the selected stage in the agent without asking the user to run npx. The commands do not replace project commands.
 
 For `explore`, use [existing solutions research](references/exploration.md) when product uncertainty warrants it. For an open `architecture`, resolve `decision-architecture` and discuss credible options in the conversation before detailing the dependent architecture. Preserve accepted choices and explicit delegations; invoking `plan` does not adopt a proposal. For `plan`, use [delivery planning](references/delivery-planning.md) to discuss useful outcomes and scope before fixing tickets.
 

package/.agents/skills/project-foundation/assets/START_HERE.md

@@ -2,7 +2,7 @@
 
 DevMethod offers six independent modules; this installation contains the modules you selected. If this is a staging directory, review and copy its installed skill folder into the project while preserving existing files. If you installed directly into the project, the selected skills are already in place. If a version already exists, compare changes before updating it. Keep `PROJECT_PROFILE.md` and complete the stack, commands, scope, deployment permissions, and data requirements from the project before adoption. `ENGINEERING_POLICY.template.md` retains the included policy; merge it with `CONTRIBUTING.md` and existing instructions.
 
-In Codex, start with `$project-foundation status`. In Claude Code or Cursor, start with `/project-foundation status`. For an open-ended request:
+In Codex, start with `$devmethod-status`; for a review select `$devmethod-review` and add a ticket, PR or changed paths. In Claude Code or Cursor use `/devmethod-status` or `/devmethod-review`. All fourteen documented stages are exposed by a full installation. Module subsets expose stages backed by installed procedures. Once installed, run stages directly in the agent: no npx is needed. Existing `project-foundation <stage>` invocations still work. For an open-ended request:
 
 > Use the `project-foundation` skill for this project. Read existing instructions and sources, complete the profile without reinventing decisions, then deliver the following scope: [my objective]. Apply only relevant modules. Preserve the approved mockup, architecture boundaries, and React rules. Progress to a verified result within this scope.
 

package/.agents/skills/project-foundation/references/operating-commands.md

@@ -4,7 +4,11 @@ These commands describe a reusable work path. They are not shell commands and do
 
 ## Native invocation
 
-The table's short names are internal stages, not standalone native commands. Invoke `$project-foundation verify TASK-1` in Codex, or `/project-foundation verify TASK-1` in Claude Code and Cursor. Apply the same syntax to all fourteen stages, with their optional argument. Do not register `/verify`, `/review`, or other short names as global commands: they can conflict with the tool's commands. Every recommended next command must be qualified in the same way. If the host is unknown, write `project-foundation: verify TASK-1` in natural language.
+Each documented stage has a discoverable `devmethod-<stage>` skill. In Codex invoke `$devmethod-review TASK-1`; in Claude Code or Cursor invoke `/devmethod-review TASK-1`. Select it in the host's skill menu and supply the target. No npx, terminal launcher or CLI installation is required to run the agent workflow after the skills are installed.
+
+The equivalent `$project-foundation review TASK-1` (Codex) and `/project-foundation review TASK-1` (Claude Code/Cursor) remain supported. Table entries omit the host prefix: recommend the qualified `devmethod-<stage>` invocation when installed, otherwise the compatible `project-foundation <stage>` form. Never register bare `/review` or `/verify`, which may conflict with host commands. If the host is unknown, use `DevMethod review TASK-1` in natural language.
+
+The default installation exposes all fourteen stages. Module subsets expose only commands whose procedure is installed; foundation commands remain available. Do not claim a missing module was loaded. These skills instruct the connected agent to do the work; they do not turn the installer into an autonomous executor.
 
 An unknown stage displays available stages without starting work. With no stage, read the current state and apply `status`. Routing is an instruction to the model, not a deterministic parser or execution guarantee.
 
@@ -14,20 +18,20 @@ Use [work sizing](work-sizing.md) to select relevant stages. A quick change may
 
 | Command | Purpose | Suggested next step |
 |---|---|---|
-| `/explore` | Research existing solutions proportionately and discuss evidence and next direction | `/frame` |
-| `/frame` | Define value, scope, exclusions, and metrics | `/design` or `/architecture` |
-| `/design` | Create/select visual direction, master and derived screens, or apply approved UX; resolve design-to-code for visual work | `/design` for unfinished visual scope, then `/architecture` |
-| `/architecture` | Discuss structural alternatives and record choice/delegation before dependent detail | `/plan` |
-| `/plan` | Discuss useful delivery scope, then milestones and near-term tickets; stay conditional on open decisions | `/ready` |
-| `/ready <ticket>` | Verify scope, DoD, dependencies, contract, and tests | `/implement <ticket>` |
-| `/implement <ticket>` | Deliver a coherent slice with focused tests | `/review <ticket>` |
-| `/review <ticket>` | Review diff, architecture, contracts, tests, and risks | `/verify` or `/implement` |
-| `/verify <ticket>` | Run documented checks and assess evidence | `/integrate <ticket>` |
-| `/integrate <ticket>` | Prepare a PR/merge under repository policy | `/next` |
-| `/correct-course` | Address a scope change or invalidated decision | `/architecture` or `/plan` |
-| `/next` | Resume from real status and select the next slice | appropriate command |
-| `/status` | Distinguish planned, in progress, PR, merged, and deployed | `/next` or `/correct-course` |
-| `/handoff` | Create a concise checkpoint for another session or agent | `/next` |
+| `devmethod-explore` | Research existing solutions proportionately and discuss evidence and next direction | `devmethod-frame` |
+| `devmethod-frame` | Define value, scope, exclusions, and metrics | `devmethod-design` or `devmethod-architecture` |
+| `devmethod-design` | Create/select visual direction, master and derived screens, or apply approved UX; resolve design-to-code for visual work | `devmethod-design` for unfinished visual scope, then `devmethod-architecture` |
+| `devmethod-architecture` | Discuss structural alternatives and record choice/delegation before dependent detail | `devmethod-plan` |
+| `devmethod-plan` | Discuss useful delivery scope, then milestones and near-term tickets; stay conditional on open decisions | `devmethod-ready` |
+| `devmethod-ready <ticket>` | Verify scope, DoD, dependencies, contract, and tests | `devmethod-implement <ticket>` |
+| `devmethod-implement <ticket>` | Deliver a coherent slice with focused tests | `devmethod-review <ticket>` |
+| `devmethod-review <ticket>` | Review diff, architecture, contracts, tests, and risks | `devmethod-verify` or `devmethod-implement` |
+| `devmethod-verify <ticket>` | Run documented checks and assess evidence | `devmethod-integrate <ticket>` |
+| `devmethod-integrate <ticket>` | Prepare a PR/merge under repository policy | `devmethod-next` |
+| `devmethod-correct-course` | Address a scope change or invalidated decision | `devmethod-architecture` or `devmethod-plan` |
+| `devmethod-next` | Resume from real status and select the next slice | appropriate command |
+| `devmethod-status` | Distinguish planned, in progress, PR, merged, and deployed | `devmethod-next` or `devmethod-correct-course` |
+| `devmethod-handoff` | Create a concise checkpoint for another session or agent | `devmethod-next` |
 
