dflow-sdd-ddd 0.8.0 → 0.9.0

package/README.en.md

@@ -35,8 +35,9 @@ npm install -g dflow-sdd-ddd
 dflow init
 ```
 
-The init flow asks whether the project is greenfield or brownfield, then
-previews the files it will create. Existing files are not overwritten. Init
+The init flow asks whether the project is greenfield or brownfield, which Git
+policy the team follows (GitFlow / Trunk), and how AI-made commits should be
+marked, then previews the files it will create. Existing files are not overwritten. Init
 creates workflow documentation and AI instruction files; it does not inspect,
 refactor, or migrate your application code.
 
@@ -317,7 +318,7 @@ Usable only inside an already-started active feature. Targets pointing at `compl
 |---|---|---|
 | `/dflow:verify` | Need to confirm docs, code, tests, and tech-debt records are still in sync | Drift report across spec, domain docs, implementation, tests, and debt records |
 | `/dflow:pr-review` | A change is ready for review | SDD/DDD compliance review checklist with risks, gaps, and follow-up items |
-| `/dflow:report-dflow-feedback` | You or the AI found a Dflow issue or improvement while using it | Sanitized local feedback draft; nothing is submitted automatically |
+| `/dflow:report-dflow-feedback` | You or the AI found a Dflow issue or improvement while using it | Sanitized local draft rendered field-by-field for the upstream issue form, ready to paste; nothing is submitted automatically |
 
 ### What should I run? (rule of thumb)
 
@@ -389,4 +390,4 @@ release history.
 
 ## License
 
-MIT License. See [LICENSE](LICENSE).
+GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later). See [LICENSE](LICENSE).

package/README.md

@@ -33,7 +33,7 @@ npm install -g dflow-sdd-ddd
 dflow init
 ```
 
-init 流程會詢問是 greenfield 或 brownfield，接著預覽即將建立的檔案。既有檔案不會被覆寫。Init 只建立 workflow 文件與 AI 指示檔，**不會**檢查、重構、或遷移你的應用程式碼。
+init 流程會詢問是 greenfield 或 brownfield、團隊採用的 Git policy（GitFlow / Trunk）、以及 AI commit 的標記方式，接著預覽即將建立的檔案。既有檔案不會被覆寫。Init 只建立 workflow 文件與 AI 指示檔，**不會**檢查、重構、或遷移你的應用程式碼。
 
 若專案已初始化、之後又要加入另一個 AI 程式設計工具，執行：
 
@@ -263,7 +263,7 @@ Dflow 指令依角色分四類。「我要做的事」對應到指令的速查
 |---|---|---|
 | `/dflow:verify` | 需要確認文件、程式、測試、債務紀錄是否一致 | 跨規格、領域文件、實作、測試、債務的 drift report |
 | `/dflow:pr-review` | 變更已準備接受審查 | SDD/DDD 合規 review 清單，含風險、缺口、後續項目 |
-| `/dflow:report-dflow-feedback` | 你或 AI 在使用中發現 Dflow 本身的問題 | sanitized 的本地 feedback 草稿；不自動送出 |
+| `/dflow:report-dflow-feedback` | 你或 AI 在使用中發現 Dflow 本身的問題 | sanitized 的本地草稿，逐欄對齊上游 issue 表單可直接貼上；不自動送出 |
 
 ### 該選哪個指令（rule of thumb）
 
@@ -328,4 +328,4 @@ GitHub 上的 source 可能包含 `0.2.0` 之後尚未發佈的 repo 變更。
 
 ## 授權
 
-MIT License，見 [LICENSE](LICENSE)。
+GNU Affero General Public License v3.0 或更新版本（AGPL-3.0-or-later），見 [LICENSE](LICENSE)。

package/bin/dflow.js

@@ -22,8 +22,9 @@ function printInitHelp() {
   dflow init
 
 Initializes Dflow project specs under dflow/specs/.
-The command prompts for project type, tech stack, prose language,
-optional starter files, and AI coding agents before showing a full file preview.
+The command prompts for project type, tech stack, prose language, Git policy,
+AI commit marker, optional starter files, and AI coding agents before showing a
+full file preview.
 `);
 }
 

package/docs/using-with-codex.en.md

@@ -162,20 +162,24 @@ triggers only. It does not create Codex command files and it does not add
 equivalent to Claude `.claude/commands` or Copilot `.github/prompts`.
 
