fdeops 3.24.0 → 3.27.0

package/hooks/session-start

@@ -91,7 +91,7 @@ fi
 
 # 5) Optional in-repo .fde (customer-approved only)
 if [ -z "$CONTEXT_FILE" ] && [ -f ".fde/context.md" ]; then
-  ENG_DIR=".fde"
+  ENG_DIR="$(pwd -P)/.fde"
   CONTEXT_FILE=".fde/context.md"
 fi
 
@@ -105,72 +105,8 @@ if [ "$IS_FDE_PROJECT" -eq 0 ]; then
   exit 0
 fi
 
-# Mirrors stripPrivate() in bin/fde.js: this is what an agent loads as
-# context, so <private>...</private> blocks (sacred data, never-AI content)
-# must never reach here unredacted, same guarantee as the dashboard renderer.
-# <private> blocks are written one per line in the templates (own line, own
-# closing tag), so a line-based state machine matches the real usage; an
-# unclosed <private> redacts to end-of-file, same as the JS regex fallback.
-strip_private() {
-  # Detection is case-insensitive (matches the JS /gi redactor) - <PRIVATE>,
-  # <Private>, <private> all redact. Detect on a lowercased copy of the line;
-  # never print the original when a tag is present.
-  awk '
-    BEGIN { inblock = 0 }
-    {
-      line = $0
-      lc = tolower(line)
-      if (inblock) {
-        if (index(lc, "</private>") > 0) { inblock = 0 }
-        next
-      }
-      if (index(lc, "<private>") > 0) {
-        print "(private - redacted)"
-        if (index(lc, "</private>") == 0) { inblock = 1 }
-        next
-      }
-      print line
-    }
-  ' "$1"
-}
-
-# Token discipline: context.md grows every session (session-stop appends a
-# snapshot). Inject a bounded view - curated head + most recent activity -
-# instead of the whole log. Mirrors resumeView() in bin/fde.js; keep in sync.
-bounded_context() {
-  local f="$1" total head_end tail_start hidden
-  total=$(wc -l < "$f" 2>/dev/null | tr -d ' ')
-  [ -z "$total" ] && { cat "$f"; return; }
-  if [ "$total" -le 160 ]; then cat "$f"; return; fi
-  # Anchor on the "## Session end" heading, matching resumeView() in bin/fde.js.
-  # The JS path reads via readClean (strips HTML comments), so both sides must
-  # anchor on a marker that survives redaction - the heading, not the comment.
-  head_end=$(grep -n -m1 '^## Session end' "$f" 2>/dev/null | cut -d: -f1)
-  if [ -n "$head_end" ]; then head_end=$((head_end - 1)); else head_end=120; fi
-  [ "$head_end" -gt 120 ] && head_end=120
-  [ "$head_end" -lt 0 ] && head_end=0
-  tail_start=$((total - 40 + 1))
-  if [ "$tail_start" -le "$((head_end + 1))" ]; then cat "$f"; return; fi
-  hidden=$((tail_start - head_end - 1))
-  [ "$head_end" -ge 1 ] && sed -n "1,${head_end}p" "$f"
-  printf '\n_(… %s lines of earlier session log hidden - `fde resume --full` or open context.md for the full history)_\n\n' "$hidden"
-  sed -n "${tail_start},\$p" "$f"
-}
-
-CONTENT=""
-
-# Lean pointer only - never cat SKILL.md. Methods load on @fde / skill trigger.
-CONTENT="${CONTENT}fdeops: engagement fieldbook active. Human speaks plain language with @fde - you (the agent) run the local fde CLI for memory plumbing; never ask the human to type fde commands. Load skills/fde/SKILL.md when @fde triggers.\n\n"
-
-# Same TRIAGE block as `fde resume` / `fde triage` (includes proactive hygiene
-# when the fieldbook has doctor issues; silent when clean). Monday morning must
-# not depend on the model remembering to run a CLI command. Prefer the installed
-# fde binary; fall back to the plugin/repo copy of bin/fde.js.
+# Prefer this installation so its hook and CLI share the same safety contract.
 resolve_fde() {
-  if command -v fde >/dev/null 2>&1; then
-    printf '%s\n' "fde"
-    return 0
-  fi
   for candidate in \
     "${CLAUDE_PLUGIN_ROOT:+$CLAUDE_PLUGIN_ROOT/bin/fde.js}" \
     "$(dirname "$0")/../bin/fde.js" \
@@ -181,25 +117,23 @@ resolve_fde() {
       return 0
     fi
   done
+  if command -v fde >/dev/null 2>&1; then
+    printf '%s\n' "fde"
+    return 0
+  fi
   return 1
 }
 