 ## Responsibility and minimal context
 

package/.agents/skills/scoped-delivery/assets/REVIEW.md

@@ -1,8 +1,8 @@
 # Structured review authoring
 
-Reuse the existing review convention, or docs/missions/<mission-id>/reviews/<review-id>/review.json. The JSON owns results. Derive REVIEW.md and the browser interface with the package's `devmethod review --review … --output … --markdown …` command; it validates records but never performs checks. Existing Markdown remains readable through `--legacy`; do not invent missing fields during migration.
+Reuse the existing review convention, or docs/missions/<mission-id>/reviews/<review-id>/review.json. The JSON owns results. The review itself needs no CLI or npx: inspect and report within the agent. Keep small reviews in the conversation or existing tracker. For substantial structured records, follow [the installed format reference](../references/review-format.md). Derive REVIEW.md from the same record; if a browser artifact is requested and the renderer is available, use the package's `devmethod review --review … --output … --markdown …` command; it validates records but never performs checks. Existing Markdown remains readable through `--legacy`; do not invent missing fields during migration.
 
-Begin only with known scope and sources. Replace the placeholders below, then add checks/findings/evidence using format 1 documented in the package's docs/REVIEWS.md and complete examples/review/review.json. These package references are not files automatically installed into the application root. The packaged `--demo` viewer can export its explicitly fictional JSON as a format example; never reuse its results as real evidence.
+Begin only with known scope and sources. Replace the placeholders below, then add checks/findings/evidence using format 1 documented in the package's docs/REVIEWS.md and complete examples/review/review.json. These package references are not files automatically installed into the application root. The optional packaged `--demo` viewer can export fictional format examples; never reuse its results as real evidence or launch it instead of reviewing. If the renderer is unavailable, deliver the review findings and record; state only the browser export limitation rather than asking for installation to continue.
 
 ```json
 {

package/.agents/skills/scoped-delivery/references/review-format.md

@@ -0,0 +1,26 @@
+# Review record format
+
+## One versioned source
+
+Use existing conventions, or `docs/missions/<mission-id>/reviews/<review-id>/review.json`, with generated `REVIEW.md` and deliberately included `preuves/`. Tickets link stable finding IDs; the report and UI derive results from the JSON. Do not maintain another independent score or status table.
+
+Format 1 is shared by the optional CLI and browser validator. This installed reference supports authoring without fetching the npm package. Schema conformance never proves that a check ran.
+
+| Object | Required fields and ownership |
+|---|---|
+| Review | format, id, title, project, mission, tickets, date, scope, exclusions, revision, technologies, sources, checks, findings, evidence, limits, policy, summary |
+| revision | commit (recorded revision label), dirty (explicit uncommitted changes); no automatic Git execution |
+| technologies | name, version, detectedFrom (actual manifest/lockfile/source evidence) |
+| ticket | id, title, url (HTTPS or null; local/unpublished destinations remain unavailable) |
+| source | id, title, kind (documentation/skill/project), publisher, technology, version, url, consultedAt, access (consulted/unavailable/unverified), usage, compatibility, provenance; consulted requires a date |
+| check | id, title, domain, kind (automated/manual), status (passed/failed/not-run/blocked/out-of-scope), result, reason, evidenceIds, revision, targets; unexecuted/excluded checks need a reason |
+| finding | id, title, domain, severity (critical/major/moderate/minor), severityReason, confidence (confirmed/suspected), resolution (open/in-progress/resolved/accepted-risk), location, trigger, expected, observed, impact, reproduction, evidenceIds, correction, tradeoffs, sourceIds, ticketIds, verification, resolutionEvidenceIds, targets |
+| location | path or component description, line (positive integer or null), component (text or null); display metadata, never arbitrary file access |
+| evidence | id, title, kind (text/log/screenshot/diagram), content (text alternative or excerpt), url (HTTPS or null), image (null or explicit PNG/JPEG object) |
+| image | mime=image/png or image/jpeg, base64, alt, origin=captured/explanatory, privacyReviewed=true; only deliberately included reviewed images, not filesystem paths or remote images |
+| policy | blockingSeverities, requireAllChecks, rationale; project-owned explicit policy, no numeric risk score |
+
+A confirmed finding still needs evidence or reproduction. A resolved finding requires resolution evidence IDs; schema validation checks the references, **not the truth of execution or whether the fix really works**. Authors must retain the original evidence and supply fresh verification. Closing a panel never changes resolution. Finding counts include all resolution states and stay independent from filtered results; uncertain unresolved findings have a separate count. Failed-check counts are separate from finding counts.
+
+A blocking confirmed open finding or a failed check requires corrections. Otherwise a blocked check yields blocked; no passed checks, an unresolved suspected finding, or required unrun checks yields incomplete. Otherwise the conclusion is ready **on the verified scope**, with exclusions and limits still visible. This conclusion does not authorize integration/deployment or replace repository policy.
