fdeops 3.23.0 → 3.26.0

package/bin/lib/trust.js

@@ -56,6 +56,22 @@ function createTrustApi(deps) {
     'blocker', 'outage', 'fire', 'issue', 'sev', 'sev1', 'sev2', 'p1', 'p2', 'p3',
     'resolved', 'risk', 'decision', 'delivery', 'contact',
   ])
+  // Articles and weekdays are not people. "the finance controller…" and
+  // "Friday's readout" must key on the role/name, not the filler word.
+  const SIGNAL_NAME_NOISE = new Set([
+    'the', 'a', 'an', 'and', 'or', 'for', 'from', 'with', 'without', 'this', 'that',
+    'these', 'those', 'their', 'our',
+    'monday', 'tuesday', 'wednesday', 'thursday', 'friday', 'saturday', 'sunday',
+    'today', 'tomorrow', 'yesterday', 'tonight',
+  ])
+
+  function isSignalNameNoise(word) {
+    const n = String(word || '').replace(/[^a-z0-9]/gi, '').toLowerCase()
+    if (SIGNAL_NAME_NOISE.has(n)) return true
+    // "Friday's" → fridays after stripping punctuation
+    if (n.endsWith('s') && SIGNAL_NAME_NOISE.has(n.slice(0, -1))) return true
+    return false
+  }
 
   function personFromSignalText(text) {
     let cleaned = String(text || '')
@@ -63,14 +79,19 @@ function createTrustApi(deps) {
       .replace(/\([^)]*\)/g, '')
       .replace(/\[signal:[^\]]+\]/gi, '')
       .replace(/\[\d{4}-\d{2}-\d{2}\]/g, '')
-      .replace(/^([A-Z]{2,}[A-Z0-9_-]*):?\s+/, '')
+      .replace(/^([A-Z]{2,}[A-Z0-9_-]*):\s+/, '')
       .trim()
     const names = cleaned.match(/\b[A-Z][a-z]{1,20}(?:\s+[A-Z][a-z]{1,20})?\b/g) || []
     for (const name of names) {
       const first = name.split(/\s+/)[0].toLowerCase()
-      if (SIGNAL_EVENT_KEYS.has(first)) continue
+      if (SIGNAL_EVENT_KEYS.has(first) || isSignalNameNoise(first) || isSignalNameNoise(name)) continue
       return name
     }
+    const acronyms = cleaned.match(/\b[A-Z]{3,6}\b/g) || []
+    for (const acronym of acronyms) {
+      if (SIGNAL_EVENT_KEYS.has(acronym.toLowerCase()) || isSignalNameNoise(acronym)) continue
+      return acronym
+    }
     return ''
   }
 
@@ -84,10 +105,11 @@ function createTrustApi(deps) {
       if (frag.length >= 3) return frag
     }
     const cleaned = String(text).replace(/\[@[^\]]+\]/g, '').replace(/\([^)]*\)/g, '')
-      .replace(/^([A-Z]{2,}[A-Z0-9_-]*):?\s+/, '')
+      .replace(/^([A-Z]{2,}[A-Z0-9_-]*):\s+/, '')
     const words = cleaned.split(/\s+/).filter(w => {
       const n = w.replace(/[^a-z0-9]/gi, '').toLowerCase()
-      return n.length >= 3 && !SIGNAL_EVENT_KEYS.has(n) && !/^(dr|mr|mrs|ms)$/i.test(w)
+      return n.length >= 3 && !SIGNAL_EVENT_KEYS.has(n) && !isSignalNameNoise(n)
+        && !/^(dr|mr|mrs|ms)$/i.test(w)
     })
     const frag = (words[0] || '').replace(/[^a-z0-9]/gi, '').toLowerCase()
     return frag.length >= 3 ? frag : ('anon:' + cleaned.slice(0, 48).toLowerCase())
@@ -243,6 +265,7 @@ function createTrustApi(deps) {
     stakeholdersMemoryHealth,
     personFromSignalText,
     signalSubjectKey,
+    isSignalNameNoise,
     parsePhase,
     countOpenRisks,
     nextActionLine,