-if [ -n "$CONTEXT_FILE" ] && [ -f "$CONTEXT_FILE" ]; then
-  FDE_CMD=$(resolve_fde || true)
-  if [ -n "$FDE_CMD" ]; then
-    if [ "$FDE_CMD" = "fde" ]; then
-      TRIAGE=$(FDEOPS_ENGAGEMENT="$ENG_DIR" fde triage 2>/dev/null || true)
-    else
-      TRIAGE=$(FDEOPS_ENGAGEMENT="$ENG_DIR" node "$FDE_CMD" triage 2>/dev/null || true)
-    fi
-    if [ -n "$TRIAGE" ]; then
-      CONTENT="$CONTENT---\n$TRIAGE\n\n"
-    fi
-  fi
-  REDACTED_CONTEXT=$(mktemp)
-  strip_private "$CONTEXT_FILE" > "$REDACTED_CONTEXT"
-  CONTENT="$CONTENT---\nEngagement context ($CONTEXT_FILE):\n$(bounded_context "$REDACTED_CONTEXT")\n"
-  rm -f "$REDACTED_CONTEXT"
+# The matching CLI owns triage, private redaction, and context bounds.
+# Never fall back to reading raw notes when Node or the CLI is unavailable.
+FDE_CMD=$(resolve_fde || true)
+[ -n "$FDE_CMD" ] || exit 0
+[ -n "$CONTEXT_FILE" ] && [ -f "$CONTEXT_FILE" ] || exit 0
+if [ "$FDE_CMD" = "fde" ]; then
+  CONTEXT=$(FDEOPS_ENGAGEMENT="$ENG_DIR" fde resume 2>/dev/null) || exit 0
+else
+  CONTEXT=$(FDEOPS_ENGAGEMENT="$ENG_DIR" node "$FDE_CMD" resume 2>/dev/null) || exit 0
 fi
-
-printf '%b' "$CONTENT"
+[ -n "$CONTEXT" ] || exit 0
+printf '%s\n\n' 'fdeops: engagement fieldbook active. Human speaks plain language with @fde - you (the agent) run the local fde CLI for memory plumbing; never ask the human to type fde commands. Load skills/fde/SKILL.md when @fde triggers.'
+printf '%s\n' 'Engagement context:' "$CONTEXT"

package/mcp/fdeops-ingest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops-ingest-mcp",
-  "version": "3.24.0",
+  "version": "3.27.0",
   "private": true,
   "description": "Thin stdio MCP sink for FDEOps ingest (stage → propose → apply). Zero runtime dependencies.",
   "bin": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fdeops",
-  "version": "3.24.0",
-  "description": "Forward deployed engineering skills for AI coding agents. One @fde skill for the client work around the code: who can say yes, what went live, whether they signed off. Dated markdown on your laptop. You confirm each write.",
+  "version": "3.27.0",
+  "description": "Client delivery tools for Forward Deployed Engineers. One @fde skill, local Markdown engagement records, and an offline dashboard for decisions, evidence, approvals, and next actions.",
   "bin": {
     "fdeops": "bin/install.js",
     "fde": "bin/fde.js"

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "fdeops",
-  "version": "3.24.0",
+  "version": "3.27.0",
   "description": "Forward deployed engineering skills for AI coding agents. One @fde skill for the client work around the code. You confirm; then it lands in .fde/ on your laptop.",
   "author": {
     "name": "Subash Natarajan",

package/skills/fde/SKILL.md

@@ -28,13 +28,13 @@ A one-line typo or compile error in a file that will not ship. On a bound client
 | **When did we agree?** | Don't argue from memory. Search the record. | `fde receipts <term>` | - |
 | **What's the outcome?** | A number nobody signed is claimed, not delivered. | `fde status` | `references/readout.md` |
 
-After a meeting: `fde debrief --smart` → one REVIEW screen (decided / asked / open / next / signer) → in chat, a four-row card (omit empty; Previously / Not yet agreed) → **Save this update?** (engineer accepted the record, not customer approval of every ask) → `--apply`. Walk-in: `fde prep`. Friday: `fde status`.
+After a meeting: `fde debrief --smart` → one REVIEW screen (decisions / asks / scope / delivery gaps / next / signer) → in chat, a four-row card (omit empty; Previously / Not yet agreed) → **Save this update?** (engineer accepted the record, not customer approval of every ask) → `--apply`. Walk-in: `fde prep`. Friday: `fde status`.
 