+

package/COMPATIBILITY.md

@@ -4,14 +4,16 @@ Historical platform assessment date: 2026-09-12; those results apply only to the
 
 | Host | Export directory | Invocation | Evidence |
 |---|---|---|---|
-| Codex | `.agents/skills/<name>/SKILL.md` | `$project-foundation status` | Local payload/export tests; method exercised with Codex in this session |
-| Claude Code | `.claude/skills/<name>/SKILL.md` | `/project-foundation status` | Official format reviewed; export tests; authenticated native session pending |
-| Cursor Agent | `.cursor/skills/<name>/SKILL.md` | `/project-foundation status` | Official format reviewed; export tests; authenticated native session pending |
+| Codex | `.agents/skills/<name>/SKILL.md` | `$devmethod-status` (legacy `$project-foundation status`) | Local payload/export tests; method exercised with Codex in this session |
+| Claude Code | `.claude/skills/<name>/SKILL.md` | `/devmethod-status` (legacy `/project-foundation status`) | Official format reviewed; export tests; authenticated native session pending |
+| Cursor Agent | `.cursor/skills/<name>/SKILL.md` | `/devmethod-status` (legacy `/project-foundation status`) | Official format reviewed; export tests; authenticated native session pending |
 
 The earlier validation environment lacked native executables/credentials. On 2026-09-13, version probes found Codex CLI 0.147.0 and Claude Code 2.1.238; Cursor CLI was not found on PATH. The subsequent delegated pilot executed six authenticated Codex invocations; see [reviewed native results](docs/NATIVE-PILOT-RESULTS.md) for the narrow fixture coverage, budget stop and incomplete comparison. Passing installer tests does not prove host discovery, model behavior or UI command completion. No Claude Code or Cursor version is claimed as runtime-tested. Therefore these profiles are provisionally compatible, not certified end-to-end.
 
 Official references: [Claude Code skills](https://code.claude.com/docs/en/skills), [Claude Code memory](https://code.claude.com/docs/en/memory), [Cursor skills](https://cursor.com/docs/skills), [Codex skills](https://developers.openai.com/codex/skills). A host version or organization policy may change discovery or execution.
 
+Version 0.4.0 adds discoverable stage adapters; [current command validation](docs/COMMANDS-VALIDATION.md) distinguishes installation checks from unverified menu discovery and model execution. Historical native results above do not validate these new adapters.
+
 ## Native smoke protocol
 
 Run separately in authenticated Codex, Claude Code and Cursor Agent sessions. Use a disposable local repo with only the chosen profile. Record date, exact host version, model, discovery result, commands, artifacts read, actual check output and observed next commands. Redact credentials and personal data. Keep the evaluation transcript local until reviewed for publication.

package/README.md

@@ -28,11 +28,11 @@ The video uses illustrative Codex commands with real generated images and record
 
 ![DevMethod workflow](docs/images/devmethod-flow.svg)
 
-DevMethod is the public name of the kit. Its entry-point skill remains `project-foundation`, preserving existing invocations and the six-module structure.
+DevMethod exposes fourteen `devmethod-*` workflow commands in the agent’s skill menu. The six procedure modules and existing `project-foundation <stage>` invocations remain supported.
 
 A reusable workflow for taking a software project from exploration to delivery: decisions, UX, architecture, tickets, development, tests, review and handoff. Six focused skills support fourteen workflow stages, each ending with evidence, limitations and one suggested next command.
 
-**DevMethod 0.3.1.** [Documentation and film update](docs/RELEASE-0.3.1.md) · [0.3 workflow changes](docs/RELEASE-0.3.0.md). This release adds proportionate research, explicit architecture decisions, delivery-scope discussion, linked mission/ticket templates, and a functional browser review viewer. Check the registry and GitHub release for publication evidence.
+**DevMethod 0.4.0.** [Direct agent commands and migration](docs/RELEASE-0.4.0.md) · [0.3 workflow changes](docs/RELEASE-0.3.0.md). This release exposes the documented stages directly in the agent, including review without a terminal launcher. It retains the research, decision dialogue, mission templates and browser review viewer introduced in 0.3. Check the registry and GitHub release for publication evidence.
 
 For developers and small teams using coding agents in new or existing repositories. Requires Node.js 22+ and npm; Git is required for context provenance. Application examples have separate framework/database prerequisites. DevMethod records scope, decisions and verification; it does not certify agent output, infer all dependencies, deploy applications or run an autonomous backlog. Installation and deterministic fixture results are separate from native host validation. See [compatibility](COMPATIBILITY.md).
 
@@ -43,18 +43,18 @@ Start with [missions and the tested source quick start](docs/MISSIONS.md), the [
 Requires Node.js 22+ and npm. Install into a fresh staging directory first:
 
 ```bash
-npx --yes devmethod-ai@0.3.1 init --tool codex --dest ../foundation-staging
+npx --yes devmethod-ai@0.4.0 init --tool codex --dest ../foundation-staging
 ```
 
 Choose `codex`, `claude` or `cursor`. If you omit `--tool`, an interactive terminal asks. For example:
 
