haiku-method 2.2.0

package/studios/security-assessment/stages/reconnaissance/hats/verifier.md

@@ -0,0 +1,27 @@
+**Focus:** Validate the per-unit knowledge artifact for the reconnaissance stage of security-assessment. Units here are recon finding — knowledge artifacts that downstream stages consume. Validation rules check substance, citation, internal consistency, and decision-register accountability. NOT executable verify-commands or DAG validity (workflow engine/build-stage concerns).
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** read or interpret unit frontmatter for any mechanical purpose. workflow engine territory per architecture §1.1.
+- The agent **MUST NOT** validate against frontmatter schema, `depends_on:` resolution, status-field shape, or any other FM-driven check — those are workflow engine responsibilities.
+- The agent **MUST NOT** advance a unit whose body is a placeholder, contains TODO markers, or has empty sections.
+- The agent **MUST NOT** reject for stylistic preferences. Substantive gaps only.
+- The agent **MUST** name a specific failed criterion in any rejection.
+- The agent **MUST NOT** invent rules not in this mandate. Stage scope is the contract.
+- The agent **MUST** flag any case where the stage's hat chain is adversarial-only (no plan-do-verify front loop) — this is an architecture §3.5 violation. Per architecture §3.5 the plan-do-verify triplet MUST come BEFORE adversarial hats. The fix is a stage-structure restructure (separate item); this verifier hat is the minimum patch to give the chain a terminal validator.
+
+## What you check (BODY ONLY)
+
+### 1. Artifact answers its topic
+The unit's title and first paragraph define the topic. The remaining body MUST deliver substantive content on that topic. Reject placeholders, content-free outlines, or redirects.
+
+### 2. Sources cited
+Non-trivial claims (numbers, market signals, system behavior, stakeholder positions) MUST cite specific sources — URL, doc path, dated stakeholder conversation, named standard. Reject "industry common knowledge" or unsourced numerical claims.
+
+### 3. Internal consistency
+Title, mission, and body must align. Numerical/categorical claims must be consistent across the body. Recommendations must follow from the evidence presented.
+
+### 4. Decision-register consistency
+The unit must not propose, default to, or assume an option that contradicts a recorded Decision. Cite the Decision ID in any rejection.
+
+### 5. Open questions accounted for
+Every "Open Questions" entry must be answered, defaulted with veto-style approval, OR flagged `(needs human escalation)`.

package/studios/security-assessment/stages/reconnaissance/outputs/TARGET-PROFILE.md

@@ -0,0 +1,25 @@
+---
+name: target-profile
+location: .haiku/intents/{intent-slug}/stages/reconnaissance/artifacts/
+scope: intent
+format: text
+required: true
+---
+
+# Target Profile
+
+Synthesized reconnaissance findings with asset catalog and attack surface map.
+
+## Expected Artifacts
+
+- **Asset catalog** -- discovered assets with technology fingerprints, version info, and confidence ratings
+- **Network topology** -- documented infrastructure layout and ingress points
+- **OSINT findings** -- DNS records, WHOIS data, and publicly indexed endpoints with timestamps
+- **Attack surface overview** -- high-level map with areas of interest flagged for enumeration
+
+## Quality Signals
+
+- All discovered assets are cataloged with technology fingerprints
+- Network topology is documented with ingress points identified
+- OSINT findings are timestamped and sourced
+- At least 5 external-facing services are identified with technology stack

package/studios/security-assessment/stages/reconnaissance/phases/ELABORATION.md

@@ -0,0 +1,16 @@
+# Reconnaissance Stage — Elaboration
+
+## Criteria Guidance
+
+### Good criteria — concrete and verifiable
+
+- "Target profile documents at least 5 external-facing services with technology stack identified for each"
+- "OSINT findings include DNS records, WHOIS data, and publicly indexed endpoints with timestamps"
+- "Network map identifies all in-scope IP ranges, subdomains, and ingress points with confidence ratings"
+
+### Bad criteria — vague (no clear check)
+
+- "Recon is complete"
+- "Target information gathered"
+- "Network has been mapped"
+

package/studios/security-assessment/stages/reconnaissance/review-agents/coverage.md

@@ -0,0 +1,10 @@
+---
+interpretation: lens
+---
+**Mandate:** The agent **MUST** verify reconnaissance covered the full target surface.
+
+**Check:**
+- The agent **MUST** verify that all in-scope domains, IPs, and services are enumerated
+- The agent **MUST** verify that both passive and active reconnaissance techniques were applied
+- The agent **MUST** verify that discovered assets are categorized by technology stack and exposure level
+- The agent **MUST** verify that no obvious blind spots (cloud assets, CDN-fronted services, API endpoints)

package/studios/security-assessment/stages/reporting/STAGE.md

@@ -0,0 +1,15 @@
+---
+name: reporting
+description: Formal findings report with severity ratings, reproduction steps, remediation guidance, and executive summary
+hats: [report-writer, remediation-advisor, verifier]
+fix_hats: [report-writer, feedback-assessor]
+review: external
+elaboration: autonomous
+inputs:
+  - stage: post-exploitation
+    discovery: impact-assessment
+---
+
+# Reporting
+
+Formal findings report with severity ratings, reproduction steps, remediation guidance, and executive summary.