 ## Ground loop
 
 On someone else's site the work is not "write code, remember later." Every change on a bound client stays on `@fde`:
 
-1. **Name it** in `decisions.md` (plan) or kill it in a day (poc).
+1. **Name it** in `decisions.md` (plan), or timebox the riskiest assumption and record what the POC proves.
 2. **Characterise their code** before you change it. Brownfield: their tests, their runner. Greenfield: the empty tree, first path they can click.
 3. **Prove it on their staging.** Staging they operate, a screen the signer in `success.md` can reject.
 4. **If a model judges:** `evals.md` Verdict SHIP before that change is done (eval-pack).
@@ -58,7 +58,7 @@ Fallbacks: `node ~/.claude/fdeops/fde.js …`, then `npx --yes fdeops …`. Skil
 
 ## Entry (every session)
 
-1. `fde resume` (bounded `context.md`). `--full` only if you need the whole log.
+1. `fde resume` (16 KiB output ceiling, not a model token count). Read client constraints first, then signer, goals, risks, delivery ledger and current context. This command is the inspectable packet the session hook loads; never substitute a recursive read of `.fde/` or raw transcripts. If truncated or a decision needs evidence, run `fde recall <specific topic>`; narrow the query rather than loading the whole history. `--max-bytes 4096` reduces the allowance for smaller models. `--full` only when the complete log is explicitly needed.
 2. **NO ENGAGEMENT:** ask "What should we call this client?" then **you** init. Pasted notes → debrief after bind.
 3. Playback 2-3 lines. `hygiene:` → offer `fde doctor`; **never auto-rewrite**.
 4. Route. Read **one** `references/*.md`. Confirm, then write.
@@ -72,7 +72,8 @@ Writes need a bind (`FDEOPS_ENGAGEMENT` or registry). Never install fdeops on in
 | debrief / pasted notes | `fde debrief --smart` → REVIEW → four-row chat card → Save this update? → `--apply`. `--smart` is a gate, not a brain. `references/debrief.md` |
 | prep me for … | `fde prep "<label>"` |
 | when did we agree | `fde receipts <term>` |
-| sponsor update / the outcome | `fde status` |
+| sponsor update / defend the number | `fde defend` |
+| successor / rotation / portable handoff | `fde handoff` (stdout; `--out new-file.md` only after export requested) |
 | they went quiet | `fde log contact "…" --signal amber\|green\|red` |
 | fieldbook page | `fde dashboard` (`--all` portfolio, `--open` to open the file) |
 | clean up the fieldbook | `fde doctor` - never auto-rewrite |
@@ -85,7 +86,7 @@ Writes need a bind (`FDEOPS_ENGAGEMENT` or registry). Never install fdeops on in
 
 1. **On entry:** `fde resume` only. Pull other `.fde/` files when the skill needs them.
 2. **Deliverable = memory.** The work *is* the `.fde/` file. The reference names which one.
-3. **Evidence.** Every claim has a source. Traceable beats plausible.
+3. **Evidence.** Without a supplied source, a decision or measurement remains CLAIM. Use `[source: meeting YYYY-MM-DD]`, a PR/URL, transcript ID, or artifact path. The automatic log date is not attribution. ON RECORD means a source was supplied, not that it was authenticated or the customer approved. Never invent a source, signer, or acceptance.
 4. **No invented facts.** People, quotes, meetings, numbers: they said it or the repo shows it. Else `unknown - ask: <question>`.
 5. **Session digest** (end of session and before a PR) - thinking, not the chat. Confirm, then write. Never a transcript dump.
 

package/skills/fde/references/plan.md

@@ -4,6 +4,8 @@
 
 **Read first:** `reality.md`, `success.md`, `terrain.md`, `stakeholders.md`. Load `business-case.md` if poc produced one. Not the full folder.
 