package/bin/lib/value-ledger.js

@@ -0,0 +1,34 @@
+'use strict'
+
+// Empty measurements and unsigned outcomes are different facts. Keep their
+// interpretation shared by status, reports, and exported vaults.
+const PENDING_CELL_RE = /^(?:pending|tbd|to ?be ?(?:measured|confirmed|determined)|n\s*\/\s*a|na|none|unknown|not(?:\s+yet)?\s+measured|unmeasured|awaiting|\?+|\.{2,}|…|-+)(?:[^\w].*)?$/i
+const UNCERTAIN_ACCEPTANCE_RE = /\b(?:not|no|never|pending|awaiting|unapproved|unsigned|unconfirmed|unaccepted|unverified|rejected|declined|denied|revoked|withdrawn|superseded|proposed|requested|unknown|tbd|tentative|conditional|required|needed|blocked|draft)\b|\?|\b(?:wait(?:ing)?|request(?:ing)?|seek(?:ing)?)\s+(?:for\s+)?(?:approval|sign.?off|acceptance)\b/i
+const APPROVAL_PROSE_RE = /^(?:yes|true|ok(?:ay)?|approved|accepted|confirmed|signed(?:\s+off)?|done|complete(?:d)?)\b/i
+
+function acceptanceName(value) {
+  const name = String(value || '').trim()
+  if (!name || PENDING_CELL_RE.test(name) || UNCERTAIN_ACCEPTANCE_RE.test(name) || APPROVAL_PROSE_RE.test(name.replace(/[*_`]/g, ''))) return ''
+  // A date, number, or punctuation cannot identify a customer-side signer.
+  if (!/\p{L}/u.test(name)) return ''
+  // Legacy cells must name a signer, not just a role plus a date. Keep names
+  // first: "Priya Shah, approved 2026-09-10" remains a recorded assertion.
+  const withoutDates = name.replace(/\b(?:jan(?:uary)?|feb(?:ruary)?|mar(?:ch)?|apr(?:il)?|may|jun(?:e)?|jul(?:y)?|aug(?:ust)?|sep(?:t(?:ember)?)?|oct(?:ober)?|nov(?:ember)?|dec(?:ember)?)\.?\s+\d{1,4}\b/gi, '')
+  const identity = withoutDates.replace(/\b(?:yes|true|okay|ok|approved|accepted|confirmed|signed|off|done|complete|completed|approval|acceptance)\b/gi, '').replace(/[\d\p{P}\p{S}]/gu, ' ').trim()
+  if (!identity || /^(?:(?:the|by|on|customer|client|sponsor|approver|owner|team|lead|manager|stakeholder|signer|signatory|ceo|cto|cfo)\s*)+$/i.test(identity)) return ''
+  return name
+}
+
+function valueState({ measured, accepted, acceptanceStatus, evidence }) {
+  if (!measured || PENDING_CELL_RE.test(measured)) return 'unmeasured'
+  if (!acceptanceName(accepted)) return 'claimed'
+  // Explicit status is authoritative when the column exists. Unknown values
+  // fail closed. Existing name-only ledgers remain readable during migration.
+  if (acceptanceStatus !== undefined) {
+    if (acceptanceStatus.trim().toLowerCase() !== 'accepted') return 'claimed'
+    if (!evidence || PENDING_CELL_RE.test(evidence)) return 'claimed'
+  }
+  return 'accepted'
+}
+
+module.exports = { PENDING_CELL_RE, acceptanceName, valueState }

package/hooks/session-start

@@ -91,7 +91,7 @@ fi
 
 # 5) Optional in-repo .fde (customer-approved only)
 if [ -z "$CONTEXT_FILE" ] && [ -f ".fde/context.md" ]; then
-  ENG_DIR=".fde"
+  ENG_DIR="$(pwd -P)/.fde"
   CONTEXT_FILE=".fde/context.md"
 fi
 
@@ -105,72 +105,8 @@ if [ "$IS_FDE_PROJECT" -eq 0 ]; then
   exit 0
 fi
 
-# Mirrors stripPrivate() in bin/fde.js: this is what an agent loads as
-# context, so <private>...</private> blocks (sacred data, never-AI content)
-# must never reach here unredacted, same guarantee as the dashboard renderer.
-# <private> blocks are written one per line in the templates (own line, own
-# closing tag), so a line-based state machine matches the real usage; an
-# unclosed <private> redacts to end-of-file, same as the JS regex fallback.
-strip_private() {
-  # Detection is case-insensitive (matches the JS /gi redactor) - <PRIVATE>,
-  # <Private>, <private> all redact. Detect on a lowercased copy of the line;
-  # never print the original when a tag is present.
-  awk '
-    BEGIN { inblock = 0 }
-    {
-      line = $0
-      lc = tolower(line)
-      if (inblock) {
-        if (index(lc, "</private>") > 0) { inblock = 0 }
-        next
-      }
-      if (index(lc, "<private>") > 0) {
-        print "(private - redacted)"
-        if (index(lc, "</private>") == 0) { inblock = 1 }
-        next
-      }
-      print line
-    }
-  ' "$1"
-}
-
-# Token discipline: context.md grows every session (session-stop appends a
-# snapshot). Inject a bounded view - curated head + most recent activity -
-# instead of the whole log. Mirrors resumeView() in bin/fde.js; keep in sync.
-bounded_context() {
-  local f="$1" total head_end tail_start hidden
-  total=$(wc -l < "$f" 2>/dev/null | tr -d ' ')
-  [ -z "$total" ] && { cat "$f"; return; }
-  if [ "$total" -le 160 ]; then cat "$f"; return; fi
-  # Anchor on the "## Session end" heading, matching resumeView() in bin/fde.js.
-  # The JS path reads via readClean (strips HTML comments), so both sides must
-  # anchor on a marker that survives redaction - the heading, not the comment.
-  head_end=$(grep -n -m1 '^## Session end' "$f" 2>/dev/null | cut -d: -f1)
-  if [ -n "$head_end" ]; then head_end=$((head_end - 1)); else head_end=120; fi
-  [ "$head_end" -gt 120 ] && head_end=120
-  [ "$head_end" -lt 0 ] && head_end=0
-  tail_start=$((total - 40 + 1))
-  if [ "$tail_start" -le "$((head_end + 1))" ]; then cat "$f"; return; fi
-  hidden=$((tail_start - head_end - 1))
-  [ "$head_end" -ge 1 ] && sed -n "1,${head_end}p" "$f"
-  printf '\n_(… %s lines of earlier session log hidden - `fde resume --full` or open context.md for the full history)_\n\n' "$hidden"
-  sed -n "${tail_start},\$p" "$f"
-}
-
-CONTENT=""
-
-# Lean pointer only - never cat SKILL.md. Methods load on @fde / skill trigger.
-CONTENT="${CONTENT}fdeops: engagement fieldbook active. Human speaks plain language with @fde - you (the agent) run the local fde CLI for memory plumbing; never ask the human to type fde commands. Load skills/fde/SKILL.md when @fde triggers.\n\n"
-
-# Same TRIAGE block as `fde resume` / `fde triage` (includes proactive hygiene
-# when the fieldbook has doctor issues; silent when clean). Monday morning must
-# not depend on the model remembering to run a CLI command. Prefer the installed
-# fde binary; fall back to the plugin/repo copy of bin/fde.js.
+# Prefer this installation so its hook and CLI share the same safety contract.
 resolve_fde() {
-  if command -v fde >/dev/null 2>&1; then
-    printf '%s\n' "fde"
-    return 0
-  fi
   for candidate in \
     "${CLAUDE_PLUGIN_ROOT:+$CLAUDE_PLUGIN_ROOT/bin/fde.js}" \
     "$(dirname "$0")/../bin/fde.js" \
@@ -181,25 +117,23 @@ resolve_fde() {
       return 0
     fi
   done
+  if command -v fde >/dev/null 2>&1; then
+    printf '%s\n' "fde"
+    return 0
+  fi
   return 1
 }
 
