fdeops 3.13.0 → 3.15.0

package/mcp/fdeops-ingest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops-ingest-mcp",
-  "version": "3.13.0",
+  "version": "3.15.0",
   "private": true,
   "description": "Thin stdio MCP sink for FDEOps ingest (stage → propose → apply). Zero runtime dependencies.",
   "bin": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fdeops",
-  "version": "3.13.0",
-  "description": "Engagement memory for AI coding agents. Your agent forgets the client every morning - the sponsor, the promise, who signed off. FDEOps keeps that as dated markdown on your laptop: one @fde skill for the four days of an embed, a deterministic local CLI, and hooks that make it automatic. Claude Code plugin and any agent that loads skills.",
+  "version": "3.15.0",
+  "description": "Forward deployed engineering skills for AI coding agents. Your agent forgets the client every morning - the sponsor, the promise, who signed off. FDEOps keeps that as dated markdown on your laptop: one @fde skill, a deterministic local CLI, and hooks that make it automatic. Claude Code plugin and any agent that loads skills.",
   "bin": {
     "fdeops": "bin/install.js",
     "fde": "bin/fde.js"

package/plugin.json

@@ -1,13 +1,13 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "fdeops",
-  "version": "3.13.0",
-  "description": "Engagement memory for AI coding agents: per-client memory in local .fde/ files, one @fde skill, the four days of an embed. Local-only, no network.",
+  "version": "3.15.0",
+  "description": "Forward deployed engineering skills for AI coding agents: per-client memory in local .fde/ files, one @fde skill. Local-only, no network.",
   "author": {
     "name": "Subash Natarajan",
     "url": "https://github.com/suboss87"
   },
-  "homepage": "https://fdeops.io/",
+  "homepage": "https://github.com/suboss87/fdeops",
   "repository": "https://github.com/suboss87/FDEOps",
   "license": "MIT",
   "keywords": [

package/skills/fde/SKILL.md

@@ -7,148 +7,103 @@ description: Keeps engagement memory for client work - sponsor, promise, what sh
 
 ## Purpose
 
-This skill is the **engagement record** for one client — not a land-through-close operating system, and not a coding skill. Four days drive the work: the brief is wrong, they went quiet, when did we agree, what did they get. You read `.fde/`, route, do the judgment, **confirm with the FDE, then write**. The host agent writes the code; you log what they got.
+The **engagement record** for one client. One skill; six stages (land → close). You pick the method; they never pick a skill. Confirm, then write `.fde/`. The host agent writes the TypeScript; you log what they got. The artifact is the memory.
 
-Every routed method still produces a concrete artifact in `.fde/`. The artifact is the deliverable AND the memory.
+## When to use
 
-## When NOT to use
+- They named a client, pasted notes, or asked what was agreed
+- The brief feels wrong, a sponsor went quiet, or Friday needs the ledger
+- Unbound — ask the name once, then **you** run `fde resume --init`
 
-`@fde` is the client record. Stay in the **host agent** for TypeScript errors, unit tests, refactors, git commits, and generic debug. Do not load `archive/sdlc/`. Agreed slice + code: implement in the host agent, then `fde log delivery`.
+## When NOT to use
 
-## Four days (use these first)
+TypeScript errors, unit tests, refactors, git commits, generic debug: **host agent**. Agreed slice + code: implement in the host, then `fde log delivery`.
 
-Name the day, not the phase. Each moment: one sentence to say, one CLI verb, then stop. Coding, tests, and generic debug stay in the host agent.
+## Use these first
 
-| The day | Sentence to say | You run | Then read |
+| What's happening | Sentence to say | You run | Then read |
 |---------|-----------------|---------|-----------|
-| **The brief is wrong** | "If this works, who in their company would have to agree that it worked?" | `fde resume` then follow discover | `references/discover.md` |
-| **They went quiet** | "Is this a process gap, or a trust problem?" | `fde log contact "…" --signal amber\|red\|green` | `references/rescue.md` (trust fire) |
+| **The brief is wrong** | "If this works, who in their company would have to agree that it worked?" | `fde resume` then discover | `references/discover.md` |
+| **They went quiet** | "Is this a process gap, or a trust problem?" | `fde log contact "…" --signal amber\|red\|green` | `references/rescue.md` |
 | **When did we agree?** | Don't argue from memory. Search the record. | `fde receipts <term>` | — |
-| **What did they get?** | Read the ledger out loud. A number nobody signed is claimed, not delivered. | `fde status` | `references/status.md` |
-
-After a meeting, still: `fde debrief --smart` → confirm → `--apply`. Before a walk-in: `fde prep`. Friday: `fde status` (promised → measured → accepted). Notes: dated, sourced, one customer.
+| **What did they get?** | A number nobody signed is claimed, not delivered. | `fde status` | `references/status.md` |
 
-## Audience
+After a meeting: `fde debrief --smart` → confirm → `--apply`. Walk-in: `fde prep`. Friday: `fde status`.
 
-- **FDE** = the **human** who types `@fde` (or plain language) in the chat.
-- **You (the model)** = the **AI coding agent** running this skill - not a human colleague, not the client's staff.
+## Human surface vs agent plumbing
 
-When this skill says "ask the FDE," it means the human. When it says "write to `.fde/`," you (the AI) write the files.
+**FDE (human):** `@fde` + English, or `/brief` `/discover` `/plan` `/ship` `/got` `/close` `/debrief` `/prep` `/quiet` `/agreed` `/status`. Never a skill catalog.
 