+**Before committing a plan or building:** run `fde doctor --ready`. Missing binary success or a named customer-side signer blocks progression: review the proposed acceptance check and authority with the FDE first. Use a test/input and observable pass/fail under **Done when:** or **Acceptance check:**. A number, role, or successful demo alone is insufficient. Do not invent missing facts to pass lint.
+
 ## Validation gate (confirm understanding, clarify where it elevates)
 
 Before planning, state what you're working from in 2-3 lines:

package/skills/fde/references/poc.md

@@ -14,10 +14,10 @@ A green check on synthetic data is not a validated solution. The person who can
 
 **1. Pick by score when several use cases compete.** Use the scoring model from `discover.md` - (Value × Data readiness) / Complexity. If discover or score-use-cases already produced a ranking, reuse it; never invent a third ranking.
 
-**2. Build the minimum that tests the assumption.** No error handling, no polish. Same-day demo if possible. Rough is honest. The POC is done when the person who can say no has seen it and reacted, not when the code looks finished.
+**2. Build the minimum that tests the assumption.** Timebox the experiment with the FDE; aim for a same-day result when access and evidence permit it. Skip cosmetic polish, but keep the input validation, access controls, and failure handling needed to protect the test environment and data. Label shortcuts and simulated inputs. The POC is done when the person who can say no has seen the evidence and reacted, not when the code looks finished.
 
 **3. AI directions - test these before anything else:**
-- Data: available, clean, sufficient volume? Synthetic-data prototypes say nothing about production behaviour.
+- Data: available, clean, sufficient volume? Synthetic data can test mechanics, but does not establish production quality or real-world coverage.
 - Environment: are external model calls even allowed here?
 - Latency: acceptable against real user expectations, not ideal conditions?
 - Is AI the right tool at all - or is this a data-quality or process problem wearing an AI costume?
@@ -26,6 +26,14 @@ A green check on synthetic data is not a validated solution. The person who can
 
 **5. Translate to business language** once validated: problem solved, cost of inaction, success in numbers, 2-3 trade-offs. Three sentences max for the stakeholder - can't say it in three, don't understand it yet.
 
+## If proceeding to production
+
+Carry the hypothesis, test evidence, customer reaction, and remaining unknowns into the existing `plan` and `ship` workflow. A working demo does not establish production readiness or customer acceptance.
+
+Inspect the prototype before deciding what to reuse. Keep components whose behavior and boundaries are suitable and tested. Replace or harden shortcuts that fail production requirements; rewrite only where the evidence justifies it. Record the decision and remaining work in `decisions.md`, rather than treating all prototype code as disposable or all working code as ready to deploy.
+
+Production work includes the actual data path, permissions, failure recovery, realistic load, observability, ownership, and required AI evaluations. Use the existing ship gates for those checks.
+
 ## Artifact
 
 **`prototype-log.md`** - what was built, shown, the actual reaction, what was learned (including kills - a killed prototype that saved three weeks is a win worth recording).
@@ -38,7 +46,7 @@ Tell the FDE: did the riskiest assumption hold · what the customer's reaction a
 
 ## Principles
 
-- Speed of learning beats code quality. Never more than a day.
+- Optimize for a bounded learning outcome. Agree a timebox and revisit scope if access or evidence blocks it; never skip necessary safeguards to meet an arbitrary duration.
 - Write pass/fail before you build. A demo with no kill line is a show.
 - Show it rough. Polish misleads.
 - Prototype the killer assumption, not the demo.

package/skills/fde/references/ship.md

@@ -12,7 +12,9 @@ Do not ask them to pick a mode. Name where you are, then start at the matching s
 
 If going live, opening question: **has anyone actually *run* the rollback, or is it still a slide?** If only planned, that's today's work - say so plainly.
 
-A same-day throwaway that kills an assumption is `poc`. This skill is the real change on a repo they will own, then production.
+A bounded experiment that tests an assumption is `poc`. This skill turns a validated direction into a maintainable change on a repo they will own, then production. Inspect existing prototype code and retain suitable tested parts; replace unsafe shortcuts based on evidence. A successful demo alone does not satisfy the readiness gates below.
+
+**Before committing a plan or building:** run `fde doctor --ready`. Missing binary success or a named customer-side signer blocks progression: review the proposed acceptance check and authority with the FDE first. Use a test/input and observable pass/fail under **Done when:** or **Acceptance check:**. A number, role, or successful demo alone is insufficient. Do not invent missing facts to pass lint.
 
 ## Field (name it once, then the same loop)