-if [ -n "$CONTEXT_FILE" ] && [ -f "$CONTEXT_FILE" ]; then
-  FDE_CMD=$(resolve_fde || true)
-  if [ -n "$FDE_CMD" ]; then
-    if [ "$FDE_CMD" = "fde" ]; then
-      TRIAGE=$(FDEOPS_ENGAGEMENT="$ENG_DIR" fde triage 2>/dev/null || true)
-    else
-      TRIAGE=$(FDEOPS_ENGAGEMENT="$ENG_DIR" node "$FDE_CMD" triage 2>/dev/null || true)
-    fi
-    if [ -n "$TRIAGE" ]; then
-      CONTENT="$CONTENT---\n$TRIAGE\n\n"
-    fi
-  fi
-  REDACTED_CONTEXT=$(mktemp)
-  strip_private "$CONTEXT_FILE" > "$REDACTED_CONTEXT"
-  CONTENT="$CONTENT---\nEngagement context ($CONTEXT_FILE):\n$(bounded_context "$REDACTED_CONTEXT")\n"
-  rm -f "$REDACTED_CONTEXT"
+# The matching CLI owns triage, private redaction, and context bounds.
+# Never fall back to reading raw notes when Node or the CLI is unavailable.
+FDE_CMD=$(resolve_fde || true)
+[ -n "$FDE_CMD" ] || exit 0
+[ -n "$CONTEXT_FILE" ] && [ -f "$CONTEXT_FILE" ] || exit 0
+if [ "$FDE_CMD" = "fde" ]; then
+  CONTEXT=$(FDEOPS_ENGAGEMENT="$ENG_DIR" fde resume 2>/dev/null) || exit 0
+else
+  CONTEXT=$(FDEOPS_ENGAGEMENT="$ENG_DIR" node "$FDE_CMD" resume 2>/dev/null) || exit 0
 fi
-
-printf '%b' "$CONTENT"
+[ -n "$CONTEXT" ] || exit 0
+printf '%s\n\n' 'fdeops: engagement fieldbook active. Human speaks plain language with @fde - you (the agent) run the local fde CLI for memory plumbing; never ask the human to type fde commands. Load skills/fde/SKILL.md when @fde triggers.'
+printf '%s\n' 'Engagement context:' "$CONTEXT"

package/mcp/fdeops-ingest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops-ingest-mcp",
-  "version": "3.23.0",
+  "version": "3.26.0",
   "private": true,
   "description": "Thin stdio MCP sink for FDEOps ingest (stage → propose → apply). Zero runtime dependencies.",
   "bin": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fdeops",
-  "version": "3.23.0",
-  "description": "Forward deployed engineering skills for AI coding agents. One @fde skill for the client work around the code: who can say yes, what went live, whether they signed off. Dated markdown on your laptop. You confirm each write.",
+  "version": "3.26.0",
+  "description": "Client delivery tools for Forward Deployed Engineers. One @fde skill, local Markdown engagement records, and an offline dashboard for decisions, evidence, approvals, and next actions.",
   "bin": {
     "fdeops": "bin/install.js",
     "fde": "bin/fde.js"

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "fdeops",
-  "version": "3.23.0",
+  "version": "3.26.0",
   "description": "Forward deployed engineering skills for AI coding agents. One @fde skill for the client work around the code. You confirm; then it lands in .fde/ on your laptop.",
   "author": {
     "name": "Subash Natarajan",

package/skills/fde/SKILL.md

@@ -28,7 +28,7 @@ A one-line typo or compile error in a file that will not ship. On a bound client
 | **When did we agree?** | Don't argue from memory. Search the record. | `fde receipts <term>` | - |
 | **What's the outcome?** | A number nobody signed is claimed, not delivered. | `fde status` | `references/readout.md` |
 
-After a meeting: `fde debrief --smart` → one REVIEW screen (decided / asked / open / next / signer) → confirm once → `--apply`. Walk-in: `fde prep`. Friday: `fde status`.
+After a meeting: `fde debrief --smart` → one REVIEW screen (decided / asked / open / next / signer) → in chat, a four-row card (omit empty; Previously / Not yet agreed) → **Save this update?** (engineer accepted the record, not customer approval of every ask) → `--apply`. Walk-in: `fde prep`. Friday: `fde status`.
 
 ## Ground loop
 
@@ -44,6 +44,10 @@ A throwaway file can skip the loop. Bound client work cannot.
 