package/studios/security-assessment/stages/reporting/hats/feedback-assessor.md

@@ -0,0 +1,11 @@
+---
+agent_type: general-purpose
+model: haiku
+---
+**Focus:** Independently verify that a fix addresses the feedback finding as written. You are the terminal hat in this stage's fix-hat sequence — the workflow engine trusts your closure decision.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** edit any file — you are a verifier, not a fixer
+- The agent **MUST NOT** close a finding that isn't actually resolved — that is how drift hides
+- The agent **MUST NOT** reject a finding because "it's not worth fixing" — that is the human's decision, not yours; either close when resolved, leave open when not, or reject when genuinely invalid
+- The agent **MUST NOT** expand the scope beyond the one feedback item you were dispatched against

package/studios/security-assessment/stages/reporting/hats/remediation-advisor.md

@@ -0,0 +1,9 @@
+**Focus:** Develop actionable remediation guidance for each finding. Prioritize fixes by risk-reduction impact, provide both immediate mitigations and long-term strategic improvements, and consider the organization's operational constraints when recommending solutions.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** recommend "patch everything" without prioritization or specificity
+- The agent **MUST NOT** ignore operational constraints that make certain remediations impractical
+- The agent **MUST NOT** provide only strategic recommendations without actionable immediate steps
+- The agent **MUST** include verification steps to confirm remediation effectiveness
+- The agent **MUST NOT** recommend solutions that introduce new security risks
+- The agent **MUST NOT** fail to consider the dependencies between findings when prioritizing fixes

package/studios/security-assessment/stages/reporting/hats/report-writer.md

@@ -0,0 +1,9 @@
+**Focus:** Compile all findings into a structured, professional security assessment report. Write for multiple audiences: executive summary for leadership, technical findings for engineering, and reproduction steps for validation teams. Ensure every claim is backed by evidence from earlier stages.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** include reproduction steps detailed enough for malicious use without proper classification
+- The agent **MUST NOT** omit findings because they seem minor — all findings belong in the report
+- The agent **MUST NOT** write technical jargon in the executive summary
+- The agent **MUST** include evidence artifacts (screenshots, logs, hashes) for each finding
+- The agent **MUST NOT** fail to document the methodology and tools used throughout the assessment
+- The agent **MUST NOT** report unverified scanner output as confirmed findings

package/studios/security-assessment/stages/reporting/hats/verifier.md

@@ -0,0 +1,27 @@
+**Focus:** Validate the per-unit operational artifact for the reporting stage of security-assessment. Units here are report section — operational steps with concrete preconditions, actions, and post-condition checks. Validation rules check that preconditions are stated, the action is unambiguous, the post-condition has a verifiable check, and rollback is named where applicable.
+
+**Anti-patterns (RFC 2119):**
+- The agent **MUST NOT** read or interpret unit frontmatter for any mechanical purpose. workflow engine territory per architecture §1.1.
+- The agent **MUST NOT** validate against frontmatter schema, `depends_on:` resolution, status-field shape, or any other FM-driven check — those are workflow engine responsibilities.
+- The agent **MUST NOT** advance a unit whose body is a placeholder, contains TODO markers, or has empty sections.
+- The agent **MUST NOT** reject for stylistic preferences. Substantive gaps only.
+- The agent **MUST** name a specific failed criterion in any rejection.
+- The agent **MUST NOT** invent rules not in this mandate. Stage scope is the contract.
+- The agent **MUST** flag any case where the stage's hat chain is adversarial-only (no plan-do-verify front loop) — this is an architecture §3.5 violation. Per architecture §3.5 the plan-do-verify triplet MUST come BEFORE adversarial hats. The fix is a stage-structure restructure (separate item); this verifier hat is the minimum patch to give the chain a terminal validator.
+
+## What you check (BODY ONLY)
+
+### 1. Preconditions, action, post-condition all stated
+The unit body MUST have three concrete sections: preconditions (what must be true before the action runs), the action itself (one unambiguous procedure), and post-condition checks (how to confirm the action succeeded). Reject if any of the three is missing or vague.
+
+### 2. Verifiable post-condition
+The post-condition section MUST name a check that produces a clear pass/fail signal — a metric to read, a query to run, a screen to inspect with named expected values. "Verify by eye that things look good" is a reject.
+
+### 3. Rollback / recovery named where applicable
+Operational units MUST declare a rollback procedure OR explicitly state "no rollback — forward-fix only" with a rationale. Silent absence of rollback is a reject for any unit whose action is not idempotent.
+
+### 4. Decision-register consistency
+The unit must not propose an operational approach contradicting a recorded Decision (e.g., blue-green deploy when Decision N chose canary). Cite the Decision ID.
+
+### 5. Open questions accounted for
+Every "Open Questions" entry must be answered, defaulted, OR flagged `(needs human escalation)`. Operational open questions left to runtime are how outages happen.