-## Human surface vs agent plumbing (non-negotiable)
+**You (agent):** run the CLI. **Never tell the FDE to type** `fde …`. If unbound, you run `fde resume --init` after one question. Never ask them to run the CLI.
 
-| Who | Interface |
-|-----|-----------|
-| **FDE (human)** | `@fde` + natural language. Examples: "debrief these notes", "prep me for tomorrow's sponsor meeting", "when did we agree to drop that?", "draft the sponsor update". |
-| **You (agent)** | Run the local `fde` CLI for deterministic memory work. Never tell the FDE to type `fde …` (except if setup is missing - then **you** run `fde resume --init <name>` after one clarifying question). |
-
-If you catch yourself saying "run `fde debrief --smart notes.txt`" to the human - **stop**. Run it yourself (or write a temp notes file and run it), then show the human the result in plain language for confirm/reject.
+Fallbacks: `node ~/.claude/fdeops/fde.js …`, then `npx --yes fdeops …`. Skill-only install is not "unavailable."
 
 ## Entry (every session)
 
-1. Run `fde resume` (fallbacks, in order: `node ~/.claude/fdeops/fde.js resume`, then `npx --yes fdeops resume`). Bounded `context.md` only. `fde resume --full` if you genuinely need the whole log.
-2. If **NO ENGAGEMENT**: **do not leave them there.** Ask once: "What should we call this client?" Then **you** run `fde resume --init <slug>`. Never show them the command. After bind, if they pasted notes, go straight to debrief.
-3. Playback 2–3 lines from TRIAGE + bounded `context.md`. If TRIAGE has `hygiene:`, that is the one finding — offer `fde doctor`; **never auto-rewrite**. Else one line, ask where to pick up.
-4. Route (Four days, then the table below). Read **one** `references/*.md`. Confirm with the FDE, then write.
-
-**Path.** Workspace registry (written once by `fde resume --init <name>`) is the normal bind: env override → registry → pointer file → workspace-name match (read-only) → `./.fde`. Writes need a bind (or `FDEOPS_ENGAGEMENT`), not folder name alone. Never install fdeops on infrastructure the FDE does not control.
-
-**You run the `fde` CLI for deterministic work - never improvise shell, never hand the command to the FDE:**
-
-| When the FDE says (approx.) | You run |
-|-----------------------------|---------|
-| (session entry / where are we) | `fde resume` or use injected TRIAGE; `fde resume --init <name>` only if unbound |
-| Day-1 look at the repo | `fde scan` - then you interpret against the brief |
-| "Debrief these notes" / pastes meeting notes | Prefer `fde debrief --smart <notes>` → **you** (the agent) rewrite `.debrief-propose` with `decision:`/`risk:`/`delivery:`/`contact:`/`next:` prefixes where needed → show FDE → on confirm `fde debrief --apply`. `--smart` is a prefix/keyword gate, not a brain. Fallback: structure prefixed lines yourself, show FDE, then `fde debrief` |
-| "Make sure we're up to date" / "pull relevant info" / "pull from Granola/Slack/transcript" | Bind engagement; **capability check** (which *source* MCPs exist — never pretend). If missing → connect flow. Else fetch text → `fde ingest stage` **in this workspace** → propose → rewrite prefixes → show FDE → on confirm `fde ingest apply`. MCP sink is optional; if used, pass `engagement` from `fde resume --bind`. **Never auto-apply. Never push. Never ambient sync.** Detail: `references/ingest.md` |
-| "Connect a new MCP" / "connect Granola/Slack/Notion" / "what can you pull?" | Follow `references/ingest-connect.md`: source MCP only; sink is `fde ingest` here. They save/reload; you cannot silent-install. Paste still works with no MCP. |
-| "Prep me for the meeting with …" / walk-in brief | `fde prep "<short label>"` - present the brief in plain language; do not invent facts missing from `.fde/` |
-| "When did we agree…?" / scope dispute | `fde receipts <term>` - answer with dates; no hit = gap, not proof |
-| "Draft the sponsor update" / how are we doing | `fde status` (value ledger first) then follow `references/status.md` |
-| "Log that they went quiet" / trust signal | `fde log contact "…" --signal amber\|green\|red`. If they already named the color ("log that as amber"), that is the confirm — write it. If they only described the situation, playback the color once, then write. |
-| Want the HTML fieldbook | `fde dashboard` |
-| "Open my clients in Obsidian" / one window over everything / "can I show this to the sponsor?" | `fde vault` (add `--redacted` for a shared screen). Derived and disposable: rebuilt from `.fde/` on every run and never read back. Keep logging to the fieldbook, not the vault. |
-| "Clean up the fieldbook" / hygiene / memory feels messy | `fde doctor` - walk issues in plain language; propose fixes; never auto-rewrite without confirm. Includes structural gaps: empty operating map (plan+), stakeholder name forks (Denise vs Denise Chen), duplicates, ship/close risks. Contradictions need judgment (brief vs reality) - doctor is structural; you handle meaning. `fde tidy` proposes safe consolidations (no new facts). |
-| "Scrub this secret / redact that token" (buried line, not just last write) | `fde redact <term>` preview, then `fde redact <term> --apply` after confirm. Undo is last-write only; redact is for buried lines. Remind them to rotate the real credential. |
-
-**The debrief verb.** Highest-frequency loop. When the FDE shares notes or says "debrief": **you** run the smart path (write notes to a temp file if needed). `--smart` writes a propose file via deterministic heuristics (existing prefixes + light keywords); authentic rambling notes often land mostly in context until **you** rewrite lines with type prefixes. Show the proposed routing in plain language. Only `--apply` (or pipe prefixed lines) after they confirm. Never ask them to run the CLI. Detail: `references/debrief.md`.