 ```bash
-npx --yes devmethod-ai@0.3.1 init --tool claude --dest ../foundation-staging --dry-run
+npx --yes devmethod-ai@0.4.0 init --tool claude --dest ../foundation-staging --dry-run
 ```
 
 Remove `--dry-run` to write. Select a subset with `--modules decision-architecture,scoped-delivery`; `project-foundation` is always included. Without `--modules`, all six modules are installed. The installer refuses divergent files and duplicate skills across host directories. It never edits AGENTS.md, CLAUDE.md or your package.json. Review the staging output, then merge only what the project needs.
 
-The installer has no runtime dependencies and makes no network requests after npm obtains the package. To pin the final version, use `npx --yes devmethod-ai@0.3.1 init ...`. To pin a reviewed repository commit instead, use: `npx --yes --package=github:montassarkhalloufi/DevMethod#<commit-sha> devmethod init ...`.
+The installer has no runtime dependencies and makes no network requests after npm obtains the package. To pin the final version, use `npx --yes devmethod-ai@0.4.0 init ...`. To pin a reviewed repository commit instead, use: `npx --yes --package=github:montassarkhalloufi/DevMethod#<commit-sha> devmethod init ...`.
 
 Complete PROJECT_PROFILE.md with your real stack, commands, scope, deployment permissions and data requirements. Merge AGENTS.foundation.md into the project's existing instructions only after review. Claude Code reads CLAUDE.md: preserve its current content and, if the project has AGENTS.md, optionally add `@AGENTS.md` to import it. Keep existing accepted architecture decisions authoritative.
 
@@ -102,28 +102,30 @@ Risk and repository policy override apparent size. Reuse accepted UI, architectu
 
 ## Run the workflow
 
-In Codex: `$project-foundation status`.
+In Codex: select `$devmethod-status` or `$devmethod-review TASK-1`.
 
-In Claude Code or Cursor: `/project-foundation status`.
+In Claude Code or Cursor: select `/devmethod-status` or `/devmethod-review TASK-1`.
 
-Replace `status` with an action below. These are prompts to the skill, not shell commands or standalone `/verify` commands. They do not create a background autonomous loop.
+After installation, these commands run the workflow in your agent without npx. For example, `$devmethod-review` inspects actual changes, runs relevant checks and reports findings; it does not merely open the viewer. Existing `project-foundation <stage>` syntax remains valid. Partial module installs expose only stages supported by the selected modules. See [command discovery and updates](docs/COMMANDS.md).
+
+Select an action below and add its target. These are prompts to the skill, not shell commands or standalone `/verify` commands. They do not create a background autonomous loop.
 
 | Action | Result |
 |---|---|
-| `explore` | Dated research on existing solutions, uncertainty and next direction |
-| `frame` | Product scope, exclusions and success measures |
-| `design` | Visual directions, selected mockups and UX criteria; image tooling depends on the host |
-| `architecture` | Conversation and explicit choice/delegation before dependent detail |
-| `plan` | Useful scope discussion, conditional milestones and near-term tickets |
-| `ready TASK-1` | Readiness assessment before implementation |
-| `implement TASK-1` | Scoped code, tests and corrections |
-| `review TASK-1` | Evidence-backed inspection, structured findings, checks, sources and report |
-| `verify TASK-1` | Executed checks and remaining gates |
-| `integrate TASK-1` | Delivery under existing permissions |
-| `correct-course` | Resolve changed scope or blocked decisions |
-| `next` | Select the next authorized slice |
-| `status` | Current evidenced implementation status |
-| `handoff` | Resumable checkpoint |
+| `devmethod-explore` | Dated research on existing solutions, uncertainty and next direction |
+| `devmethod-frame` | Product scope, exclusions and success measures |
+| `devmethod-design` | Visual directions, selected mockups and UX criteria; image tooling depends on the host |
+| `devmethod-architecture` | Conversation and explicit choice/delegation before dependent detail |
+| `devmethod-plan` | Useful scope discussion, conditional milestones and near-term tickets |
+| `devmethod-ready TASK-1` | Readiness assessment before implementation |
+| `devmethod-implement TASK-1` | Scoped code, tests and corrections |
+| `devmethod-review TASK-1` | Evidence-backed inspection, structured findings, checks, sources and report |
+| `devmethod-verify TASK-1` | Executed checks and remaining gates |
+| `devmethod-integrate TASK-1` | Delivery under existing permissions |
+| `devmethod-correct-course` | Resolve changed scope or blocked decisions |
+| `devmethod-next` | Select the next authorized slice |
+| `devmethod-status` | Current evidenced implementation status |
+| `devmethod-handoff` | Resumable checkpoint |
 
 See [research, decision dialogue and mission migration](docs/WORKFLOW-0.3.md). See the [full command contract](.agents/skills/project-foundation/references/operating-commands.md). A failed check returns to correction; a blocked gate leads to handoff or replanning. Tests, code review and native permissions remain necessary.
 
@@ -133,12 +135,12 @@ See [research, decision dialogue and mission migration](docs/WORKFLOW-0.3.md). S
 
 [Detailed recorded Lisière chain](docs/media/full-chain-4k/README.md) · [Short Clair demo](docs/media/from-zero/README.md) · [Run Clair](examples/clair-from-zero/README.md). Clair is a separate from-zero example. The featured film retains the Lisière story and adds an explicitly separate fictional review example.
 
-## Inspect a review in your browser
+## Inspect a review in your browser (optional)
 
 Generate a local interactive report from the packaged fictional demo:
 