package/studios/security-assessment/stages/reporting/outputs/FINDINGS-REPORT.md

@@ -0,0 +1,25 @@
+---
+name: findings-report
+location: .haiku/intents/{intent-slug}/stages/reporting/artifacts/
+scope: intent
+format: text
+required: true
+---
+
+# Findings Report
+
+Formal security assessment report with severity ratings, reproduction steps, and remediation plan.
+
+## Expected Artifacts
+
+- **Executive summary** -- overall risk posture in business terms for non-technical stakeholders
+- **Technical findings** -- each with severity (CVSS), affected asset, reproduction steps, and evidence
+- **Remediation plan** -- prioritized by risk-reduction impact with quick wins and strategic improvements
+- **Remediation guidance** -- specific fix recommendations per finding with ownership suggestions
+
+## Quality Signals
+
+- Each finding has severity rating, reproduction steps, evidence, and remediation guidance
+- Executive summary communicates risk in business terms
+- Remediation plan is prioritized by impact with clear ownership suggestions
+- Report is reviewed for accuracy and appropriate classification of sensitive details

package/studios/security-assessment/stages/reporting/phases/ELABORATION.md

@@ -0,0 +1,16 @@
+# Reporting Stage — Elaboration
+
+## Criteria Guidance
+
+### Good criteria — concrete and verifiable
+
+- "Each finding includes severity rating (CVSS), affected asset, reproduction steps, evidence artifacts, and specific remediation guidance"
+- "Executive summary communicates overall risk posture in business terms understandable by non-technical stakeholders"
+- "Remediation plan prioritizes fixes by risk-reduction impact and includes both quick wins and strategic improvements"
+
+### Bad criteria — vague (no clear check)
+
+- "Report is written"
+- "Findings are documented"
+- "Remediation is suggested"
+

package/studios/security-assessment/stages/reporting/review-agents/remediation-quality.md

@@ -0,0 +1,10 @@
+---
+interpretation: lens
+---
+**Mandate:** The agent **MUST** verify findings are actionable and remediation guidance is specific.
+
+**Check:**
+- The agent **MUST** verify that each finding has clear reproduction steps
+- The agent **MUST** verify that remediation recommendations are specific to the technology in use, not generic
+- The agent **MUST** verify that severity ratings follow an established framework (CVSS, DREAD, or engagement-specific)
+- The agent **MUST** verify that executive summary accurately conveys business risk without minimizing or sensationalizing

package/studios/software/STUDIO.md

@@ -0,0 +1,19 @@
+---
+name: application-development
+slug: appdev
+aliases: [software]
+description: Lifecycle for web, mobile, and desktop applications
+stages: [inception, design, product, development, operations, security]
+category: engineering
+default_model: sonnet
+---
+
+# Application Development
+
+Lifecycle for user-facing applications — web, mobile, desktop, and services.
+Covers product discovery, UX design, implementation, operations, and security
+review. For libraries, SDKs, and CLI tools, use `libdev`. For games, use
+`gamedev`. For hardware products, use `hwdev`.
+
+Supports both single-stage (all disciplines merged) and multi-stage
+(sequential discipline progression) execution modes.

package/studios/software/examples/add-oauth-login/intent.md

@@ -0,0 +1,22 @@
+---
+title: add-oauth-login
+studio: software
+stages: [inception, design, product, development, operations, security]
+status: complete
+created: "2025-03-15T10:24:00Z"
+completed: "2025-03-15T14:52:00Z"
+---
+
+# Add OAuth Login
+
+Add OAuth-based authentication to the application, supporting Google and GitHub as identity providers. Replace the existing email/password-only login with a full-page login screen featuring social sign-in buttons, a forgot-password link, and proper session management.
+
+## Goals
+
+- Support Google and GitHub OAuth 2.0 flows
+- Abstract provider integration so adding Apple later is trivial
+- Full-page login with responsive design (mobile, tablet, desktop)
+- Secure session management with httpOnly cookies
+- Rate limiting on callback endpoints (100 req/min)
+- Vault-based secret management for OAuth credentials
+- STRIDE threat model with no unaddressed critical/high findings

package/studios/software/examples/add-oauth-login/knowledge/DISCOVERY.md

@@ -0,0 +1,71 @@
+# Discovery: OAuth Login
+
+## Domain Model
+
+### Entities
+
+- **User** — application user account, linked to one or more OAuth identities
+- **OAuthIdentity** — provider-specific identity (provider, provider_user_id, email, profile_data)
+- **Session** — authenticated session with access/refresh token pair
+- **OAuthProvider** — abstraction over Google/GitHub/future providers
+
+### Relationships
+
+```
+User 1--* OAuthIdentity
+User 1--* Session
+OAuthProvider 1--* OAuthIdentity
+```
+
+## Technical Landscape
+
+### Current State
+
+- Express.js backend (v4.18) with TypeScript
+- React 18 frontend with Vite bundler
+- PostgreSQL 15 with Prisma ORM
+- Existing email/password auth via bcrypt + JWT
+- Kubernetes deployment with Helm charts
+- HashiCorp Vault for secrets (migrating from K8s secrets)
+
+### OAuth Provider Analysis
+
+#### Google
+
+- Authorization endpoint: `https://accounts.google.com/o/oauth2/v2/auth`
+- Token endpoint: `https://oauth2.googleapis.com/token`
+- Supports PKCE (code_verifier/code_challenge)
+- Server-side code exchange with client_secret
+- Returns id_token with email, name, picture
+- Scopes needed: `openid email profile`
+
+#### GitHub
+
+- Authorization endpoint: `https://github.com/login/oauth/authorize`
+- Token endpoint: `https://github.com/login/oauth/access_token`
+- Does NOT support PKCE — relies on state parameter + client_secret
+- Separate API call needed for user profile (`/user` endpoint)
+- Separate API call needed for email (`/user/emails` endpoint)
+- Scopes needed: `user:email read:user`
+
+### Provider Abstraction
+
+Interface designed to normalize differences:
+
+```typescript
+interface OAuthProvider {
+  name: string
+  getAuthorizationUrl(state: string, redirectUri: string): string
+  exchangeCode(code: string, redirectUri: string): Promise<TokenSet>
+  getUserProfile(tokenSet: TokenSet): Promise<OAuthUserProfile>
+}
+```
+
+This abstraction hides the per-provider quirks (Google's id_token vs GitHub's API calls, PKCE support differences) behind a uniform interface. Adding Apple later requires implementing this interface — no changes to the callback handler or session logic.
+
+## Key Decisions
+
+1. **Provider abstraction over direct integration** — extra layer pays off when adding providers
+2. **httpOnly cookies for tokens** — not localStorage, not sessionStorage
+3. **Separate callback error handling** — Google and GitHub have different failure modes
+4. **Vault for secrets** — aligning with org migration away from K8s secrets

