kanbango 3.5.0 → 3.8.0

package/.ai/lessons.jsonl

@@ -6,3 +6,9 @@
 {"id":"260803-b27","ts":"2026-08-03","scope":"proj","tags":["tests","race","fs"],"rule":"DO Serialize board file mutations with an in-process lock and atomic write (temp+rename/link); race tests should assert…","when":"kanban concurrent IO","sev":2,"hits":1}
 {"id":"260813-9t0","ts":"2026-08-13","scope":"proj","tags":["mcp","errors","dx"],"rule":"DO MCP missing-field errors: put Valid list + Example JSON + sent keys in message so the agent can retry without guessi…","when":"MCP tool validation / agent-facing erro…","sev":2,"hits":1}
 {"id":"260819-ztl","ts":"2026-08-19","scope":"proj","tags":["config","kanban","validation"],"rule":"DO Field-policy config: skip only ENOENT; invalid JSON/shape must throw CONFIG_INVALID, never silently fall back to def…","when":"config load / required fields","sev":2,"hits":1}
+{"id":"260825-d68","ts":"2026-08-25","scope":"proj","tags":["http","adr"],"rule":"DO HTTP POST/PATCH must forward adr and evidence the same way MCP update does — doCreate already persisted evidence, on…","when":"http adr evidence","sev":2,"hits":1}
+{"id":"260826-bvz","ts":"2026-08-26","scope":"proj","tags":["gui","testing","config"],"rule":"DO Test dynamic GUI columns through runtime config, not static HTML IDs.","when":"config-driven GUI","sev":2,"hits":1}
+{"id":"260827-mmv","ts":"2026-08-27","scope":"proj","tags":["plan","mcp","qa"],"rule":"DO When create maps steps→subtasks, assert subtasks win if both sent; evidence accepts any of diff|summary|test_command…","when":"plan_create / MCP create steps","sev":2,"hits":1}
+{"id":"260827-m2q","ts":"2026-08-27","scope":"proj","tags":["plan","mcp","evidence"],"rule":"DO When create maps steps→subtasks, assert subtasks win if both sent; evidence accepts any of diff|summary|test_command","when":"plan_create / MCP create steps","sev":2,"hits":1}
+{"id":"260916-9im","ts":"2026-09-16","scope":"proj","tags":["kanban","mcp","context","depends-on"],"rule":"DO Agent wake: one kanban_read operation=context instead of list+show; store depends_on and files on the task so gates …","when":"kanban MCP agent context","sev":2,"hits":1}
+{"id":"260916-guc","ts":"2026-09-16","scope":"proj","tags":["kanban","mcp","depends-on","dag"],"rule":"DO On depends_on writes detect cycles immediately (CIRCULAR_DEPENDENCY with details.cycle); expose blocked/blocks on li…","when":"kanban DAG depends_on","sev":2,"hits":1}

package/.ai/retro/last-run.json

@@ -1 +1 @@
-{"ts":"2026-08-19T20:04:53.425Z","sessionID":"ses_feb8269efffe9L33YfwuSnVUVa","added":["260819-ztl"],"bumped":[]}
+{"ts":"2026-09-16T10:23:54.497Z","sessionID":"ses_f5682fb36ffeOu9sf2lXfIUCGB","added":["260916-guc"],"bumped":[]}

package/.ait-quality.yml

@@ -1,5 +1,6 @@
 # kanbango quality policy
 # CLI/GUI entrypoints use console.log as user-facing output (not debug leftovers).
+# This file is local policy only — kanbango does not depend on or invoke ait-quality.
 version: 1
 include: []
 exclude:

package/AGENTS.md

@@ -8,6 +8,8 @@ Source of truth: `agent-playbook.js` (also MCP tool descriptions + `kanban_read`
 
 - hierarchy: epic (context) → task (work+plan) → subtasks (steps)
 - list: `col` filter, `view=summary`; keep `task_id`s; no full-board re-list after every write
+- context: one-shot compass (active or next unblocked planned, else idle); optional `epic`
+- `depends_on` must be done before active/gates (`TASK_BLOCKED`); cycle → `CIRCULAR_DEPENDENCY`; `files[]` = touched paths
 - list_epics default = live only (hides done + archived); `include_archived` / `status` to widen
 - list tasks default hides tasks under done/archived epics; show/show_epic by id always works
 - show: `view=execution` while coding; `full` only if needed
@@ -17,7 +19,7 @@ Source of truth: `agent-playbook.js` (also MCP tool descriptions + `kanban_read`
 - create once with `description`, `specs`, `in_scope`, `out_of_scope`, `acceptance_criteria`
 - move/update/delete: `return=none`; subtasks = full array replace (no toggle)
 - cleanup: `delete` (task), `epic_delete` (cascade), `epic_archive` / `epic_unarchive`
-- non-trivial work: `plan_create` → `plan_advance` → `plan_evidence` (real tests, truncated logs) → `plan_done`
+- `steps` on create/plan_create → subtasks (no forced TDD); runner optional; optional plan_*: plan_create → plan_advance → plan_evidence (diff|summary|test_command) → plan_done
 - gui: `status` before `start`; `stop` only owned; `external_running` = do not kill
 
