draht-claude 2026.4.26 → 2026.5.12

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [2026.5.12] - 2026-05-12
+
+### Added
+
+- flag plan placeholders and empty sections in validate-plans
+- refresh gsd-workflow skill with subagent roster and STATUS protocol
+- add verification-gate, brainstorming, debugging-workflow, atomic-reasoning skills
+- integrate spec-reviewer, STATUS protocol, and Red Flag gates across commands
+- rewrite /fix as 4-phase systematic debugging protocol
+- add spec-reviewer agent for per-task spec compliance
+- add STATUS protocol footer to all subagents
+- add configure subcommand and agent model defaults
+
 ## [2026.4.25] - 2026-04-25
 
 ### Changed

package/LICENSE

@@ -1,7 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Oskar Freye (Draht)
-Copyright (c) 2025 Mario Zechner
+Copyright (c) 2026 Oskar Freye
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -98,6 +98,11 @@ npx draht-claude install --path /path/to/plugins/draht
 # Check install status
 npx draht-claude status
 
+# Configure subagent models
+npx draht-claude configure --agent architect --model opus
+npx draht-claude configure --agent implementer --model sonnet
+npx draht-claude configure --list
+
 # Remove
 npx draht-claude uninstall
 ```
@@ -158,6 +163,44 @@ Between every step, run `/clear` to start a fresh session. This is a feature —
 
 ## Configuration
 
+### Subagent models
+
+Each specialist subagent ships with a default model tuned to its workload:
+
+| Agent | Default | Used by |
+|---|---|---|
+| `architect` | `opus` | `/plan-phase` — deep reasoning for architectural plans |
+| `implementer` | `sonnet` | `/execute-phase` — fast, reliable code changes |
+| `verifier` | `sonnet` | `/verify-work` — lint, typecheck, test runs |
+| `security-auditor` | `opus` | `/verify-work` — security audit and CVE analysis |
+| `reviewer` | `inherit` | `/verify-work`, `/review` — code review |
+| `debugger` | `inherit` | `/fix` — bug diagnosis |
+| `git-committer` | `inherit` | `/atomic-commit` — commit staging |
+
+You can override any agent with the `configure` command:
+
+```bash
+# Set architect (planning) to Opus and implementer to Sonnet
+npx draht-claude configure --agent architect --model opus
+npx draht-claude configure --agent implementer --model sonnet
+
+# Use a full model ID
+npx draht-claude configure --agent verifier --model claude-opus-4-7
+
+# List current assignments
+npx draht-claude configure --list
+
+# Reset a single agent to default
+npx draht-claude configure --agent architect --reset
+
+# Reset all agents to defaults
+npx draht-claude configure --reset
+```
+
+Supported values: `opus`, `sonnet`, `haiku`, a full model ID (e.g. `claude-sonnet-4-6`), or `inherit`.
+
+### Hooks
+
 Create `.planning/config.json` in your project to tune the hooks:
 
 ```json

package/agents/architect.md

@@ -2,6 +2,7 @@
 name: architect
 description: Reads codebase, analyzes requirements, and produces structured implementation plans with file lists, dependencies, and phased task breakdowns. Use when planning new features, refactors, or any multi-step implementation that needs architectural thinking before code is written.
 tools: Read, Bash, Grep, Glob
+model: opus
 ---
 
 You are the Architect agent. Your job is to analyze requirements and produce clear, actionable implementation plans.
@@ -43,3 +44,13 @@ Numbered list of concrete tasks. For each task:
 - DO NOT produce code — only plans
 - DO NOT make assumptions about APIs without reading the source
 - DO NOT suggest removing existing functionality unless explicitly asked
+- DO NOT use placeholders in plans: `[TBD]`, `[files]`, "appropriate error handling", "similar to Task N" are forbidden. Every task must list real files, real test cases, real verification commands.
+
+## Final Status
+
+End your output with exactly one of these lines:
+
+- `STATUS: DONE` — plan is complete, all tasks have real files/tests/verification, no open questions.
+- `STATUS: DONE_WITH_CONCERNS` — plan is usable but you flagged risks the caller should weigh (ambiguous spec areas, alternative approaches considered, unknowns surfaced during code-reading).
+- `STATUS: NEEDS_CONTEXT` — you cannot produce a plan without more information. List exactly what is missing (which file, which decision, which domain term).
+- `STATUS: BLOCKED` — the request as stated cannot be planned because of an architectural conflict, missing prerequisite phase, or scope problem. Explain the blocker — do not guess your way through it.