package/studios/software/examples/add-oauth-login/pre-intent.yml

@@ -0,0 +1,17 @@
+related:
+  - security-assessment
+  - data-pipeline
+  - documentation
+turns:
+  - role: user
+    text: "I want to add OAuth login to the app."
+  - role: agent
+    text: "Which providers — Google, GitHub, both?"
+  - role: user
+    text: "Google and GitHub. Maybe Apple later."
+  - role: agent
+    text: "Full-page login screen or a modal? Session via cookies or tokens?"
+  - role: user
+    text: "Full page, httpOnly cookies. Rate-limit the callback."
+  - role: agent
+    text: "Got it — I have everything I need to draft the intent."

package/studios/software/examples/add-oauth-login/sequence.ts

@@ -0,0 +1,137 @@
+import type { DemoConfig } from "@/lib/demo/types"
+
+const P = ".haiku/intents/add-oauth-login"
+
+export const config: DemoConfig = {
+  title: "software",
+  studio: "software",
+  stages: ["inception", "design", "product", "development", "operations", "security"],
+  completionText: "All 6 stages passed. add-oauth-login delivered.",
+  steps: [
+    // Step 1: User invokes /haiku:start
+    { delay: 800, actions: [{ type: "msg", role: "user", label: "you", text: "/haiku:start" }] },
+    { delay: 1200, actions: [{ type: "typing" }] },
+    { delay: 1000, actions: [{ type: "removeTyping" }, { type: "msg", role: "agent", label: "agent", text: "What do you want to accomplish?" }] },
+    { delay: 1500, actions: [{ type: "msg", role: "user", label: "you", text: "Add OAuth login to the app" }] },
+
+    // Step 2: Intent created
+    { delay: 800, actions: [{ type: "typing" }] },
+    { delay: 1200, actions: [{ type: "removeTyping" }, { type: "msg", role: "agent", label: "agent", text: "Creating intent: add-oauth-login..." }, { type: "file", path: `${P}/intent.md` }] },
+    { delay: 800, actions: [{ type: "msg", role: "system", label: "system", text: "Intent created. Studio: software. 6 stages: inception \u2192 design \u2192 product \u2192 development \u2192 operations \u2192 security" }] },
+
+    // Step 3: Inception - elaborate (collaborative)
+    { delay: 1000, actions: [{ type: "activateStage", stage: "inception" }, { type: "msg", role: "agent", label: "agent", text: "Entering inception stage. Hat: elaborator." }, { type: "file", path: `${P}/stages/inception/state.json` }] },
+    { delay: 1200, actions: [{ type: "msg", role: "agent", label: "agent", text: "What OAuth providers do you need to support?" }] },
+    { delay: 2000, actions: [{ type: "msg", role: "user", label: "you", text: "Google and GitHub. Maybe Apple later." }] },
+    { delay: 800, actions: [{ type: "typing" }] },
+    { delay: 1200, actions: [{ type: "removeTyping" }, { type: "msg", role: "agent", label: "agent", text: "I\u2019ll set up the provider abstraction to make adding Apple easy. Here\u2019s the breakdown:" }] },
+    { delay: 1000, actions: [{ type: "msg", role: "agent", label: "agent", text: "3 units: OAuth provider setup, callback handler, session management" }, { type: "file", path: `${P}/stages/inception/units/unit-01-oauth-provider-setup.md` }, { type: "file", path: `${P}/stages/inception/units/unit-02-callback-handler.md` }, { type: "file", path: `${P}/stages/inception/units/unit-03-session-management.md` }, { type: "card", stage: "inception", name: "oauth-provider-setup", status: "in-progress" }, { type: "card", stage: "inception", name: "callback-handler", status: "" }, { type: "card", stage: "inception", name: "session-management", status: "" }] },
+    { delay: 2200, actions: [{ type: "msg", role: "user", label: "you", text: "Split the callback into its own unit \u2014 it has complex error handling" }] },
+    { delay: 800, actions: [{ type: "typing" }] },
+    { delay: 1000, actions: [{ type: "removeTyping" }, { type: "msg", role: "agent", label: "agent", text: "Good call. Updated to 4 units." }, { type: "file", path: `${P}/stages/inception/units/unit-04-callback-error-handling.md` }, { type: "card", stage: "inception", name: "callback-errors", status: "" }] },
+
+    // Step 4: Inception - execute
+    { delay: 800, actions: [{ type: "msg", role: "agent", label: "agent", text: "Hat: researcher. Starting OAuth provider setup \u2014 mapping provider abstraction layer..." }] },
+    { delay: 600, actions: [{ type: "fastForward", seconds: "30" }] },
+    { delay: 2000, actions: [{ type: "removeFastForward" }, { type: "msg", role: "agent", label: "agent", text: "Provider setup complete. Abstraction layer supports Google and GitHub with a clean interface for adding Apple later." }, { type: "file", path: `${P}/knowledge/DISCOVERY.md` }, { type: "updateCard", stage: "inception", name: "oauth-provider-setup", status: "completed" }, { type: "updateCard", stage: "inception", name: "callback-handler", status: "in-progress" }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "25" }] },
+    { delay: 1500, actions: [{ type: "removeFastForward" }, { type: "msg", role: "agent", label: "agent", text: "Callback handler analysis done. Google uses server-side code exchange, GitHub\u2019s token endpoint differs. Both mapped." }, { type: "updateCard", stage: "inception", name: "callback-handler", status: "completed" }, { type: "updateCard", stage: "inception", name: "session-management", status: "in-progress" }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "20" }] },
+    { delay: 1200, actions: [{ type: "removeFastForward" }, { type: "updateCard", stage: "inception", name: "session-management", status: "completed" }, { type: "updateCard", stage: "inception", name: "callback-errors", status: "in-progress" }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "20" }] },