 ```sh
-npx --yes devmethod-ai@0.3.1 review --demo --output review.html --open
+npx --yes devmethod-ai@0.4.0 review --demo --output review.html --open
 ```
 
 The command generates `review.html` and opens it in your browser without a local server. On a headless machine, omit `--open`; if opening fails, the file remains available. For your own results, use `--review relative/review.json`; add `--markdown REVIEW.md` for the derived report. Search and filter findings, inspect evidence and source provenance, and export the same results. Existing Markdown remains readable with `--legacy`. See [review commands, format and trust limits](docs/REVIEWS.md). The CLI presents recorded results; it does not perform an automatic code review.

package/START_HERE.md

@@ -2,7 +2,7 @@
 
 DevMethod offers six independent modules; this installation contains the modules you selected. If this is a staging directory, review and copy its installed skill folder into the project while preserving existing files. If you installed directly into the project, the selected skills are already in place. If a version already exists, compare changes before updating it. Keep `PROJECT_PROFILE.md` and complete the stack, commands, scope, deployment permissions, and data requirements from the project before adoption. `ENGINEERING_POLICY.template.md` retains the included policy; merge it with `CONTRIBUTING.md` and existing instructions.
 
-In Codex, start with `$project-foundation status`. In Claude Code or Cursor, start with `/project-foundation status`. For an open-ended request:
+In Codex, start with `$devmethod-status`; for a review select `$devmethod-review` and add a ticket, PR or changed paths. In Claude Code or Cursor use `/devmethod-status` or `/devmethod-review`. All fourteen documented stages are exposed by a full installation. Module subsets expose stages backed by installed procedures. Once installed, run stages directly in the agent: no npx is needed. Existing `project-foundation <stage>` invocations still work. For an open-ended request:
 
 > Use the `project-foundation` skill for this project. Read existing instructions and sources, complete the profile without reinventing decisions, then deliver the following scope: [my objective]. Apply only relevant modules. Preserve the approved mockup, architecture boundaries, and React rules. Progress to a verified result within this scope.
 

package/dist/cli.js

@@ -32,7 +32,9 @@ Non-interactive init calls require --tool. Destination defaults to the current d
 All six modules are included by default; project-foundation is always included.
 Existing divergent files block installation; there is no overwrite option.
 The installer is offline. npx may download the package before it runs.
-Workflow stages are skill arguments: project-foundation explore|frame|design|architecture|plan.
+After installation, select devmethod-review (or any documented devmethod-<stage>)
+in your agent. No npx is needed to run a workflow. Full installs expose 14 stages;
+subsets expose commands backed by installed modules. project-foundation <stage> still works.
 Use the host-native skill syntax; these are not executable CLI subcommands.
 The JSON plan inspector is read-only. Markdown PLAN/tickets and legacy missions
 are agent-readable guidance; init never creates or migrates mission records.

package/dist/commands.js

@@ -0,0 +1,20 @@
+/** Native stage entry points; module selection remains the six-module contract. */
+export const stageOwners = {
+    'devmethod-explore': 'project-foundation',
+    'devmethod-frame': 'project-foundation',
+    'devmethod-design': 'design-to-code',
+    'devmethod-architecture': 'decision-architecture',
+    'devmethod-plan': 'scoped-delivery',
+    'devmethod-ready': 'scoped-delivery',
+    'devmethod-implement': 'scoped-delivery',
+    'devmethod-review': 'scoped-delivery',
+    'devmethod-verify': 'scoped-delivery',
+    'devmethod-integrate': 'scoped-delivery',
+    'devmethod-correct-course': 'project-foundation',
+    'devmethod-next': 'scoped-delivery',
+    'devmethod-status': 'project-foundation',
+    'devmethod-handoff': 'scoped-delivery',
+};
+export function commandSkills(selected) {
+    return Object.entries(stageOwners).filter(([, owner]) => selected.includes('project-foundation') && selected.includes(owner)).map(([name]) => name);
+}

package/dist/doctor.js

@@ -2,6 +2,7 @@ import * as fs from 'node:fs';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { tools, modules, templates } from './init.js';
+import { commandSkills } from './commands.js';
 import { parseJson, checkPath, stat } from './filesystem.js';
 function object(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
@@ -15,6 +16,7 @@ export function validateManifest(value) {
         !object(value.files))
         throw new Error('Expected a DevMethod format 2 manifest with a supported host and unique modules including project-foundation.');
     const root = tools[value.tool];
+    const supportedSkills = [...value.skills, ...commandSkills(value.skills)];
     const required = [...templates, 'DEVMETHOD-LICENSE', ...value.skills.map(name => `${root}/${name}/SKILL.md`)];
     for (const name of required) {
         if (!Object.hasOwn(value.files, name))
@@ -25,7 +27,7 @@ export function validateManifest(value) {
         const parts = name.split('/');
         const safe = parts.every(part => /^[a-zA-Z0-9._-]+$/.test(part) && part !== '.' && part !== '..');
         const rootFile = templates.includes(name) || name === 'DEVMETHOD-LICENSE';
-        const skillFile = parts.slice(0, 2).join('/') === root && value.skills.includes(parts[2]) &&
+        const skillFile = parts.slice(0, 2).join('/') === root && supportedSkills.includes(parts[2]) &&
             ((parts.length === 4 && parts[3] === 'SKILL.md') ||
                 (parts.length >= 5 && ['assets', 'references'].includes(parts[3] ?? '') && name.endsWith('.md')));
         if (!safe || (!rootFile && !skillFile))
@@ -93,7 +95,7 @@ export function diagnose(destination) {
             add('error', 'file-unreadable', error instanceof Error ? error.message : String(error), relative);
         }
     }
-    for (const name of manifest.skills) {
+    for (const name of [...manifest.skills, ...commandSkills(manifest.skills)]) {
         for (const root of Object.values(tools)) {
             if (root === tools[manifest.tool])
                 continue;

package/dist/init.js

@@ -2,6 +2,7 @@ import * as fs from 'node:fs';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
+import { commandSkills } from './commands.js';
 import { parseJson, checkPath, stat } from './filesystem.js';