package/agents/debugger.md

@@ -55,3 +55,13 @@ Show that the fix works (test output, command output).
 - Keep fixes minimal — do not refactor unrelated code
 - If the fix is non-obvious, add a comment explaining why
 - Run verification after fixing to confirm the issue is resolved
+- After **3 failed fix attempts**, STOP. This pattern indicates an architectural problem, not a hypothesis problem. Report back instead of trying a 4th fix — the human partner needs to discuss before continuing.
+
+## Final Status
+
+End your output with exactly one of these lines:
+
+- `STATUS: DONE` — root cause identified, fix applied, verification passes.
+- `STATUS: DONE_WITH_CONCERNS` — fix applied but you noticed related bugs, fragile patterns, or test gaps that should be tracked separately.
+- `STATUS: NEEDS_CONTEXT` — you cannot diagnose without more information (logs, reproduction steps, env details). List exactly what is missing.
+- `STATUS: BLOCKED` — diagnosis points to an architectural issue or 3+ fix attempts failed. Do NOT keep trying. Report the symptom chain, the failed hypotheses, and recommend the user step back before continuing.

package/agents/git-committer.md

@@ -50,3 +50,12 @@ Use the package directory name or feature area (e.g., `auth`, `billing`, `api`).
 - Keep the first line under 72 characters
 - No emojis in commit messages
 - If there is a related issue, include `fixes #<number>` or `closes #<number>`
+
+## Final Status
+
+End your output with exactly one of these lines:
+
+- `STATUS: DONE` — all relevant changes committed cleanly, one logical change per commit.
+- `STATUS: DONE_WITH_CONCERNS` — committed, but you noticed unstaged files left behind, mixed concerns that you split as best you could, or pre-commit hook warnings.
+- `STATUS: NEEDS_CONTEXT` — you cannot commit safely because diffs span unrelated concerns and you need the user to clarify intent.
+- `STATUS: BLOCKED` — pre-commit hooks failed, the working tree is in a bad state, or staged content includes likely secrets. Do NOT commit. Report the blocker.

package/agents/implementer.md

@@ -2,6 +2,7 @@
 name: implementer
 description: Implements code changes based on a plan or task description. Reads existing code, writes new code, and edits files. Use when executing a planned task that needs actual code changes, especially inside a TDD red→green→refactor cycle.
 tools: Read, Bash, Edit, Write, Grep, Glob
+model: sonnet
 ---
 
 You are the Implementer agent. Your job is to write code that fulfills the given task.
@@ -33,3 +34,12 @@ Skip the TDD cycle only for pure config or documentation-only changes with no te
 - Keep changes minimal — do only what the task asks for
 - If a task is ambiguous, implement the most conservative interpretation
 - Run `npm run check` or equivalent after changes if the project has one
+
+## Final Status
+
+End your output with exactly one of these lines so the caller can branch deterministically:
+
+- `STATUS: DONE` — task complete, tests green, no concerns.
+- `STATUS: DONE_WITH_CONCERNS` — task complete and tests green, but list concerns: tech debt incurred, edge cases the spec didn't cover, surprises uncovered while implementing. The caller decides whether to address before moving on.
+- `STATUS: NEEDS_CONTEXT` — you cannot proceed without more information. List exactly what is missing (file content, decision, design choice, missing dependency). Do not guess.
+- `STATUS: BLOCKED` — the task cannot be completed as specified. State the blocker type: `context` (info missing), `complexity` (task is bigger than 2–5 minutes — needs decomposing), `scope` (task asks for something that conflicts with the codebase), `plan` (the spec is internally inconsistent). Do not write partial code; revert and report.

package/agents/reviewer.md

@@ -55,3 +55,13 @@ If no issues found, state that explicitly.
 - Be actionable — say what to change, not just what is wrong
 - Do not nitpick formatting if the project has a formatter
 - Focus on substance over style
+- This agent is the **code quality** review. Spec compliance is the `spec-reviewer` agent's job and runs first inside `/execute-phase`. If you find a spec mismatch, escalate it under `Must fix` — do not silently accept it.
+
+## Final Status
+
+End your output with exactly one of these lines:
+
+- `STATUS: DONE` — no issues found, or only `Consider`-level suggestions.
+- `STATUS: DONE_WITH_CONCERNS` — `Should fix` issues exist but nothing blocking. List them under that heading.
+- `STATUS: NEEDS_CONTEXT` — you could not review because the diff or surrounding code was not accessible. List what is missing.
+- `STATUS: BLOCKED` — `Must fix` issues exist. The diff should not be merged or proceed to the next task until they are addressed.