 **Skip is loud.** Bound + a change that will ship + no this-turn line in `delivery.md` = not done. Say that. Do not call it shipped. A coding pack may write the function; `@fde` still owns done.
 
+## Working with an engineering pack
+
+Use the customer's existing coding, testing, review, and repository instructions for implementation. Carry the confirmed outcome, scope boundary, acceptance criteria, and evidence requirements into that workflow. Reference its existing plan from `decisions.md`; do not create a competing backlog or repeat questions already answered. FDEOps owns the engagement record and acceptance status. A coding pack's green tests do not establish customer acceptance. Never claim compatibility was tested with a host or pack you have not run.
+
 ## Human surface vs agent plumbing
 
 **FDE (human):** `@fde` + English, or `/brief` `/discover` `/plan` `/ship` `/outcome` `/close` `/debrief` `/prep` `/trust` `/receipts` `/readout`. Never a skill catalog.
@@ -54,7 +58,7 @@ Fallbacks: `node ~/.claude/fdeops/fde.js …`, then `npx --yes fdeops …`. Skil
 
 ## Entry (every session)
 
-1. `fde resume` (bounded `context.md`). `--full` only if you need the whole log.
+1. `fde resume` (16 KiB output ceiling, not a model token count). Read the goals, risks and current context. If truncated or a decision needs evidence, run `fde recall <specific topic>`; narrow the query rather than loading the whole history. `--max-bytes 4096` reduces the allowance for smaller models. `--full` only when the complete log is explicitly needed.
 2. **NO ENGAGEMENT:** ask "What should we call this client?" then **you** init. Pasted notes → debrief after bind.
 3. Playback 2-3 lines. `hygiene:` → offer `fde doctor`; **never auto-rewrite**.
 4. Route. Read **one** `references/*.md`. Confirm, then write.
@@ -65,12 +69,12 @@ Writes need a bind (`FDEOPS_ENGAGEMENT` or registry). Never install fdeops on in
 |----------|---------|
 | where are we | `fde resume` |
 | day-1 look at the repo | `fde scan` |
-| debrief / pasted notes | `fde debrief --smart` → REVIEW → confirm once → `--apply`. `--smart` is a gate, not a brain. `references/debrief.md` |
+| debrief / pasted notes | `fde debrief --smart` → REVIEW → four-row chat card → Save this update? → `--apply`. `--smart` is a gate, not a brain. `references/debrief.md` |
 | prep me for … | `fde prep "<label>"` |
 | when did we agree | `fde receipts <term>` |
 | sponsor update / the outcome | `fde status` |
 | they went quiet | `fde log contact "…" --signal amber\|green\|red` |
-| fieldbook page | `fde dashboard` |
+| fieldbook page | `fde dashboard` (`--all` portfolio, `--open` to open the file) |
 | clean up the fieldbook | `fde doctor` - never auto-rewrite |
 | scrub a secret | `fde redact <term>` then `--apply` after confirm |
 | pull Granola/Slack/transcript | capability check → `fde ingest stage` → confirm → apply. Never auto-apply. `references/ingest.md` |
@@ -140,7 +144,7 @@ Work names (engage, diagnose, align, deliver, realize, transfer) are the same ma
 
 | You hear | Skill | Reference |
 |----------|-------|-----------|
-| Align, break this down, what order, sequence the build, plan the roadmap, create user stories, write the tasks | plan | `references/plan.md` |
+| Align, break this down, what order, sequence the delivery, align the plan | plan | `references/plan.md` |
 | Sponsor needs justification, need to defend budget or timeline, build the business case | business-case | `references/business-case.md` |
 | Significant decision, multiple approaches, "what should we do?", generate solutions, generate options, not the playbook, from the surviving facts | three-options | `references/three-options.md` |
 | 20 things are "urgent," need to pick the 3 that matter, prioritize three | pick-three | `references/pick-three.md` |
@@ -154,7 +158,7 @@ Work names (engage, diagnose, align, deliver, realize, transfer) are the same ma
 | Deliver, start building, update their checkout, first module, visible progress, their tests, POC follow-through, ready to deploy, going live, pre-flight, deliver the increment, build the increment, create the launch plan, design their UI | ship | `references/ship.md` |
 | Review this change, review the pull request, is it safe, does it match what we agreed | review | `references/review.md` |
 | Diff grew / scope creep in the PR / "did we only build what we said" / KEEP JUSTIFY SPLIT DROP | review (+ ship if going live) | `references/review.md` Stage 1 · `references/ship.md` Intent vs diff |
-| Wrap the session / share the thinking / catch teammates up / before I open the PR | (memory contract - session digest) | SKILL.md **On exit** - write TL;DR + decisions/why into `.fde/`; no transcript sync |
+| Wrap the session / share the thinking / catch teammates up / before I open the PR | (memory contract - session digest) | SKILL.md **Session digest** - write TL;DR + decisions/why into `.fde/`; no transcript sync |
 | "We can always revert" - need to actually test the escape route, rehearse rollback | rollback | `references/rollback.md` |
 
 ### Outcome

package/skills/fde/references/dashboard.md

@@ -4,11 +4,11 @@
 
 **Read per engagement:** `reality.md`, `brief.md`, `success.md`, `risks.md`, `decisions.md`, `delivery.md`, `stakeholders.md`. Never `terrain.md` (too large) or `trust-profile.md` (sensitive - stakeholder signals live in `stakeholders.md`).
 