+    { delay: 1200, actions: [{ type: "removeFastForward" }, { type: "msg", role: "agent", label: "agent", text: "All 4 units complete. Callback error handling confirmed your instinct \u2014 the two providers need separate error paths due to different failure modes." }, { type: "updateCard", stage: "inception", name: "callback-errors", status: "completed" }] },
+
+    // Step 5: Inception gate - auto
+    { delay: 1000, actions: [{ type: "msg", role: "system", label: "system", text: "Inception complete. Review gate: auto. All criteria met \u2014 advancing." }, { type: "msg", role: "agent", label: "agent", text: "Advancing to design stage." }] },
+
+    // Step 6: Design - elaborate
+    { delay: 1000, actions: [{ type: "activateStage", stage: "design" }, { type: "msg", role: "agent", label: "agent", text: "Entering design stage. Hat: designer.\nElaborating design work..." }, { type: "file", path: `${P}/stages/design/state.json` }] },
+    { delay: 800, actions: [{ type: "file", path: `${P}/stages/design/units/unit-01-login-screen.md` }, { type: "file", path: `${P}/stages/design/units/unit-02-oauth-flow.md` }, { type: "card", stage: "design", name: "login-screen", status: "in-progress" }, { type: "card", stage: "design", name: "oauth-flow", status: "" }, { type: "msg", role: "agent", label: "agent", text: "2 units: login-screen and oauth-flow." }] },
+
+    // Step 7: Design - execute (collaborative)
+    { delay: 1200, actions: [{ type: "msg", role: "agent", label: "agent", text: "For the login screen \u2014 modal overlay or full page?" }] },
+    { delay: 2200, actions: [{ type: "msg", role: "user", label: "you", text: "Full page with the app logo. Social buttons prominent." }] },
+    { delay: 800, actions: [{ type: "typing" }] },
+    { delay: 1200, actions: [{ type: "removeTyping" }, { type: "msg", role: "agent", label: "agent", text: "Opening visual review..." }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "45" }] },
+    { delay: 2000, actions: [{ type: "removeFastForward" }, { type: "msg", role: "agent", label: "agent", text: "Wireframe ready. Presenting for review." }, { type: "showDesignReview", title: "Design", intent: "add-oauth-login" }] },
+    { delay: 2500, actions: [{ type: "hideReview" }, { type: "msg", role: "user", label: "you", text: "Add a 'forgot password' link below the form" }] },
+    { delay: 800, actions: [{ type: "typing" }] },
+    { delay: 1000, actions: [{ type: "removeTyping" }, { type: "msg", role: "agent", label: "agent", text: "Added. Design brief updated." }, { type: "updateCard", stage: "design", name: "login-screen", status: "completed" }, { type: "updateCard", stage: "design", name: "oauth-flow", status: "in-progress" }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "30" }] },
+    { delay: 1500, actions: [{ type: "removeFastForward" }, { type: "updateCard", stage: "design", name: "oauth-flow", status: "completed" }, { type: "file", path: `${P}/stages/design/DESIGN-BRIEF.md` }, { type: "msg", role: "agent", label: "agent", text: "Design brief and mockups complete. Desktop and mobile login screens plus OAuth flow diagram committed as design artifacts. All breakpoints, interactive states, accessible color contrast verified." }] },
+
+    // Step 8: Design gate - ask (visual review)
+    { delay: 1000, actions: [{ type: "msg", role: "system", label: "system", text: "Design stage complete. Review gate: ask." }, { type: "msg", role: "agent", label: "agent", text: "Opening visual review for stage approval..." }] },
+    { delay: 800, actions: [{ type: "showDesignReview", title: "Design", intent: "add-oauth-login" }] },
+    { delay: 2000, actions: [{ type: "highlightApprove" }] },
+    { delay: 1200, actions: [{ type: "hideReview" }, { type: "msg", role: "agent", label: "agent", text: "Approved via visual review. Advancing to product stage." }] },
+
+    // Step 9: Product stage (collaborative)
+    { delay: 1000, actions: [{ type: "activateStage", stage: "product" }, { type: "msg", role: "agent", label: "agent", text: "Entering product stage. Hat: product.\nLoading design stage outputs as inputs..." }, { type: "file", path: `${P}/stages/product/state.json` }] },
+    { delay: 800, actions: [{ type: "msg", role: "system", label: "system", text: "Resolved inputs \u2192 inception/discovery (knowledge/DISCOVERY.md), design/design-brief (stages/design/DESIGN-BRIEF.md)" }, { type: "msg", role: "agent", label: "agent", text: "Design brief specifies full-page login with social buttons and forgot-password link.\nElaborating product work from design artifacts..." }, { type: "file", path: `${P}/stages/product/units/unit-01-auth-spec.md` }, { type: "card", stage: "product", name: "auth-spec", status: "in-progress" }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "40" }] },
+    { delay: 1800, actions: [{ type: "removeFastForward" }, { type: "msg", role: "agent", label: "agent", text: "Here are the acceptance criteria for the callback flow:" }] },
+    { delay: 1000, actions: [{ type: "msg", role: "agent", label: "agent", text: "1. Valid code \u2192 token exchange \u2192 session created\n2. Invalid code \u2192 400 error\n3. Expired code \u2192 redirect to login" }] },
+    { delay: 2500, actions: [{ type: "msg", role: "user", label: "you", text: "Add a rate limiting scenario \u2014 what happens at 100 requests/minute?" }] },
+    { delay: 800, actions: [{ type: "typing" }] },
+    { delay: 1200, actions: [{ type: "removeTyping" }, { type: "msg", role: "agent", label: "agent", text: "Added: rate limit returns 429 with retry-after header." }, { type: "updateCard", stage: "product", name: "auth-spec", status: "completed" }] },