 When you select `AGENTS.md - Codex / Copilot coding agent` in
-`--command-adapters` mode and Dflow can create a new `AGENTS.md` shim, the
-shim includes a trigger list generated from the canonical command registry.
-Those triggers are still plain text prompts, for example:
+`--command-adapters` mode, Dflow writes a trigger list generated from the
+canonical command registry into `AGENTS.md`. Those triggers are still plain
+text prompts, for example:
 
 ```text
 dflow:new-feature
 ```
 
-If the project already has a custom `AGENTS.md`, Dflow still preserves that
-file; merge the Dflow pointer manually from the generated snippet or the
-documentation guidance.
+As long as `AGENTS.md` is an unmodified Dflow-generated shim — which is exactly
+the case after the standard `init` → `configure-agents --command-adapters`
+flow — Dflow **injects** the trigger section directly into `AGENTS.md`, wrapped
+in markers, with zero manual merge. Re-running re-projects that same section in
+place instead of appending a duplicate.
 
-In this mode, the Codex-target merge snippet filename is
-`dflow/specs/shared/AGENTS-md-command-adapters-snippet.md`.
+If `AGENTS.md` was edited after Dflow generated it, or is your own custom file,
+Dflow leaves it untouched and instead writes the trigger section to a merge
+snippet for you to merge manually. In that case the Codex-target merge snippet
+filename is `dflow/specs/shared/AGENTS-md-command-adapters-snippet.md`.
 
 ### Version-Control Policy for Generated Artifacts (Codex)
 

package/docs/using-with-codex.md

@@ -149,18 +149,20 @@ Claude `.claude/commands` 或 Copilot `.github/prompts` 對等的 Dflow command-
 adapter。
 
 當你在 `--command-adapters` 模式下選擇 `AGENTS.md - Codex / Copilot coding agent`
-且 Dflow 可以建立新的 `AGENTS.md` shim 時，shim 會加入從 canonical command
-registry 產生的 trigger 清單。這些 trigger 仍是文字提示，例如：
+時，Dflow 會把從 canonical command registry 產生的 trigger 清單寫進 `AGENTS.md`。
+這些 trigger 仍是文字提示，例如：
 
 ```text
 dflow:new-feature
 ```
 
-如果專案已有自訂 `AGENTS.md`，Dflow 仍會保留既有檔案；請依產生的 merge snippet
-或文件指引手動合併 Dflow 指標。
+只要 `AGENTS.md` 是 Dflow 產生且未經改動的 shim（標準 `init` → `configure-agents
+--command-adapters` 流程就是如此），Dflow 會把帶 marker 的 trigger 段**直接注入**
+`AGENTS.md`，零手動合併；重複執行會就地重投影同一段、不會重複附加。
 
-在這個模式下，Codex 目標的 merge snippet 檔名是
-`dflow/specs/shared/AGENTS-md-command-adapters-snippet.md`。
+如果 `AGENTS.md` 在 Dflow 產生後被改過、或本來就是你自訂的檔案，Dflow 會保留既有
+檔案不動，改把 trigger 段寫到 merge snippet 供你手動合併。此情況下 Codex 目標的
+merge snippet 檔名是 `dflow/specs/shared/AGENTS-md-command-adapters-snippet.md`。
 
