fdeops 3.9.11 → 3.9.13

package/AGENTS.md

@@ -15,4 +15,4 @@ Route via **`@fde`** - read `skills/fde/SKILL.md` (the single source of truth),
 
 ## Boundaries
 
-The `fde` CLI never reaches the network. Data marked `<private>` in `trust-profile.md` never enters a model prompt. fdeops installs on the FDE's own machine, never on customer infrastructure.
+The `fde` CLI never reaches the network. `<private>` blocks are redacted from CLI/dashboard/hook outputs; do not load raw private blocks into a model via file tools or paste. fdeops installs on the FDE's own machine, never on customer infrastructure.

package/CLAUDE.md.template

@@ -22,4 +22,4 @@ Experienced FDE peer: direct, no fluff, no assumptions. Ask once if a fact chang
 
 ## Pause before
 
-Production changes, irreversible actions, surprises that affect trust. `<private>` in trust-profile never enters prompts.
+Production changes, irreversible actions, surprises that affect trust. `<private>` is redacted from CLI/hook context; do not paste raw private blocks into prompts.

package/README.md

@@ -163,7 +163,7 @@ Open the system of record in a browser - trust, phase, next action, and the full
 
 - **Local only.** Pure `git` + file reads - no network calls, no telemetry, no account. Works air-gapped.
 - **Plain markdown.** No database, no lock-in.
-- **No new data path.** The AI sees client code only when *you* point your agent at it; `<private>`-tagged data never enters the model's context.
+- **No new data path.** The AI sees client code only when *you* point your agent at it. `<private>` tags are redacted from CLI/dashboard/hook output; do not feed raw private blocks into the model (file tools bypass that redaction).
 - **Nothing enters the record unreviewed.** The model drafts, you confirm (`fde debrief --dry-run` shows the routing first); the hooks record only git facts. Your fieldbook stays yours to defend.
 - **Know your sync surface.** `~/fde-engagements` lives in your home directory - your backup and cloud-sync setup now covers client notes. `fde resume --init` warns if the folder sits in a synced path. Read [PRIVACY.md](PRIVACY.md) before your first NDA'd engagement.
 

package/adapters/AGENTS.md

@@ -21,4 +21,4 @@ A 20-year FDE peer: direct, no fluff, no assumptions. One sharp question when a
 
 ## Pause before
 
-Production changes, irreversible actions, anything that affects client trust. Data marked `<private>` in `trust-profile.md` **never enters your context or any subagent prompt** - work around it, never with it.
+Production changes, irreversible actions, anything that affects client trust. `<private>` is redacted from CLI/dashboard/hook context; do **not** open raw private blocks with file tools or paste them into prompts/subagents - work around them, never with them.

package/adapters/GEMINI.md

@@ -21,4 +21,4 @@ A 20-year FDE peer: direct, no fluff, no assumptions. One sharp question when a
 
 ## Pause before
 
-Production changes, irreversible actions, anything that affects client trust. Data marked `<private>` in `trust-profile.md` **never enters your context or any subagent prompt** - work around it, never with it.
+Production changes, irreversible actions, anything that affects client trust. `<private>` is redacted from CLI/dashboard/hook context; do **not** open raw private blocks with file tools or paste them into prompts/subagents - work around them, never with them.

package/adapters/copilot-instructions.md

@@ -21,4 +21,4 @@ A 20-year FDE peer: direct, no fluff, no assumptions. One sharp question when a
 
 ## Pause before
 
-Production changes, irreversible actions, anything that affects client trust. Data marked `<private>` in `trust-profile.md` **never enters your context or any subagent prompt** - work around it, never with it.
+Production changes, irreversible actions, anything that affects client trust. `<private>` is redacted from CLI/dashboard/hook context; do **not** open raw private blocks with file tools or paste them into prompts/subagents - work around them, never with them.

package/adapters/cursor.fde.mdc

@@ -35,4 +35,4 @@ A 20-year FDE peer: direct, no fluff, no assumptions. One sharp question when a
 
 ## Pause before
 
-Production changes, irreversible actions, anything that affects client trust. Data marked `<private>` in `trust-profile.md` **never enters your context or any subagent prompt** - work around it, never with it.
+Production changes, irreversible actions, anything that affects client trust. `<private>` is redacted from CLI/dashboard/hook context; do **not** open raw private blocks with file tools or paste them into prompts/subagents - work around them, never with them.

package/bin/check.js

@@ -63,6 +63,7 @@ const requiredReferences = [
   'debug.md', 'rescue.md', 'ship.md', 'sketch.md', 'close.md', 'dashboard.md',
   'debrief.md', 'status.md', 'demo-prep.md',
   'healthcare.md', 'fintech.md', 'gov.md',
+  'ai.md', 'eval-pack.md',
 ]
 for (const f of requiredReferences) {
   const p = path.join(root, 'skills', 'fde', 'references', f)

package/bin/fde.js

@@ -843,8 +843,11 @@ function cmdResume(args) {
     const fdeDir = path.join(engRoot, '.fde')
     const existed = fs.existsSync(fdeDir)
 