-The visual artifact is rendered by code, not by you. `fde dashboard` reads every `.fde/` folder and writes a self-contained `fieldbook.html` - deterministically, offline, **at zero token cost**. Your job is the judgment the render can't do: which engagement gets tomorrow morning, and why.
+The visual artifact is rendered by code, not by you. Bare `fde dashboard` renders the **bound** engagement into `fieldbook-current.html`. Pass `--all` for every engagement (default file `~/fde-engagements/fieldbook.html`). Deterministic, offline, **at zero token cost**. Your job is the judgment the render can't do: which engagement gets tomorrow morning, and why.
 
 ## Method (you do this work)
 
-0. **First move: `fde status`** - instant heuristic triage (trust-first ordering) across every engagement. Use it as the index; then deep-read only the folders that are red/amber or that the FDE asks about, and apply the full card below.
+0. **First move: `fde status`** - value ledger, then trust, for the bound engagement. Pass `--all` for the portfolio. Use it as the index; then deep-read only the folders that are red/amber/`new` or that the FDE asks about, and apply the full card below.
 1. **Find the engagements:** `~/fde-engagements/*/.fde/` (primary) · workspace `./.fde/` if present · paths the FDE names. Read each folder **separately** - never merge two customers.
 2. **Per engagement, read the card the way a human would:**
    - Name, phase, week
@@ -17,15 +17,15 @@ The visual artifact is rendered by code, not by you. `fde dashboard` reads every
    - Top active risk
    - Last significant action + next step
    - Value delivered so far
-   - **Trust signal** - the most important row: **green** (no adverse signals) / **amber** (a stakeholder gone quiet or routing around the FDE) / **red** (escalation or explicit concern). Technical progress on a red-trust engagement is wasted until trust is addressed.
+   - **Trust signal** - the most important row: **new** (no dated `[signal:]` token - empty is not green) / **green** (someone was asked, and the latest token for that person is green) / **amber** (a stakeholder gone quiet or routing around the FDE) / **red** (escalation or explicit concern). Technical progress on a red-trust engagement is wasted until trust is addressed.
 3. **Triage order:** red trust first, then overdue risks, then stalled delivery. Say which engagement gets tomorrow morning and why.
-4. **Refresh the visual:** run `fde dashboard` to (re)generate `fieldbook.html` (defaults to `~/fde-engagements/fieldbook.html`). It is a deterministic render of the `.fde/` markdown - never hand-write HTML, never paste a model-built page. The session-end hook also refreshes it automatically when an engagement moved, so it is current next time the FDE opens it.
+4. **Refresh the visual:** run `fde dashboard` (add `--all` for the portfolio, `--open` to open the file). Default output is `fieldbook-current.html` for the bound client. It is a deterministic render of the `.fde/` markdown - never hand-write HTML, never paste a model-built page. The session-end hook also refreshes the bound fieldbook when an engagement moved.
 
 Sparse data: the render shows what exists and pads nothing. An empty field honestly shows what hasn't been captured.
 
 ## Artifact
 
-**`fieldbook.html`** - generated by `fde dashboard`, never hand-maintained. One file, opens in a browser, works offline, `<private>` notes redacted. Portfolio grid on top (a card per client: trust, phase, next action, top risk); click a card to drill into that engagement's full memory below.
+**`fieldbook-current.html`** (bound) or **`fieldbook.html`** (`--all`) - generated by `fde dashboard`, never hand-maintained. Opens in a browser, works offline, `<private>` notes redacted. Today plus a left rail of engagements; not a card grid.
 
 ## Checkpoint
 

package/skills/fde/references/debrief.md

@@ -31,8 +31,14 @@
    - `next: send one-pager before Thursday 9am`
    - unprefixed lines stay context color only
 4. Show the **REVIEW** block first (decided / asked / open / next / signer). That is the one screen to confirm. File routing stays underneath.
-5. On FDE confirm → run `fde debrief --apply`.
-6. On reject → stop; ask what to change; do not apply.
+5. In **chat**, after that REVIEW, present a four-row card and omit empty rows:
+   - Decided
+   - Asked / open
+   - Next
+   - Signer
+   Then a **Previously:** line from the record, and **Not yet agreed** for anything still proposed. Ask **Save this update?** Saving means the engineer accepted this as the engagement record, not that the customer approved every ask. Uncertainty stays visible.
+6. On FDE confirm → run `fde debrief --apply`.
+7. On reject → stop; ask what to change; do not apply. Do not rebuild or replace the CLI REVIEW engine.
 
 No invented names or quotes. If the propose looks wrong, fix prefixes with judgment then re-apply or use the fallback path.
 
@@ -47,8 +53,8 @@ If `--smart` is unavailable or you already have clean prefixes:
    - **Risks** - new / confirmed / retired
    - **Open questions** - what to chase next
 2. Format lines as `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:` (contacts may end with `[signal:green|amber|red]`).
-3. Show that structured version to the FDE for confirmation.
-4. Pipe to `fde debrief` (or write a file and run it).
+3. Show the same **chat card** as the smart path (omit empty rows; Previously; Not yet agreed; **Save this update?**). Do not invent a second confirm surface.
+4. On confirm, pipe to `fde debrief` (or write a file and run it).
 
 One clarifying question max if the dump is ambiguous - then write. Never stall capture on completeness.
 

package/skills/fde/references/discover.md

@@ -18,6 +18,8 @@ Then check - probe ONLY if it prevents wasted discovery:
 
 State your read, let the FDE correct, then discover.
 
+Before asking for facts, inspect the supplied brief and existing redacted records for the answer. Once the decision frame is confirmed and code access is authorized, use the scan below and targeted file reads to resolve technical unknowns. Phrase remaining questions around the discrepancy found: “The queue already exists, but alerts are disabled; who currently checks it?”
+
 ## Brief interrogation (when the hypothesis is still mush)
 
 Use when the "problem" is unfalsifiable, success is undefined, or you cannot name the decision discovery informs. Skip when `reality.md` / `terrain.md` already pin a testable claim and the FDE is ready to dig.
@@ -66,7 +68,7 @@ Do not mark pieces as facts or assumptions here. That is `test-assumptions`. Do
 
 ## Method - part 1: the codebase (you do this work)
 
-**First move: `fde scan`** - it runs everything below deterministically in seconds (churn×tests, "temporary" archaeology, AI components, secrets redacted, previous attempts). Your job is then **interpretation**: read its output against the brief, follow the hotspots into the code, and connect the technical findings to the human signals in part 2.
+**First code move: `fde scan`** - after the Question is locked. It runs everything below deterministically in seconds (churn×tests, "temporary" archaeology, AI components, secrets redacted, previous attempts). Your job is then **interpretation**: read its output against the brief, follow the hotspots into the code, and connect the technical findings to the human signals in part 2.
 
 If the CLI is unavailable, run the manual commands below. Either way: do not load the full codebase into context - scan wide, read deep only on hotspots.
 
@@ -106,6 +108,8 @@ Flag every one. AI components don't fail like regular code - they degrade as the
 
 **6. Data flow.** Where data enters, how it moves, where it stops. Entry points first: routes, queues, cron, file drops.
 
+**7. Existing capability.** Trace the requested user action through existing code, configuration, tests, and operating workarounds. In `terrain.md`, record what can already be reused and the evidence that it works or fails. Check whether a configuration, ownership, or process change could resolve the observed break. A disabled feature is a lead, not a proven root cause. Keep observations and hypotheses distinct; option selection still belongs to plan / three-options.
+
 ## Method - part 2: the humans (you coach, the FDE asks)
 
 The real spec is what people **do** when the system fails - not what the slide deck says. Arm the FDE with these, in their own words:

package/skills/fde/references/earn-trust.md

@@ -25,7 +25,7 @@ Level 5: Trusted      → they call you before making decisions
 
 | Day | Move | Why it works |
 |-----|------|-------------|
-| 1 | Fix a small, visible, annoying bug - something the team has been stepping over | Proves you can ship in their environment without breaking things |
+| 1 | Fix a small, visible, annoying bug - something the team has been stepping over (only after `success.md` has a signer, or the FDE overrides with the unknown still visible) | Proves you can ship in their environment without breaking things |
 | 1 | Ask the passed-over team what naming conventions they use - then use them | Shows respect before competence |
 | 2 | Send a one-paragraph status to the sponsor without being asked | Sets the pattern: they hear from you before they have to ask |
 | 3 | Find a genuine risk and flag it without drama | Demonstrates you're protecting them, not performing |

package/skills/fde/references/ingest.md

@@ -32,7 +32,7 @@ List what you can actually call **this session**:
 4. **List** (optional) - `fde ingest list` shows staged items when you need an id or filename.
 5. **Propose** - `fde ingest propose <id-or-filename>` runs the debrief `--smart` path on the staged body (+ provenance line). Opens `.debrief-propose`.
 6. **Rewrite prefixes** - same as debrief: lines without `decision:` / `risk:` / `delivery:` / `contact:` / `next:` / `signer:` need **you** to rewrite before showing the FDE. `--smart` is a gate, not a brain.
-7. **Show** the proposed routing in plain language. Wait for confirm.
+7. **Show** the same chat card as debrief (decided / asked / open / next / signer; omit empty; Previously; Not yet agreed; **Save this update?**). Wait for confirm. The CLI REVIEW printout is unchanged.
 8. **Apply** - on FDE confirm only → `fde ingest apply` (= `fde debrief --apply`). On reject → stop; ask what to change.
 
 No invented names, meetings, or quotes. If the propose looks wrong, fix prefixes with judgment, then re-show before apply.

package/skills/fde/references/land.md

@@ -2,7 +2,7 @@
 
 **Enter when:** new customer, first meeting, just got the brief, nothing started yet.
 
-**Read first:** `context.md` if it exists. Nothing else until you know what kind of engagement this is.
+**Read first:** `context.md` if it exists, then the supplied brief. Once the engagement type and AI/access policy are known, inspect the supplied repo/docs relevant to the ask before asking questions they can answer. This is a bounded evidence check, not a full discovery scan.
 
 ## Validation gate (confirm understanding, clarify where it elevates)
 
@@ -35,7 +35,7 @@ Wait for the reaction before the next question. Stop when confidence is high eno
 
 ## Method - part 1: interrogate the brief (you do this work)
 
-Read the brief the FDE gives you. What is **not** in it matters as much as what is. Produce the gap list yourself:
+Read the brief the FDE gives you. Separate **observed** (source/path and date), **reported** (who said it), and **hypothesis** (how to test it). A requested solution such as “build an agent” is not evidence of the cause. Ask only about gaps that change scope, access, acceptance, or the next investigation. What is **not** in the brief matters as much as what is. Produce the gap list yourself:
 
 - **No named decision-maker** → the FDE will spend two weeks building for someone who can't say yes. Flag it.
 - **"Straightforward cleanup" on an 8-year-old system** → the previous attempt is still visible in git history as a revert. Flag it.
@@ -52,7 +52,7 @@ Pre-arrival checks to run through with the FDE:
 