 export const tools = { codex: '.agents/skills', claude: '.claude/skills', cursor: '.cursor/skills' };
 export const modules = ['project-foundation', 'decision-architecture', 'design-to-code', 'react-feature-engineering', 'reliable-ai-integration', 'scoped-delivery'];
@@ -35,7 +36,7 @@ export function initialize(options) {
         throw new Error('Install outside the distribution directory');
     if (stat(destination) && !stat(destination)?.isDirectory())
         throw new Error('Destination must be a directory');
-    for (const name of selected) {
+    for (const name of [...selected, ...commandSkills(selected)]) {
         for (const otherRoot of Object.values(tools)) {
             if (otherRoot !== tools[options.tool] && stat(path.join(destination, otherRoot, name)))
                 throw new Error(`Duplicate skill in another host directory: ${otherRoot}/${name}`);
@@ -104,7 +105,7 @@ export function initialize(options) {
 /** The exact host-profiled payload shipped with this CLI. */
 export function bundledFiles(tool, selected) {
     const files = new Map();
-    for (const name of selected) {
+    for (const name of [...selected, ...commandSkills(selected)]) {
         const source = path.join(packageRoot, '.agents/skills', name);
         checkPath(source);
         for (const relative of walk(source)) {

package/docs/ADR-009-visible-workflow-commands.md

@@ -0,0 +1,11 @@
+# ADR 009: Discoverable workflow commands
+
+Status: accepted for implementation under the user's explicit request, 2026-09-13.
+
+The user requested that documented workflow commands, especially review, be exposed and execute in the agent without npx. Keeping only stage arguments meets neither discoverability nor the selected interaction. Registering bare review/plan commands could collide with host commands. Expose fourteen namespaced devmethod-* skills as short adapters to the existing stage contract and procedure modules. Preserve project-foundation invocations and the six-module selection contract. This amends ADR 001's entry-point restriction without changing its filesystem or permission boundaries.
+
+A full installation ships all entry points; subsets include only entries backed by selected procedures. Manifest file hashes include adapters, while skills continues to identify selected procedure modules. Validation permits only the known applicable adapter paths and continues to accept old manifests without them. Initialization checks cross-host duplicates and preflights conflicts before writing. Update preview reports additions without overwriting existing installations.
+
+The agent performs a review with installed instructions and resources; the optional presentation CLI does not perform checks. Install the structured format reference to remove the former dependence on package documentation. This release does not change the design workflow, browser UI, mission schemas or permission model.
+
+Revisit if native-host testing shows ambiguous automatic routing, discovery limits or real demand for a different grouping. More commands do not establish superiority over another method. Automated packaging/integrity tests and manual instruction inspection are not native model execution evidence.

package/docs/COMMANDS-VALIDATION.md

@@ -0,0 +1,13 @@
+# Command validation
+
+Candidate: 0.4.0, based on main 18e003f. Date: 2026-09-13.
+
+Local checks on the candidate worktree: `npm ci --ignore-scripts`, `npm test` (95 passed), `npm run test:greenfield` (24 passed), `npm run check:docs`, skill-creator quick validation (14 adapters), `npm pack --dry-run`, and packed smoke tests passed. HTTP fixture tests required permission to bind localhost outside the filesystem/network sandbox; no assertion was bypassed.
+
+Packed smoke used the actual npm 0.3.1 archive as its migration baseline. Full Codex/Claude/Cursor installations include all 14 adapters and the review format reference; hashes, subset installation, read-only diagnostics and local-customization conflicts passed. The legacy profile and customized foundation bytes remained intact. The public CLI still presents results rather than performing review.
+
+Release CI and registry results are attached to the corresponding PR/GitHub release after execution. This file records local candidate evidence, not a prior assertion of remote success.
+
+Manual instruction inspection: each adapter executes its named stage using the existing contract, preserves arguments and authorization, and does not automatically run the suggested next stage. Review points to the installed procedure and format; it distinguishes actual inspection from optional CLI rendering. Existing architecture dialogue, conditional plans, exploration and design rules remain in their owners.
+
+Limits: no fresh authenticated Codex, Claude Code or Cursor invocation or menu-discovery check has been run for these adapters. File links, frontmatter and install checks alone do not establish conversational behavior. Existing comparative studies do not measure this release.

package/docs/COMMANDS.md

@@ -0,0 +1,36 @@
+# Run DevMethod in your agent
+
+Version 0.4.0 exposes every documented workflow stage as a discoverable skill. Install the skills once using the existing installer. Afterwards select a command in the agent and supply its target; no npx invocation or running DevMethod service is needed.
+
+| Workflow | Codex | Claude Code / Cursor |
+|---|---|---|
+| Explore | `$devmethod-explore` | `/devmethod-explore` |
+| Frame | `$devmethod-frame` | `/devmethod-frame` |
+| Design | `$devmethod-design` | `/devmethod-design` |
+| Architecture | `$devmethod-architecture` | `/devmethod-architecture` |
+| Plan | `$devmethod-plan` | `/devmethod-plan` |
+| Ready | `$devmethod-ready TASK-1` | `/devmethod-ready TASK-1` |
+| Implement | `$devmethod-implement TASK-1` | `/devmethod-implement TASK-1` |
+| Review | `$devmethod-review TASK-1` | `/devmethod-review TASK-1` |
+| Verify | `$devmethod-verify TASK-1` | `/devmethod-verify TASK-1` |
+| Integrate | `$devmethod-integrate TASK-1` | `/devmethod-integrate TASK-1` |
+| Correct course | `$devmethod-correct-course` | `/devmethod-correct-course` |
+| Next | `$devmethod-next` | `/devmethod-next` |
+| Status | `$devmethod-status` | `/devmethod-status` |
+| Handoff | `$devmethod-handoff` | `/devmethod-handoff` |
+
+The entry points load the existing [stage contract](../.agents/skills/project-foundation/references/operating-commands.md) and relevant procedure. They are not separate copies of the method. The old `project-foundation <stage>` syntax remains supported. No bare `/review` is registered over the host's own command.
+