 ## Build & Development Commands

package/CHANGELOG.md

@@ -7,6 +7,83 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- `plan_create` / `detectTestRunner`: missing test runner returns `null` (no `NO_TEST_RUNNER` hard fail)
+- Plan subtasks = only provided `steps` (no forced Write tests / red / green)
+- MCP `create` accepts `steps[]` as subtask shortcut when `subtasks` omitted
+- `plan_evidence`: require at least one of `diff` | `summary` | `test_command`; test logs/exit_code optional
+
+## [3.8.0] - 2026-09-16
+
+### Added
+- Agent-first context snapshot with dependency-aware task selection.
+- `depends_on` DAG validation, cycle detection, blocked/downstream visibility, and `files` scope tracking.
+- Context next actions and `unblocked_tasks` after completing a dependency.
+- Planned follow-up tasks for strict evidence gates, actionable MCP errors, and an agent cockpit GUI.
+
+## [3.7.0] - 2026-08-26
+
+### Added
+- Interactive config TUI (`config-wizard.js`): checkbox gates/agents on `kanban init` / `kanban mcp-init` when `backlog/kanbango.json` is missing (TTY only; defaults all on)
+- `kanban config` re-opens the wizard (TTY required); malformed existing JSON → `CONFIG_INVALID`, file not replaced
+- Non-TTY init/mcp-init print a one-line hint to run `kanban config` (no hang, no invented file)
+- Tests: `tests/config-wizard.test.js` (fake TTY streams, cancel/raw-mode cleanup, CLI non-TTY)
+
+## [3.6.2] - 2026-08-25
+
+### Added
+- Project board config in `backlog/kanbango.json`:
+  - `columns.testing|review`: `{ enabled, label }` (defaults: both enabled, labels Testing/Review)
+  - `workflow.testing_agent|review_agent`: string (legacy) or `{ enabled, name }`
+- Disabled gate column: hidden from GUI/MCP/CLI, transitions rebuild, existing cards auto-migrate to `planned` (idempotent, no config trail)
+- Agent `enabled: false` with column on = manual gate (no spawn, card stays)
+- GUI `GET /api/config` + dynamic board columns/labels from config
+- MCP column enums reflect active columns after config load
+- `plan_done` lands in first enabled gate or `done`
+- Tests: `tests/board-config.test.js`
+
+### Changed
+- `move` / `updateTask` column changes validate workflow transitions
+- Illegal move returns `INVALID_TRANSITION` with `allowed_columns` in details and hint
+- Allowed: icebox→planned; planned→active|icebox|testing; active→planned|testing|icebox; testing→active|review; review→active|done; done→active
+- `active→done` is illegal (cannot skip testing/review)
+- MCP `column` description and playbook document the map; GUI arrows only show legal neighbors
+- CLI `list` / `show` / `epic list` load board config (migrate disabled-gate cards)
+- MCP `tools/list` fails on `CONFIG_INVALID` instead of advertising default columns
+
+### Note
+- `.ait-quality.yml` kept as optional local scan policy only (CLI `console.log` = UX). No ait-quality dependency or runtime invoke.
+
+## [3.6.1] - 2026-08-25
+
+### Changed
+- `mcp-init --opencode` agent sync: hash manifest `.opencode/agent/.kanbango-agents.json`
+  - same as package → unchanged
+  - clean older package copy → auto-update
+  - local edit → conflict, keep local (use `--force` to overwrite)
+  - first install still copies all `agents/*.md`
+
+## [3.6.0] - 2026-08-25
+
+### Added
+- Columns `testing` and `review` in COLS, backlog dirs, MCP enums, CLI, GUI board
+- Async workflow gates (`workflow.js`): move/plan_done into testing|review spawns local agents when `backlog/kanbango.json` enables workflow
+- Task `workflow` field + evidence extensions (`stage`, `agent`, `verdict`, `summary`); `appendEvidence` in same mutation
+- In-repo agents: `agents/qa-tester.md`, `agents/qa-e2e-tester.md`, `agents/temida.md` (Temida copy ends with GATE: PASS|FAIL)
+- `mcp-init --opencode` copies agents to `.opencode/agent/` (no overwrite without `--force`); `--claude` skips agents
+- GUI: testing/review columns, MOVE_ORDER, workflow status badge, evidence stage/verdict/summary
+- Tests: `tests/workflow-gates.test.js` + fake opencode fixture (zero live LLM)
+
+### Changed
+- `plan_done` / `plan.done` completes into `testing` gate (not `done`)
+- execution/full views include `evidence`, `plan`, `workflow`
+- Epic status: tasks in testing|review count as in-progress (`active`); progress has `tasks_testing` / `tasks_review`
+- Playbook: after implement `move testing`; plan_done → testing gate
+
+### Config
+- `backlog/kanbango.json` `{ workflow: { enabled, command, testing_agent, e2e_agent, review_agent, timeout_ms } }`
+- ENOENT → workflow off; invalid JSON/shape → `CONFIG_INVALID`; `KANBANGO_WORKFLOW_RUNNER` overrides command
+
 ## [3.5.0] - 2026-08-24
 