+    { delay: 800, actions: [{ type: "msg", role: "system", label: "system", text: "Product stage complete. Review gate: external." }, { type: "msg", role: "agent", label: "agent", text: "Sharing browse URL for external review..." }] },
+    { delay: 1000, actions: [{ type: "showReview", title: "Product", intent: "add-oauth-login", criteria: ["Valid code \u2192 token exchange \u2192 session created", "Invalid code \u2192 400 error with message", "Expired code \u2192 redirect to login", "Rate limit at 100 req/min \u2192 429 + retry-after"] }] },
+    { delay: 800, actions: [{ type: "animateCheckmarks" }] },
+    { delay: 2200, actions: [{ type: "highlightApprove" }] },
+    { delay: 1200, actions: [{ type: "hideReview" }, { type: "msg", role: "system", label: "system", text: "External review approved via browse page." }, { type: "msg", role: "agent", label: "agent", text: "Advancing to development stage." }] },
+
+    // Step 10: Development stage (bolt loop, collaborative)
+    { delay: 1000, actions: [{ type: "activateStage", stage: "development" }, { type: "msg", role: "agent", label: "agent", text: "Entering development stage. Hat: planner.\nLoading upstream stage outputs..." }, { type: "file", path: `${P}/stages/development/state.json` }] },
+    { delay: 800, actions: [{ type: "msg", role: "system", label: "system", text: "Resolved inputs \u2192 inception/discovery, design/design-brief, product/auth-spec" }, { type: "msg", role: "agent", label: "agent", text: "Design brief: full-page login with social buttons + forgot-password link. Product spec: OAuth callback flow with 429 rate limiting.\nElaborating into implementation units..." }, { type: "file", path: `${P}/stages/development/units/unit-01-oauth-provider.md` }, { type: "file", path: `${P}/stages/development/units/unit-02-login-ui.md` }, { type: "file", path: `${P}/stages/development/units/unit-03-session-mgmt.md` }, { type: "card", stage: "development", name: "oauth-provider", status: "in-progress" }, { type: "card", stage: "development", name: "login-ui", status: "" }, { type: "card", stage: "development", name: "session-mgmt", status: "" }] },
+    // Bolt 1
+    { delay: 800, actions: [{ type: "msg", role: "agent", label: "agent", text: "Unit: oauth-provider. Bolt 1. Hat: builder.\nImplementing OAuth provider integration for Google and GitHub..." }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "60" }] },
+    { delay: 2000, actions: [{ type: "removeFastForward" }, { type: "msg", role: "agent", label: "agent", text: "Bolt 1 complete. Hat: reviewer. Running code review..." }] },
+    { delay: 1200, actions: [{ type: "msg", role: "agent", label: "agent", text: "Review found 1 issue: race condition in concurrent token exchanges" }] },
+    { delay: 2200, actions: [{ type: "msg", role: "user", label: "you", text: "Good catch. Use a mutex on the token store." }] },
+    { delay: 800, actions: [{ type: "msg", role: "agent", label: "agent", text: "Fixed \u2014 added lock on token write. Re-running review..." }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "20" }] },
+    { delay: 1200, actions: [{ type: "removeFastForward" }, { type: "msg", role: "agent", label: "agent", text: "Review passed. All criteria met." }, { type: "updateCard", stage: "development", name: "oauth-provider", status: "completed" }, { type: "updateCard", stage: "development", name: "login-ui", status: "in-progress" }] },
+    // Unit 2
+    { delay: 800, actions: [{ type: "msg", role: "agent", label: "agent", text: "Unit: login-ui. Hat: builder. Building login components with the forgot-password link from the design brief..." }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "45" }] },
+    { delay: 1500, actions: [{ type: "removeFastForward" }, { type: "msg", role: "agent", label: "agent", text: "Login UI complete. Review passed on first bolt." }, { type: "updateCard", stage: "development", name: "login-ui", status: "completed" }, { type: "updateCard", stage: "development", name: "session-mgmt", status: "in-progress" }] },
+    // Unit 3
+    { delay: 800, actions: [{ type: "msg", role: "agent", label: "agent", text: "Unit: session-mgmt. Hat: builder. Implementing session lifecycle with the rate limiting from the product spec..." }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "50" }] },
+    { delay: 1500, actions: [{ type: "removeFastForward" }, { type: "msg", role: "agent", label: "agent", text: "Session management complete \u2014 includes the 429 rate limiting on the callback endpoint. All 3 units delivered." }, { type: "updateCard", stage: "development", name: "session-mgmt", status: "completed" }] },
+    { delay: 800, actions: [{ type: "msg", role: "agent", label: "agent", text: "Running design consistency and accessibility review agents..." }] },
+    { delay: 1000, actions: [{ type: "msg", role: "agent", label: "agent", text: "Review agents passed: design consistency OK, accessibility OK." }] },
+    { delay: 800, actions: [{ type: "msg", role: "system", label: "system", text: "Development stage complete. Review gate: ask. Awaiting your approval." }] },
+    { delay: 1500, actions: [{ type: "msg", role: "user", label: "you", text: "Approved." }, { type: "msg", role: "agent", label: "agent", text: "Advancing to operations stage." }] },
+
+    // Step 11: Operations stage (collaborative)