+A full installation exposes all fourteen commands. Foundation-only installs expose explore, frame, correct-course and status. Design requires design-to-code; architecture requires decision-architecture; plan, ready, implement, review, verify, integrate, next and handoff require scoped-delivery. Module selection and the manifest's six module names are unchanged. Other technical modules remain available when selected.
+
+## Review actual work
+
+For example, select `$devmethod-review` and add `the current uncommitted diff against HEAD`. The agent reads actual changes and relevant contracts, executes applicable checks and reports located findings, evidence and limits. A clear ticket, PR, revision or path selection can replace that target. An ambiguous scope is clarified only when it affects the review.
+
+A review does not silently fix product code. Small reviews can stay in the conversation; substantial reviews use the existing tracker or the installed structured review format. Checks that were not run remain explicitly unverified. A browser viewer is optional: the shell command `devmethod review --review ...` validates and displays recorded results, but cannot conduct the review. The agent must not ask you to run npx as a prerequisite to inspection or launch fictional demo results instead of reviewing your code.
+
+## Adopt into an existing project
+
+Install the candidate into a fresh staging directory with the same host and selected modules. Compare it with your existing installation. Copy the new `devmethod-*` folders and merge the relevant foundation/delivery resources, preserving local customizations. Do not overwrite the filled project profile, instructions, mission records or a divergent skill. Keep the previous manifest until you have intentionally reconciled all adopted baseline files; never replace hashes merely to hide modifications. `update-preview` can classify changes read-only; it does not apply them.
+
+Do not run `init` over a customized installation expecting it to upgrade: conflicts block all writes. Both legacy single-file missions and PLAN/tickets missions remain readable, with no automatic migration. If the host does not discover the added skills, reload/reopen its session and inspect its configured skill directory. As a fallback ask it to read the installed `devmethod-review/SKILL.md` directly. Discovery and model behavior need host-specific verification; file installation tests alone do not prove autocomplete behavior.

package/docs/RELEASE-0.4.0.md

@@ -0,0 +1,15 @@
+# DevMethod 0.4.0
+
+## Direct workflow commands
+
+All fourteen documented stages now have discoverable devmethod-* skill entries. Select `$devmethod-review` in Codex or `/devmethod-review` in Claude Code/Cursor and add the review target. The agent inspects the work and executes relevant checks without requiring the user to launch npx. The optional CLI remains a renderer/validator for recorded review results.
+
+This additive pre-1.0 minor release preserves project-foundation invocations, the six procedure modules, approved design behavior, legacy missions and installation conflict protection. Module subsets install only entry points backed by available procedures. Manifest integrity and read-only update previews cover the added files. Review record documentation is installed with scoped-delivery.
+
+## Migration
+
+Follow [command adoption](COMMANDS.md#adopt-into-an-existing-project): stage a fresh installation and intentionally merge adapters/resources. Do not overwrite divergent skills or filled project context. No mission or instruction migration runs automatically. Old manifests remain readable by the new CLI; older CLI versions may reject manifests containing new adapter paths, so use the matching or newer CLI for diagnostics.
+
+## Verification
+
+Candidate checks and publication evidence are recorded in [command validation](COMMANDS-VALIDATION.md). Automated checks cover installation, hashes, links, module subsets, conflicts, legacy preview and the packed CLI. Manual instruction inspection is distinct from a native model run. Host autocomplete and fresh native execution remain unverified unless explicitly recorded there. No new BMAD superiority claim is made.

package/docs/REVIEW-GUIDE.md

@@ -2,6 +2,8 @@
 
 DevMethod 0.3 adds a review workflow and an offline browser interface. Version 0.3.1 expands the documentation and the existing narrated film with this journey. The CLI presents recorded results; it does not inspect code or run tests on your behalf.
 
+After skills installation, invoke `$devmethod-review <target>` in Codex or `/devmethod-review <target>` in Claude Code/Cursor to perform the review without npx. The terminal commands below are optional presentation utilities for recorded results.
+
 ## Try the packaged example
 
 Use Node.js 22+ from a normal project directory, with a fresh output filename:

package/docs/REVIEWS.md

@@ -1,6 +1,8 @@
 # Review results, reports and browser consultation
 
-The agent's `project-foundation review` stage performs project-aware inspection under [the review workflow](../.agents/skills/scoped-delivery/references/review-workflow.md). The CLI `devmethod review` only validates and presents recorded results. It never runs repository commands, discovers evidence on disk, or performs the review itself.
+The agent's `devmethod-review` command (also `project-foundation review`) performs project-aware inspection under [the review workflow](../.agents/skills/scoped-delivery/references/review-workflow.md). The CLI `devmethod review` only validates and presents recorded results. It never runs repository commands, discovers evidence on disk, or performs the review itself.
+
+After skills installation, invoke `$devmethod-review <target>` in Codex or `/devmethod-review <target>` in Claude Code/Cursor to perform the review without npx. The terminal commands below are optional presentation utilities for recorded results.
 
 ## Use the installed package
 
@@ -26,27 +28,7 @@ Existing outputs are never overwritten. Choose a fresh path for a newer snapshot
 
 ## One versioned source
 
-Use existing conventions, or `docs/missions/<mission-id>/reviews/<review-id>/review.json`, with generated `REVIEW.md` and deliberately included `preuves/`. Tickets link stable finding IDs; the report and UI derive results from the JSON. Do not maintain another independent score or status table.
-
-Format 1 is validated by the same pure model in the CLI and browser. See the [complete fictional example](../examples/review/review.json) and [compiled validator](../dist/review-model.js). Unknown formats, unknown/missing fields, duplicate IDs, invalid destinations and dangling references are rejected with errors that omit source contents. Arrays are bounded to 256 items, text fields to 16,384 characters, and input to 4 MiB. Image data has a separate limit of approximately 1 MiB per PNG/JPEG.