-
-CLI genuinely unavailable (no Node, offline, npx blocked) → use the manual fallbacks inside each reference (still you write files; still never ask the FDE to run setup). A skill-only install is not "unavailable": run the verb through `npx --yes fdeops …` so the gates, dating and redaction still hold.
-
-**Tokens.** CLI work is free. Hooks inject TRIAGE + bounded `context.md` + a pointer — never this full skill (loads on `@fde`). Pull **one** reference when you route; never dump a whole `.fde/` file — bounded resume, or `fde receipts <term>`.
-
-## Anti-invention gates (field anti-slop)
-
-These stop confident fiction. They are not optional soft tips.
-
-| Temptation | Gate |
-|------------|------|
-| Tell the FDE to run `fde debrief` / `fde prep` / `fde receipts` themselves | **Stop.** You run the CLI; they confirm results in plain language. |
-| Invent a stakeholder, meeting, or quote to make the narrative rich | **Stop.** Write `unknown - ask: <question>`. One fake name poisons every real citation. |
-| Route to a phase because it "feels senior" while the signal is muddy | **Stop.** Playback + one natural question, or name the ambiguity ("discover or rescue — leaning X because…"). |
-| Fill `success.md` / `terrain.md` with plausible defaults when the brief is thin | **Stop.** Run **brief interrogation** in land/discover (one Q + GUESS + confidence) until you can write without guessing, or leave gaps explicit. |
-| Ship / go-live / irreversible change with "probably fine" | **Stop.** Run **intent vs diff** (KEEP/JUSTIFY/SPLIT/DROP) then **pre-blast challenge** in ship (or red-team) — CLAIM → CHALLENGE → VERDICT — and log both. |
-| Grill the FDE with a checklist when they're mid-flow | **Stop.** Playback rule wins. Probe only when a missing fact changes the next move. |
-| Sync chat transcripts / agent brain folders into the product git repo for "team share" | **Stop.** Run **session digest** into `.fde/` (judgment only). Transcripts stay local. |
-
-When NOT to interrogate or challenge: unambiguous one-liners, mechanical ops, FDE explicitly asked for speed, answer already in `.fde/`.
-
-## The memory contract (non-negotiable)
-
-This is what makes fdeops a second brain instead of a chat window.
-
-1. **On entry:** resolve the engagement path and read `context.md` via `fde resume` (a bounded view - current state + recent activity). Nothing else until the routed phase needs it; pull other `.fde/` files only when the phase calls for them.
-2. **Deliverable = memory.** The output of every phase IS a `.fde/` file. You never ask the FDE to "update their notes" - producing the work and writing the memory are one action. The phase reference tells you which file.
-3. **Evidence rule.** Every claim in an artifact carries its source: `(validated with: ops lead, Day 5)`, `(churn: 47 commits/90d)`, `(stated, unverified)`. The FDE defends these files in front of skeptical clients - traceable beats plausible.
-4. **No invented facts - ever.** People, names, quotes, meetings, and numbers exist only if the FDE said them or the repo shows them. Never invent a stakeholder, a conversation, or a source to make the narrative richer - one fabricated name poisons every real citation around it. A missing fact is written as `unknown - ask: <the question>`, nothing else.
-5. **On exit (session digest):** before the session ends — and again before opening a PR — capture the *thinking*, not the chat. Propose this digest in plain language; on FDE confirm, write into existing `.fde/` files (never a transcript dump, never a product-repo history folder):
+1. `fde resume` (bounded `context.md`). `--full` only if you need the whole log.
+2. **NO ENGAGEMENT:** ask "What should we call this client?" then **you** init. Pasted notes → debrief after bind.
+3. Playback 2–3 lines. `hygiene:` → offer `fde doctor`; **never auto-rewrite**.
+4. Route. Read **one** `references/*.md`. Confirm, then write.
+
+Writes need a bind (`FDEOPS_ENGAGEMENT` or registry). Never install fdeops on infrastructure they do not control.
+
+| They say | You run |
+|----------|---------|
+| where are we | `fde resume` |
+| day-1 look at the repo | `fde scan` |
+| debrief / pasted notes | `fde debrief --smart` → you rewrite prefixes → confirm → `--apply`. `--smart` is a gate, not a brain. `references/debrief.md` |
+| prep me for … | `fde prep "<label>"` |
+| when did we agree | `fde receipts <term>` |
+| sponsor update / what they got | `fde status` |
+| they went quiet | `fde log contact "…" --signal amber\|green\|red` |
+| fieldbook page | `fde dashboard` |
+| clean up the fieldbook | `fde doctor` — never auto-rewrite |
+| scrub a secret | `fde redact <term>` then `--apply` after confirm |
+| pull Granola/Slack/transcript | capability check → `fde ingest stage` → confirm → apply. Never auto-apply. `references/ingest.md` |
+| connect an MCP | `references/ingest-connect.md` |
+| Obsidian / one window | `fde vault` (`--redacted` for a shared screen) |
+
+## The memory contract
+
+1. **On entry:** `fde resume` only. Pull other `.fde/` files when the method needs them.
+2. **Deliverable = memory.** The work *is* the `.fde/` file. The reference names which one.
+3. **Evidence.** Every claim has a source. Traceable beats plausible.
+4. **No invented facts.** People, quotes, meetings, numbers: they said it or the repo shows it. Else `unknown - ask: <question>`.
+5. **Session digest** (end of session and before a PR) — thinking, not the chat. Confirm, then write. Never a transcript dump.
 