 ### 產生物的版控政策（Codex）
 

package/lib/init.js

@@ -13,6 +13,8 @@ const COMMAND_REGISTRY_END = '<!-- dflow-command-registry:end -->';
 const COMMAND_ADAPTER_GENERATED_MARKER = '<!-- dflow-generated: command-adapter -->';
 const SKILL_ADAPTER_GENERATED_MARKER = '<!-- dflow-generated: skill-adapter -->';
 const WORKFLOW_BUNDLE_GENERATED_MARKER = '<!-- dflow-generated: workflow-bundle -->';
+const CODEX_TRIGGER_SECTION_START = '<!-- dflow-generated: codex-command-triggers START -->';
+const CODEX_TRIGGER_SECTION_END = '<!-- dflow-generated: codex-command-triggers END -->';
 const WORKFLOW_BUNDLE_DEST = 'dflow/specs/shared/dflow-workflows';
 const WORKFLOW_BUNDLE_MANIFEST_PATH = `${WORKFLOW_BUNDLE_DEST}/.dflow-bundle-manifest.json`;
 const COMMON_SKILL_SOURCE_REL = 'common/skill/SKILL.md';
@@ -110,16 +112,42 @@ const OPTIONAL_FILE_OPTIONS = [
     key: 'overview',
     label: '_overview.md - system overview',
     aliases: ['overview', '_overview.md']
+  }
+];
+
+// Git policy is a mandatory team choice (PROPOSAL-047): both options use feature
+// branches; the choice selects the finish-stage merge guidance and drives the
+// runtime branch gates / commit checkpoints.
+const GIT_POLICY_OPTIONS = [
+  {
+    key: 'gitflow',
+    label: 'Git Flow - long-lived develop/release branches',
+    aliases: ['gitflow', 'git flow', 'flow']
+  },
+  {
+    key: 'trunk',
+    label: 'Trunk / GitHub Flow - short-lived feature branches (lightest)',
+    aliases: ['trunk', 'trunk-based', 'github flow', 'githubflow']
+  }
+];
+
+// How AI-made commits are marked (PROPOSAL-047). Chosen once at init; the
+// runtime does not re-ask. None is the default.
+const AI_COMMIT_MARKER_OPTIONS = [
+  {
+    key: 'none',
+    label: 'None - AI commits look like any other commit',
+    aliases: ['none', 'off', 'no']
   },
   {
-    key: 'git-trunk',
-    label: 'Git principles - trunk-based',
-    aliases: ['git principles - trunk-based', 'trunk', 'trunk-based']
+    key: 'co-authored-by',
+    label: 'Co-Authored-By trailer (dflow-ai) - filterable / auditable',
+    aliases: ['co-authored-by', 'co-author', 'trailer', 'coauthored']
   },
   {
-    key: 'git-flow',
-    label: 'Git principles - Git Flow',
-    aliases: ['git principles - git flow', 'git flow', 'gitflow']
+    key: 'prefix',
+    label: '[ai-assisted] commit-message prefix - visible at a glance',
+    aliases: ['prefix', 'ai-assisted', '[ai-assisted]']
   }
 ];
 
@@ -612,6 +640,20 @@ async function promptForAnswers(rl, stdout, stderr, detection) {
     proseLanguage = await askCustomProseLanguage(rl, stderr);
   }
 
+  const gitPolicy = await askSelect(rl, stdout, stderr, {
+    id: 'Q5',
+    question: 'Which Git policy does the team follow? (drives branch gates and finish-stage merge guidance)',
+    options: GIT_POLICY_OPTIONS,
+    defaultKey: null
+  });
+
+  const aiCommitMarker = await askSelect(rl, stdout, stderr, {
+    id: 'Q6',
+    question: 'How should AI-made commits be marked? (the AI offers to commit at checkpoints; you can always decline)',
+    options: AI_COMMIT_MARKER_OPTIONS,
+    defaultKey: 'none'
+  });
+
   const optionalFiles = await askOptionalFiles(rl, stdout, stderr);
   const aiAgents = await askAiAgents(rl, stdout, stderr, detection.configuredAgents || []);
 
@@ -621,6 +663,8 @@ async function promptForAnswers(rl, stdout, stderr, detection) {
     techStackSummary,
     migrationContext,
     proseLanguage,
+    gitPolicy,
+    aiCommitMarker,
     optionalFiles,
     aiAgents
   };
@@ -645,10 +689,26 @@ async function inferProjectContext(cwd, rl, stdout, stderr) {
     techStackSummary: await inferTechStackSummary(cwd),
     migrationContext: await inferMigrationContext(cwd),
     proseLanguage: await inferProseLanguage(cwd),
+    gitPolicy: await inferGitPolicy(cwd),
+    aiCommitMarker: await inferAiCommitMarker(cwd),
     optionalFiles: []
   };
 }
 
+async function inferGitPolicy(cwd) {
+  const conventionsPath = path.join(cwd, 'dflow/specs/shared/_conventions.md');
+  const content = await fs.readFile(conventionsPath, 'utf8').catch(() => '');
+  const match = content.match(/Selected Git policy:\s*`([^`]+)`/);
+  return match ? match[1] : null;
+}
+
+async function inferAiCommitMarker(cwd) {
+  const conventionsPath = path.join(cwd, 'dflow/specs/shared/_conventions.md');
+  const content = await fs.readFile(conventionsPath, 'utf8').catch(() => '');
+  const match = content.match(/AI commit marker:\s*`([^`]+)`/);
+  return match ? match[1] : null;
+}
+
 async function inferExistingEdition(cwd) {
   if (await pathExists(path.join(cwd, 'dflow/specs/architecture/tech-debt.md'))) {
     return 'greenfield';
@@ -767,33 +827,22 @@ async function askOptionalFiles(rl, stdout, stderr) {
   while (true) {
     stdout.write('\nWhich optional starter files should Dflow seed?\n');
     OPTIONAL_FILE_OPTIONS.forEach((option, index) => {
-      const defaultMarker = option.key === 'overview' || option.key === 'git-trunk' ? ' (recommended)' : '';
+      const defaultMarker = option.key === 'overview' ? ' (recommended)' : '';
       stdout.write(`  ${index + 1}. ${option.label}${defaultMarker}\n`);
     });
 