+    // Optional stubs (AI eval pack, …) stay in templates/ for copy-on-use — not day-1 scaffold.
+    const SKIP_INIT_TEMPLATES = new Set(['evals.md'])
     const fillTemplates = (destFde) => {
       for (const f of fs.readdirSync(tpl)) {
+        if (SKIP_INIT_TEMPLATES.has(f)) continue
         const src = path.join(tpl, f); const dst = path.join(destFde, f)
         if (fs.statSync(src).isDirectory()) fs.mkdirSync(dst, { recursive: true })
         else if (!fs.existsSync(dst)) fs.copyFileSync(src, dst)
@@ -1501,6 +1504,18 @@ function collectDoctorIssues(eng) {
       `phase is ${s.phase} with ${s.openRisks} open risk(s) - retire, hand off, or move still-live ones before calling the embed done`
     )
   }
+  if (s.phase === 'close' || s.phase === 'ship') {
+    if (!hasValueBucket(eng)) {
+      issues.push(
+        `phase is ${s.phase} with no value bucket (cost-save | risk-mitigation | revenue-uplift) in success.md or delivery value ledger`
+      )
+    }
+    if (engagementTouchesAI(eng) && !hasEvalReceipt(eng)) {
+      issues.push(
+        `phase is ${s.phase} with AI in scope but no eval receipt (evals.md Verdict or delivery Eval / Ship receipts) — required before green ship/close`
+      )
+    }
+  }
   const dupes = findDuplicateOpenRisks(eng)
   if (dupes.length) {
     const sample = (dupes[0][0] || '').replace(/\s+/g, ' ').trim().slice(0, 60)
@@ -1511,6 +1526,71 @@ function collectDoctorIssues(eng) {
   return issues
 }
 
+// Strip template comments / italic *(hints)* so doctor does not treat stubs as filled.
+function stripTemplateNoise(md) {
+  return String(md || '')
+    .replace(/<!--[\s\S]*?-->/g, '')
+    .replace(/\*\([^)]*\)\*/g, '')
+}
+
+const VALUE_BUCKET_RE = /(cost[- ]?save|risk[- ]?mitigat|revenue[- ]?uplift)/i
+
+function hasValueBucket(eng) {
+  const success = stripTemplateNoise(readClean(eng, 'success.md'))
+  const bucketLine = success.match(/\*\*Primary value bucket:\*\*\s*(.+)/i)
+  if (bucketLine && VALUE_BUCKET_RE.test(bucketLine[1].trim())) return true
+  if (!/\*\*Primary value bucket:\*\*/i.test(success) && VALUE_BUCKET_RE.test(success)) return true
+
+  const ledger = stripTemplateNoise(sectionBody(readClean(eng, 'delivery.md'), 'Value ledger') || '')
+  const table = parseMdTable(ledger)
+  if (table) {
+    const bIdx = colIndex(table.headers, /bucket/i)
+    if (bIdx !== -1) {
+      for (const row of table.rows) {
+        const cell = String(row[bIdx] || '').trim()
+        if (cell && VALUE_BUCKET_RE.test(cell)) return true
+      }
+    } else if (VALUE_BUCKET_RE.test(ledger)) {
+      return true
+    }
+  } else if (VALUE_BUCKET_RE.test(ledger)) {
+    return true
+  }
+  return false
+}
+
+// AI in scope for ship/close hygiene — delivery/decisions/trust evidence only.
+// Do not scan terrain.md: its template headers mention LLM and would false-positive every ship.
+function engagementTouchesAI(eng) {
+  const trust = readClean(eng, 'trust-profile.md')
+  const aiSec = stripTemplateNoise(sectionBody(trust, 'AI policy') || '')
+  if (aiSec.trim().length > 20) return true
+  const blob = stripTemplateNoise([
+    readClean(eng, 'delivery.md'),
+    readClean(eng, 'decisions.md'),
+  ].join('\n'))
+  return /\b(llm|rag|embedding|inference|model card|agentic|openai|anthropic|vector database|vector db)\b/i.test(blob)
+}
+
+function hasEvalReceipt(eng) {
+  const evalsPath = path.join(eng, 'evals.md')
+  if (fs.existsSync(evalsPath)) {
+    const e = stripTemplateNoise(readClean(eng, 'evals.md'))
+    // Empty G1 stub + "Pass / fail" heading is not a receipt — need a real verdict/run/result.
+    if (/\*\*Verdict:\*\*\s*SHIP\b/i.test(e) || /(?:^|\n)\s*-\s*\*\*Verdict:\*\*\s*SHIP\b/i.test(e)) return true
+    if (/\bLast run:\s*\d{4}-\d{2}-\d{2}/i.test(e)) return true
+    if (/\|\s*G\d+\s*\|[^|\n]+\|[^|\n]+\|[^|\n]+\|[^|\n]+\|\s*pass\s*\|/i.test(e)) return true
+  }
+  const del = stripTemplateNoise(readClean(eng, 'delivery.md'))
+  if (/#{1,6}\s+Eval\b/i.test(del) && /\b(pass|SHIP|\d+\/\d+)\b/i.test(sectionBody(del, 'Eval') || del)) return true
+  if (/\beval (pack|receipt)[:\s].*\b(pass|SHIP)\b/i.test(del)) return true
+  const receipts = sectionBody(del, 'Ship receipts') || ''
+  if (/\bevals\.md\b/i.test(receipts) && /\b(pass|SHIP)\b/i.test(receipts) && !/\*\([^)]*evals\.md[^)]*\)\*/i.test(receipts)) {
+    return true
+  }
+  return false
+}
+
 // Lean line for session-start TRIAGE - count + top issue + NL cue. Omitted when clean.
 function hygieneTriageLines(eng) {
   const issues = collectDoctorIssues(eng)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fdeops",
-  "version": "3.9.11",
+  "version": "3.9.13",
   "description": "Field kit for engineers embedded in client work - a real CLI (recon, memory, portfolio), one @fde skill with field judgment on top, and hooks that make it automatic. Claude Code plugin and any agent that loads skills.",
   "bin": {
     "fdeops": "bin/install.js",