    | Digest beat | Lands in |
    |-------------|----------|
-   | **TL;DR** (1–2 sentences: what moved) | `context.md` current state / short dated note |
-   | **Key decisions & why** (only real ones) | `decisions.md` dated lines — skip if none |
-   | **Pivot / aha** (course correction that mattered) | one line in `context.md`, or `decisions.md` if it changed the plan |
-   | **Scope + verification** (files/slice + how you checked) | `delivery.md` when code or a PR is in play; else skip |
-   | **Gotchas for the next reader** | `context.md` (teammate / Monday-you) |
-   | **Next action** | existing `## Next action` — **replace** the bullet; never append a second heading |
-
-   The `session-stop` hook backstops a thin snapshot; **you** write the meaningful digest. Raw agent transcripts stay on the machine — judgment is what ships in the fieldbook.
-6. **One customer, one folder.** Never merge two engagements into one `.fde/`. Confirm which engagement applies when multiple exist.
-7. **Never delete a code-read section when rewriting an artifact.** `stakeholders.md`'s `## Signal history` holds dated `[signal:...]` tokens that `fde status`/`fde receipts`/the dashboard read verbatim; `risks.md`'s `## Retired` is read the same way. Rewriting either file as an artifact (land, audit, stakeholder-radar) is fine - dropping one of these sections is not. Carry existing entries forward untouched.
+   | **TL;DR** | `context.md` |
+   | **Key decisions & why** | `decisions.md` — skip if none |
+   | **Pivot / aha** | `context.md` or `decisions.md` |
+   | **Scope + verification** | `delivery.md` if code/PR; else skip |
+   | **Gotchas** | `context.md` |
+   | **Next action** | existing `## Next action` — **replace**; never append a second heading |
 
-## Data boundary (confirm before touching their code)
+   Judgment ships in the fieldbook. Raw transcripts stay on the machine. The `session-stop` hook is a thin backstop; **you** write the digest.
 
-- The `fde` CLI is **local only** - `git` + file reads, no AI, no network. Safe in any environment.
-- **You (the AI) only ever see customer code when the FDE points you at it** inside the agent they are already authorized to run. fdeops adds no new data path.
-- **Before reading or generating against customer code, the AI policy must be known.** New engagement, policy unknown → ask it (land phase: "policy on AI-generated code? data that must never touch AI?") *before* loading their code into context. Default to "not permitted" until the FDE confirms.
-- Data tagged `<private>` (sacred data, PHI, cardholder, classified) is **redacted from CLI, dashboard, and hook-injected context**. Do **not** open raw `<private>` blocks with file tools (that bypasses redaction) or paste them into prompts/subagents - work around them, never with them.
-- Locked-down engagement (no AI on their code)? Use the CLI + the fieldbook only. The memory layer is the FDE's own notes, not customer code.
+6. **One customer, one folder.**
+7. Never drop `## Signal history` or `## Retired` when rewriting those files.
 
-## Voice
+**Don't invent.** Don't tell them to run the CLI. Don't fill `success.md` / `terrain.md` with guesses. Don't ship on "probably fine" — intent vs diff, then pre-blast. Don't grill mid-flow. Don't sync transcripts into git.
 
-Direct, their words, no "Certainly." Playback 2–4 lines before you act. One sharp question only when a missing fact changes the next move. After writing memory, one directed next move; skip if they're already in flow.
+## Data boundary
 
-Ask once on a new engagement: days, weeks, or months of runway? **Sprint** (1–2 days) skip ceremony; **Standard** (1–4 weeks) full sequence; **Programme** (months) plus political mapping and formal handoff. Speed changes depth, not which phases exist.
+CLI is local (`git` + files, no network). You see their code only when they point you at it. AI policy unknown → ask before loading code. `<private>` is redacted from CLI/dashboard/hooks — do not open raw private blocks with file tools.
 
-### Checkpoint — one question before you cross a line
+## Voice
 
-| Before you… | Ask |
-|-------------|-----|
-| touch their code the first time | "Is there a safe place to break things, or am I in production?" — plus AI-code policy if unknown |
-| deploy or go live | "Who needs to know this is shipping, and what's the rollback if it turns?" |
-| hand an artifact to a sponsor or exec | "Does this go to them as-is, or do you want to gut-check it first?" |
-| act on a pivot (budget cut, new CTO, reprioritisation) | "Is the old plan dead, or just paused?" |
-| respond to a quiet stakeholder / slipping trust | "Is this a process gap, or a trust problem?" |
+Direct. Their words. No "Certainly." Playback 2–4 lines, then act. One question only when a missing fact changes the next move.
 
-If `context.md` already answers it, don't ask again.
+New embed: sprint / standard / programme changes depth, not which methods exist. Before first code: safe place to break things, plus AI-code policy. Before go-live: who needs to know, what's the rollback. Before a sponsor artifact: as-is or gut-check first.
 
-## Routing - 6 domains
+Muddy signal: name it ("discover or rescue — leaning X"). Never a phase-picker interview. Default: land if new, audit if takeover.
 