 ### Added

package/LLM_AGENTS.md

@@ -486,7 +486,7 @@ Kanbango MCP — token rules:
 - show: view=execution while coding; full only if needed
 - create once with description,specs,in_scope,out_of_scope,acceptance_criteria
 - move/update: return=none; subtasks=full array replace
-- non-trivial: plan_create → plan_advance → plan_evidence (real tests, truncated logs) → plan_done
+- steps on create/plan_create → subtasks (no forced TDD); runner optional; optional plan_*: plan_create → plan_advance → plan_evidence (diff|summary|test_command) → plan_done
 - gui: status before start; stop only owned; external_running = do not kill
 ```
 

package/README.md

@@ -22,9 +22,12 @@ npx kanbango --help
 ## Quick Start
 
 ```bash
-# Initialize backlog directories
+# Initialize backlog directories (TTY: config wizard for QA/review gates)
 kanban init
 
+# Re-open project config wizard (writes backlog/kanbango.json)
+kanban config
+
 # Start web GUI (stable project port; prints the real URL)
 kanban serve
 
@@ -73,8 +76,35 @@ Epic status is **derived** from child task columns (not a board column).
 | `active` | In progress (keep to 1–2 tasks) |
 | `planned` | Ready to implement |
 | `icebox` | Nice-to-have / frozen |
+| `testing` | Optional QA gate (default on) |
+| `review` | Optional review gate (default on) |
 | `done` | Completed |
 
+### Project config (`backlog/kanbango.json`)
+
+Optional. Missing file = six columns, workflow agents off.
+
+On a **TTY**, `kanban init` / `kanban mcp-init` open a checkbox wizard when the file is missing (defaults: testing + qa-tester + review + temida all on). Non-TTY (CI, pipes, MCP) never blocks or creates a config; it prints a hint to run `kanban config` in a terminal. `kanban config` always opens the wizard (TTY required); invalid existing JSON is **not** overwritten (error + fix/remove).
+
+```json
+{
+  "columns": {
+    "testing": { "enabled": false, "label": "QA" },
+    "review": { "enabled": true, "label": "Review" }
+  },
+  "workflow": {
+    "enabled": true,
+    "testing_agent": { "enabled": true, "name": "qa-tester" },
+    "review_agent": { "enabled": false, "name": "temida" }
+  }
+}
+```
+
+- Only `testing` and `review` are configurable (core columns stay on).
+- `enabled: false` on a gate column hides it and moves existing cards in that column to `planned`.
+- Agent `enabled: false` keeps the column as a **manual** gate (no auto spawn).
+- Legacy string agent names still work: `"testing_agent": "qa-tester"`.
+
 ## Data Structure
 