-    const answer = await askLine(rl, 'Enter comma-separated choices, "none", or press Enter for recommended [1,2]: ');
-    const parsed = parseMultiselectAnswer(answer, OPTIONAL_FILE_OPTIONS, ['overview', 'git-trunk']);
+    const answer = await askLine(rl, 'Enter comma-separated choices, "none", or press Enter for recommended [1]: ');
+    const parsed = parseMultiselectAnswer(answer, OPTIONAL_FILE_OPTIONS, ['overview']);
 
     if (!parsed.valid) {
       failedAttempts += 1;
       if (failedAttempts >= 3) {
-        throw new InitError('Too many invalid attempts for Q5. Dflow init aborted.');
+        throw new InitError('Too many invalid attempts for Q7. Dflow init aborted.');
       }
       stderr.write(`${parsed.message} (${3 - failedAttempts} attempts left)\n`);
       continue;
     }
 
-    if (parsed.values.includes('git-trunk') && parsed.values.includes('git-flow')) {
-      const keepBoth = await askConfirmation(
-        rl,
-        'You selected both Git principles templates. Most projects choose one. Keep both? (y/N) '
-      );
-      if (!keepBoth) {
-        failedAttempts = 0;
-        continue;
-      }
-    }
-
     return parsed.values;
   }
 }
@@ -997,6 +1046,7 @@ async function buildFilePlan(cwd, answers) {
     content = substitutePlaceholders(content, substitution);
     if (options.injectProseLanguage) {
       content = ensureProseLanguageSection(content, answers.proseLanguage);
+      content = ensureConventionPolicySections(content, answers);
     }
     items.push({
       relativePath,
@@ -1030,11 +1080,13 @@ async function buildFilePlan(cwd, answers) {
   if (answers.optionalFiles.includes('overview')) {
     await addTemplate('dflow/specs/shared/_overview.md', 'scaffolding/_overview.md', 'selected');
   }
-  if (answers.optionalFiles.includes('git-trunk')) {
-    await addTemplate('dflow/specs/shared/Git-principles-trunk.md', 'scaffolding/Git-principles-trunk.md', 'selected');
-  }
-  if (answers.optionalFiles.includes('git-flow')) {
-    await addTemplate('dflow/specs/shared/Git-principles-gitflow.md', 'scaffolding/Git-principles-gitflow.md', 'selected');
+
+  // PROPOSAL-047: the selected Git policy is mandatory — always project exactly
+  // the matching Git-principles file so the runtime branch gates have a policy.
+  if (answers.gitPolicy === 'gitflow') {
+    await addTemplate('dflow/specs/shared/Git-principles-gitflow.md', 'scaffolding/Git-principles-gitflow.md', 'mandatory, selected Git policy');
+  } else {
+    await addTemplate('dflow/specs/shared/Git-principles-trunk.md', 'scaffolding/Git-principles-trunk.md', 'mandatory, selected Git policy');
   }
 
   if (answers.aiAgents.length > 0) {
@@ -1080,7 +1132,7 @@ async function buildConfigureAgentsPlan(cwd, answers) {
   const commandRegistry = answers.commandAdapters ? parseDflowCommandRegistry(content) : [];
 
   for (const agent of answers.aiAgents) {
-    await addAiAgentShim(cwd, items, agent, substitution, { commandRegistry });
+    await addAiAgentShim(cwd, items, agent, substitution, { commandRegistry, warnings });
   }
 