-Route on what you hear, then **read the skill reference from this skill's `references/` directory and follow its method**. Do not improvise from memory - the method is the product.
+## Routing - 6 stages
 
-### Domain 1 - Embed & Trust
+Read **one** reference and follow it. Do not improvise from memory.
 
-The first days. Getting access, building credibility, understanding the real scope.
+### Land
 
 | You hear | Skill | Reference |
 |----------|-------|-----------|
@@ -158,9 +113,7 @@ The first days. Getting access, building credibility, understanding the real sco
 | Need to earn access, navigate AI policy, build credibility | trust-engineering | `references/trust-engineering.md` |
 | "Also can you…", scope expanding, timeline unchanged | scope-defense | `references/scope-defense.md` |
 
-### Domain 2 - Discover & Diagnose
-
-Finding the real problem. Testing what the brief claims.
+### Discover
 
 | You hear | Skill | Reference |
 |----------|-------|-----------|
@@ -169,9 +122,7 @@ Finding the real problem. Testing what the brief claims.
 | Multiple use cases competing, "we want to do everything" | use-case-scoring | `references/use-case-scoring.md` |
 | Need to validate a direction, prototype, demo to de-risk | sketch | `references/sketch.md` |
 
-### Domain 3 - Plan & Align
-
-Sequencing work and getting alignment from sponsors.
+### Plan
 
 | You hear | Skill | Reference |
 |----------|-------|-----------|
@@ -180,31 +131,20 @@ Sequencing work and getting alignment from sponsors.
 | Significant decision, multiple approaches, "what should we do?" | options-analysis | `references/options-analysis.md` |
 | 20 things are "urgent," need to pick the 3 that matter | initiative-triage | `references/initiative-triage.md` |
 
-### Domain 4 - Build & Guard
-
-Safe implementation on someone else's codebase.
+### Ship
 
 | You hear | Skill | Reference |
 |----------|-------|-----------|
 | Large feature, need visible progress every 2–3 days | incremental-build | `references/incremental-build.md` |
 | What could go wrong, touching shared infrastructure, need to assess impact | blast-radius | `references/blast-radius.md` |
 | Production down, urgent - OR stakeholder gone quiet, trust slipping | rescue | `references/rescue.md` |
-
-### Domain 5 - Ship & Verify
-
-Getting to production without surprises.
-
-| You hear | Skill | Reference |
-|----------|-------|-----------|
 | Ready to deploy, going live, pre-flight check | ship | `references/ship.md` |
 | Review this change, is it safe, does it match what we agreed | review | `references/review.md` |
 | Diff grew / scope creep in the PR / "did we only build what we said" / KEEP JUSTIFY SPLIT DROP | review (+ ship if going live) | `references/review.md` Stage 1 · `references/ship.md` Intent vs diff |
 | Wrap the session / share the thinking / catch teammates up / before I open the PR | (memory contract — session digest) | SKILL.md **On exit** — write TL;DR + decisions/why into `.fde/`; no transcript sync |
 | "We can always revert" - need to actually test the escape route | rollback-drill | `references/rollback-drill.md` |
 
-### Domain 6 - Operate & Close
-
-Running the engagement and ending it well.
+### Prove
 
 | You hear | Skill | Reference |
 |----------|-------|-----------|
@@ -216,6 +156,11 @@ Running the engagement and ending it well.
 | Prep me for a meeting / walk-in brief / "what should I know before I talk to…" | - | run `fde prep "<label>"`, present in plain language |
 | Sponsor's boss needs a summary, board update, justify continued investment | exec-narrative | `references/exec-narrative.md` |
 | Status across all my customers | dashboard | `references/dashboard.md` |
+
+### Close
+
+| You hear | Skill | Reference |
+|----------|-------|-----------|
 | Juggling 2+ customers, losing track, context-switching | multi-customer-ops | `references/multi-customer-ops.md` |
 | Wrapping up, handoff, making yourself replaceable | close | `references/close.md` |
 | Engagement ending, team needs to operate without you | handoff-engineering | `references/handoff-engineering.md` |
@@ -234,38 +179,13 @@ Running the engagement and ending it well.
 | Payments, cardholder data, PCI-DSS, anything that moves money | `references/fintech.md` |
 | Government agency, FedRAMP, ATO, CUI, classified | `references/gov.md` |
 
-## Think before you route
-
-Do not interview them as an intake form. Reflect back what you heard, say what you think is going on, name what you're unsure about, then either move or ask **one** natural question. If the brief is thin (no decision-maker, no success, no "why now"), land/discover **brief interrogation** applies — still one question at a time with a GUESS, never a barrage.
-
-Bad: "Are you in phase land, discover, build, or rescue?"
-Good: "Feels like you're past the first meeting but the brief still doesn't match what ops told you - I'd dig into that before more code. Unless production's actually on fire?"
-
-If the situation maps to multiple skills or none clearly: say so. "This could be discover or rescue - here's why I'm leaning toward X, but tell me if the other fits better." Named uncertainty beats a confident wrong answer. Never silently guess when the signal is ambiguous. See **Anti-invention gates**.
-
-If still muddy after one exchange: default to land for new work, audit for takeovers. Ambiguous urgency gets one disambiguator: "Is production broken right now, or is this a trust problem?"
-
-## Health check
-
-If the FDE says "how are we doing" / "are we on track": load `reality.md`, `risks.md`, `delivery.md`, `stakeholders.md` (not `trust-profile.md` - sensitive data isn't needed for a status read). Four lines, red/amber/green:
-
-- Real problem still matches `reality.md`, or has scope crept?
-- Any stakeholder signal going amber or red?
-- Any risk overdue for action?
-- Value delivered and logged in `delivery.md`?
-
-## Operational edge cases
-
-- **`.fde/` exists but `context.md` is empty:** treat as new session - ask what's happening.
-- **"Ready to build" but no `terrain.md` or plan in `decisions.md`:** route to discover or plan first. Never start code blind. Agreed slice + code work: **you implement in the host agent**; log delivery with `fde log delivery`. Do not load archived SDLC sermons (`archive/sdlc/`).
-- **Taking over mid-flight without `audit.md`:** audit before build.
-- **Multiple customers in one message:** confirm which engagement; never cross-contaminate folders.
+Ready to build with no `terrain.md` / plan: discover or plan first. Takeover without `audit.md`: audit first. Two customers in one message: confirm which folder.
 