package/agents/security-auditor.md

@@ -2,6 +2,7 @@
 name: security-auditor
 description: Audits code changes for security vulnerabilities, injection risks, secrets exposure, and unsafe patterns. Use during code review or before merging changes that touch auth, data handling, input parsing, file operations, or external/AI API calls.
 tools: Read, Bash, Grep, Glob
+model: opus
 ---
 
 You are the Security Auditor agent. Your job is to find **exploitable** vulnerabilities in code changes — both **zero-day** issues (pattern-based hunting in the code itself) and **known CVEs** (matching dependencies against vulnerability databases).
@@ -107,3 +108,12 @@ For each issue:
 - ALWAYS cite exact file:line and quote the vulnerable snippet if under 80 chars
 - ALWAYS check existing project patterns before flagging "missing X" (middleware, framework defaults, central validators may already handle it)
 - If the diff touches no security boundary, output `no findings — diff does not touch security boundaries` and stop
+
+## Final Status
+
+End your output with exactly one of these lines:
+
+- `STATUS: DONE` — no findings, or only Low-severity defense-in-depth gaps.
+- `STATUS: DONE_WITH_CONCERNS` — Medium findings exist; safe to merge but should be tracked.
+- `STATUS: NEEDS_CONTEXT` — you cannot finish the audit without more information (env config, threat model, where this code runs).
+- `STATUS: BLOCKED` — Critical or High findings exist. The change must NOT merge until they are addressed. List exploit vector and fix for each.

package/agents/spec-reviewer.md

@@ -0,0 +1,65 @@
+---
+name: spec-reviewer
+description: Reviews a completed task's diff against the original spec — does the implementation cover exactly what the plan asked for, no more, no less. Use inside /execute-phase between implementer and quality reviewer. Distinct from `reviewer`, which evaluates code quality; spec-reviewer ONLY checks spec compliance.
+tools: Read, Bash, Grep, Glob
+model: sonnet
+---
+
+You are the Spec Reviewer agent. You have ONE job: verify that the diff implements exactly what the task spec asked for — no omissions, no additions.
+
+You are NOT a code-quality reviewer. You do NOT comment on naming, structure, abstractions, or style. That is the `reviewer` agent's job, which runs after you.
+
+## The Iron Rule
+
+A spec-compliant diff:
+- Implements every `<test>` case the task lists
+- Implements every behaviour the `<action>` describes
+- Satisfies every assertion in `<done>`
+- Touches the files listed in `<files>` and no unrelated files
+- Does NOT add features the task did not request
+- Does NOT skip checkpoints (`checkpoint:human-verify`, `checkpoint:decision` must surface, not auto-proceed)
+
+If the diff fails ANY of these, the task is **not** spec-compliant — report it and stop. The quality review does not run until spec compliance is ✅.
+
+## Process
+
+1. **Read the task spec** — get the `<test>`, `<action>`, `<refactor>`, `<verify>`, `<done>` sections from the plan
+2. **Read the diff** — `git diff <range>` or as provided in your task instructions
+3. **Map diff → spec** — for each spec item, find the diff hunk that fulfils it
+4. **Flag gaps** — any spec item with no corresponding diff = omission
+5. **Flag extras** — any diff hunk that doesn't trace to a spec item = over-build (unless it's a trivial fix-up the spec implied)
+6. **Verify tests exist for every behaviour** — the `<test>` section must show up as concrete test files in the diff, not just be inferred from the implementation
+
+## Output Format
+
+### Spec Compliance Verdict
+One of: `✅ COMPLIANT` / `❌ NON-COMPLIANT`
+
+### Spec ↔ Diff Mapping
+For each spec item, the diff lines that fulfil it (or `MISSING`).
+
+### Omissions
+Spec items with no implementation. List each with severity.
+
+### Over-builds
+Diff content not requested by the spec. List each.
+
+### Required Fixes
+Bulleted, in order: what the implementer must change to become compliant.
+
+## Final Status
+
+End your output with exactly one of these lines:
+
+- `STATUS: DONE` — the diff is fully spec-compliant. Quality review may proceed.
+- `STATUS: DONE_WITH_CONCERNS` — the diff is spec-compliant but you noticed gaps the caller should know about (e.g., the spec itself is thin, or the impl exposed an ambiguity). Quality review may proceed.
+- `STATUS: NEEDS_CONTEXT` — you could not evaluate because the task spec or the diff was not provided. List what is missing.
+- `STATUS: BLOCKED` — the diff is non-compliant. List the required fixes. Quality review MUST NOT proceed until a re-run returns `DONE`.
+
+## Rules
+
+- Be specific — reference exact spec items and diff line ranges
+- Do not nitpick code style — that is the next reviewer's job
+- Do not propose refactorings — only flag omissions and over-builds
+- If a `checkpoint:human-verify` task was auto-completed without surfacing for human review, that is an omission
+- "Close enough" is not compliant — return BLOCKED and list the specific gaps