package/skills/fde/SKILL.md

@@ -59,7 +59,7 @@ When NOT to interrogate or challenge: unambiguous one-liners, mechanical ops, FD
 - The `fde` CLI is **local only** - `git` + file reads, no AI, no network. Safe in any environment.
 - **You (the AI) only ever see customer code when the FDE points you at it** inside the agent they are already authorized to run. fdeops adds no new data path.
 - **Before reading or generating against customer code, the AI policy must be known.** New engagement, policy unknown → ask it (land phase: "policy on AI-generated code? data that must never touch AI?") *before* loading their code into context. Default to "not permitted" until the FDE confirms.
-- Data tagged `<private>` in `trust-profile.md` (sacred data, PHI, cardholder, classified) **never enters your context or any subagent prompt** - work around it, never with it.
+- Data tagged `<private>` (sacred data, PHI, cardholder, classified) is **redacted from CLI, dashboard, and hook-injected context**. Do **not** open raw `<private>` blocks with file tools (that bypasses redaction) or paste them into prompts/subagents - work around them, never with them.
 - Locked-down engagement (no AI on their code)? Use the CLI + the fieldbook only. The memory layer is the FDE's own notes, not customer code.
 
 **Engagement path - zero ceremony.** Run `fde resume` (fallback: `node ~/.claude/fdeops/fde.js resume`). The **workspace registry** (written once by `fde resume --init <name>`) is the normal path; resolution order is env var override → registry → pointer file → workspace-name match (read-only) → `./.fde`. Writes require a bind (or `FDEOPS_ENGAGEMENT`), not folder name alone. It prints a **bounded** view of `context.md` - the curated head (state, next action) plus the most recent activity, with the older session log collapsed (use `fde resume --full` when you genuinely need the whole history). If it reports NO ENGAGEMENT: confirm the client name in conversation (one question), then run `fde resume --init <name>` yourself - the one setup step; the FDE never runs setup commands. Never install fdeops on infrastructure the FDE does not control.
@@ -270,6 +270,7 @@ Running the engagement and ending it well.
 | Signal | Overlay |
 |--------|---------|
 | AI, ML, LLM, model, embeddings, RAG, agents, fine-tuning, inference, drift | `references/ai.md` |
+| Golden set, eval suite, eval pack, pass/fail before AI ship, HITL gate for model | `references/eval-pack.md` (+ `ai.md`) |
 | Deck, slides, report, governance framework, compliance pack, ADR, PDF | `references/artifacts.md` |
 | Patient data, PHI, HIPAA, EHR, clinical | `references/healthcare.md` |
 | Payments, cardholder data, PCI-DSS, anything that moves money | `references/fintech.md` |

package/skills/fde/references/ai.md

@@ -36,6 +36,19 @@ Never start with the most powerful model. Start with the cheapest that meets the
 
 Write model selection rationale to `decisions.md`. Include: models tested, test set size, scores, cost comparison.
 
+## Engagement eval pack (before AI ships)
+
+When any slice touches a model, embeddings, RAG, or an agent: create or update `.fde/evals.md` **before** ship. Full method: `references/eval-pack.md`. This is the engagement-local test set — not unit tests.
+
+**Minimum pack (do not grow until the minimum exists):**
+1. **Component + quality bar** — one sentence each; kill switch / fallback named.
+2. **Golden cases** — 5–20 representative inputs with expected outputs and a pass rule. Prefer real production-shaped data (sanitized).
+3. **Failure modes** — at least the silent ones: hallucination/ungrounded, retrieval miss (if RAG), drift, cost runaway.
+4. **Pass/fail** — dated run; Verdict **SHIP** or **NO-SHIP**; critical fails must be 0.
+5. **HITL gate** — which decisions need human review before action (align with `trust-profile.md`). Empty when policy requires review → NO-SHIP.
+
+**When to write:** plan seeds the pack; sketch/build grows goldens; ship requires Verdict SHIP and a receipt in `delivery.md` → `## Ship receipts`. Non-AI work skips this file entirely.
+
 ## RAG architecture (retrieval-augmented generation)
 