   if (answers.commandAdapters) {
@@ -1308,15 +1360,48 @@ async function addAiAgentShim(cwd, items, agent, substitution, options = {}) {
   const targetExists = await pathExists(targetPath);
   const targetConfigured = targetExists && await fileReferencesAiAgentGuide(targetPath);
   const commandRegistry = options.commandRegistry || [];
+  const warnings = options.warnings;
   const codexCommandAdapterSnippet = target.relativePath === 'AGENTS.md' && commandRegistry.length > 0 && targetExists;
+  const content = substitutePlaceholders(buildAiAgentShim(target.relativePath, options.commandRegistry), substitution);
+  const source = `generated:${agent}-shim`;
+
+  // PROPOSAL-046: when adding Codex command triggers and the existing AGENTS.md
+  // is an unmodified Dflow shim, inject the marked trigger section directly
+  // (zero manual merge) instead of parking a side snippet. A user-modified shim
+  // still degrades safely to the snippet + warning.
+  if (codexCommandAdapterSnippet && targetConfigured) {
+    const existingContent = await fs.readFile(targetPath, 'utf8');
+    const baseShim = substitutePlaceholders(buildAiAgentShim(target.relativePath), substitution);
+    if (isPristineDflowAgentsShim(existingContent, baseShim)) {
+      items.push({
+        relativePath: target.relativePath,
+        source,
+        notes: `selected, injected command trigger section into Dflow-generated ${target.relativePath}`,
+        content,
+        overwrite: true
+      });
+      return;
+    }
+    if (warnings) {
+      warnings.push(
+        `Existing ${target.relativePath} was modified after Dflow generated it; wrote the command trigger section to dflow/specs/shared/AGENTS-md-command-adapters-snippet.md for manual merge.`
+      );
+    }
+    items.push({
+      relativePath: 'dflow/specs/shared/AGENTS-md-command-adapters-snippet.md',
+      source,
+      notes: `selected, ${target.relativePath} was modified after Dflow generated it; merge this command trigger snippet manually`,
+      content,
+      overwrite: true
+    });
+    return;
+  }
+
   const relativePath = codexCommandAdapterSnippet
-    ? (targetConfigured ? 'dflow/specs/shared/AGENTS-md-command-adapters-snippet.md' : target.snippetPath)
+    ? target.snippetPath
     : (targetExists && !targetConfigured ? target.snippetPath : target.relativePath);
-  const content = substitutePlaceholders(buildAiAgentShim(target.relativePath, options.commandRegistry), substitution);
   let notes = 'selected, tool-specific shim';
-  if (codexCommandAdapterSnippet && targetConfigured) {
-    notes = `selected, ${target.relativePath} already points to AI-AGENT-GUIDE.md; merge this command trigger snippet manually`;
-  } else if (codexCommandAdapterSnippet) {
+  if (codexCommandAdapterSnippet) {
     notes = `selected, ${target.relativePath} already exists; merge this command trigger snippet manually`;
   } else if (targetConfigured) {
     notes = `selected, ${target.relativePath} already points to AI-AGENT-GUIDE.md`;
@@ -1326,7 +1411,7 @@ async function addAiAgentShim(cwd, items, agent, substitution, options = {}) {
 
   items.push({
     relativePath,
-    source: `generated:${agent}-shim`,
+    source,
     notes,
     content,
     overwrite: codexCommandAdapterSnippet
@@ -1544,6 +1629,36 @@ function normalizeCommandAdapterFingerprint(content) {
   return String(content).replace(/\r\n/g, '\n');
 }
 
+function normalizeShimForMatch(content) {
+  return String(content)
+    .replace(/\r\n/g, '\n')
+    .split('\n')
+    .map((line) => line.replace(/[ \t]+$/, ''))
+    .join('\n')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim();
+}
+
+function stripCodexTriggerBlock(content) {
+  const escape = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const re = new RegExp(
+    `\\n*${escape(CODEX_TRIGGER_SECTION_START)}[\\s\\S]*?${escape(CODEX_TRIGGER_SECTION_END)}\\n*`
+  );
+  return content.replace(re, '\n');
+}
+
+// An AGENTS.md is a safely-injectable Dflow shim when, after removing any
+// previously-injected trigger block, it matches the shim Dflow itself
+// generates. This covers both a pristine 0.8.0/0.9.0 shim (no marker, normalized
+// exact-template match) and a shim Dflow already injected into (idempotent
+// re-projection). A user-edited shim fails the match and degrades to a snippet.
+// (A future shim could carry its own generated-marker for a cheaper check, but
+// that would require freezing this pre-marker template for back-compat matching;
+// the normalized template match works for both eras without that.)
+function isPristineDflowAgentsShim(existingContent, baseShim) {
+  return normalizeShimForMatch(stripCodexTriggerBlock(existingContent)) === normalizeShimForMatch(baseShim);
+}
+
 function buildCodexCommandTriggerSection(commandRegistry) {
   const triggers = commandRegistry
     .map((command) => {
@@ -1554,6 +1669,8 @@ function buildCodexCommandTriggerSection(commandRegistry) {
 
   return `
 
+${CODEX_TRIGGER_SECTION_START}
+
 ## Dflow Text Triggers
 
 Codex does not install Dflow command files. When the developer asks for a
@@ -1568,6 +1685,8 @@ and execute it.
 Recognized canonical triggers:
 