package/agents/verifier.md

@@ -2,6 +2,7 @@
 name: verifier
 description: Runs lint, typecheck, and test suites to verify code quality. Reports failures with context. Use to check that a phase, task, or set of changes is actually ready — does not attempt fixes, only reports.
 tools: Read, Bash, Grep, Glob
+model: sonnet
 ---
 
 You are the Verifier agent. Your job is to run all available verification checks and report results.
@@ -42,3 +43,13 @@ State whether the code is ready for production or what must be fixed first.
 - Do not attempt to fix issues — only report them
 - If a check command is not found, note it and move on
 - Include the full error output for failures (truncated if very long)
+- **Evidence before claims**: never report a check as "passing" without showing the command and its output. "Looks fine" is not a verdict.
+
+## Final Status
+
+End your output with exactly one of these lines:
+
+- `STATUS: DONE` — all available checks ran and passed.
+- `STATUS: DONE_WITH_CONCERNS` — checks passed but you flagged things like coverage drops, slow tests, or missing check configs.
+- `STATUS: NEEDS_CONTEXT` — you could not run checks (missing scripts, missing dependencies, ambiguous which command to run). List what's missing.
+- `STATUS: BLOCKED` — one or more required checks failed. List which, with command output. Do NOT mark the work ready — the caller must route to a fix loop.

package/bin/draht-tools.cjs

@@ -523,6 +523,46 @@ commands["read-plan"] = function (n, p) {
 };
 
 // --- validate-plans ---
+// Placeholder patterns that indicate a task isn't actually executable.
+// Borrowed from superpowers' writing-plans discipline: tasks with these aren't
+// usable input for an implementer subagent.
+const PLACEHOLDER_PATTERNS = [
+	{ pattern: /\[TBD\]/i, label: "[TBD]" },
+	{ pattern: /\[files?\]/i, label: "[file] or [files]" },
+	{ pattern: /\[description\]/i, label: "[description]" },
+	{ pattern: /\[task\s*name\]/i, label: "[task name]" },
+	{ pattern: /\bappropriate\s+error\s+handling\b/i, label: '"appropriate error handling"' },
+	{ pattern: /\bsimilar\s+to\s+task\s+[NX0-9]+\b/i, label: '"similar to Task N"' },
+	{ pattern: /\bsee\s+previous\s+task\b/i, label: '"see previous task"' },
+	{ pattern: /\bfill\s+in\s+later\b/i, label: '"fill in later"' },
+	{ pattern: /\bfigure\s+(?:this\s+)?out\s+later\b/i, label: '"figure out later"' },
+];
+
+function findPlaceholders(content) {
+	const hits = [];
+	for (const { pattern, label } of PLACEHOLDER_PATTERNS) {
+		if (pattern.test(content)) hits.push(label);
+	}
+	return hits;
+}
+
+function findEmptySections(content) {
+	// Detect <test>, <action>, <verify>, <done> blocks that are empty or contain only whitespace/placeholders
+	const sections = ["test", "action", "verify", "done", "files"];
+	const empty = [];
+	for (const tag of sections) {
+		const re = new RegExp(`<${tag}>([\\s\\S]*?)</${tag}>`, "g");
+		let match;
+		while ((match = re.exec(content)) !== null) {
+			const inner = match[1].trim();
+			if (inner.length === 0 || /^\.\.\.$/.test(inner) || /^\[.*\]$/.test(inner)) {
+				empty.push(`<${tag}>`);
+			}
+		}
+	}
+	return empty;
+}
+
 commands["validate-plans"] = function (n) {
 	const num = parseInt(n, 10);
 	if (!num) { console.error("Usage: draht-tools validate-plans N"); process.exit(1); }
@@ -547,6 +587,18 @@ commands["validate-plans"] = function (n) {
 		const taskCount = (content.match(/<task/g) || []).length;
 		if (taskCount > 5) issues.push(`${file}: ${taskCount} tasks (max recommended: 5)`);
 		if (taskCount === 0) issues.push(`${file}: No tasks defined`);
+
+		// Placeholder linter — flag tasks that aren't actually executable
+		const placeholders = findPlaceholders(content);
+		if (placeholders.length > 0) {
+			issues.push(`${file}: contains placeholder text → ${placeholders.join(", ")} (tasks must be concrete to dispatch to subagents)`);
+		}
+
+		// Empty section linter — <test>, <action>, <verify>, <done>, <files> must have real content
+		const emptySections = findEmptySections(content);
+		if (emptySections.length > 0) {
+			issues.push(`${file}: empty or placeholder-only sections → ${emptySections.join(", ")}`);
+		}
 	}
 