 ## Method - part 2: the first conversation (you coach, the FDE asks)
 
-Intent: before any tech, learn what keeps the sponsor up at night - personally, not the project charter. Failure talk surfaces truth faster than "requirements." Angles in the FDE's own words:
+Intent: coach the FDE's first *customer* conversation - what keeps the sponsor up at night, personally, not the project charter. You already inspected the supplied brief and any authorized repo/docs. This is before *their* laptop in the room / before a deep build, not before you read evidence. Failure talk surfaces truth faster than "requirements." Angles in the FDE's own words:
 
 - "Before you open the laptop - what would make this a bad engagement for *them*, not just a delayed project?"
 - "What are they afraid you'll miss?"
@@ -71,13 +71,13 @@ Let silence sit. If their fear doesn't match the written brief, the brief is wro
 
 ## The day 1 deliverable
 
-Before the end of day 1, ship one visible thing: a small bug fix, a cleanup the team has stepped over, a dashboard tweak, a config improvement. Not because it matters technically - because it proves you can ship in their environment without breaking things. The first deploy sets the trust trajectory for the entire engagement. A day-1 deliverable earns more credibility than a week-3 architecture deck.
+After `success.md` names a signer (or the FDE explicitly overrides with `unknown - ask:` still visible), ship one visible thing before the end of day 1: a small bug fix, a cleanup the team has stepped over, a dashboard tweak, a config improvement. Not because it matters technically - because it proves you can ship in their environment without breaking things. The first deploy sets the trust trajectory for the entire engagement. A day-1 deliverable earns more credibility than a week-3 architecture deck. Skip it until the land gate is met.
 
 ## Artifact (write as the conversation is debriefed)
 
 **`brief.md`** - what they said, who sent the FDE, the timeline, **and the gap list**.
 
-**`success.md`** - what done looks like, **primary value bucket** (`cost-save` | `risk-mitigation` | `revenue-uplift`), baseline → target, who actually signs off, what is explicitly out of scope. Agreed with the customer, not assumed.
+**`success.md`** - what done looks like, **primary value bucket** (`cost-save` | `risk-mitigation` | `revenue-uplift`), baseline → target, who actually signs off, what is explicitly out of scope. Record agreement only with its source and scope; otherwise label the target proposed. For each baseline, record source, date/window, environment, and sample size when relevant. An operator recollection is reported, not measured. If no baseline exists, name the measurement owner and cheapest way to obtain it; do not manufacture a number.
 
 For every target number, run the **gaming check** before it is written down: *how could this metric hit its target without the customer being any better off?* There is always an answer, and the answer is what the org will drift toward under pressure. Write the guard next to the metric:
 
@@ -113,7 +113,7 @@ One falsifiable hypothesis about the real problem also goes at the bottom of `br
 
 One page back to the FDE: success + value bucket + sign-off owner, out-of-scope boundary, sacred data, stakeholder map with veto power, AI posture, the hypothesis, the top CRITICAL assumptions still OPEN, and any exception-path seeds heard (break → workaround → owner) for discover to map into `terrain.md`. If it doesn't fit one page, the engagement isn't understood yet.
 
-If remote: trust-building takes ~40% longer - push for a short video call before anything asynchronous.
+If remote: agree how progress and blockers will be shared; use a short call when asynchronous context is insufficient.
 
 ## Worked example
 

package/skills/fde/references/pick-three.md

@@ -61,7 +61,7 @@ Notice: every stakeholder's initiative is P0 or P1. That's the problem this skil
 
 ## Artifact
 
-**`decisions.md`** - the triage table with scores, lanes, **and an explicit Kill / Later commitment**. Dated. Referenced by plan and status.
+**`decisions.md`** - the triage table with scores, lanes, **and an explicit Kill / Later commitment**. Dated. Updates the same Now/Next/Later plan already uses; do not open a second plan section. Referenced by plan and status.
 
 Required closing block (plan will not treat triage as done without it):
 

package/skills/fde/references/plan.md

@@ -24,6 +24,8 @@ An FDE plan is not a sprint backlog. The technical sequence is the easy part. Th
 
 **0. Lock scope first.** Read `success.md`, `assumptions.md`, and the **Question** on `reality.md`. If out-of-scope is undefined, define it now with the FDE - a plan on undefined scope accumulates silent commitments. If any CRITICAL assumption is still `OPEN`, stop and run test-assumptions / discover before sequencing work. If `reality.md` has no Question, stop and finish discover - you are sequencing trivia.
 
+**Reuse check.** Before sequencing a build, compare the requested solution with the smallest existing capability or operating change that could satisfy the same acceptance test. Cite the relevant repo/config/workaround evidence. Record why reuse is sufficient or insufficient in `decisions.md`; include “no new code” when supported. A request for AI does not establish that a model is needed. If a host engineering pack already has an approved implementation plan, reference it from `decisions.md`; do not generate a parallel user-story backlog.
+
 **1. Work backwards from success.** What's the last thing that must be true before done? And before that? That's the dependency chain - not a wish list.
 
 **2. Front-load the fragile.** Check `terrain.md` hotspots. Risky modules go early - fail fast, not in week three.
@@ -57,6 +59,10 @@ Risk: <what could go wrong + fallback>
 Kill if: <the observation that voids this slice - copy from assumptions.md How we test, or the check that means stop>
 Verify: <specific check>
 Value promised: <business unit change this slice claims>
+Baseline: <value + source/date/window/environment, or pending + measurement owner>
+Acceptance owner: <name + authority source, or unknown - ask: who can accept?>
+Evidence to collect: <before/after check, sample/window, environment, and receipt location>
+Reuse: <existing capability used, or evidence it cannot satisfy the criteria>
 
 ### Next
 - ...
@@ -70,6 +76,8 @@ Value promised: <business unit change this slice claims>
 | <rewrite / nice-to-have / political ask> | <evidence> | <name, date> |
 ```
 
+In `Who accepted`, distinguish a proposed deferral from an agreement: use `pending` until a named person accepted this scope with a dated source. Sponsorship alone is not approval of every plan detail.
+
 No kill list → not a finished plan. Reopen with the FDE until the deferrals are written.
 ## Checkpoint
 

package/skills/fde/references/poc.md

@@ -12,7 +12,7 @@ A green check on synthetic data is not a validated solution. The person who can
 
 **0b. Pass / fail before you build.** For the test you will run, write three lines in `prototype-log.md` first: what you will actually do (who you talk to, what you show, on whose screen); the result that **kills** this option; the result that keeps it alive. What you would learn either way. If every option's test would fail, name which `assumptions.md` block to reopen - do not invent a fourth playbook.
 
-**1. Pick by score when several use cases compete.** Use the scoring model from `discover.md` - (Value × Data readiness) / Complexity. If discover already scored, reuse; never re-score independently.
+**1. Pick by score when several use cases compete.** Use the scoring model from `discover.md` - (Value × Data readiness) / Complexity. If discover or score-use-cases already produced a ranking, reuse it; never invent a third ranking.
 
 **2. Build the minimum that tests the assumption.** No error handling, no polish. Same-day demo if possible. Rough is honest. The POC is done when the person who can say no has seen it and reacted, not when the code looks finished.
 

package/skills/fde/references/readout.md

@@ -6,7 +6,9 @@
 
 ## Method (you do this work)
 
-**First:** run `fde status`. It prints the value ledger before trust - promised → measured → accepted by, or `claimed, not yet accepted`. Those lines are the Situation. Do not invent a number the CLI did not print.
+**First:** run `fde status`. It prints the value ledger before trust - promised → measured → accepted by, or `claimed, not yet accepted`. Those lines locate the Situation; check their cited records before making the claim. CLI output summarizes recorded text, not independently verified acceptance. Do not invent a number the CLI did not print. If the CLI is unavailable, use the redacted source records and say so.
+
+**Qualify the evidence before drafting.** For each result, identify baseline source, measurement environment, observation window/sample, and the scope of acceptance. Report an informal baseline as reported and a staging sample as staging; neither establishes realized savings. “Looks good” without what was accepted is not outcome acceptance. Attribute an engineer's note as such; do not turn it into a direct customer receipt. If evidence conflicts, include the conflict and the next verification action rather than choosing the flattering version.
 
 **Always draft in SCQA.** One page maximum. No other shape.
 
@@ -23,7 +25,7 @@ Then add, still on the same page:
 3. **Kill / defer reminder** - one line from the plan kill list so scope fights stay visible.
 4. **Hostile Q prep** - three questions a skeptical sponsor will ask, with one-line answers from memory.
 
-Exec voice: no jargon, no hedging, every claim traceable (`(shipped Tue, delivery.md)`). Draft in the **FDE's voice, for the FDE to send** - never send anything yourself.
+Exec voice: no jargon, explicit uncertainty where evidence is incomplete, every claim traceable (`(shipped Tue, delivery.md)`). Draft in the **FDE's voice, for the FDE to send** - never send anything yourself.
 
 For board / renewal / sponsor's boss (longer pyramid): use `board-memo.md`. Do not invent a second weekly format.
 

package/skills/fde/references/review.md

@@ -59,7 +59,7 @@ Five dimensions, line-specific ("line 47 fails under concurrent writes - no lock
 
 ## Before the PR - thinking for the next reader
 
-Code alone loses the "why." Before you call the change reviewable, run the **session digest** from the memory contract (SKILL.md On exit): TL;DR, key decisions & rationale, scope + how you verified, gotchas. Confirm with the FDE, then write into `.fde/` - `decisions.md` / `delivery.md` / `context.md`. Reviewers (or Monday-you) should answer "why this approach?" from the fieldbook, not from a chat transcript. Do **not** dump agent logs into the product repo.
+Code alone loses the "why." Before you call the change reviewable, run the **session digest** from the memory contract (SKILL.md Session digest): TL;DR, key decisions & rationale, scope + how you verified, gotchas. Confirm with the FDE, then write into `.fde/` - `decisions.md` / `delivery.md` / `context.md`. Reviewers (or Monday-you) should answer "why this approach?" from the fieldbook, not from a chat transcript. Do **not** dump agent logs into the product repo.
 
 ## Artifact
 

package/skills/fde/references/score-use-cases.md

@@ -10,7 +10,7 @@ The most dangerous moment in a multi-use-case engagement is when the technically
 
 **1. List every candidate.** From the brief, from discovery conversations, from the FDE's own observations. Include the ones the customer hasn't said aloud but the codebase implies - a high-churn module with no tests is a candidate even if nobody named it.
 
-**2. Score on five dimensions.** Each 1-5, with the scoring rubric below:
+**2. Score on five dimensions.** Each 1-5, with the scoring rubric below. If discover already ranked candidates with (Value × Data readiness) / Complexity, reuse that order; this table extends the conversation. Do not invent dimension scores from a thin brief - write `unknown` and ask.
 
 | Dimension | 1 | 3 | 5 |
 |-----------|---|---|---|