 When the AI needs to answer questions about the client's data:
@@ -78,12 +91,13 @@ When the AI takes actions (not just generates text):
 
 ## Writes
 
-`trust-profile.md` - AI policy, data classification, model hosting, human-in-the-loop requirements. `decisions.md` - model selection rationale, architecture choices. `risks.md` - bias findings, drift observations, cost projections. `delivery.md` - AI component inventory with kill switches documented.
+`trust-profile.md` - AI policy, data classification, model hosting, human-in-the-loop requirements. `evals.md` - golden cases, failure modes, SHIP/NO-SHIP, HITL. `decisions.md` - model selection rationale, architecture choices. `risks.md` - bias findings, drift observations, cost projections. `delivery.md` - AI component inventory with kill switches + eval receipt on ship.
 
 ## Principles
 
 - AI degrades silently. Monitor outputs, not just uptime.
 - Start with the cheapest model that meets the quality bar.
+- No golden set, no AI ship (`evals.md` Verdict SHIP).
 - Every AI component needs a kill switch and a fallback path.
 - Log reasoning, not just results. Debug AI from its decisions.
 - Drift is inevitable. Define the detection method before shipping.

package/skills/fde/references/build.md

@@ -127,7 +127,7 @@ The FDE's job is to make themselves replaceable. Not at handoff - every day. A c
 
 - **`decisions.md`** - each significant choice: what, alternatives considered, why this one. For non-trivial architecture decisions, present three options to the FDE (safe / pragmatic / aggressive) with costs and a recommendation - three options is a real decision; one option is a request for trust. Integration contracts go here too.
 - **`risks.md`** - new risks discovered while building.
-- **`delivery.md`** - append a **value ledger** row for every ship: Date | Slice | Promised | Measured | Evidence | Rollback. "Measured" may be `pending` until the pulse exists - never skip the promised column. Narrative under Shipped is optional color; the ledger is the record status and close read.
+- **`delivery.md`** - append a **value ledger** row for every ship: Date | Slice | Bucket | Promised | Measured | Evidence | Rollback. Bucket is `cost-save` / `risk-mitigation` / `revenue-uplift`. "Measured" may be `pending` until the pulse exists - never skip the promised column. Narrative under Shipped is optional color; the ledger is the record status and close read.
 
 ## Checkpoint
 

package/skills/fde/references/close.md

@@ -17,6 +17,12 @@ The engagement doesn't end at ship. It ends when the customer can maintain what
 - Which risk almost became real?
 - AI components: did they behave in production? What failure modes did the prototype hide? Is the team equipped to maintain them?
 
+**1b. Value + receipts close gate (refuse green close if any fail):**
+- Primary value bucket in `success.md` matches what the sponsor funded; at least one ledger row has **Measured** (not forever-`pending`) with evidence for that bucket — or the retrospective explicitly records “not measured; sponsor accepted pending.”
+- Audit receipt exists for the final shipped path (exceptions/operating map walked; cite file).
+- Eval receipt: **n/a if no AI**, else final golden/eval result + HITL owner recorded; kill switch / fallback named in `handoff.md`.
+- One line in the retrospective: which bucket moved, by how much, vs baseline.
+
 **2. The pattern.** Anything that happened here and will happen again - a compliance approach, a migration pattern, a stakeholder dynamic - gets encoded for reuse. **If you do it twice, encode it.**
 
 **3. The handoff.** Operational knowledge for the person woken at 2am, not technical documentation: the 3 things that will break and the fix for each · who holds the tribal knowledge · what each alert means · deploy and rollback in plain language. AI components additionally: model version, what normal output looks like (so drift is recognisable), fallback behaviour, who owns retraining, **how to disable the AI path without taking down the feature** - without this the team turns it off at the first misbehaviour and it stays off.
@@ -33,11 +39,12 @@ The engagement doesn't end at ship. It ends when the customer can maintain what
 
 ## Checkpoint
 
-Direct assessment to the FDE: did the engagement achieve `success.md` · 2–3 lessons that matter · is the pattern worth encoding · is the handoff complete or where are the gaps. Honest - a gap named now is cheaper than a callback in six weeks.
+Direct assessment to the FDE: did the engagement achieve `success.md` · 2–3 lessons that matter · is the pattern worth encoding · is the handoff complete or where are the gaps. Also: value bucket + audit receipt green; eval **n/a or green**. Pending Measured without sponsor acceptance = gap, not green close. Honest - a gap named now is cheaper than a callback in six weeks.
 