+    { delay: 1000, actions: [{ type: "activateStage", stage: "operations" }, { type: "msg", role: "agent", label: "agent", text: "Entering operations stage. Hat: ops-engineer.\nI see you\u2019re on Kubernetes with Helm charts. For the OAuth secrets (client IDs, client secrets), do you want me to use your existing Vault setup or Kubernetes secrets?" }, { type: "file", path: `${P}/stages/operations/state.json` }, { type: "file", path: `${P}/stages/operations/units/unit-01-deploy-config.md` }, { type: "card", stage: "operations", name: "deploy-config", status: "in-progress" }] },
+    { delay: 2000, actions: [{ type: "msg", role: "user", label: "you", text: "Use Vault. We\u2019re migrating everything there. Kubernetes secrets are being phased out." }] },
+    { delay: 800, actions: [{ type: "msg", role: "agent", label: "agent", text: "Got it. I\u2019ll wire the OAuth secrets through Vault with the existing injector sidecar pattern. Updating the Helm values and adding the Vault policy." }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "35" }] },
+    { delay: 1500, actions: [{ type: "removeFastForward" }, { type: "msg", role: "agent", label: "agent", text: "Hat: sre. Vault policies configured, health checks added for both provider endpoints, rollback plan documented with secret rotation procedure." }, { type: "updateCard", stage: "operations", name: "deploy-config", status: "completed" }] },
+    { delay: 800, actions: [{ type: "msg", role: "system", label: "system", text: "Operations complete. Review gate: auto. Advancing." }, { type: "msg", role: "agent", label: "agent", text: "Advancing to security stage." }] },
+
+    // Step 12: Security stage (collaborative)
+    { delay: 1000, actions: [{ type: "activateStage", stage: "security" }, { type: "msg", role: "agent", label: "agent", text: "Entering security stage. Running review agents in parallel:\n  \u2022 Hat: threat-modeler \u2014 STRIDE analysis\n  \u2022 Hat: red-team \u2014 attack surface scan\n  \u2022 Hat: blue-team \u2014 defense validation" }, { type: "file", path: `${P}/stages/security/state.json` }, { type: "file", path: `${P}/stages/security/units/unit-01-threat-model.md` }, { type: "file", path: `${P}/stages/security/units/unit-02-pen-test.md` }, { type: "card", stage: "security", name: "threat-model", status: "in-progress" }, { type: "card", stage: "security", name: "pen-test", status: "in-progress" }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "60" }] },
+    { delay: 2000, actions: [{ type: "removeFastForward" }, { type: "msg", role: "agent", label: "agent", text: "Threat model found 2 medium-risk items:\n  1. GitHub OAuth doesn\u2019t support PKCE \u2014 relying on state param + client_secret only\n  2. Token stored in localStorage on one code path (should be httpOnly cookie everywhere)\n\nItem 2 is a code fix. Item 1 is an accepted limitation \u2014 want me to document it as a known risk or is there a mitigation you prefer?" }] },
+    { delay: 2200, actions: [{ type: "msg", role: "user", label: "you", text: "Document it as a known risk. GitHub doesn\u2019t support PKCE, that\u2019s on them. Fix the localStorage issue though \u2014 that should never have been there." }] },
+    { delay: 800, actions: [{ type: "msg", role: "agent", label: "agent", text: "Agreed. Fixing the localStorage path now and documenting GitHub\u2019s PKCE gap as accepted risk with compensating controls (strict state validation + short-lived tokens)." }] },
+    { delay: 500, actions: [{ type: "fastForward", seconds: "15" }] },
+    { delay: 1200, actions: [{ type: "removeFastForward" }, { type: "msg", role: "agent", label: "agent", text: "Fixed. All token storage now uses httpOnly cookies. CSRF protection verified across both providers." }, { type: "updateCard", stage: "security", name: "threat-model", status: "completed" }, { type: "updateCard", stage: "security", name: "pen-test", status: "completed" }] },
+    { delay: 1000, actions: [{ type: "msg", role: "agent", label: "agent", text: "Hat: security-reviewer. Final review... All findings addressed. No critical or high-risk issues remain." }] },
+    { delay: 800, actions: [{ type: "msg", role: "system", label: "system", text: "Security stage complete. Review gate: external." }, { type: "msg", role: "agent", label: "agent", text: "Sharing browse URL for external security review..." }] },
+    { delay: 1000, actions: [{ type: "showReview", title: "Security", intent: "add-oauth-login", criteria: ["STRIDE threat model complete", "No critical/high-risk findings remain", "Token storage uses httpOnly cookies only", "CSRF protection verified both providers", "GitHub PKCE gap documented as accepted risk"] }] },
+    { delay: 800, actions: [{ type: "animateCheckmarks" }] },
+    { delay: 2400, actions: [{ type: "highlightApprove" }] },
+    { delay: 1200, actions: [{ type: "hideReview" }, { type: "msg", role: "system", label: "system", text: "External security review approved via browse page." }] },
+
+    // Step 13: Intent complete
+    { delay: 1200, actions: [{ type: "complete" }, { type: "msg", role: "agent", label: "agent", text: "All 6 stages complete for add-oauth-login.\n\nDelivered:\n  \u2022 OAuth provider integration (Google, GitHub) with separate callback handlers\n  \u2022 Login UI with forgot-password link, 3-breakpoint responsive design\n  \u2022 Session management with 429 rate limiting on callback endpoint\n  \u2022 Race-condition-safe token refresh with distributed mutex lock\n  \u2022 Deploy config with Vault secret management and rollback plan\n  \u2022 Security review with STRIDE threat model, localStorage fix applied\n\nIntent status: complete." }] },
+    { delay: 1500, actions: [{ type: "msg", role: "system", label: "system", text: "__SHOW_COMPLETION__" }] },
+  ],
+}