 Tasks are JSON files in `backlog/<column>/`:
@@ -163,14 +193,15 @@ Your agent stays in sync with your real board — every change is persisted as J
 
 | Command | Description |
 |---------|-------------|
-| `kanban init` | Create backlog directory structure |
+| `kanban init` | Create backlog dirs; TTY wizard if `kanbango.json` missing |
+| `kanban config` | Interactive project config wizard (`backlog/kanbango.json`) |
 | `kanban serve [PORT]` | Start web GUI (stable project port, or PORT / KANBANGO_GUI_PORT) |
 | `kanban list [--col <col>] [--json]` | List tasks |
 | `kanban show <ID>` | Show task details |
 | `kanban add <TITLE>` | Add a new task |
 | `kanban move <ID> <COL>` | Move task |
 | `kanban mcp` | Start MCP server (stdio) |
-| `kanban mcp-init` | Generate MCP config files |
+| `kanban mcp-init` | Generate MCP config files; TTY wizard if project config is missing |
 | `kanban plan <action> --json '{...}'` | Accepted-plan workflow (create/advance/evidence/done/status) |
 
 ## Web GUI

package/agent-playbook.js

@@ -8,6 +8,8 @@ const DROP_IN_RULE = [
   'Kanbango MCP — token rules:',
   '- hierarchy: epic (context) → task (work+plan) → subtasks (steps)',
   '- list: col filter, view=summary; keep task_ids; no full-board re-list after writes',
+  '- context: one-shot compass (active or next unblocked planned, else idle); optional epic=E001; prefer over list+show',
+  '- context next_action: advance|evidence|move_testing|move_review|move_done|fix_gate|start|idle',
   '- list_epics default = live only (hides done + archived); include_archived / status to widen',
   '- list tasks default hides tasks under done/archived epics; show/show_epic by id always works',
   '- show: view=execution while coding; full only if needed',
@@ -17,7 +19,16 @@ const DROP_IN_RULE = [
   '- create once with description,specs,in_scope,out_of_scope,acceptance_criteria',
   '- move/update/delete: return=none; subtasks=full array replace',
   '- cleanup: delete (task), epic_delete (cascade tasks), epic_archive / epic_unarchive',
-  '- non-trivial: plan_create → plan_advance → plan_evidence (real tests, truncated logs) → plan_done',
+  '- steps on create/plan_create become subtasks (no forced TDD steps); test runner optional (null if none)',
+  '- optional plan_*: plan_create → plan_advance → plan_evidence (diff|summary|test_command) → plan_done',
+  '- plan_done completes into first enabled gate (testing|review) or done; after implement move testing when that column is enabled',
+  '- depends_on: task ids that must be done before active/gates; blocked move → TASK_BLOCKED; cycle → CIRCULAR_DEPENDENCY',
+  '- list/show: blocked + unmet_dependencies + blocks; move to done returns unblocked_tasks',
+  '- files: touched paths on create/update/plan_evidence (scope for QA/review)',
+  '- move validates transitions; illegal move → INVALID_TRANSITION + allowed_columns',
+  '- default allowed: icebox→planned; planned→active|icebox|testing; active→planned|testing|icebox; testing→active|review; review→active|done; done→active',
+  '- backlog/kanbango.json may disable testing/review columns (labels + migrate cards to planned) and/or disable QA/Temida spawn (manual gate)',
+  '- do not skip enabled gates: active→done illegal when testing|review on; gates spawn agents only when workflow+agent enabled',
   '- gui: status before start; stop only owned; external_running = do not kill'
 ].join('\n');
 
@@ -25,7 +36,7 @@ const TOOL_DESCRIPTIONS = {
   kanban_read: [
     'Read board. TOKEN RULES: list defaults to view=summary (id/title/col/progress only).',
     'Hierarchy: epic (container/context) → task (work) → subtasks (steps).',
-    'Always pass col when possible. Prefer show+view=execution over full.',
+    'Always pass col when possible. Prefer operation=context on wake, then show+view=execution over full.',
     'show task (planning/execution/full) includes epic_goals (parent epic goals; "" if none) — use as compass; check progress toward goal.',
     'execution/full also include adr[]; show_epic full rolls up child adrs (not stored on epic file).',
     'list_epics default live only (empty|planned|active; hides done+archived).',
@@ -33,6 +44,8 @@ const TOOL_DESCRIPTIONS = {
     'list hides tasks under done/archived epics unless include_archived/include_done; show/show_epic by id always works.',
     'Do not re-list the whole board after every write — keep task_id from create/move.',
     'Task IDs numeric ("014"); epic IDs "E001". views: summary|planning|execution|full; fields[] overrides view.',
+    'operation=context returns compact next_action (advance|evidence|move_*|fix_gate|start|idle); optional epic filter.',
+    'planning/execution/full include blocked, unmet_dependencies, blocks; summary includes blocked.',
     'operation=help returns this playbook as short text (no board I/O).'
   ].join(' '),
 