-
-| Object | Required fields and ownership |
-|---|---|
-| Review | format, id, title, project, mission, tickets, date, scope, exclusions, revision, technologies, sources, checks, findings, evidence, limits, policy, summary |
-| revision | commit (recorded revision label), dirty (explicit uncommitted changes); no automatic Git execution |
-| technologies | name, version, detectedFrom (actual manifest/lockfile/source evidence) |
-| ticket | id, title, url (HTTPS or null; local/unpublished destinations remain unavailable) |
-| source | id, title, kind (documentation/skill/project), publisher, technology, version, url, consultedAt, access (consulted/unavailable/unverified), usage, compatibility, provenance; consulted requires a date |
-| check | id, title, domain, kind (automated/manual), status (passed/failed/not-run/blocked/out-of-scope), result, reason, evidenceIds, revision, targets; unexecuted/excluded checks need a reason |
-| finding | id, title, domain, severity (critical/major/moderate/minor), severityReason, confidence (confirmed/suspected), resolution (open/in-progress/resolved/accepted-risk), location, trigger, expected, observed, impact, reproduction, evidenceIds, correction, tradeoffs, sourceIds, ticketIds, verification, resolutionEvidenceIds, targets |
-| location | path or component description, line (positive integer or null), component (text or null); display metadata, never arbitrary file access |
-| evidence | id, title, kind (text/log/screenshot/diagram), content (text alternative or excerpt), url (HTTPS or null), image (null or explicit PNG/JPEG object) |
-| image | mime=image/png or image/jpeg, base64, alt, origin=captured/explanatory, privacyReviewed=true; only deliberately included reviewed images, not filesystem paths or remote images |
-| policy | blockingSeverities, requireAllChecks, rationale; project-owned explicit policy, no numeric risk score |
-
-A confirmed finding still needs evidence or reproduction. A resolved finding requires resolution evidence IDs; schema validation checks the references, **not the truth of execution or whether the fix really works**. Authors must retain the original evidence and supply fresh verification. Closing a panel never changes resolution. Finding counts include all resolution states and stay independent from filtered results; uncertain unresolved findings have a separate count. Failed-check counts are separate from finding counts.
-
-A blocking confirmed open finding or a failed check requires corrections. Otherwise a blocked check yields blocked; no passed checks, an unresolved suspected finding, or required unrun checks yields incomplete. Otherwise the conclusion is ready **on the verified scope**, with exclusions and limits still visible. This conclusion does not authorize integration/deployment or replace repository policy.
+The [installed review format reference](../.agents/skills/scoped-delivery/references/review-format.md) owns fields, statuses and conclusion rules. It is shipped with scoped-delivery so authoring does not require a package download. The [complete fictional example](../examples/review/review.json) and [compiled validator](../dist/review-model.js) support optional browser export. Use one result owner and derive reports from it.
 
 ## Browser journey
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devmethod-ai",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "From idea to delivery with your AI coding agents",
   "license": "MIT",
   "type": "module",

package/scripts/package-smoke.mjs

@@ -15,7 +15,7 @@ try {
   run('tar', ['-xzf', '-'], root, 0, fs.readFileSync(path.resolve(archive)));
   const pkg = path.join(root, 'package'); const cli = path.join(pkg, 'dist/cli.js');
   const call = (args, expected = 0) => run(process.execPath, [cli, ...args], root, expected);
-  assert.equal(JSON.parse(fs.readFileSync(path.join(pkg, 'package.json'))).version, '0.3.1');
+  assert.equal(JSON.parse(fs.readFileSync(path.join(pkg, 'package.json'))).version, '0.4.0');
   run(process.execPath, ['scripts/check-docs.mjs'], pkg);
   assert.match(call(['--help']), /Markdown PLAN\/tickets and legacy missions/);
   for (const resource of ['project-foundation/references/exploration.md', 'project-foundation/references/delivery-planning.md', 'project-foundation/assets/EXISTANT.md', 'project-foundation/assets/OPPORTUNITES.md', 'project-foundation/assets/CADRAGE.md', 'project-foundation/assets/REGLES.md', 'scoped-delivery/assets/PLAN.md', 'scoped-delivery/assets/TICKET.md', 'scoped-delivery/assets/REPRISE.md', 'scoped-delivery/assets/MISSION.md', 'scoped-delivery/assets/REVIEW.md', 'scoped-delivery/references/review-workflow.md']) {
@@ -37,6 +37,12 @@ try {
     const project = path.join(root, host);
     call(['init', '--tool', host, '--dest', project]);
     assert.equal(JSON.parse(call(['doctor', '--dest', project, '--json'])).status, 'ok');
+    const skillRoot = { codex: '.agents/skills', claude: '.claude/skills', cursor: '.cursor/skills' }[host];
+    const entries = fs.readdirSync(path.join(project, skillRoot)).filter(name => name.startsWith('devmethod-'));
+    assert.equal(entries.length, 14);
+    assert.ok(entries.includes('devmethod-review'));
+    for (const name of entries) assert.ok(fs.statSync(path.join(project, skillRoot, name, 'SKILL.md')).size > 0);
+    assert.ok(fs.statSync(path.join(project, skillRoot, 'scoped-delivery/references/review-format.md')).size > 0);
     const profile = path.join(project, 'PROJECT_PROFILE.md'); fs.appendFileSync(profile, '\nFictional local customization.\n');
     const before = fs.readFileSync(profile);
     const preview = JSON.parse(call(['update-preview', '--dest', project, '--json']));
@@ -75,5 +81,5 @@ try {
     assert.deepEqual([fs.readFileSync(customized), fs.readFileSync(profile)], before);
     console.log(`Actual legacy tarball: ${upstreamChanged ? 'local/upstream conflict' : 'unchanged upstream with local customization'} detected; filled profile/custom skill preserved.`);
   }
-  console.log('Packed 0.3.1: three host installs, subset, customization preservation, mission/context/staleness/planning and documentation links passed. No native host execution.');
+  console.log('Packed 0.4.0: three host installs, subset, customization preservation, mission/context/staleness/planning and documentation links passed. No native host execution.');
 } finally { fs.rmSync(root, { recursive: true, force: true }); }