 ${triggers}
+
+${CODEX_TRIGGER_SECTION_END}
 `;
 }
 
@@ -1757,8 +1876,7 @@ const PLACEHOLDER_ALIASES = {
 
 function buildSubstitutionMap(cwd, answers) {
   const extracted = extractTechStackPlaceholders(answers.techStackSummary);
-  const gitSelection = answers.optionalFiles.filter((key) => key === 'git-trunk' || key === 'git-flow');
-  const gitStyle = gitSelection.length === 1 ? (gitSelection[0] === 'git-trunk' ? 'trunk' : 'gitflow') : null;
+  const gitStyle = answers.gitPolicy === 'gitflow' ? 'gitflow' : (answers.gitPolicy === 'trunk' ? 'trunk' : null);
   const systemName = path.basename(cwd);
 
   const map = new Map([
@@ -1990,6 +2108,70 @@ function stripProseLanguageSections(content) {
   return kept.join('\n');
 }
 
+function stripNamedSections(content, headings) {
+  const set = new Set(headings.map((heading) => `## ${heading}`));
+  const kept = [];
+  let skipping = false;
+
+  for (const line of content.split(/\r?\n/)) {
+    if (set.has(line.trim())) {
+      skipping = true;
+      continue;
+    }
+    if (skipping && /^## /.test(line)) {
+      skipping = false;
+    }
+    if (!skipping) {
+      kept.push(line);
+    }
+  }
+
+  return kept.join('\n');
+}
+
+function buildGitPolicySection(gitPolicy) {
+  const policy = gitPolicy === 'gitflow' ? 'gitflow' : 'trunk';
+  return `## Git Policy
+
+Selected Git policy: \`${policy}\`
+
+Dflow runtime branch gates and finish-feature guidance follow this policy. Both
+policies use feature branches; the policy selects the finish-stage merge
+guidance — \`gitflow\` introduces merge-commit / release+develop flow, while
+\`trunk\` (GitHub Flow) favors squash or fast-forward back to the main branch
+with small, frequent merges.`;
+}
+
+function buildAiCommitPolicySection(aiCommitMarker) {
+  const marker = ['none', 'co-authored-by', 'prefix'].includes(aiCommitMarker) ? aiCommitMarker : 'none';
+  return `## AI Commit Policy
+
+AI commit marker: \`${marker}\`
+
+At lifecycle checkpoints the AI may offer to commit using your Git identity; you
+can always decline (Y / N). Completed and skipped checkpoints are recorded in
+each feature's Checkpoint Log. Marker modes:
+
+- \`none\`: AI-made commits carry no extra marker.
+- \`co-authored-by\`: append a \`Co-Authored-By: dflow-ai <noreply@dflow.local>\`
+  trailer (teams may customize the name/email).
+- \`prefix\`: prefix the commit subject with \`[ai-assisted]\`.`;
+}
+
+function ensureConventionPolicySections(content, answers) {
+  const stripped = stripNamedSections(content, ['Git Policy', 'AI Commit Policy']).replace(/\n{3,}/g, '\n\n');
+  const sections = `${buildGitPolicySection(answers.gitPolicy)}\n\n${buildAiCommitPolicySection(answers.aiCommitMarker)}`;
+  const markerMatch = stripped.match(/^## Filling the Templates/m);
+
+  if (markerMatch && typeof markerMatch.index === 'number') {
+    const before = stripped.slice(0, markerMatch.index).replace(/\s*$/, '\n\n');
+    const after = stripped.slice(markerMatch.index).replace(/^\s*/, '');
+    return `${before}${sections}\n\n${after}`;
+  }
+
+  return `${stripped.replace(/\s*$/, '\n\n')}${sections}\n`;
+}
+
 function buildProseLanguageSection(proseLanguage) {
   return `## Prose Language
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dflow-sdd-ddd",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Spec-first SDD/DDD workflow kit for AI-assisted development",
   "type": "commonjs",
   "bin": {
@@ -41,7 +41,7 @@
   "scripts": {
     "test": "node test/smoke.mjs"
   },
-  "license": "MIT",
+  "license": "AGPL-3.0-or-later",
   "publishConfig": {
     "access": "public"
   }