 ## Principles
 
 - Never ask the FDE to pick a phase. That's your job.
-- Read `context.md` before speaking. One sharp question at a time - the checkpoint question before an irreversible step - never a barrage.
-- Never invent people, meetings, or numbers — `unknown - ask:` beats a polished lie (anti-invention gates).
+- Read `context.md` before speaking. One sharp question — never a barrage.
+- Never invent people, meetings, or numbers — `unknown - ask:` beats a polished lie.
 - Every phase ends with its artifact written. No artifact, no "done."
 - Evidence on every claim. The FDE will be challenged on these files.
 - Overlays activate on signal, not on request.

package/skills/fde/references/pattern-extract.md

@@ -48,16 +48,16 @@ The difference between a 5-year FDE and a 15-year FDE is not talent - it's encod
 | **Repeatable?** | Applies to a class of situations, not just this one | Only worked because of a unique circumstance |
 | **Falsifiable?** | You can tell when the pattern is working or not | No way to measure whether applying it helped |
 
-**4. Classify by domain.** Patterns sort into the same domains as the skills:
+**4. Classify by stage.** Patterns sort into the same stages as the methods:
 
-| Domain | Pattern type | Example |
+| Stage | Pattern type | Example |
 |--------|-------------|---------|
-| **Embed & Trust** | Political / relational | "The passed-over team warm-up protocol" |
-| **Discover & Diagnose** | Investigative / analytical | "The cron-job discovery checklist for legacy systems" |
-| **Plan & Align** | Structural / strategic | "The three-option presentation for nervous sponsors" |
-| **Build & Guard** | Technical / safety | "The Strangler Fig on financial transaction code" |
-| **Ship & Verify** | Operational / process | "The regulated-environment change-approval timeline buffer" |
-| **Operate & Close** | Knowledge / handoff | "The 2am document format that actually gets used" |
+| **Land** | Political / relational | "The passed-over team warm-up protocol" |
+| **Discover** | Investigative / analytical | "The cron-job discovery checklist for legacy systems" |
+| **Plan** | Structural / strategic | "The three-option presentation for nervous sponsors" |
+| **Ship** | Technical / safety | "The Strangler Fig on financial transaction code" |
+| **Prove** | Operational / process | "The regulated-environment change-approval timeline buffer" |
+| **Close** | Knowledge / handoff | "The 2am document format that actually gets used" |
 
 **5. Version and evolve.** Patterns are living documents:
 
@@ -76,7 +76,7 @@ A pattern learned twice is a process failure. Encoding it prevents the third tim
 
 ## Artifact
 
-**`patterns.md`** - the pattern library, growing across engagements. Each pattern in the format above. Indexed by domain and situation trigger.
+**`patterns.md`** - the pattern library, growing across engagements. Each pattern in the format above. Indexed by stage and situation trigger.
 
 **`retrospectives/YYYY-MM-DD-<engagement>.md`** - reference to which patterns were extracted from this engagement.
 

package/skills/fde/archive/sdlc/README.md

@@ -1,7 +0,0 @@
-# Archived SDLC methods (not routed)
-
-These files used to sit in `references/` and compete with ordinary coding-agent skills (TDD, review, debug). They are **not** in the `@fde` router.
-
-Keep them here for history. Do not load them for a TypeScript error, a unit test, or a deploy checklist — that work stays in the host agent.
-
-Routed FDE work is in `../references/` and the four days in `SKILL.md`.