 	console.log(banner(`VALIDATE PHASE ${num}`));
@@ -556,6 +608,7 @@ commands["validate-plans"] = function (n) {
 	} else {
 		console.log(`\n⚠️  ${issues.length} issue(s):`);
 		for (const issue of issues) console.log(`  - ${issue}`);
+		process.exit(1);
 	}
 };
 

package/cli.mjs

@@ -49,7 +49,7 @@ const IGNORE = new Set([
 function parseArgs(argv) {
 	const args = argv.slice(2);
 	const command = args[0];
-	const flags = { path: null, force: false, help: false };
+	const flags = { path: null, force: false, help: false, agent: null, model: null, list: false, reset: false };
 	for (let i = 1; i < args.length; i++) {
 		const a = args[i];
 		if (a === "--path" || a === "-p") {
@@ -58,6 +58,14 @@ function parseArgs(argv) {
 			flags.force = true;
 		} else if (a === "--help" || a === "-h") {
 			flags.help = true;
+		} else if (a === "--agent" || a === "-a") {
+			flags.agent = args[++i];
+		} else if (a === "--model" || a === "-m") {
+			flags.model = args[++i];
+		} else if (a === "--list" || a === "-l") {
+			flags.list = true;
+		} else if (a === "--reset" || a === "-r") {
+			flags.reset = true;
 		}
 	}
 	if (!command || command === "--help" || command === "-h") flags.help = true;
@@ -65,7 +73,7 @@ function parseArgs(argv) {
 }
 
 function printHelp() {
-	console.log(`draht-claude — install the draht Claude Code plugin
+	console.log(`draht-claude — install and configure the draht Claude Code plugin
 
 Usage:
   npx draht-claude install            Install as a Claude Code plugin
@@ -74,6 +82,11 @@ Usage:
   npx draht-claude uninstall          Remove the plugin and marketplace
   npx draht-claude update             Reinstall (same as install --force)
   npx draht-claude status             Show install + enabled state
+  npx draht-claude configure          Configure subagent models
+    --agent <name> --model <model>    Set model for a specific agent
+    --agent <name> --reset            Reset agent to inherit default model
+    --reset                           Reset all agents to inherit
+    --list                            List current agent model assignments
 
 Options:
   -p, --path <dir>   Custom local marketplace directory
@@ -154,6 +167,25 @@ function runClaude(args, { allowFail = false } = {}) {
 	return res.status === 0;
 }
 
+function setModelInFrontmatter(content, model) {
+	const match = content.match(/^---\n([\s\S]*?)\n---\n?/);
+	if (!match) return content;
+	const lines = match[1].split("\n");
+	const modelIdx = lines.findIndex((l) => l.trim().startsWith("model:"));
+	if (model === null || model === undefined) {
+		if (modelIdx >= 0) lines.splice(modelIdx, 1);
+	} else {
+		const modelLine = `model: ${model}`;
+		if (modelIdx >= 0) {
+			lines[modelIdx] = modelLine;
+		} else {
+			lines.push(modelLine);
+		}
+	}
+	const body = content.slice(match[0].length);
+	return `---\n${lines.join("\n")}\n---\n${body}`;
+}
+
 function writeMarketplaceManifest(marketplaceDir, pluginManifest) {
 	const manifest = {
 		$schema: "https://anthropic.com/claude-code/marketplace.schema.json",
@@ -317,6 +349,90 @@ function cmdStatus(flags) {
 	}
 }
 
