flow-workflows 0.86.0 → 0.87.0

package/README.md

@@ -173,6 +173,7 @@ Symmetrically, `guided`/`auto` never ask about the flow's own machinery (panels,
 | `/flow:work:try` | Point the main checkout at a branch to test it, and print the manual test plan once it is up (then `--back`) |
 | `/flow:work:clean` | Sweep merged worktrees, dead branches, unarchived folders. Never deletes on a guess |
 | `/flow:work:abandon` | Close a work item without shipping |
+| `/flow:work:handoff` | Hand a finished study to whoever builds it elsewhere — pushes only its folder to a branch of its own, offers a summary for the ticket |
 | `/flow:news` | What changed in the plugin since the version you last saw |
 
 ## What a work looks like on disk

package/adapters/codex/CORE.md

@@ -17,7 +17,7 @@ Every `$flow-*` command assumes these rules. They are stated once, here, so a co
 carries what is specific to its phase. Read this once per session; a command that says "load
 `flow-core`" means this file.
 
-**This file belongs to flow `0.86.0`.** Compare it once, at the start of the session, against
+**This file belongs to flow `0.87.0`.** Compare it once, at the start of the session, against
 `version` in `~/.claude/flow/.claude-plugin/plugin.json`. The two differing means the session
 is running a **mixture** — the commands from one copy of the plugin, these shared rules from another
 — which is exactly what happens when a branch or a release candidate is loaded over an installed

package/adapters/codex/skills/flow-work-README/SKILL.md

@@ -249,6 +249,7 @@ Two signals arrive on an open MR/PR, each with its own cross-cutting loop (feat
 - `$flow-work-daily [question]` — the **work assistant** (daily standup), read-only. **Local** (`.claude/work/` + git) + **forge** (open MRs/PRs, reviews awaiting you, red CI, unmergeable, unresolved threads via `git.cli`) + **tracker** (assigned tickets, priority changes via `tracker.tool`); where they cross, concrete commands (`$flow-feat-start`, `$flow-work-green`, `$flow-work-respond`). No argument → *yesterday · today · blockers*; a question → just that. External sources best-effort, never blocking; the only write is a "last seen" marker, like `$flow-news`.
 - `$flow-work-status` — all works in `.claude/work/`, current phase, divergence with git.
 - `$flow-work-run [ticket]` — the **entry an orchestrator launches** for an `unattended` run: asks it `why` (start · answer · merged · review · pipeline), routes to the phase that answers it, and makes no decision of its own. Refuses to run in any other mode.
+- `$flow-work-handoff` — hands a **finished study** to whoever builds it elsewhere (an unattended server, another machine): refuses an unfinished one, pushes only this work's folder as a parentless commit to `git.handoff_branch` without touching the checkout, asks before the push, then offers a marked summary for the ticket body (`tracker.edit_cmd`).
 - `$flow-work-resume` — detects the branch, reads `meta.json`, recaps, suggests the next step. **Re-reads the ticket's comment thread** (§2.5), reports only what is new since `01-context.md`, appends it to the artifact; never amends the design on its own.
 - `$flow-work-try <branch>` / `$flow-work-try --back` — point the main checkout at a branch to test it here, then return; re-syncs per `git.worktree_resync`. Resolves the work behind the branch and, once the environment is up, **prints the manual test plan already written** (the `needs-manual`/`unproven` criteria, or the acceptance criteria when `validate` has not run) and offers to collect Pass/Fail/Blocked into the validation artifact. No work behind the branch → the plain switch, as before.
 - `$flow-work-clean [--dry-run]` — **periodic sweep** of finished work's residue: worktree, local branch, `.claude/work/` folder (intermediate train MR/PRs never set `phase: done`, so the `ship`/`abandon` prompt never fires). Verdict per branch from **the forge** with local fallbacks, including patch-equivalence for **squash merges** (`git branch --merged` misses them); acts only on `merged`/`empty`. `unknown` never a candidate; dirty and unpushed protected; work folders **archived, never deleted**; remote never touched. **`autonomy.mode` does not authorize deletion**: `auto` confirms the list too. `--purge-archive <N>d`: separate opt-in pass over `_archive/`, only folders already committed to git.

package/adapters/codex/skills/flow-work-handoff/SKILL.md

@@ -0,0 +1,158 @@
+---
+name: flow-work-handoff
+description: "Hand a finished study to whoever builds it elsewhere — push only this work's folder to a branch of its own, then offer a summary for the ticket"
+---
+
+<!-- GENERATED by script/adapter-build.py from plugins/flow/commands/work/handoff.md — do not edit; change the plugin file and run the script. -->
+
+# `$flow-work-handoff`
+
+> **codex adapter — how the Claude Code primitives named below map here.**
+> - `AskUserQuestion` → ask in plain text with numbered options and wait for the reply.
+> - `Agent <role>` / `Agent general-purpose` / subagents → the subagent declared under `[agents.<name>]` in `~/.codex/config.toml`; the name comes from `agents.<role>` in `FLOW.md`, empty → do it in this context.
+> - Parallel fan-out → several subagents in one response, capped at `agents.fanout_max` (empty → 4); `agents.fanout_tool` is Claude Code-only, ignore it.
+> - `ScheduleWakeup` / `Monitor` / `/loop` → not available in-session: run one cycle, persist state in `monitor.md`, let the user schedule `codex exec "<command>"` with cron or Codex automations.
+> - `TaskCreate` → a markdown checklist in the phase artifact.
+> - `Skill commit-commands:commit-push-pr` → `git add` · `git commit` · `git push -u origin HEAD` · the `git.cli` CLI (`gh pr create` / `glab mr create`).
+> - `/model <value>` → the `--model` flag at launch (or `/model` if your Codex version has it).
+> - `knowledge.*` roles → whatever tools `FLOW.md` names there; an MCP tool keeps its name, its server is declared under `[mcp_servers.<name>]` in `config.toml` (see `config.snippet.toml`).
+> - `$ARGUMENTS` → whatever the user typed after the skill name, empty if nothing — Codex substitutes nothing, so read it off their message.
+
+Read `~/.claude/flow/CORE.codex.md` first (shared rules: `FLOW.md` step 0, autonomy, how a stop reads, the live panel, `00-summary.md`) — skip if you already read it in this session.
+
+**Panel words are closed** — `mark`: `done` · `current` · `pending` · `wait` · `block` · `info`; `style`: `normal` · `dim` · `title` · `accent` · `ok` · `warn` · `error`. Anything else is dropped by the reader in silence: the panel still paints, and nobody is told.
+
+For a study made here and built somewhere else — a server running `$flow-work-run` unattended,
+another person, another machine. The builder gets the work folder at the same path and nothing
+else: no conversation, maybe a less capable model. So this command checks the study can stand on
+its own, pushes the folder to a branch that holds only it, and offers to put a summary in the
+ticket for the people who review it.
+
+## 1. Pre-flight
+
+- Effective FLOW configuration per flow-core §0. `autonomy.mode: unattended` → refuse in one line:
+  an unattended run never pushes (flow-core §2.1); handing off is a person's step.
+- Locate the active `meta.json` by current branch; not found → ask the user for the ticket.
+- `git.handoff_branch` empty → refuse, naming the key and an example
+  (`git.handoff_branch: study/{TICKET}`): where the study goes is the receiver's convention, never
+  flow's guess. `{TICKET}` = `meta.json.ticket`.
+- `origin` not configured → refuse; there is nowhere to push.
+
+## 2. Is the study finished?
+
+The builder can ask no one. Refuse — pushing nothing, naming every reason that holds — when:
+
+- **The study's last phase is not in `phases_done`.** A feature: `context` on XS (what `start`
+  records), `design` on S, `plan` on M/L. A bug: `context` on XS, `investigate` otherwise.
+- **`meta.json.pending` is set** — a question is still waiting for its answer.
+- **A clarification is still open** — a question under "Decisions clarified at start" in
+  `01-context.md` recorded without its answer.
+
+Then, **before anything is pushed**: decisions this session settled while talking that no artifact
+records yet → write them where they belong now (`01-context.md` "Decisions clarified at start",
+`03-design.md` "Decisions (ADR-light)", `04-mr-plan.md`), and say which. What was decided only in
+the chat does not travel.
+
+## 3. Build the commit, without touching the checkout
+
+A throwaway index holds only this folder, so the current branch, `HEAD`, the real index (staged
+work included) and the working tree are never read into it nor written to, and a git-ignored
+`.claude/work/` is no obstacle.
+
+**Each block below is one shell call, run as it stands** — a harness need not keep variables from
+one call to the next, so every block sets its own. Replace each `@…@` with its literal value first:
+`@WORK@` the work folder relative to the repository root (`.claude/work/<work-dir>`, no trailing
+slash), `@BRANCH@` the resolved `git.handoff_branch`, `@TICKET@` `meta.json.ticket`, `@COMMIT@` the
+sha the build block printed. A value holding a `'` cannot go inside those quotes: refuse it and
+say which.
+
+First, the branch must not exist on `origin` — a second push would need a force, and this command
+never forces:
+
+```bash handoff-check
+BRANCH='@BRANCH@'
+git ls-remote --exit-code origin "refs/heads/$BRANCH" >/dev/null; echo "rc=$?"
+```
+
+`rc=0` → the branch exists: refuse, and say what the person does next — delete it on the forge
+(only when nothing still reads it), or set another name in `git.handoff_branch`. `rc=2` → absent,
+continue. Anything else → stop and say why (no network, no access). Then build the commit:
+
+```bash handoff-build
+WORK='@WORK@'; TICKET='@TICKET@'
+cd "$(git rev-parse --show-toplevel)" || exit 1
+[ -d "$WORK" ] || { echo "no such folder: $WORK"; exit 1; }
+tmp=$(mktemp -d) || exit 1
+idx="$tmp/index"   # does not exist yet: git starts an empty index there
+GIT_INDEX_FILE="$idx" git add -f -- "$WORK" ":(exclude)$WORK/panel.json" &&
+  files=$(GIT_INDEX_FILE="$idx" git ls-files) &&
+  tree=$(GIT_INDEX_FILE="$idx" git write-tree) &&
+  commit=$(git commit-tree "$tree" -m "study $TICKET")
+rc=$?; rm -rf "$tmp"
+[ "$rc" -eq 0 ] && [ -n "$files" ] || { echo "nothing was built (rc=$rc)"; exit 1; }
+printf '%s\n' "$files"; echo "commit=$commit"
+```
+
+`GIT_INDEX_FILE` is set per command, never exported, so a failure leaves no session pointing git
+at a deleted index. `panel.json` stays out: it is this machine's terminal panel, and on another one
+it would show this session's last state as if it were theirs. The block failing → its message, and
+stop: `commit-tree` with no git identity configured is the usual cause.
+
+## 4. Confirm, then push
+
+Show the branch, the remote and the file list the build printed — every path, one per line — then
+ask with `AskUserQuestion` **in every `autonomy.mode`**: a push leaves the machine (flow-core §2).
+**Push** · **Cancel**. Nothing between the list and the question (flow-core §3).
+
+```bash handoff-push
+BRANCH='@BRANCH@'; COMMIT='@COMMIT@'
+case "$COMMIT" in ''|*[!0-9a-f]*) echo "not a commit sha: $COMMIT"; exit 1 ;; esac
+git cat-file -e "$COMMIT^{commit}" || exit 1
+git push origin "$COMMIT:refs/heads/$BRANCH"
+```
+
+The sha is checked first because `git push origin :refs/heads/<branch>` — an empty source —
+deletes the branch on the remote. A rejected push → its message, verbatim, and stop. Never retried
+with `--force`.
+
+## 5. The ticket summary (offer)
+
+Only after a successful push, and only in ticket mode with a real tracker id. The people reviewing
+the ticket read it there, never in the work folder; the receiver does not parse it.
+
+- **Read the body back** — the summary goes inside the ticket's own text, never over it:
+  `gh` → `gh issue view {TICKET} --json body -q .body` · `glab` → `glab issue view {TICKET} -F json`,
+  its `description`. Any other tracker → the offer is not made: one line saying flow cannot read that
+  body back to keep its text.
+- **The write command** — `tracker.edit_cmd`, `{TICKET}` and `{BODY_FILE}` substituted. Empty →
+  `gh issue edit {TICKET} --body-file {BODY_FILE}` for `gh`,
+  `glab issue update {TICKET} --description-file {BODY_FILE}` for `glab`.
+- **The block**, short, in the language of the ticket. A feature takes it from `01-context.md`,
+  `03-design.md` and `04-mr-plan.md`; a bug from `01-context.md` and `03-investigation.md` — the
+  expected behaviour as its criteria, the root cause and the intended fix as its design, "Areas with
+  similar risk" as its risks. A section whose source does not exist (an XS study, an S feature with
+  no plan) says `none`:
+
+  ```
+  <!-- flow-study -->
+  ## What and why
+  ## Acceptance criteria
+  ## Design in brief
+  ## MR/PR plan
+  ## Risks
+  <!-- end flow-study -->
+  ```
+
+  Criteria keep their literal values. The plan lists each MR/PR with what it covers and what it
+  waits on; a bug's plan is its single fix.
+- **The new body**: the body read above with the block between the two markers replaced — or, with
+  no markers yet, the block appended after a blank line. Written to a `mktemp` file outside the
+  tree — `{BODY_FILE}` — so nothing of it can be committed later.
+- **Show the block and ask** with `AskUserQuestion`, **in every mode**: it writes to a shared
+  tracker. **Write it** · **Skip**. Failure → its message in one line; the push stands.
+
+## 6. Close
+
+Report following flow-core §3: the branch and the commit, the file count, whether the ticket
+summary was written. Refresh the panel: a `Now` line saying the study was handed off, no `Decision`
+line. `meta.json` gains nothing — the branch on `origin` is the record, and the §3 refusal reads it.

package/adapters/gemini/CORE.md

@@ -16,7 +16,7 @@ Every `/flow:*` command assumes these rules. They are stated once, here, so a co
 carries what is specific to its phase. Read this once per session; a command that says "load
 `flow-core`" means this file.
 