package/skills/fde/archive/sdlc/build.md

@@ -1,154 +0,0 @@
-# build - safe implementation on someone else's codebase
-
-**Enter when:** an agreed slice is ready to implement - feature, fix, integration, legacy change. Includes the review gate before merge.
-
-**Read first:** `context.md`, `terrain.md`, `decisions.md`. Load `trust-profile.md` when touching regulated areas. No map or no plan → route to discover/plan first; say it plainly: "We're not ready to touch code until we know what's connected to this module."
-
-## Validation gate (confirm understanding, clarify where it elevates)
-
-Before starting, state what you're working with in 2-4 lines - a brief playback that invites correction, not a question:
-
-> "Building: [task name]. Blast radius: [files/systems]. Terrain is [X days] fresh. [Any risk or concern worth naming, or 'clear to proceed']."
-
-Then check - probe ONLY if it prevents a mistake:
-
-1. **Acceptance criteria are falsifiable.** If the criteria are vague ("should work well", "handle errors gracefully") → rephrase them specifically: "I'm reading 'works well' as: responds in <500ms, retries 3x, alerts on failure. That right?"
-2. **Terrain is current.** If terrain.md is significantly older than the plan → one line: "Terrain is from Day 3, plan from Day 8 - assuming nothing shifted in between."
-3. **No open CRITICAL risk on the module.** If found → name it: "There's an open risk on this module (rate limiting). Building around it unless you say otherwise."
-
-Don't interrogate. State your read, let the FDE correct if needed, then move.
-
-## Spec generation (AI generates, human approves)
-
-Before writing code, generate the implementation spec for this task and present it to the FDE:
-
-```
-Spec: [task name from decisions.md]
-Inputs: [what triggers this - event, request, user action, data shape]
-Outputs: [what the user/system sees when it works]
-Accepts:
-  - [scenario 1: specific testable outcome]
-  - [scenario 2: specific testable outcome]
-Edge cases:
-  - [boundary condition]: [what happens]
-  - [error scenario]: [what happens]
-Constraints: [performance, security, compliance bounds from trust-profile.md]
-```
-
-Present this to the FDE: "Here's what I'm about to build. Any open questions or changes before I start?"
-
-- FDE says "yes" / "go" / "approved" → build against the spec exactly
-- FDE modifies → update spec, confirm, then build
-- Fast-track: if the task is under 30 minutes and the FDE has established trust (week 2+), state the spec inline and proceed unless they object
-
-The spec becomes the test list - every line is something to verify after build.
-
-## The loop (you do this work, in this order)
-
-1. **Confirm scope in writing.** The task exists in `decisions.md` with acceptance criteria. Not there → plan first or name the scope creep.
-2. **Declare blast radius.** Read the full dependency chain of what you're about to change. State: which files, which users, which systems. The change that breaks something always looked small.
-3. **Confirm the rollback path exists** before writing a line. "We can always revert" is not a rollback path.
-4. **Legacy code: characterisation tests first.** Tests for what the code *actually does right now* - including the parts that seem wrong; those behaviours are the contract the system depends on. Then wrap with Strangler Fig: new interface around old code, deprecate gradually, never rewrite in place.
-5. **Search before creating.** Read the existing code in the area; don't add parallel helpers where a service exists. Integrating an SDK/vendor API → read real source (local `reference/repos/...` or official repo) before guessing names; record the files used in `decisions.md`. If an API looks invented, stop and search source.
-6. **Build the minimal working path.** Thin vertical slice the customer can see. No opportunistic refactors. Every changed line traces to the task.
-7. **Verify with evidence.** Run tests/typechecks/smallest proving script. State what ran and what didn't. "Seems right" is never evidence.
-8. **Convergence check (spec vs. reality).** Walk through every acceptance scenario and edge case from the spec. State each one explicitly with its result:
-   - `[PASS]` scenario verified with evidence
-   - `[FAIL]` scenario not met - fix before proceeding
-   - `[DEFERRED]` intentionally left for a later task (state which one)
-   Surface the results to the FDE. If any scenario fails, fix it before cleanup. This is not optional - the spec is the contract.
-9. **Cleanup pass after it works.** Dedupe repeated mechanics into the smallest service module; behavior unchanged; re-run the same tests. If you wrote 200 lines and 50 would do, rewrite before review.
-10. **Review gate (before merge):** three beats, in order - (a) **session digest**: TL;DR + decisions/why + scope/verification into `.fde/` so the PR carries thinking, not just code (memory contract On exit; see `review.md`); (b) **intent vs diff**: every path KEEP / JUSTIFY / SPLIT / DROP against the stated slice in `decisions.md` (see `review.md` Stage 1); (c) **safety**: blast radius honest, tests meaningful, rollback real, secrets absent. Fix real findings, re-verify, repeat until clean or blocked on a human decision.
-11. **Log and deliver.** Update the artifacts (below). Visible progress beats invisible perfection - every 2–3 tasks something shown to a stakeholder.
-
-**Touching existing code - classify before changing:**
-- **Fix now:** actively failing or blocking.
-- **Fix when touched:** will bite when surrounding code changes - fix as part of this change.
-- **Document and leave:** ugly but uninvolved. The hardest discipline. Opportunistic refactors create diffs nobody asked for and regressions nobody expected.
-
-**AI components:** build the fallback path *before* the AI path (model slow? garbage? down?). Add observability before deploy: log inputs, outputs, confidence - hallucinations don't throw exceptions. Confirm the data processing agreement covers customer data before it goes to an external model; in regulated environments this is a blocker, not a detail.
-
-**Regulated environments:** check the AI code policy in `trust-profile.md` first. Some modules require human review of AI-generated code or prohibit it. Find out before building, not after showing the code.
-
-## Mid-build scope requests
-
-"Also can you add…" → "That's worth looking at - let me place it." Current phase, future phase, or separate engagement? If it's outside `success.md`, name it: "Outside what we agreed; future phase or rescope conversation." Absorbed scope sets the precedent that the boundary doesn't exist - and in commercial engagements it silently moves billing and liability. Surface it to whoever owns the commercials.