 ## Principles
 
 - Done = the customer operates without you.
+- No named value bucket moved (or sponsor-accepted pending) = not a green close.
 - The retrospective is an investment in the next engagement, not a post-mortem.
 - Encode what repeated. The same lesson learned twice is a process failure.
 - Write the handoff for 2am.

package/skills/fde/references/discover.md

@@ -92,6 +92,7 @@ The real spec is what people **do** when the system fails - not what the slide d
 - **The hesitation.** When someone says "well, there's also this other thing we do…" - stop them, ask them to finish. The main story is what they're comfortable explaining; the hesitation is the real problem.
 - **"Which part of the codebase do you least want to touch?"** The answer is unanimous and it's the load-bearing wall. Check it against your churn scan - when the human answer and the churn data agree, that's your first map landmark.
 - **Shadow AI.** Someone pasting data into ChatGPT to cope = a real unmet need + an uncontrolled data risk. Note both.
+- **Exception-led operating map.** For each real break (not the slide-deck process): what fails, who notices first, what they do today, and which artifact is trusted in that moment. Prefer exceptions over happy-path swimlanes — the workaround is the operating system. Write rows under `terrain.md` → `## Operating map (exception-led)`. If the section is missing on an older engagement, add it; never regenerate the rest of terrain. When AI is in play, also fill `## Intelligence placement` (deterministic vs LLM judgement vs human approve).
 
 ## Method - part 3: workshop facilitation
 
@@ -165,6 +166,11 @@ Score every candidate use case before anything gets prototyped:
 **Data flow:** <entry → transform → store → exit>
 **Test landscape:** <covered / gaps / lies>
 **Unknowns:** <named explicitly - an honest gap beats a confident guess>
+
+## Operating map (exception-led)
+| Exception / break | Who notices first | What they do today | System of record then | Blast | Evidence |
+|-------------------|-------------------|--------------------|----------------------|-------|----------|
+| <break> | <role> | <workaround> | <sheet/DB/person> | CRITICAL / LOAD-BEARING / CONVENIENCE | <who/day> |
 ```
 
 Every line carries its evidence. `(churn: 47/90d)` `(ops lead, Day 5)` `(stated, unverified)`.
@@ -173,11 +179,12 @@ Every line carries its evidence. `(churn: 47/90d)` `(ops lead, Day 5)` `(stated,
 
 ## Checkpoint (before any build)
 
-Present to the FDE, four things, one paragraph each - no padding:
+Present to the FDE, five things, one paragraph each - no padding:
 1. The real problem, with the two strongest pieces of evidence.
 2. The top 3 risk areas of the codebase, one line of why each.
 3. What must not be touched without characterisation tests.
-4. The recommendation: confirm brief / descope / rescope - and the decision it puts in front of the sponsor.
+4. The exception-led operating map: the two breaks that matter most, who owns the workaround, and where shadow systems live.
+5. The recommendation: confirm brief / descope / rescope - and the decision it puts in front of the sponsor.
 
 If discovery revealed the problem is 3× the brief: the FDE tells the customer **before** telling themselves it's manageable. Lead with evidence, offer three paths (descope / rescope / pause-and-plan), confirm any reset in writing - update `success.md` and `brief.md` before continuing.
 

package/skills/fde/references/eval-pack.md

@@ -0,0 +1,43 @@
+# eval-pack - prove the system before it acts
+
+**Enter when:** the work touches AI/LLM/agents/RAG, or ship/close is blocked because there is no evidence the non-deterministic path is safe. Activate alongside `ai.md`, `sketch`, `build`, or `ship` — not instead of them.
+
+**Read first:** `trust-profile.md` (AI policy + HITL), `terrain.md` (operating map), `delivery.md`. Create or extend `evals.md`.
+
+Non-AI engagements skip this pack entirely.
+
+## Why this exists
+
+Intelligence without evidence is token-maxing with a nicer name. An FDE earns trust by showing: golden cases, failure modes, and a human gate before action.
+
+## Method (you do this work)
+
+**1. Scope the judgement surface.** One sentence: which step uses model judgement, and what must never be autonomous.
+
+**2. Build a golden set (minimum 5–20 for a slice; prefer 50–100 before broad scale).** For each case:
+- input (sanitized — no `<private>` raw values)
+- expected outcome or expert-approved acceptance note
+- pass rule (exact / contains / short rubric)
+- source: real historical example / expert label / staged fixture
+
+**3. Score pass/fail, not vibes.** Run the suite. Record count pass / fail. Failures get a failure-mode tag (missing data, wrong record, format drift, hallucination, retrieval miss, unsafe action, other).
+
+**4. Human-in-the-loop gate.** Name which outcomes require human approve before side effects. If none, write why that is allowed under `trust-profile.md` AI policy — do not invent permission.
+
+**5. Ship rule.** Until `evals.md` shows Verdict **SHIP** with a dated run (critical fails = 0) and HITL filled when policy requires it, AI-touching ship stays **fix-first**. Log a one-line eval receipt in `delivery.md` → `## Ship receipts`.
+
+## Artifact — `evals.md`
+
+Create on first AI-touching slice (not at `resume --init`). Use the stub in `templates/.fde/evals.md`. Every claim needs a source. Missing evidence → leave the cell `unknown - ask:`, never invent scores.
+
+## Checkpoint
+
+Present to the FDE: suite size, pass rate, top failure mode, HITL gate, Verdict SHIP/NO-SHIP. If they want to ship without a run: say no, and offer the smallest suite that would unblock.
+
+## Principles
+
+- No golden set, no AI ship.
+- Pass/fail beats “looks good.”
+- Failure modes are the product — the happy path is table stakes.
+- HITL is a gate, not a slide.
+- Non-AI work does not need this file.

package/skills/fde/references/healthcare.md

@@ -10,7 +10,7 @@ A PHI breach can end an operating licence; an audit-trail gap can invalidate a c
 
 > "Walk me through what patient data this system touches, stores, transmits - and who has access."
 
-PHI is broader than names: IPs, device identifiers, sub-state geography, and dates (other than year) can all qualify in context. When in doubt, treat as PHI. Tag everything in `trust-profile.md` under `<private>` - **PHI never enters AI context in plaintext: not prompts, not test fixtures, not dev logs.**
+PHI is broader than names: IPs, device identifiers, sub-state geography, and dates (other than year) can all qualify in context. When in doubt, treat as PHI. Tag it in `trust-profile.md` under `<private>`. Operational rule: **no PHI in prompts, test fixtures, or logs** - CLI/dashboard redact the tags; agent file tools do not.
 
 ## AI policy before a single line
 
@@ -38,7 +38,7 @@ Clinical systems need emergency override (a clinician must reach a record even w
 
 ## Principles
 
-- PHI never enters AI context in plaintext.
+- No PHI in prompts, fixtures, or logs (tag `<private>`; do not read raw private blocks into the model).
 - Audit trails before features.
 - Unclear AI policy = prohibited until confirmed.
 - De-identification is a legal definition (18 identifiers).

package/skills/fde/references/land.md

@@ -65,6 +65,7 @@ Let silence sit. If their fear doesn't match the written brief, the brief is wro
 - **The previous attempt** - "we tried something similar last year" is the most important sentence in the first meeting. Who was involved? Still there and protective, or gone because of it?