package/studios/software/examples/add-oauth-login/stages/design/DESIGN-BRIEF.md

@@ -0,0 +1,60 @@
+# Design Brief: OAuth Login
+
+## Layout
+
+Full-page login with centered card (max-width 420px). Background uses the app's neutral tone (`--color-bg-surface`). Card has subtle shadow and rounded corners.
+
+### Desktop (1280px+)
+
+- Card centered both vertically and horizontally
+- App logo: 48px height, centered above card
+- Card padding: 40px
+- Social buttons: full-width, 48px height, 12px gap between them
+- Forgot password link: centered below buttons, 14px text
+
+### Tablet (768px)
+
+- Same as desktop, card max-width reduces to 380px
+- Card padding: 32px
+
+### Mobile (375px)
+
+- Card fills width with 16px horizontal margin
+- Card padding: 24px
+- Social buttons: 44px min height (touch target)
+- Logo: 36px height
+
+## Social Buttons
+
+Each button has the provider's logo on the left and "Sign in with {Provider}" text.
+
+| State | Google | GitHub |
+|-------|--------|--------|
+| Default | White bg, dark border, dark text | Dark bg (#24292e), white text |
+| Hover | Light gray bg (#f8f9fa) | Slightly lighter (#2f363d) |
+| Focus | Blue outline ring (2px offset) | Blue outline ring (2px offset) |
+| Active | Pressed shadow (inset) | Pressed shadow (inset) |
+| Loading | Spinner replaces logo, text "Connecting..." | Same |
+| Disabled | 50% opacity, no pointer events | Same |
+
+## Design Tokens
+
+```css
+--login-card-max-width: 420px;
+--login-card-padding: 40px;
+--login-card-radius: 12px;
+--login-card-shadow: 0 4px 24px rgba(0, 0, 0, 0.08);
+--login-btn-height: 48px;
+--login-btn-radius: 8px;
+--login-btn-gap: 12px;
+--login-link-size: 14px;
+--login-logo-height: 48px;
+```
+
+## Accessibility
+
+- All interactive elements have visible focus indicators
+- Color contrast: AA compliant (verified against both light and dark themes)
+- Screen reader: buttons have `aria-label="Sign in with Google"` etc.
+- Loading state: `aria-busy="true"` on the button, `aria-live="polite"` on status region
+- Error messages: linked via `aria-describedby` to the relevant form region

package/studios/software/examples/add-oauth-login/stages/design/state.json

@@ -0,0 +1,10 @@
+{
+  "stage": "design",
+  "status": "complete",
+  "current_unit": null,
+  "completed_units": [
+    "unit-01-login-screen",
+    "unit-02-oauth-flow"
+  ],
+  "iteration": 0
+}

package/studios/software/examples/add-oauth-login/stages/design/units/unit-01-login-screen.md

@@ -0,0 +1,20 @@
+---
+title: Login Screen
+type: design
+status: complete
+depends_on: []
+---
+
+# Unit 01: Login Screen
+
+Design the full-page login screen with social sign-in buttons and forgot-password link.
+
+## Completion Criteria
+
+- [x] Full-page layout with centered card — app logo at top, social buttons prominent
+- [x] Responsive breakpoints: mobile (375px), tablet (768px), desktop (1280px)
+- [x] Social buttons: "Sign in with Google" and "Sign in with GitHub" with provider logos
+- [x] "Forgot password?" link below the social buttons
+- [x] Interactive states specified: default, hover, focus, active, disabled, loading
+- [x] Touch targets at least 44px on mobile
+- [x] Color contrast meets WCAG AA (4.5:1 for text, 3:1 for large text)