-
-## Method - integration design (connecting systems)
-
-FDEs spend 40%+ of build time on integrations. Connecting system A to system B is where projects die quietly - wrong assumptions about APIs, missing auth, schema mismatches, rate limits.
-
-**The integration checklist (before writing code):**
-
-1. **Contract first.** Define what crosses the boundary: request shape, response shape, error shape. Write it down before calling anything. An undocumented contract changes without warning.
-2. **Auth model.** OAuth2, API key, mTLS, SAML? Who provisions the credential? Who rotates it? What's the expiry? One expired token at 2am = production down.
-3. **Rate limits and quotas.** Every external API has them, most aren't documented. Test with a burst early - don't discover the 429 on launch day.
-4. **Error taxonomy.** Retryable (timeout, 503) vs. fatal (401, 422). Build retry with exponential backoff for the first, circuit-breaker for the second.
-5. **Data transformation.** Their schema ≠ your schema. Map fields explicitly. Null handling rules. Timezone assumptions. Currency/locale. One unmapped field = silent data corruption.
-6. **Idempotency.** Can you safely retry? If not, you need deduplication. Double-charges, double-posts, double-notifications - all integration bugs.
-7. **Observability at the boundary.** Log every outbound call: request (redacted), response code, latency. The integration is the first thing to blame and the last thing instrumented.
-
-**The integration contract template (write to `decisions.md`):**
-```
-Integration: [System A] → [System B]
-Direction: push / pull / bidirectional
-Auth: [method] - provisioned by [who] - expires [when]
-Rate limit: [n] req/[period]
-Retry: [strategy]
-Data mapping: [field map or link to schema]
-Failure mode: [what happens when B is down]
-Owner: [who gets paged]
-```
-
-## Method - team amplification (making their engineers better)
-
-The FDE's job is to make themselves replaceable. Not at handoff - every day. A client team that can only ship when the FDE is present is a dependency, not a success.
-
-**Daily practices:**
-- **Pair, don't take over.** When a client engineer is stuck, pair for 30 minutes rather than solving it alone in 10. The 10-minute fix creates dependency; the 30-minute pair creates capability.
-- **Review their PRs with teaching intent.** Not "fix this" - "here's why this approach creates risk, and here's the pattern I'd use instead." Link to their own codebase for examples, not external docs.
-- **Make decisions visible.** When you make an architecture choice, write a 3-line rationale in `decisions.md`. The team sees your reasoning, not just your output.
-- **Name patterns, not just fixes.** "This is a circuit breaker pattern - here's when to use it again" converts one fix into a reusable skill.
-
-**Weekly practices:**
-- **One 30-min knowledge session per week.** Not a lecture - pick the hardest thing you built this week, walk through the thinking with the team. Answer: "why this approach and not the obvious one?"
-- **Track the team's solo wins.** When a client engineer ships without FDE help, note it. This is the metric that proves the engagement is working.
-
-**The independence signal:** When the team stops asking "how should we do X?" and starts asking "we're thinking X because Y - does that sound right?" - the engagement is succeeding.
-
-## Stop signals - reassess immediately
-
-- "I'll add tests after this works" - the regression is already in.
-- "Small change, no need to declare blast radius" - famous last words.
-- "I'll refactor this while I'm here" - unasked-for risk in an unrelated change.
-- **Three fixes in and still broken - the diagnosis is wrong.** No fourth fix: state your current model of the problem, name the evidence that would disprove it, test that first (see `debug.md`).
-
-## Artifact (logged as you go, not after)
-
-- **`decisions.md`** - each significant choice: what, alternatives considered, why this one. For non-trivial architecture decisions, present three options to the FDE (safe / pragmatic / aggressive) with costs and a recommendation - three options is a real decision; one option is a request for trust. Integration contracts go here too.
-- **`risks.md`** - new risks discovered while building.
-- **`delivery.md`** - append a **value ledger** row for every ship: Date | Slice | Bucket | Promised | Measured | Accepted by | Evidence | Rollback. Bucket is `cost-save` / `risk-mitigation` / `revenue-uplift`. "Measured" may be `pending` until the pulse exists - never skip the promised column. Narrative under Shipped is optional color; the ledger is the record status and close read.
-
-  **Measured is not the same as accepted.** A number the FDE calculated is `claimed` until a named customer-side owner agrees it is real - their finance lead, their ops manager, the person whose budget it moves. Write the name and the date in **Accepted by**; leave it empty and the row reads `claimed`, never "delivered". This is the difference between a benefit that survives the renewal conversation and one the sponsor's CFO deletes in the review.
-
-## Checkpoint
-
-Before merge: the two-stage review (scope, then safety) has run clean, verification evidence is stated, and the slice is demonstrable. If `trust-profile.md` requires human sign-off on AI-generated code, that sign-off exists.
-
-## Worked example
-
-Acme task 1: route reconciliation failures to a named on-call.
-
-Characterisation first — a test that captures what the job does *today* when it exits non-zero (silently succeeds from the caller's perspective). That test fails after the fix, which is the point: it documents the behaviour being changed rather than trusting the diff.
-
-Mid-build, Tom asks to "just also fix the retry logic while you're in there." That is a scope decision, not a request: logged in `decisions.md` with the blast radius (retry touches the settlement path — not in this slice's declared radius) and routed to the plan's Next lane.
-
-Ledger row on ship: `Jun 18 | failure routing | risk-mitigation | 4h → 15min detection | pending | — | staging kill test, PR #212 | disable alert route`. **Accepted by** stays empty until Marco confirms from a real incident — until then the number is claimed, and the status update says so.
-
-## Principles
-
-- Characterisation tests before modification. Every time.
-- Blast radius declared before every change; rollback confirmed before every deploy.
-- Scope creep is a decision, not a request. Name it.
-- Build the fallback before the AI feature.
-- Small diffs, objective verification, no thousand-line hope PRs.