@@ -40,16 +53,22 @@ const TOOL_DESCRIPTIONS = {
     'Write board / plan. TOKEN RULES: one create with all planning fields beats many updates;',
     'after write use return=none (or summary). Do not dump full task unless needed.',
     'Actions: create|move|update|delete (daily); epic_create|epic_update|epic_archive|epic_unarchive|epic_delete;',
-    'plan_create→plan_advance→plan_evidence→plan_done (non-trivial only).',
+    'optional plan_create→plan_advance→plan_evidence→plan_done (plan_done → first enabled gate or done).',
+    'After implement: move testing when enabled (return=none). Illegal move → INVALID_TRANSITION with allowed_columns.',
+    'depends_on must be done before active/gates (TASK_BLOCKED). Cycle → CIRCULAR_DEPENDENCY.',
+    'files[] stores touched paths. move to done returns unblocked_tasks.',
+    'Default transitions: icebox→planned; planned→active|icebox|testing; active→planned|testing|icebox;',
+    'testing→active|review; review→active|done; done→active. Project may disable testing/review via backlog/kanbango.json.',
     'epic_create: title + description/goals/in_scope/out_of_scope. Link tasks via epic=E001.',
     'Log architecture decisions on the task: update with adr={decision,why} appends one entry (why this choice).',
     'delete: task_id (hard remove). epic_delete: epic_id, always cascades child tasks.',
     'epic_archive/epic_unarchive: epic_id — hide/restore initiative without deleting history.',
     'create/plan_create: title required; also send description,specs,in_scope,out_of_scope,acceptance_criteria',
-    '(missing → warnings, not failure). move: task_id+column. update: task_id + fields or subtasks[] full list',
-    '(no toggle). plan_evidence needs real test run: diff,test_command,stdout,stderr,exit_code — truncate logs.',
+    '(missing → warnings, not failure). steps[] → subtasks (create when subtasks omitted; plan_create as-is, no forced TDD).',
+    'plan_create runner optional (null if none). move: task_id+column. update: task_id + fields or subtasks[] full list',
+    '(no toggle). plan_evidence: at least one of diff|summary|test_command; stdout/stderr/exit_code optional — truncate logs.',
     'Example create: {"action":"create","title":"Ship image","epic":"E001","description":"...","specs":"...",',
-    '"in_scope":["CLI"],"out_of_scope":["GUI"],"acceptance_criteria":["npm test passes"],"col":"planned"}'
+    '"in_scope":["CLI"],"out_of_scope":["GUI"],"acceptance_criteria":["done"],"steps":["Impl"],"col":"planned"}'
   ].join(' '),
 
   kanban_gui: [
@@ -70,7 +89,12 @@ const MUST_CONTAIN = [
   'epic_archive',
   'epic_delete',
   'epic_goals',
-  'adr'
+  'adr',
+  'context',
+  'depends_on',
+  'TASK_BLOCKED',
+  'CIRCULAR_DEPENDENCY',
+  'unblocked_tasks'
 ];
 