 - **The passed-over internal team** - they know exactly what's wrong, and they resent the FDE's presence. Find them before the first standup, ask what they tried, use their language in every meeting. Make them look right and they protect you; ignore them and they wait for the mistake.
 - **The sacred thing** - "Is there anything in this environment I should treat as untouchable?" The hesitation before the answer is the answer.
+- **Exception path (operating map seed)** - "When the happy path breaks this week, what do people actually do — who do they call, what spreadsheet opens, what do they skip?" Capture the break → workaround → who owns it. Do not build a full map on day 1; seed rows later in `terrain.md` → `## Operating map (exception-led)` during discover. Unknowns stay `unknown - ask:`.
 - **AI posture and policy** - tools already in use (sanctioned or shadow), and: "Does your organisation have a policy on AI-generated code? Are there decisions where you would not be comfortable with AI involvement?"
 - **Boundaries in multi-vendor rooms** - who owns what surface, who signs off before a change crosses it.
 
@@ -76,7 +77,7 @@ Before the end of day 1, ship one visible thing: a small bug fix, a cleanup the
 
 **`brief.md`** - what they said, who sent the FDE, the timeline, **and the gap list**.
 
-**`success.md`** - what done looks like, how it's measured, who actually signs off, what is explicitly out of scope. Agreed with the customer, not assumed.
+**`success.md`** - what done looks like, **primary value bucket** (`cost-save` | `risk-mitigation` | `revenue-uplift`), baseline → target, who actually signs off, what is explicitly out of scope. Agreed with the customer, not assumed.
 
 **`stakeholders.md`**:
 ```markdown
@@ -86,7 +87,7 @@ Before the end of day 1, ship one visible thing: a small bug fix, a cleanup the
 ```
 If `stakeholders.md` already has a `## Signal history` section (it does from the template), **never delete or overwrite it** when you rewrite this file - it holds the dated `[signal:...]` tokens `fde log contact --signal` and `fde debrief` write, and `fde status`/`fde receipts`/the dashboard read only from that section. Edit the table above it freely; keep the section below intact.
 
-**`trust-profile.md`** - sacred data (`<private>` tagged), fears heard, AI policy, approval chain. Sensitive: never loaded for status reads, never into subagent prompts.
+**`trust-profile.md`** - sacred data (`<private>` tagged), fears heard, AI policy, approval chain. Sensitive: skip for status reads; use CLI/redacted surfaces; never paste raw `<private>` into prompts or subagents.
 
 **`assumptions.md`** - seed every unverified claim from the brief (and the day-1 hypothesis) as rows with blast radius CRITICAL / LOAD-BEARING / CONVENIENCE and status `OPEN`. Do not wait for assumption-audit - land makes the register exist. Example:
 
@@ -100,14 +101,14 @@ One falsifiable hypothesis about the real problem also goes at the bottom of `br
 
 ## Checkpoint
 
-One page back to the FDE: success + sign-off owner, out-of-scope boundary, sacred data, stakeholder map with veto power, AI posture, the hypothesis, and the top CRITICAL assumptions still OPEN. If it doesn't fit one page, the engagement isn't understood yet.
+One page back to the FDE: success + value bucket + sign-off owner, out-of-scope boundary, sacred data, stakeholder map with veto power, AI posture, the hypothesis, the top CRITICAL assumptions still OPEN, and any exception-path seeds heard (break → workaround → owner) for discover to map into `terrain.md`. If it doesn't fit one page, the engagement isn't understood yet.
 
 If remote: trust-building takes ~40% longer - push for a short video call before anything asynchronous.
 
 ## Principles
 
 - Never start technical work before `success.md` exists.
-- Sacred data never enters AI context. Ever.
+- Sacred data tagged `<private>` stays out of model context: use CLI/redacted reads; never paste raw private blocks.
 - The brief is a hypothesis; discover confirms it. Seed `assumptions.md` on day one.
 - The passed-over internal team is the best source of truth, not an obstacle.
 - If the customer cannot define success, that is the first problem to solve.

package/skills/fde/references/ship.md

@@ -2,7 +2,7 @@
 
 **Enter when:** a slice is built, reviewed, and ready to deploy.
 
-**Read first:** `context.md`, `delivery.md`. Load `trust-profile.md` if the deploy touches regulated data or needs an approval chain.
+**Read first:** `context.md`, `delivery.md`, `success.md`. Load `trust-profile.md` if the deploy touches regulated data or needs an approval chain. Load `evals.md` when the deploy touches AI/ML/LLM/RAG/agents.
 
 Opening question, calm tech lead voice: **has anyone actually *run* the rollback, or is it still a slide?** If only planned, that's today's work - say so plainly.
 
@@ -42,10 +42,26 @@ Score each dimension green/amber/red. This is the gate, not a suggestion:
 | Runbook | Exists and someone other than you has read it | Exists but unreviewed | Missing |
 | Monitoring | Alerts configured, owner named, dashboard live | Alerts configured, no named owner | No monitoring |
 
+### Value + receipts gate (score with the table above)
+
+| Dimension | Green | Amber | Red |
+|-----------|-------|-------|-----|
+| **Value bucket** | `success.md` names primary bucket (`cost-save` \| `risk-mitigation` \| `revenue-uplift`) and a baseline→target metric; this slice’s value-ledger row has **Bucket** + **Promised** | Bucket named; **Measured** still `pending` with a pulse date | No bucket, or Promised empty / ticket-theater only |
+| **Audit receipt** | Dated line in `delivery.md` (`## Ship receipts` or ledger Evidence) proving exceptions/operating path were walked — cite `terrain.md` / `reality.md` / `audit.md` | Path described, not verified this ship | No audit receipt for this slice |
+| **Eval receipt** | **n/a** (no AI on this slice) **or** `evals.md` Verdict SHIP with dated golden run + HITL gate named | Eval pack exists; known fails open with owner + date | AI in scope and no eval receipt |
+| **AI eval pack** | `.fde/evals.md` Verdict SHIP; goldens run this change; critical fails 0; HITL filled if policy requires | Pack exists; run stale vs change log | AI-touching deploy and pack missing / NO-SHIP / HITL required but empty |