-**This file belongs to flow `0.86.0`.** Compare it once, at the start of the session, against
+**This file belongs to flow `0.87.0`.** Compare it once, at the start of the session, against
 `version` in `~/.claude/flow/.claude-plugin/plugin.json`. The two differing means the session
 is running a **mixture** — the commands from one copy of the plugin, these shared rules from another
 — which is exactly what happens when a branch or a release candidate is loaded over an installed

package/adapters/gemini/commands/flow/work/README.toml

@@ -245,6 +245,7 @@ Two signals arrive on an open MR/PR, each with its own cross-cutting loop (feat
 - `/flow:work:daily [question]` — the **work assistant** (daily standup), read-only. **Local** (`.claude/work/` + git) + **forge** (open MRs/PRs, reviews awaiting you, red CI, unmergeable, unresolved threads via `git.cli`) + **tracker** (assigned tickets, priority changes via `tracker.tool`); where they cross, concrete commands (`/flow:feat:start`, `/flow:work:green`, `/flow:work:respond`). No argument → *yesterday · today · blockers*; a question → just that. External sources best-effort, never blocking; the only write is a "last seen" marker, like `/flow:news`.
 - `/flow:work:status` — all works in `.claude/work/`, current phase, divergence with git.
 - `/flow:work:run [ticket]` — the **entry an orchestrator launches** for an `unattended` run: asks it `why` (start · answer · merged · review · pipeline), routes to the phase that answers it, and makes no decision of its own. Refuses to run in any other mode.
+- `/flow:work:handoff` — hands a **finished study** to whoever builds it elsewhere (an unattended server, another machine): refuses an unfinished one, pushes only this work's folder as a parentless commit to `git.handoff_branch` without touching the checkout, asks before the push, then offers a marked summary for the ticket body (`tracker.edit_cmd`).
 - `/flow:work:resume` — detects the branch, reads `meta.json`, recaps, suggests the next step. **Re-reads the ticket's comment thread** (§2.5), reports only what is new since `01-context.md`, appends it to the artifact; never amends the design on its own.
 - `/flow:work:try <branch>` / `/flow:work:try --back` — point the main checkout at a branch to test it here, then return; re-syncs per `git.worktree_resync`. Resolves the work behind the branch and, once the environment is up, **prints the manual test plan already written** (the `needs-manual`/`unproven` criteria, or the acceptance criteria when `validate` has not run) and offers to collect Pass/Fail/Blocked into the validation artifact. No work behind the branch → the plain switch, as before.
 - `/flow:work:clean [--dry-run]` — **periodic sweep** of finished work's residue: worktree, local branch, `.claude/work/` folder (intermediate train MR/PRs never set `phase: done`, so the `ship`/`abandon` prompt never fires). Verdict per branch from **the forge** with local fallbacks, including patch-equivalence for **squash merges** (`git branch --merged` misses them); acts only on `merged`/`empty`. `unknown` never a candidate; dirty and unpushed protected; work folders **archived, never deleted**; remote never touched. **`autonomy.mode` does not authorize deletion**: `auto` confirms the list too. `--purge-archive <N>d`: separate opt-in pass over `_archive/`, only folders already committed to git.

package/adapters/gemini/commands/flow/work/handoff.toml

@@ -0,0 +1,155 @@
+# GENERATED by script/adapter-build.py from plugins/flow/commands/work/handoff.md — do not edit; change the plugin file and run the script.
+description = "Hand a finished study to whoever builds it elsewhere — push only this work's folder to a branch of its own, then offer a summary for the ticket"
+
+prompt = """
+# `/flow:work:handoff`
+
+> **gemini adapter — how the Claude Code primitives named below map here.**
+> - `AskUserQuestion` → ask in plain text with numbered options and wait for the reply.
+> - `Agent <role>` / `Agent general-purpose` / subagents → `@<name>` from `.gemini/agents/`; the name comes from `agents.<role>` in `FLOW.md`, empty or absent → do it in this context.
+> - Parallel fan-out → several `@name` in one turn (sequential in this context if none are configured), capped at `agents.fanout_max` (empty → 4); `agents.fanout_tool` is Claude Code-only, ignore it.
+> - `ScheduleWakeup` / `Monitor` / `/loop` → not available in-session: run one cycle, persist state in `monitor.md`, let the user schedule `gemini -p "<command>"` with cron.
+> - `TaskCreate` → a markdown checklist in the phase artifact.
+> - `Skill commit-commands:commit-push-pr` → `git add` · `git commit` · `git push -u origin HEAD` · the `git.cli` CLI (`gh pr create` / `glab mr create`).
+> - `/model <value>` → the `--model` flag at launch.
+> - `knowledge.*` roles → whatever tools `FLOW.md` names there; an MCP tool keeps its name, its server is declared under `mcpServers` in `settings.json` (see `settings.snippet.json`).
+
+Read `~/.claude/flow/CORE.gemini.md` first (shared rules: `FLOW.md` step 0, autonomy, how a stop reads, the live panel, `00-summary.md`) — skip if you already read it in this session.
+
+**Panel words are closed** — `mark`: `done` · `current` · `pending` · `wait` · `block` · `info`; `style`: `normal` · `dim` · `title` · `accent` · `ok` · `warn` · `error`. Anything else is dropped by the reader in silence: the panel still paints, and nobody is told.
+
+For a study made here and built somewhere else — a server running `/flow:work:run` unattended,
+another person, another machine. The builder gets the work folder at the same path and nothing
+else: no conversation, maybe a less capable model. So this command checks the study can stand on
+its own, pushes the folder to a branch that holds only it, and offers to put a summary in the
+ticket for the people who review it.
+
+## 1. Pre-flight
+
+- Effective FLOW configuration per flow-core §0. `autonomy.mode: unattended` → refuse in one line:
+  an unattended run never pushes (flow-core §2.1); handing off is a person's step.
+- Locate the active `meta.json` by current branch; not found → ask the user for the ticket.
+- `git.handoff_branch` empty → refuse, naming the key and an example
+  (`git.handoff_branch: study/{TICKET}`): where the study goes is the receiver's convention, never
+  flow's guess. `{TICKET}` = `meta.json.ticket`.
+- `origin` not configured → refuse; there is nowhere to push.
+
+## 2. Is the study finished?
+
+The builder can ask no one. Refuse — pushing nothing, naming every reason that holds — when:
+
+- **The study's last phase is not in `phases_done`.** A feature: `context` on XS (what `start`
+  records), `design` on S, `plan` on M/L. A bug: `context` on XS, `investigate` otherwise.
+- **`meta.json.pending` is set** — a question is still waiting for its answer.
+- **A clarification is still open** — a question under "Decisions clarified at start" in
+  `01-context.md` recorded without its answer.
+
+Then, **before anything is pushed**: decisions this session settled while talking that no artifact
+records yet → write them where they belong now (`01-context.md` "Decisions clarified at start",
+`03-design.md` "Decisions (ADR-light)", `04-mr-plan.md`), and say which. What was decided only in
+the chat does not travel.
+
+## 3. Build the commit, without touching the checkout
+
+A throwaway index holds only this folder, so the current branch, `HEAD`, the real index (staged
+work included) and the working tree are never read into it nor written to, and a git-ignored
+`.claude/work/` is no obstacle.
+
+**Each block below is one shell call, run as it stands** — a harness need not keep variables from
+one call to the next, so every block sets its own. Replace each `@…@` with its literal value first:
+`@WORK@` the work folder relative to the repository root (`.claude/work/<work-dir>`, no trailing
+slash), `@BRANCH@` the resolved `git.handoff_branch`, `@TICKET@` `meta.json.ticket`, `@COMMIT@` the
+sha the build block printed. A value holding a `'` cannot go inside those quotes: refuse it and
+say which.
+
+First, the branch must not exist on `origin` — a second push would need a force, and this command
+never forces:
+
+```bash handoff-check
+BRANCH='@BRANCH@'
+git ls-remote --exit-code origin "refs/heads/$BRANCH" >/dev/null; echo "rc=$?"
+```
+
+`rc=0` → the branch exists: refuse, and say what the person does next — delete it on the forge
+(only when nothing still reads it), or set another name in `git.handoff_branch`. `rc=2` → absent,
+continue. Anything else → stop and say why (no network, no access). Then build the commit:
+
+```bash handoff-build
+WORK='@WORK@'; TICKET='@TICKET@'
+cd "$(git rev-parse --show-toplevel)" || exit 1
+[ -d "$WORK" ] || { echo "no such folder: $WORK"; exit 1; }
+tmp=$(mktemp -d) || exit 1
+idx="$tmp/index"   # does not exist yet: git starts an empty index there
+GIT_INDEX_FILE="$idx" git add -f -- "$WORK" ":(exclude)$WORK/panel.json" &&
+  files=$(GIT_INDEX_FILE="$idx" git ls-files) &&
+  tree=$(GIT_INDEX_FILE="$idx" git write-tree) &&
+  commit=$(git commit-tree "$tree" -m "study $TICKET")
+rc=$?; rm -rf "$tmp"
+[ "$rc" -eq 0 ] && [ -n "$files" ] || { echo "nothing was built (rc=$rc)"; exit 1; }
+printf '%s\\n' "$files"; echo "commit=$commit"
+```
+
+`GIT_INDEX_FILE` is set per command, never exported, so a failure leaves no session pointing git
+at a deleted index. `panel.json` stays out: it is this machine's terminal panel, and on another one
+it would show this session's last state as if it were theirs. The block failing → its message, and
+stop: `commit-tree` with no git identity configured is the usual cause.
+
+## 4. Confirm, then push
+
+Show the branch, the remote and the file list the build printed — every path, one per line — then
+ask with `AskUserQuestion` **in every `autonomy.mode`**: a push leaves the machine (flow-core §2).
+**Push** · **Cancel**. Nothing between the list and the question (flow-core §3).
+
+```bash handoff-push
+BRANCH='@BRANCH@'; COMMIT='@COMMIT@'
+case "$COMMIT" in ''|*[!0-9a-f]*) echo "not a commit sha: $COMMIT"; exit 1 ;; esac
+git cat-file -e "$COMMIT^{commit}" || exit 1
+git push origin "$COMMIT:refs/heads/$BRANCH"
+```
+
+The sha is checked first because `git push origin :refs/heads/<branch>` — an empty source —
+deletes the branch on the remote. A rejected push → its message, verbatim, and stop. Never retried
+with `--force`.
+
+## 5. The ticket summary (offer)
+
+Only after a successful push, and only in ticket mode with a real tracker id. The people reviewing
+the ticket read it there, never in the work folder; the receiver does not parse it.
+
+- **Read the body back** — the summary goes inside the ticket's own text, never over it:
+  `gh` → `gh issue view {TICKET} --json body -q .body` · `glab` → `glab issue view {TICKET} -F json`,
+  its `description`. Any other tracker → the offer is not made: one line saying flow cannot read that
+  body back to keep its text.
+- **The write command** — `tracker.edit_cmd`, `{TICKET}` and `{BODY_FILE}` substituted. Empty →
+  `gh issue edit {TICKET} --body-file {BODY_FILE}` for `gh`,
+  `glab issue update {TICKET} --description-file {BODY_FILE}` for `glab`.
+- **The block**, short, in the language of the ticket. A feature takes it from `01-context.md`,
+  `03-design.md` and `04-mr-plan.md`; a bug from `01-context.md` and `03-investigation.md` — the
+  expected behaviour as its criteria, the root cause and the intended fix as its design, "Areas with
+  similar risk" as its risks. A section whose source does not exist (an XS study, an S feature with
+  no plan) says `none`:
+
+  ```
+  <!-- flow-study -->
+  ## What and why
+  ## Acceptance criteria
+  ## Design in brief
+  ## MR/PR plan
+  ## Risks
+  <!-- end flow-study -->
+  ```
+
+  Criteria keep their literal values. The plan lists each MR/PR with what it covers and what it
+  waits on; a bug's plan is its single fix.
+- **The new body**: the body read above with the block between the two markers replaced — or, with
+  no markers yet, the block appended after a blank line. Written to a `mktemp` file outside the
+  tree — `{BODY_FILE}` — so nothing of it can be committed later.
+- **Show the block and ask** with `AskUserQuestion`, **in every mode**: it writes to a shared
+  tracker. **Write it** · **Skip**. Failure → its message in one line; the push stands.
+
+## 6. Close
+
+Report following flow-core §3: the branch and the commit, the file count, whether the ticket
+summary was written. Refresh the panel: a `Now` line saying the study was handed off, no `Decision`
+line. `meta.json` gains nothing — the branch on `origin` is the record, and the §3 refusal reads it.
+"""

package/adapters/hermes/CORE.md

@@ -17,7 +17,7 @@ Every `/flow-*` command assumes these rules. They are stated once, here, so a co
 carries what is specific to its phase. Read this once per session; a command that says "load
 `flow-core`" means this file.
 
-**This file belongs to flow `0.86.0`.** Compare it once, at the start of the session, against
+**This file belongs to flow `0.87.0`.** Compare it once, at the start of the session, against
 `version` in `~/.claude/flow/.claude-plugin/plugin.json`. The two differing means the session
 is running a **mixture** — the commands from one copy of the plugin, these shared rules from another
 — which is exactly what happens when a branch or a release candidate is loaded over an installed

package/adapters/hermes/skills/flow-work-README/SKILL.md

@@ -249,6 +249,7 @@ Two signals arrive on an open MR/PR, each with its own cross-cutting loop (feat
 - `/flow-work-daily [question]` — the **work assistant** (daily standup), read-only. **Local** (`.claude/work/` + git) + **forge** (open MRs/PRs, reviews awaiting you, red CI, unmergeable, unresolved threads via `git.cli`) + **tracker** (assigned tickets, priority changes via `tracker.tool`); where they cross, concrete commands (`/flow-feat-start`, `/flow-work-green`, `/flow-work-respond`). No argument → *yesterday · today · blockers*; a question → just that. External sources best-effort, never blocking; the only write is a "last seen" marker, like `/flow-news`.
 - `/flow-work-status` — all works in `.claude/work/`, current phase, divergence with git.
 - `/flow-work-run [ticket]` — the **entry an orchestrator launches** for an `unattended` run: asks it `why` (start · answer · merged · review · pipeline), routes to the phase that answers it, and makes no decision of its own. Refuses to run in any other mode.
+- `/flow-work-handoff` — hands a **finished study** to whoever builds it elsewhere (an unattended server, another machine): refuses an unfinished one, pushes only this work's folder as a parentless commit to `git.handoff_branch` without touching the checkout, asks before the push, then offers a marked summary for the ticket body (`tracker.edit_cmd`).
 - `/flow-work-resume` — detects the branch, reads `meta.json`, recaps, suggests the next step. **Re-reads the ticket's comment thread** (§2.5), reports only what is new since `01-context.md`, appends it to the artifact; never amends the design on its own.
 - `/flow-work-try <branch>` / `/flow-work-try --back` — point the main checkout at a branch to test it here, then return; re-syncs per `git.worktree_resync`. Resolves the work behind the branch and, once the environment is up, **prints the manual test plan already written** (the `needs-manual`/`unproven` criteria, or the acceptance criteria when `validate` has not run) and offers to collect Pass/Fail/Blocked into the validation artifact. No work behind the branch → the plain switch, as before.
 - `/flow-work-clean [--dry-run]` — **periodic sweep** of finished work's residue: worktree, local branch, `.claude/work/` folder (intermediate train MR/PRs never set `phase: done`, so the `ship`/`abandon` prompt never fires). Verdict per branch from **the forge** with local fallbacks, including patch-equivalence for **squash merges** (`git branch --merged` misses them); acts only on `merged`/`empty`. `unknown` never a candidate; dirty and unpushed protected; work folders **archived, never deleted**; remote never touched. **`autonomy.mode` does not authorize deletion**: `auto` confirms the list too. `--purge-archive <N>d`: separate opt-in pass over `_archive/`, only folders already committed to git.

package/adapters/hermes/skills/flow-work-handoff/SKILL.md

@@ -0,0 +1,158 @@
+---
+name: flow-work-handoff
+description: "Hand a finished study to whoever builds it elsewhere — push only this work's folder to a branch of its own, then offer a summary for the ticket"
+---
+
+<!-- GENERATED by script/adapter-build.py from plugins/flow/commands/work/handoff.md — do not edit; change the plugin file and run the script. -->
+
+# `/flow-work-handoff`
+
+> **hermes adapter — how the Claude Code primitives named below map here.**
+> - `AskUserQuestion` → ask in plain text with numbered options and wait for the reply.
+> - `Agent <role>` / `Agent general-purpose` / subagents → `delegate_task`, which creates the child on the spot from the `goal` and `context` you give it: the name in `agents.<role>` in `FLOW.md` is a role to state in that prompt, not an agent to declare anywhere; empty → do it in this context.
+> - Parallel fan-out → several `delegate_task` calls in one response, capped at `agents.fanout_max` (empty → 4) and, above that, by `delegation.max_concurrent_children` in `config.yaml` (default 10); `agents.fanout_tool` is Claude Code-only, ignore it.
+> - `ScheduleWakeup` / `Monitor` / `/loop` → Hermes schedules itself: the `cronjob` tool, or `/cron add "every 30m" "<this command>"`. Each firing is a fresh session with no history, so the state still lives in `monitor.md` and the scheduled text must stand alone; retiring the job from inside a firing needs `cron.allow_agent_scheduling: true`.
+> - `TaskCreate` → a markdown checklist in the phase artifact.
+> - `Skill commit-commands:commit-push-pr` → `git add` · `git commit` · `git push -u origin HEAD` · the `git.cli` CLI (`gh pr create` / `glab mr create`).
+> - `/model <value>` → Hermes's own `/model`; a subagent's model is `delegation.model` in `config.yaml`, one value for every child of a round.
+> - `knowledge.*` roles → whatever tools `FLOW.md` names there; an MCP tool keeps its name, its server is declared under `mcp_servers` in `~/.hermes/config.yaml` (see `config.snippet.yaml`).
+> - `$ARGUMENTS` → what the user typed after the skill name: Hermes takes everything from the first non-skill token on as the instruction.
+
+Read `~/.claude/flow/CORE.hermes.md` first (shared rules: `FLOW.md` step 0, autonomy, how a stop reads, the live panel, `00-summary.md`) — skip if you already read it in this session.
+
+**Panel words are closed** — `mark`: `done` · `current` · `pending` · `wait` · `block` · `info`; `style`: `normal` · `dim` · `title` · `accent` · `ok` · `warn` · `error`. Anything else is dropped by the reader in silence: the panel still paints, and nobody is told.
+
+For a study made here and built somewhere else — a server running `/flow-work-run` unattended,
+another person, another machine. The builder gets the work folder at the same path and nothing
+else: no conversation, maybe a less capable model. So this command checks the study can stand on
+its own, pushes the folder to a branch that holds only it, and offers to put a summary in the
+ticket for the people who review it.
+
+## 1. Pre-flight
+
+- Effective FLOW configuration per flow-core §0. `autonomy.mode: unattended` → refuse in one line:
+  an unattended run never pushes (flow-core §2.1); handing off is a person's step.
+- Locate the active `meta.json` by current branch; not found → ask the user for the ticket.
+- `git.handoff_branch` empty → refuse, naming the key and an example
+  (`git.handoff_branch: study/{TICKET}`): where the study goes is the receiver's convention, never
+  flow's guess. `{TICKET}` = `meta.json.ticket`.
+- `origin` not configured → refuse; there is nowhere to push.
+
+## 2. Is the study finished?
+
+The builder can ask no one. Refuse — pushing nothing, naming every reason that holds — when:
+
+- **The study's last phase is not in `phases_done`.** A feature: `context` on XS (what `start`
+  records), `design` on S, `plan` on M/L. A bug: `context` on XS, `investigate` otherwise.
+- **`meta.json.pending` is set** — a question is still waiting for its answer.
+- **A clarification is still open** — a question under "Decisions clarified at start" in
+  `01-context.md` recorded without its answer.
+
+Then, **before anything is pushed**: decisions this session settled while talking that no artifact
+records yet → write them where they belong now (`01-context.md` "Decisions clarified at start",
+`03-design.md` "Decisions (ADR-light)", `04-mr-plan.md`), and say which. What was decided only in
+the chat does not travel.
+
+## 3. Build the commit, without touching the checkout
+
+A throwaway index holds only this folder, so the current branch, `HEAD`, the real index (staged
+work included) and the working tree are never read into it nor written to, and a git-ignored
+`.claude/work/` is no obstacle.
+
+**Each block below is one shell call, run as it stands** — a harness need not keep variables from
+one call to the next, so every block sets its own. Replace each `@…@` with its literal value first:
+`@WORK@` the work folder relative to the repository root (`.claude/work/<work-dir>`, no trailing
+slash), `@BRANCH@` the resolved `git.handoff_branch`, `@TICKET@` `meta.json.ticket`, `@COMMIT@` the
+sha the build block printed. A value holding a `'` cannot go inside those quotes: refuse it and
+say which.
+
+First, the branch must not exist on `origin` — a second push would need a force, and this command
+never forces:
+
+```bash handoff-check
+BRANCH='@BRANCH@'
+git ls-remote --exit-code origin "refs/heads/$BRANCH" >/dev/null; echo "rc=$?"
+```
+
+`rc=0` → the branch exists: refuse, and say what the person does next — delete it on the forge
+(only when nothing still reads it), or set another name in `git.handoff_branch`. `rc=2` → absent,
+continue. Anything else → stop and say why (no network, no access). Then build the commit:
+
+```bash handoff-build
+WORK='@WORK@'; TICKET='@TICKET@'
+cd "$(git rev-parse --show-toplevel)" || exit 1
+[ -d "$WORK" ] || { echo "no such folder: $WORK"; exit 1; }
+tmp=$(mktemp -d) || exit 1
+idx="$tmp/index"   # does not exist yet: git starts an empty index there
+GIT_INDEX_FILE="$idx" git add -f -- "$WORK" ":(exclude)$WORK/panel.json" &&
+  files=$(GIT_INDEX_FILE="$idx" git ls-files) &&
+  tree=$(GIT_INDEX_FILE="$idx" git write-tree) &&
+  commit=$(git commit-tree "$tree" -m "study $TICKET")
+rc=$?; rm -rf "$tmp"
+[ "$rc" -eq 0 ] && [ -n "$files" ] || { echo "nothing was built (rc=$rc)"; exit 1; }
+printf '%s\n' "$files"; echo "commit=$commit"
+```
+
+`GIT_INDEX_FILE` is set per command, never exported, so a failure leaves no session pointing git
+at a deleted index. `panel.json` stays out: it is this machine's terminal panel, and on another one
+it would show this session's last state as if it were theirs. The block failing → its message, and
+stop: `commit-tree` with no git identity configured is the usual cause.
+
+## 4. Confirm, then push
+
+Show the branch, the remote and the file list the build printed — every path, one per line — then
+ask with `AskUserQuestion` **in every `autonomy.mode`**: a push leaves the machine (flow-core §2).
+**Push** · **Cancel**. Nothing between the list and the question (flow-core §3).
+
+```bash handoff-push
+BRANCH='@BRANCH@'; COMMIT='@COMMIT@'
+case "$COMMIT" in ''|*[!0-9a-f]*) echo "not a commit sha: $COMMIT"; exit 1 ;; esac
+git cat-file -e "$COMMIT^{commit}" || exit 1
+git push origin "$COMMIT:refs/heads/$BRANCH"
+```
+
+The sha is checked first because `git push origin :refs/heads/<branch>` — an empty source —
+deletes the branch on the remote. A rejected push → its message, verbatim, and stop. Never retried
+with `--force`.
+
+## 5. The ticket summary (offer)
+
+Only after a successful push, and only in ticket mode with a real tracker id. The people reviewing
+the ticket read it there, never in the work folder; the receiver does not parse it.
+
+- **Read the body back** — the summary goes inside the ticket's own text, never over it:
+  `gh` → `gh issue view {TICKET} --json body -q .body` · `glab` → `glab issue view {TICKET} -F json`,
+  its `description`. Any other tracker → the offer is not made: one line saying flow cannot read that
+  body back to keep its text.
+- **The write command** — `tracker.edit_cmd`, `{TICKET}` and `{BODY_FILE}` substituted. Empty →
+  `gh issue edit {TICKET} --body-file {BODY_FILE}` for `gh`,
+  `glab issue update {TICKET} --description-file {BODY_FILE}` for `glab`.
+- **The block**, short, in the language of the ticket. A feature takes it from `01-context.md`,
+  `03-design.md` and `04-mr-plan.md`; a bug from `01-context.md` and `03-investigation.md` — the
+  expected behaviour as its criteria, the root cause and the intended fix as its design, "Areas with
+  similar risk" as its risks. A section whose source does not exist (an XS study, an S feature with
+  no plan) says `none`:
+
+  ```
+  <!-- flow-study -->
+  ## What and why
+  ## Acceptance criteria
+  ## Design in brief
+  ## MR/PR plan
+  ## Risks
+  <!-- end flow-study -->
+  ```
+
+  Criteria keep their literal values. The plan lists each MR/PR with what it covers and what it
+  waits on; a bug's plan is its single fix.
+- **The new body**: the body read above with the block between the two markers replaced — or, with
+  no markers yet, the block appended after a blank line. Written to a `mktemp` file outside the
+  tree — `{BODY_FILE}` — so nothing of it can be committed later.
+- **Show the block and ask** with `AskUserQuestion`, **in every mode**: it writes to a shared
+  tracker. **Write it** · **Skip**. Failure → its message in one line; the push stands.
+
+## 6. Close
+
+Report following flow-core §3: the branch and the commit, the file count, whether the ticket
+summary was written. Refresh the panel: a `Now` line saying the study was handed off, no `Decision`
+line. `meta.json` gains nothing — the branch on `origin` is the record, and the §3 refusal reads it.

package/adapters/opencode/CORE.md

@@ -16,7 +16,7 @@ Every `/flow-*` command assumes these rules. They are stated once, here, so a co
 carries what is specific to its phase. Read this once per session; a command that says "load
 `flow-core`" means this file.
 
-**This file belongs to flow `0.86.0`.** Compare it once, at the start of the session, against
+**This file belongs to flow `0.87.0`.** Compare it once, at the start of the session, against
 `version` in `~/.claude/flow/.claude-plugin/plugin.json`. The two differing means the session
 is running a **mixture** — the commands from one copy of the plugin, these shared rules from another
 — which is exactly what happens when a branch or a release candidate is loaded over an installed

package/adapters/opencode/commands/flow-work-README.md

@@ -247,6 +247,7 @@ Two signals arrive on an open MR/PR, each with its own cross-cutting loop (feat
 - `/flow-work-daily [question]` — the **work assistant** (daily standup), read-only. **Local** (`.claude/work/` + git) + **forge** (open MRs/PRs, reviews awaiting you, red CI, unmergeable, unresolved threads via `git.cli`) + **tracker** (assigned tickets, priority changes via `tracker.tool`); where they cross, concrete commands (`/flow-feat-start`, `/flow-work-green`, `/flow-work-respond`). No argument → *yesterday · today · blockers*; a question → just that. External sources best-effort, never blocking; the only write is a "last seen" marker, like `/flow-news`.
 - `/flow-work-status` — all works in `.claude/work/`, current phase, divergence with git.
 - `/flow-work-run [ticket]` — the **entry an orchestrator launches** for an `unattended` run: asks it `why` (start · answer · merged · review · pipeline), routes to the phase that answers it, and makes no decision of its own. Refuses to run in any other mode.
+- `/flow-work-handoff` — hands a **finished study** to whoever builds it elsewhere (an unattended server, another machine): refuses an unfinished one, pushes only this work's folder as a parentless commit to `git.handoff_branch` without touching the checkout, asks before the push, then offers a marked summary for the ticket body (`tracker.edit_cmd`).
 - `/flow-work-resume` — detects the branch, reads `meta.json`, recaps, suggests the next step. **Re-reads the ticket's comment thread** (§2.5), reports only what is new since `01-context.md`, appends it to the artifact; never amends the design on its own.
 - `/flow-work-try <branch>` / `/flow-work-try --back` — point the main checkout at a branch to test it here, then return; re-syncs per `git.worktree_resync`. Resolves the work behind the branch and, once the environment is up, **prints the manual test plan already written** (the `needs-manual`/`unproven` criteria, or the acceptance criteria when `validate` has not run) and offers to collect Pass/Fail/Blocked into the validation artifact. No work behind the branch → the plain switch, as before.
 - `/flow-work-clean [--dry-run]` — **periodic sweep** of finished work's residue: worktree, local branch, `.claude/work/` folder (intermediate train MR/PRs never set `phase: done`, so the `ship`/`abandon` prompt never fires). Verdict per branch from **the forge** with local fallbacks, including patch-equivalence for **squash merges** (`git branch --merged` misses them); acts only on `merged`/`empty`. `unknown` never a candidate; dirty and unpushed protected; work folders **archived, never deleted**; remote never touched. **`autonomy.mode` does not authorize deletion**: `auto` confirms the list too. `--purge-archive <N>d`: separate opt-in pass over `_archive/`, only folders already committed to git.

package/adapters/opencode/commands/flow-work-handoff.md

@@ -0,0 +1,156 @@
+---
+description: Hand a finished study to whoever builds it elsewhere — push only this work's folder to a branch of its own, then offer a summary for the ticket
+---
+
+<!-- GENERATED by script/adapter-build.py from plugins/flow/commands/work/handoff.md — do not edit; change the plugin file and run the script. -->
+
+# `/flow-work-handoff`
+
+> **opencode adapter — how the Claude Code primitives named below map here.**
+> - `AskUserQuestion` → ask in plain text with numbered options and wait for the reply.
+> - `Agent <role>` / `Agent general-purpose` / subagents → `@<name>` declared in `agents/<name>.md` (`mode: subagent`); the name comes from `agents.<role>` in `FLOW.md`, empty → do it in this context.
+> - Parallel fan-out → several `@name` in one prompt, capped at `agents.fanout_max` (empty → 4); `agents.fanout_tool` is Claude Code-only, ignore it.
+> - `ScheduleWakeup` / `Monitor` / `/loop` → not available in-session: run one cycle, persist state in `monitor.md`, let the user schedule `opencode run -p "<command>"` with cron.
+> - `TaskCreate` → a markdown checklist in the phase artifact.
+> - `Skill commit-commands:commit-push-pr` → `git add` · `git commit` · `git push -u origin HEAD` · the `git.cli` CLI (`gh pr create` / `glab mr create`).
+> - `/model <value>` → opencode's model picker (`/models`).
+> - `knowledge.*` roles → whatever tools `FLOW.md` names there; an MCP tool keeps its name, its server is declared in `opencode.json` (see this adapter's `opencode.json` for the domain-memory example).
+
+Read `~/.claude/flow/CORE.opencode.md` first (shared rules: `FLOW.md` step 0, autonomy, how a stop reads, the live panel, `00-summary.md`) — skip if you already read it in this session.
+
+**Panel words are closed** — `mark`: `done` · `current` · `pending` · `wait` · `block` · `info`; `style`: `normal` · `dim` · `title` · `accent` · `ok` · `warn` · `error`. Anything else is dropped by the reader in silence: the panel still paints, and nobody is told.
+
+For a study made here and built somewhere else — a server running `/flow-work-run` unattended,
+another person, another machine. The builder gets the work folder at the same path and nothing
+else: no conversation, maybe a less capable model. So this command checks the study can stand on
+its own, pushes the folder to a branch that holds only it, and offers to put a summary in the
+ticket for the people who review it.
+
+## 1. Pre-flight
+
+- Effective FLOW configuration per flow-core §0. `autonomy.mode: unattended` → refuse in one line:
+  an unattended run never pushes (flow-core §2.1); handing off is a person's step.
+- Locate the active `meta.json` by current branch; not found → ask the user for the ticket.
+- `git.handoff_branch` empty → refuse, naming the key and an example
+  (`git.handoff_branch: study/{TICKET}`): where the study goes is the receiver's convention, never
+  flow's guess. `{TICKET}` = `meta.json.ticket`.
+- `origin` not configured → refuse; there is nowhere to push.
+
+## 2. Is the study finished?
+
+The builder can ask no one. Refuse — pushing nothing, naming every reason that holds — when:
+
+- **The study's last phase is not in `phases_done`.** A feature: `context` on XS (what `start`
+  records), `design` on S, `plan` on M/L. A bug: `context` on XS, `investigate` otherwise.
+- **`meta.json.pending` is set** — a question is still waiting for its answer.
+- **A clarification is still open** — a question under "Decisions clarified at start" in
+  `01-context.md` recorded without its answer.
+
+Then, **before anything is pushed**: decisions this session settled while talking that no artifact
+records yet → write them where they belong now (`01-context.md` "Decisions clarified at start",
+`03-design.md` "Decisions (ADR-light)", `04-mr-plan.md`), and say which. What was decided only in
+the chat does not travel.
+
+## 3. Build the commit, without touching the checkout
+
+A throwaway index holds only this folder, so the current branch, `HEAD`, the real index (staged
+work included) and the working tree are never read into it nor written to, and a git-ignored
+`.claude/work/` is no obstacle.
+
+**Each block below is one shell call, run as it stands** — a harness need not keep variables from
+one call to the next, so every block sets its own. Replace each `@…@` with its literal value first:
+`@WORK@` the work folder relative to the repository root (`.claude/work/<work-dir>`, no trailing
+slash), `@BRANCH@` the resolved `git.handoff_branch`, `@TICKET@` `meta.json.ticket`, `@COMMIT@` the
+sha the build block printed. A value holding a `'` cannot go inside those quotes: refuse it and
+say which.
+
+First, the branch must not exist on `origin` — a second push would need a force, and this command
+never forces:
+
+```bash handoff-check
+BRANCH='@BRANCH@'
+git ls-remote --exit-code origin "refs/heads/$BRANCH" >/dev/null; echo "rc=$?"
+```
+
+`rc=0` → the branch exists: refuse, and say what the person does next — delete it on the forge
+(only when nothing still reads it), or set another name in `git.handoff_branch`. `rc=2` → absent,
+continue. Anything else → stop and say why (no network, no access). Then build the commit:
+
+```bash handoff-build
+WORK='@WORK@'; TICKET='@TICKET@'
+cd "$(git rev-parse --show-toplevel)" || exit 1
+[ -d "$WORK" ] || { echo "no such folder: $WORK"; exit 1; }
+tmp=$(mktemp -d) || exit 1
+idx="$tmp/index"   # does not exist yet: git starts an empty index there
+GIT_INDEX_FILE="$idx" git add -f -- "$WORK" ":(exclude)$WORK/panel.json" &&
+  files=$(GIT_INDEX_FILE="$idx" git ls-files) &&
+  tree=$(GIT_INDEX_FILE="$idx" git write-tree) &&
+  commit=$(git commit-tree "$tree" -m "study $TICKET")
+rc=$?; rm -rf "$tmp"
+[ "$rc" -eq 0 ] && [ -n "$files" ] || { echo "nothing was built (rc=$rc)"; exit 1; }
+printf '%s\n' "$files"; echo "commit=$commit"
+```
+
+`GIT_INDEX_FILE` is set per command, never exported, so a failure leaves no session pointing git
+at a deleted index. `panel.json` stays out: it is this machine's terminal panel, and on another one
+it would show this session's last state as if it were theirs. The block failing → its message, and
+stop: `commit-tree` with no git identity configured is the usual cause.
+
+## 4. Confirm, then push
+
+Show the branch, the remote and the file list the build printed — every path, one per line — then
+ask with `AskUserQuestion` **in every `autonomy.mode`**: a push leaves the machine (flow-core §2).
+**Push** · **Cancel**. Nothing between the list and the question (flow-core §3).
+
+```bash handoff-push
+BRANCH='@BRANCH@'; COMMIT='@COMMIT@'
+case "$COMMIT" in ''|*[!0-9a-f]*) echo "not a commit sha: $COMMIT"; exit 1 ;; esac
+git cat-file -e "$COMMIT^{commit}" || exit 1
+git push origin "$COMMIT:refs/heads/$BRANCH"
+```
+
+The sha is checked first because `git push origin :refs/heads/<branch>` — an empty source —
+deletes the branch on the remote. A rejected push → its message, verbatim, and stop. Never retried
+with `--force`.
+
+## 5. The ticket summary (offer)
+
+Only after a successful push, and only in ticket mode with a real tracker id. The people reviewing
+the ticket read it there, never in the work folder; the receiver does not parse it.
+
+- **Read the body back** — the summary goes inside the ticket's own text, never over it:
+  `gh` → `gh issue view {TICKET} --json body -q .body` · `glab` → `glab issue view {TICKET} -F json`,
+  its `description`. Any other tracker → the offer is not made: one line saying flow cannot read that
+  body back to keep its text.
+- **The write command** — `tracker.edit_cmd`, `{TICKET}` and `{BODY_FILE}` substituted. Empty →
+  `gh issue edit {TICKET} --body-file {BODY_FILE}` for `gh`,
+  `glab issue update {TICKET} --description-file {BODY_FILE}` for `glab`.
+- **The block**, short, in the language of the ticket. A feature takes it from `01-context.md`,
+  `03-design.md` and `04-mr-plan.md`; a bug from `01-context.md` and `03-investigation.md` — the
+  expected behaviour as its criteria, the root cause and the intended fix as its design, "Areas with
+  similar risk" as its risks. A section whose source does not exist (an XS study, an S feature with
+  no plan) says `none`:
+
+  ```
+  <!-- flow-study -->
+  ## What and why
+  ## Acceptance criteria
+  ## Design in brief
+  ## MR/PR plan
+  ## Risks
+  <!-- end flow-study -->
+  ```
+
+  Criteria keep their literal values. The plan lists each MR/PR with what it covers and what it
+  waits on; a bug's plan is its single fix.
+- **The new body**: the body read above with the block between the two markers replaced — or, with
+  no markers yet, the block appended after a blank line. Written to a `mktemp` file outside the
+  tree — `{BODY_FILE}` — so nothing of it can be committed later.
+- **Show the block and ask** with `AskUserQuestion`, **in every mode**: it writes to a shared
+  tracker. **Write it** · **Skip**. Failure → its message in one line; the push stands.
+
+## 6. Close
+
+Report following flow-core §3: the branch and the commit, the file count, whether the ticket
+summary was written. Refresh the panel: a `Now` line saying the study was handed off, no `Decision`
+line. `meta.json` gains nothing — the branch on `origin` is the record, and the §3 refusal reads it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flow-workflows",
-  "version": "0.86.0",
+  "version": "0.87.0",
   "description": "Guided feat/bug workflows (start→ship), post-deploy monitoring and multi-agent code review, stack-agnostic. Each repo uses a shared FLOW.md plus optional harness overlay.",
   "type": "module",
   "bin": {

package/plugins/flow/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "flow",
   "displayName": "Flow — guided dev workflows",
   "description": "Guided feat/bug workflows (start→ship), post-deploy monitoring and multi-agent code review, stack-agnostic. Each repo uses a shared FLOW.md plus optional harness overlay.",
-  "version": "0.86.0",
+  "version": "0.87.0",
   "author": {
     "name": "Alberto Vioque",
     "email": "mashware@gmail.com"

package/plugins/flow/CHANGELOG.md

@@ -5,6 +5,22 @@ plugin and is what `/flow:news` reads to show you what changed since your previo
 
 The canonical, richest notes live in the [GitHub Releases](https://github.com/mashware/flow-workflows/releases).
 
+## v0.87.0 — A finished study is handed off from the laptop, and summarised in its ticket  ·  2026-10-01
+
+**In short**
+- **`/flow:work:handoff` hands a study to whoever builds it elsewhere.** It pushes this work's
+  folder, and nothing else, as a commit with no history to the branch `git.handoff_branch` names
+  (e.g. `study/{TICKET}`). Your current branch, staged changes and other works are never touched,
+  even when `.claude/work/` is git-ignored.
+- **It refuses a study that cannot stand on its own** — its design or plan not closed, a question
+  pending, a clarification open — and writes down first what this session decided but no file says.
+- **It asks before the push, and never forces**: a branch that already exists is refused, with what
+  to do next.
+- **A summary for the ticket**, offered after the push: what and why, criteria, design in brief,
+  MR/PR plan and risks, in a marked block that keeps the ticket's own text and is replaced on a
+  second run. GitHub and GitLab out of the box; new key `tracker.edit_cmd`.
+- Completes #186.
+
 ## v0.86.0 — An unattended run builds a study made on another machine  ·  2026-10-01
 
 **In short**

package/plugins/flow/examples/FLOW.template.md

@@ -48,6 +48,7 @@ How tickets are identified and read.
                       # they are asked before running in `autonomy.mode: manual` and run automatically in `guided`/`auto`;
                       # a failure or an already-in-state ticket warns and continues, never blocks. They run only in
                       # ticket mode with a real tracker id (skipped for ticket-less / local-only works).
+- `edit_cmd:`         # optional, rewrites a ticket's BODY from a file: `/flow:work:handoff` writes its study summary with it. `{TICKET}` and `{BODY_FILE}` substituted. Empty = derived for `gh` (`gh issue edit {TICKET} --body-file {BODY_FILE}`) and `glab` (`glab issue update {TICKET} --description-file {BODY_FILE}`); other trackers get no summary — flow cannot read their body back to keep its text.
 - `followup_ask_max:` # how many parked findings one finished work may turn into questions at `ship`'s Close (flow-core §7). Empty = 2. `0` = never ask, log everything. A ticket where
                       #   seven phases each notice something is not seven problems: with 3+ candidates a skeptic tries to refute each one (burden of proof on the finding), the ones
                       #   without a named subject are dropped, and only the strongest survivors up to this number are put to you. Raise it if you would rather triage than be handed a log.
@@ -86,6 +87,8 @@ Branch and Pull/Merge Request conventions.
                       #   - make database-update
                       #   - make frontend
 
+- `handoff_branch:`   # branch `/flow:work:handoff` pushes a finished study to, holding only that work's folder. `{TICKET}` substituted. Empty = the command refuses: where a study goes is the receiver's convention. e.g. `study/{TICKET}`.
+
 ## autonomy
 How much the flow advances on its own vs. stopping to ask you.