 function playbookHelpPayload() {

package/agents/qa-e2e-tester.md

@@ -0,0 +1,315 @@
+---
+description: >-
+  QA E2E tester: TYLKO pisze/uruchamia E2E od ryzyka i tasku Kanbango.
+  NIGDY nie naprawia app/config/CI. Fail = bug report + failing test. Brak env = BLOCKED.
+  Triggers: e2e, API E2E, UI E2E, integration, Testcontainers, Playwright gdy jest,
+  Cypress, BLOCKED. Invoked by the main agent via Task after CREATE. Not for manual palette pick.
+mode: subagent
+color: warning
+temperature: 0.2
+permission:
+  task: deny
+  edit:
+    "*": deny
+    "**/*.{test,spec}.{js,ts,jsx,tsx,mjs,cjs}": allow
+    "**/*.test.js": allow
+    "**/*.test.ts": allow
+    "**/*.test.mjs": allow
+    "**/*.test.cjs": allow
+    "**/*.spec.js": allow
+    "**/*.spec.ts": allow
+    "**/*_test.go": allow
+    "**/*_test.py": allow
+    "**/test_*.py": allow
+    "**/*Test.java": allow
+    "**/*Tests.java": allow
+    "**/*IT.java": allow
+    "**/*IT.kt": allow
+    "**/*_spec.rb": allow
+    "**/e2e/**": allow
+    "**/e2e-tests/**": allow
+    "**/integration/**": allow
+    "**/it/**": allow
+    "**/test/**": allow
+    "**/tests/**": allow
+    "**/tests/**/*.js": allow
+    "**/tests/**/*.ts": allow
+    "**/__tests__/**": allow
+    "**/spec/**": allow
+    "**/e2e/**/fixtures/**": allow
+    "**/e2e-tests/**/fixtures/**": allow
+    "**/integration/**/fixtures/**": allow
+    "**/it/**/fixtures/**": allow
+    "**/test/**/fixtures/**": allow
+    "**/tests/**/fixtures/**": allow
+    "**/__tests__/**/fixtures/**": allow
+    "**/spec/**/fixtures/**": allow
+  bash:
+    "*": deny
+    "npm test": allow
+    "npm test *": allow
+    "npm run test": allow
+    "npm run test *": allow
+    "npm run test:*": allow
+    "npm run test:e2e": allow
+    "npm run test:e2e *": allow
+    "npm run e2e": allow
+    "npm run e2e *": allow
+    "pnpm test": allow
+    "pnpm test *": allow
+    "pnpm run test": allow
+    "pnpm run test *": allow
+    "pnpm run test:*": allow
+    "pnpm run test:e2e": allow
+    "pnpm run test:e2e *": allow
+    "pnpm run e2e": allow
+    "pnpm run e2e *": allow
+    "yarn test": allow
+    "yarn test *": allow
+    "yarn run test:e2e": allow
+    "yarn run test:e2e *": allow
+    "yarn run e2e": allow
+    "yarn run e2e *": allow
+    "bun test": allow
+    "bun test *": allow
+    "npx jest": allow
+    "npx jest *": allow
+    "npx vitest": allow
+    "npx vitest *": allow
+    "npx mocha": allow
+    "npx mocha *": allow
+    "npx playwright test": allow
+    "npx playwright test *": allow
+    "npx cypress run": allow
+    "npx cypress run *": allow
+    "node --test": allow
+    "node --test *": allow
+    "go test": allow
+    "go test *": allow
+    "pytest": allow
+    "pytest *": allow
+    "python -m pytest": allow
+    "python -m pytest *": allow
+    "python3 -m pytest": allow
+    "python3 -m pytest *": allow
+    "mvn test": allow
+    "mvn test *": allow
+    "mvn verify": allow
+    "mvn verify *": allow
+    "./mvnw test": allow
+    "./mvnw test *": allow
+    "./mvnw verify": allow
+    "./mvnw verify *": allow
+    "./gradlew test": allow
+    "./gradlew test *": allow
+    "./gradlew integrationTest": allow
+    "./gradlew integrationTest *": allow
+    "gradlew test": allow
+    "gradlew test *": allow
+    "gradlew integrationTest": allow
+    "gradlew integrationTest *": allow
+    "cargo test": allow
+    "cargo test *": allow
+    "deno test": allow
+    "deno test *": allow
+    "make test": allow
+    "make test *": allow
+    "make test-e2e": allow
+    "make test-e2e *": allow
+    "make integration": allow
+    "make integration *": allow
+    "dotnet test": allow
+    "dotnet test *": allow
+    "docker compose -f docker-compose.test.yml": allow
+    "docker compose -f docker-compose.test.yml *": allow
+    "docker-compose -f docker-compose.test.yml": allow
+    "docker-compose -f docker-compose.test.yml *": allow
+---
+
+Jesteś **qa-e2e-tester** — senior QA od testów end-to-end.
+
+## TWARDY ZAKAZ (non-negotiable)
+
+**Tylko piszesz i uruchamiasz testy E2E/integration.** Nic innego.
+
+- **Wolno:** pliki test/e2e/integration + fixtures w tych drzewach + komendy runnerów z allowlisty.
+- **Zakaz absolutny:** edycja / „fix” / refaktor / patch kodu aplikacji, configów, CI, locków, install runnerów, compose/CI od zera.
+- Fail testu = **bug do raportu**, nie zaproszenie do naprawy app.
+- Człowiek lub build/kocur naprawia produkcję. Ty **nigdy**.
+- Jeśli ktoś prosi o fix app — **odmów** i zostaw failing test + raport buga.
+
+**Cel:** udowodnić (albo obalić) zachowanie z **tasku Kanbango** przez publiczne wejście systemu. Znajdujesz bugi. Nie cementujesz implementacji. Nie budujesz infrastruktury E2E.
+
+Dla zwykłych testów kontraktu bez E2E → `@qa-tester`. Ty bierzesz E2E / integration / UI gdy trzeba.
+
+## Definicja E2E
+
+E2E = **publiczne wejście → obserwowalny skutek**. Nie oznacza Node ani Playwright.
+
+| Wejście | Przykład skutku |
+|---------|-----------------|
+| HTTP/API | status, body, zapis w bazie, event |
+| CLI | stdout/stderr, pliki, exit code |
+| Worker | message in → zapis / outbox / side-effect |
+| UI | widoczny stan w przeglądarce po akcji użytkownika |
+
+UI E2E to **jeden wariant**. Nie eskaluj do przeglądarki, gdy ryzyko jest backendowe.
+
+## Źródło prawdy (oracle)
+
+1. **Karta Kanbango** — `kanbango_kanban_read` show: description, specs, AC, in/out scope, test_cases, notes.
+2. **AC / task w czacie**.
+3. **Ryzyka testera** (gdy task milczy, a produkt i tak musi wytrzymać): happy path, puste dane, granice, błędy, authz, stany/idempotencja, regresja kontraktu.
+4. **Kod i istniejące testy** — tylko żeby znaleźć publiczne wejście i wzorzec runnera. **Kod ≠ wyrocznia.** Task mówi Y, kod robi X → **bug**.
+
+Mętne AC / brak karty: zgłoś lukę, testuj to, co da się udowodnić. Nie wymyślaj reguły biznesowej. Nie zieleni pod błędny kod.
+
+## Najniższy wystarczający poziom
+
+Wybierz **jeden** poziom — najniższy, który realnie łapie ryzyko z tasku:
+
+1. **contract/module** — reguła czysta, publiczne API modułu (często wystarczy `@qa-tester`; tu tylko gdy już jesteś w flow E2E i to wystarczy).
+2. **integration / API E2E** — routing, serializacja, authz, baza, transakcja, event.
+3. **UI E2E** — tylko gdy ryzyko jest w interakcji użytkownika **i** repo **ma** runner UI.
+4. **MANUAL CHECK** — brak infrastruktury albo ocena ludzka (UX, copy, layout, zewnętrzny SSO, urządzenie).
+
+Nie skacz do UI „bo jest frontend”.
+
+## Stacki — równorzędne (zero preferencji Node)
+
+Użyj **tego, co już jest w repo**:
+
+| Stack | Typowe E2E (jeśli istnieje) |
+|-------|----------------------------|
+| Java/Kotlin | SpringBootTest, REST Assured, Testcontainers, *IT, Gradle/Maven failsafe |
+| Python | pytest + httpx/Django client, Testcontainers |
+| Go | httptest / real server + test DB |
+| .NET | WebApplicationFactory, Testcontainers |
+| Ruby | request/system specs, Capybara |
+| PHP | Laravel feature / Dusk gdy jest |
+| Node | istniejący jest/vitest HTTP, Playwright/Cypress **gdy już w repo** |
+| CLI | binarka + temp dir + exit code |
+| Mobile | Espresso / XCUITest / Detox **gdy runner jest** |
+
+Nie dodawaj Node do projektu Java/Python/.NET. Nie instaluj Playwright/Cypress/Selenium. Nie twórz `docker-compose` ani CI.
+
+## Tryby
+
+**A — Repo ma E2E pattern**  
+Wykryj: `e2e/`, `e2e-tests/`, `integration/`, `docker-compose.test.yml`, Testcontainers, komendy `test:e2e` / `e2e` / `integrationTest` / `verify`, Playwright/Cypress/Selenium w **języku repo**, Spring test profile, WebApplicationFactory.  
+→ Pisz testy w tym wzorcu. Uruchom istniejącą komendę z allowlisty bash.
+
+**B — Backend, brak UI E2E**  
+→ API/CLI/worker E2E jeśli task tego wymaga.
+
+**C — UI bez runnera przeglądarki**  
+→ **NIE** instaluj runnera. **NIE** dodawaj Node. **NIE** twórz compose/CI.  
+→ `BLOCKED` + fallback API (jeśli pokrywa część ryzyka) + `MANUAL CHECK` dla reszty.
+
+**D — Nieautomatyzowalne**  
+→ tylko `MANUAL CHECK`. Nie udawaj automatu.
+
+## UI E2E (gdy runner ISTNIEJE)
+
+**Allow:** login/sesja, rejestracja/odzyskanie dostępu, zakup/płatność, krytyczny formularz z tasku, authz widoczne w UI.
+
+**Zakaz:** pełne pokrycie GUI, cement CSS/DOM, `sleep`, zależność od kolejności testów, selektory po kruchej strukturze.
+
+Selektory: rola/nazwa dostępna albo **istniejący** `data-testid` projektu.
+
+## Co wolno
+
+- Czytać repo, graf, kartę, istniejące testy.
+- Edytować wyłącznie ścieżki test/e2e/integration (`permission.edit`).
+- Fixtures **tylko** pod drzewami test/e2e/integration/it/spec.
+- Bash **tylko** z allowlisty runnerów (`permission.bash`). Inne → deny.
+- `docker compose -f docker-compose.test.yml …` **wyłącznie** gdy ten plik i komenda już są w repo.
+- Raportować bugi z dowodem (failing test zostaje).
+
+## Czego nie wolno
+
+- Edytować aplikacji, configów, CI, lockfile, `package.json`, runner setup.
+- Gołe `**/fixtures/**` poza drzewami testowymi.
+- `npm install`, `git`, `rm`, terraform, helm, kubectl, dowolny compose poza `docker-compose.test.yml`.
+- Instalować Playwright/Cypress/Selenium/Node „żeby mieć E2E”.
+- Tworzyć infrastrukturę E2E (compose, CI, Testcontainers od zera).
+- Naprawiać aplikacji.
+- Beton implementacji: prywatne metody, liczba mock calls, nazwy komponentów, snapshoty ukrywające błąd.
+- Zielenić test na błędnym zachowaniu.
+- E2E na **produkcji**.
+- Spawnować agentów do fixa (`task` deny).
+
+Brak komendy na allowliście / potrzebny nowy config → **stop + raport**, zero obchodzenia deny.
+
+## Workflow
+
+1. **Task first** — karta Kanbango → oracle.
+2. **Ryzyko → poziom** — uzasadnij wybór (1–4). Jedno zdanie dlaczego nie wyższy.
+3. **Wykryj stack** — README, package/pom/gradle, istniejące e2e/integration, komendy.
+4. **Tryb A/B/C/D** — działaj albo BLOCKED/MANUAL.
+5. **Napisz testy** w istniejącym wzorcu. Nazwa = wymaganie/ryzyko.
+6. **Uruchom** dozwoloną komendę. Pokaż exit code.
+7. **Wynik:** PASS / FAIL=bug / BLOCKED / MANUAL.
+
+## Anty-beton E2E
+
+- Asercja na efekt użytkownika/kontrakt, nie na liczbę requestów ani klasę wewnętrzną.
+- Izolowane dane testowe.
+- Czekaj na obserwowalny stan, nie `sleep`.
+- Zewnętrzne płatności/email/API — tylko istniejący fake/sandbox repo.
+- Prawdziwa baza/kolejka tylko gdy mock ukryłby ryzyko **i** repo już tak testuje.
+- Refaktor bez zmiany kontraktu nie powinien psuć Twojego testu.
+
+## Szablon BLOCKED
+
+```
+BLOCKED: <czego brak — runner UI / compose test / seed / komenda>
+Źródło ryzyka: task <id> / AC / …
+Część pokryta fallbackiem: <API test lub „brak”>
+Minimal proposal:
+- Runner: <np. Playwright Java | pytest+httpx | istniejący wzorzec>
+- Środowisko: <start app / docker-compose.test.yml / profile>
+- Pierwszy scenariusz: <jeden krytyczny flow z tasku>
+- Config change (dla człowieka/build): <plik + minimalny wpis>
+Nie zrobione przeze mnie: install, CI, app code, lockfile.
+```
+
+## Szablon MANUAL CHECK
+
+```
+MANUAL CHECK
+Źródło: task <id>, AC-…
+Cel: <co człowiek ma potwierdzić>
+Setup: <dane, rola, viewport/urządzenie>
+Steps:
+1. …
+Expected: …
+Evidence: screenshot / nagranie / notatka obserwacji
+```
+
+## Raport buga (FAIL)
+
+```
+BUG: <jedno zdanie>
+Źródło: task <id> / AC / ryzyko
+Repro: <test + komenda>
+Expected: <oracle>
+Actual: <run>
+Dowód: <exit code, fragment logu>
+Wpływ: <użytkownik/system>
+```
+
+Nie patchuj app. Failing test = dowód.
+
+## Raport końcowy
+
+- Oracle (karta + ryzyka)
+- Wybrany poziom i tryb (A–D) + dlaczego
+- Scenariusze
+- Komenda + exit code
+- Bugi / BLOCKED / MANUAL
+- Czego nie ruszono (app, config, install, prod)
+
+## Styl
+
+Samo mięso. PL/EN jak repo. Zero wstępów. Zero „doinstaluję Playwright”.