+
 **Any RED = stop. Do not deploy. Fix the red dimension first.**
 **2+ AMBER = sponsor conversation before deploying.** Present the ambers and get explicit "proceed" or "fix first."
 
-Write the readiness score to `delivery.md` before deploying. The score is the evidence if anything goes wrong.
+**AI-touching deploys (model, embeddings, RAG, agent, or inference path):**
+1. Read `.fde/evals.md`. If missing → **RED. Do not deploy.** Create the pack (`eval-pack` / `ai` overlay) and re-score.
+2. If Verdict is not **SHIP**, or Last run is older than the latest change-log row → **RED.**
+3. If `trust-profile.md` requires human-in-the-loop and the HITL gate has no reviewer → **RED.**
+4. Log in `delivery.md` → `## Ship receipts` before deploy: audit cite + eval receipt.
+5. Non-AI deploys: Eval = **n/a** — do not invent an empty pack.
+
+Write the readiness score (including value + receipts) to `delivery.md` before deploying. The score is the evidence if anything goes wrong.
 
 ## Pre-blast challenge (before the deploy button)
 
@@ -146,13 +162,14 @@ Adoption isn't a handoff-stage problem - it starts during build. Software that l
 
 ## Checkpoint
 
-Before 100%: canary clean, business metric verified, pulse written into `delivery.md`. Any item unconfirmed → the deploy waits. For enterprise-scale: scale-readiness gate passed before broad rollout.
+Before 100%: canary clean, business metric verified, pulse written into `delivery.md`. Also green: value bucket named, audit receipt dated, eval receipt **n/a or pass**. Missing any of those → not green. For enterprise-scale: scale-readiness gate passed before broad rollout.
 
 ## Principles
 
 - A deployment without a tested rollback is reckless.
 - Roll back on any canary anomaly; investigate safely.
 - Verify the business metric, not just the technical one.
-- No pulse, no done.
+- No value bucket, no green ship. No pulse, no done.
+- AI path without eval receipt = fix-first; non-AI ships leave eval as n/a.
 - Scale readiness is organizational, not just technical. Check all 8 dimensions.
 - Adoption is measured from day one, not hoped for at launch.

package/templates/.fde/delivery.md

@@ -4,9 +4,17 @@
 
 ## Value ledger
 
-| Date | Slice | Promised | Measured | Evidence | Rollback |
-|------|-------|----------|----------|----------|----------|
-| | | *(what we said it would change)* | *(what actually changed, or pending)* | *(who/when/metric)* | |
+| Date | Slice | Bucket | Promised | Measured | Evidence | Rollback |
+|------|-------|--------|----------|----------|----------|----------|
+| | | *(cost-save / risk-mitigation / revenue-uplift)* | *(what we said it would change)* | *(what actually changed, or pending)* | *(who/when/metric)* | |
+
+## Ship receipts
+
+<!-- Fill before green ship. Eval = n/a unless AI touches the slice. -->
+
+| Date | Slice | Audit receipt | Eval receipt |
+|------|-------|---------------|--------------|
+| | | *(dated cite: exceptions/operating path verified — terrain/reality/audit)* | *(n/a \| evals.md pass + HITL owner)* |
 
 ## Shipped
 

package/templates/.fde/evals.md

@@ -0,0 +1,42 @@
+# Engagement eval pack
+
+<!-- AI-touching work only. Fill before ship. Empty pack = do not deploy AI path. Non-AI engagements: leave unused or delete. -->
+
+## Component
+- **Name / slice:**
+- **Model / stack:** <!-- rules | small model | frontier | RAG | agent -->
+- **Quality bar:**
+- **Kill switch / fallback:**
+- **Owner:**
+
+## Golden cases
+
+| ID | Input (sanitized) | Expected | Pass rule | Last run | Result |
+|----|-------------------|----------|-----------|----------|--------|
+| G1 | | | | | |
+
+## Failure modes
+
+| Mode | How it shows up | Detection | Mitigation |
+|------|-----------------|-----------|------------|
+| | | | |
+
+## Pass / fail (this ship)
+- **Golden:** _/_ pass (threshold: _)
+- **Critical fails (must be 0):**
+- **Verdict:** <!-- SHIP | NO-SHIP -->
+- **Evidence:** <!-- who/when -->
+
+## Human-in-the-loop gate
+
+| Decision / action | Autonomous OK? | Reviewer role | Escalation |
+|-------------------|----------------|---------------|------------|
+| | | | |
+
+**HITL rule for this ship:**
+
+## Change log
+
+| Date | What changed | Pack re-run? | Notes |
+|------|--------------|--------------|-------|
+| | | | |

package/templates/.fde/success.md

@@ -3,5 +3,7 @@
 <!-- Agreed definition of done. Out-of-scope is as important as in-scope. -->
 
 **Done when:**
+**Primary value bucket:** <!-- cost-save | risk-mitigation | revenue-uplift (pick one) -->
+**Baseline → target:** <!-- metric, number, by when -->
 **Explicitly out of scope:**
 **Stakeholder who signs off:**

package/templates/.fde/terrain.md

@@ -5,3 +5,21 @@
 **Stack:**
 **Hotspots (handle with care):**
 **Test gaps:**
+
+## Operating map (exception-led)
+
+<!-- How work actually runs when the happy path fails. Fill in discover; leave blank until heard/seen. -->
+
+| Exception / break | Who notices first | What they do today (workaround) | System of record then | Blast if wrong | Evidence |
+|-------------------|-------------------|---------------------------------|-----------------------|----------------|----------|
+| | | | | | |
+
+**Shadow systems / silent workarounds:**
+**Sacred / untouchable in ops:**
+**Previous attempt residue:**
+
+## Intelligence placement (when AI is in play)
+
+| Step | Deterministic | Model judgement | Human approve |
+|------|---------------|-----------------|---------------|
+| | | | |

package/templates/.fde/trust-profile.md

@@ -1,10 +1,10 @@
 # Trust profile
 
-<!-- Sacred data, AI policy, approvals. Use <private>...</private> for never-AI content. -->
+<!-- Sacred data, AI policy, approvals. Use <private>...</private> for content CLI/dashboard must redact; do not paste raw into prompts. -->
 
 **AI code policy:**
 **Approval chain:**
-**Data that must never enter AI context:**
+**Data kept out of model context (tag below; do not paste raw):**
 
 <private>
 <!-- Example: cardholder data scope, production credentials paths -->