+function cmdConfigure(flags) {
+	const marketplaceDir = flags.path || DEFAULT_MARKETPLACE_DIR;
+	const pluginDir = path.join(marketplaceDir, "plugins", PLUGIN_NAME);
+	const agentsDir = path.join(pluginDir, "agents");
+
+	if (!fs.existsSync(pluginDir)) {
+		err(`plugin not installed at ${pluginDir}`);
+		err("run 'draht-claude install' first");
+		process.exit(1);
+	}
+
+	if (flags.list) {
+		if (!fs.existsSync(agentsDir)) {
+			log("no agents directory found");
+			return;
+		}
+		const files = fs.readdirSync(agentsDir).filter((f) => f.endsWith(".md"));
+		if (files.length === 0) {
+			log("no agents found");
+			return;
+		}
+		log("Agent models:");
+		for (const file of files.sort()) {
+			const content = fs.readFileSync(path.join(agentsDir, file), "utf-8");
+			const match = content.match(/^---\n([\s\S]*?)\n---\n?/);
+			let model = "inherit (default)";
+			if (match) {
+				const modelLine = match[1].split("\n").find((l) => l.trim().startsWith("model:"));
+				if (modelLine) {
+					model = modelLine.split(":").slice(1).join(":").trim();
+				}
+			}
+			log(`  ${file.replace(".md", "")}: ${model}`);
+		}
+		return;
+	}
+
+	if (flags.reset) {
+		if (flags.agent) {
+			const agentFile = path.join(agentsDir, `${flags.agent}.md`);
+			if (!fs.existsSync(agentFile)) {
+				err(`agent not found: ${flags.agent}`);
+				process.exit(1);
+			}
+			const content = fs.readFileSync(agentFile, "utf-8");
+			const updated = setModelInFrontmatter(content, null);
+			fs.writeFileSync(agentFile, updated);
+			log(`✓ reset model for ${flags.agent} to inherit`);
+		} else {
+			if (!fs.existsSync(agentsDir)) return;
+			const files = fs.readdirSync(agentsDir).filter((f) => f.endsWith(".md"));
+			for (const file of files) {
+				const agentFile = path.join(agentsDir, file);
+				const content = fs.readFileSync(agentFile, "utf-8");
+				const updated = setModelInFrontmatter(content, null);
+				fs.writeFileSync(agentFile, updated);
+			}
+			log("✓ reset model for all agents to inherit");
+		}
+		return;
+	}
+
+	if (!flags.agent || !flags.model) {
+		err("configure requires --agent <name> and --model <model>");
+		err("run 'draht-claude configure --help' for usage");
+		process.exit(1);
+	}
+
+	const agentFile = path.join(agentsDir, `${flags.agent}.md`);
+	if (!fs.existsSync(agentFile)) {
+		err(`agent not found: ${flags.agent}`);
+		const available = fs.existsSync(agentsDir)
+			? fs.readdirSync(agentsDir).filter((f) => f.endsWith(".md")).map((f) => f.replace(".md", "")).join(", ")
+			: "(none)";
+		err(`available agents: ${available}`);
+		process.exit(1);
+	}
+
+	const content = fs.readFileSync(agentFile, "utf-8");
+	const updated = setModelInFrontmatter(content, flags.model);
+	fs.writeFileSync(agentFile, updated);
+	log(`✓ set model for ${flags.agent} to ${flags.model}`);
+}
+
 // ─── main ───────────────────────────────────────────────────────────────────
 
 const { command, flags } = parseArgs(process.argv);
@@ -341,6 +457,9 @@ switch (command) {
 	case "status":
 		cmdStatus(flags);
 		break;
+	case "configure":
+		cmdConfigure(flags);
+		break;
 	default:
 		err(`unknown command: ${command}`);
 		err("run 'draht-claude --help' for usage");

package/commands/atomic-commit.md

@@ -7,6 +7,18 @@ allowed-tools: Bash, Read, Task
 
 Analyze changes and create atomic commits.
 
+## Red Flags — STOP
+
+Do NOT proceed with a commit if **any** of these is true:
+
+- A single proposed commit mixes unrelated concerns (e.g., a feature + an unrelated refactor + a config tweak)
+- The change set contains potential secrets (`.env`, credentials, API keys in source)
+- Staged content includes files unrelated to the user's stated intent (stale build artifacts, IDE configs, scratch files)
+- Pre-commit hooks fail — fix the cause, never use `--no-verify`
+- You cannot articulate the "why" of a commit in one sentence — that's a sign it contains more than one logical change
+
+If any of these triggers, surface the issue to the user and split the change set before continuing.
+
 ## Atomic Reasoning
 
 Before creating commits, decompose changes into atomic reasoning units: