kushi-agents 3.4.2 → 3.12.1

package/plugin/skills/self-check/run.ps1

@@ -354,12 +354,12 @@ if ($Deep) {
             Add-Finding D2 'Snapshot/Stream' 'warning' "Skill $($d.Name) doesn't cite snapshot-vs-stream.instructions.md" "Add a reference (e.g. 'per snapshot-vs-stream.instructions.md') in the skill body." $f 0
         }
     }
-    # D3: pull-* must put WorkIQ first
+    # D3: pull-* must list WorkIQ in Tools section (order is the skill's choice; some skills correctly prefer REST/host first when WorkIQ summarizes — see pull-crm/email/onenote v3.7.x)
     foreach ($d in $skillDirs | Where-Object { $_.Name -like 'pull-*' }) {
         $f = Join-Path $d.FullName 'SKILL.md'
         $text = $mdText[$f]
-        if ($text -notmatch '(?ms)1\.\s*\*\*WorkIQ\*\*') {
-            Add-Finding D3 'WorkIQ-first' 'warning' "Skill $($d.Name) doesn't list **WorkIQ** as tool #1" "Restructure the Tools section so WorkIQ is item 1." $f 0
+        if ($text -notmatch '(?ms)\bWorkIQ\b') {
+            Add-Finding D3 'WorkIQ-listed' 'warning' "Skill $($d.Name) doesn't reference **WorkIQ** in its Tools section" "Add WorkIQ to the Tools section (order is per-skill; verbatim-required skills may correctly prefer REST/host first)." $f 0
         }
     }
     # D4: live install SKILL.md = agent file
@@ -450,6 +450,140 @@ if ($Deep) {
         }
     }
 
+    # D9: v3.7.6 learnings register — required files present + non-empty
+    $learnDir = Join-Path $pluginDir 'learnings'
+    if (-not (Test-Path $learnDir)) {
+        Add-Finding D9 'Learnings register' 'warning' "plugin/learnings/ directory missing — required by capture-learnings.instructions.md (v3.7.6)" "Create plugin/learnings/ with README + per-source files." $learnDir 0
+    } else {
+        $expectedLearnFiles = @('README.md','ado.md','crm.md','email.md','teams.md','meetings.md','onenote.md','sharepoint.md','cross-cutting.md')
+        foreach ($lf in $expectedLearnFiles) {
+            $lp = Join-Path $learnDir $lf
+            if (-not (Test-Path $lp)) {
+                Add-Finding D9 'Learnings register' 'warning' "Missing learnings file: $lf" "Create plugin/learnings/$lf with at minimum the section template from README.md" $lp 0
+            } elseif ((Get-Item $lp).Length -lt 50) {
+                Add-Finding D9 'Learnings register' 'warning' "Learnings file $lf is empty or stub" "Seed with at least one capture-template entry." $lp 0
+            }
+        }
+    }
+
+    # D10: v3.7.6 doctrine instructions — required files present + applyTo glob set
+    $reqInstructions = @(
+        'capture-learnings.instructions.md',
+        'cleanup-on-resolution.instructions.md',
+        'run-reports.instructions.md',
+        'verbatim-by-default.instructions.md'
+    )
+    $instrDir = Join-Path $pluginDir 'instructions'
+    foreach ($ri in $reqInstructions) {
+        $ip = Join-Path $instrDir $ri
+        if (-not (Test-Path $ip)) {
+            Add-Finding D10 'v3.7.6 doctrine' 'warning' "Required v3.7.6 instruction missing: $ri" "Create plugin/instructions/$ri with applyTo + HARD rule body." $ip 0
+        } else {
+            $fm = Get-Frontmatter $ip
+            if (-not $fm.applyTo) {
+                Add-Finding D10 'v3.7.6 doctrine' 'warning' "$ri missing applyTo in frontmatter" "Add ``applyTo: ""**""`` to frontmatter." $ip 0
+            }
+        }
+    }
+
+    # D11: pull-* skills SKILL.md cite verbatim-by-default contract in front blockquote
+    $pullSkillDirs = Get-ChildItem -Path (Join-Path $pluginDir 'skills') -Directory | Where-Object { $_.Name -like 'pull-*' -or $_.Name -in @('bootstrap-project','refresh-project') }
+    foreach ($sd in $pullSkillDirs) {
+        $sf = Join-Path $sd.FullName 'SKILL.md'
+        if (Test-Path $sf) {
+            $sc = Get-Content $sf -Raw
+            if ($sc -notmatch 'verbatim-by-default') {
+                Add-Finding D11 'Verbatim contract' 'warning' "$($sd.Name)/SKILL.md does not reference verbatim-by-default doctrine" "Add a one-line cite in the front blockquote: 'Honors verbatim-by-default.instructions.md (v3.7.6).'" $sf 0
+            }
+            if ($sc -notmatch 'capture-learnings|cleanup-on-resolution|run-reports') {
+                Add-Finding D11 'v3.7.6 contracts' 'warning' "$($sd.Name)/SKILL.md does not reference v3.7.6 process contracts (capture-learnings / cleanup-on-resolution / run-reports)" "Add the v3.7.6 contracts blockquote near the top of SKILL.md." $sf 0
+            }
+        }
+    }
+
+    # D12: discover-once / consume-deterministically — pull-* skills cite m365-id-registry; pull-onenote carries v2.5.0 retry-registry + EULA contracts (kushi v3.7.9)
+    $idRegistryInst = Join-Path $pluginDir 'instructions\m365-id-registry.instructions.md'
+    if (-not (Test-Path $idRegistryInst)) {
+        Add-Finding D12 'ID registry doctrine' 'warning' "plugin/instructions/m365-id-registry.instructions.md is missing" "Restore the m365-id-registry instruction from kushi v3.7.8." $idRegistryInst 0
+    }
+    $registryConsumers = @(
+        @{ name='bootstrap-project'; required=@('m365-id-registry','knownSections') },
+        @{ name='refresh-project';   required=@('m365-id-registry','knownSections') },
+        @{ name='pull-onenote';      required=@('m365-id-registry','one_pages', 'webPageId', 'auth-required', 'playwright-profile') },
+        @{ name='pull-misc';         required=@('m365-id-registry','external-links', 'misc_links', 'placeholder', 'delegated') }
+    )
+    foreach ($rc in $registryConsumers) {
+        $sf = Join-Path $pluginDir "skills\$($rc.name)\SKILL.md"
+        if (Test-Path $sf) {
+            $sc = Get-Content $sf -Raw
+            foreach ($needle in $rc.required) {
+                if ($sc -notmatch [regex]::Escape($needle)) {
+                    Add-Finding D12 'ID registry contract' 'warning' "$($rc.name)/SKILL.md is missing required token '$needle'" "Add the canonical reference per m365-id-registry.instructions.md (and pull-onenote v2.5.0 contract for retry registry / EULA pre-flight)." $sf 0
+                }
+            }
+        }
+    }
+
+
+    # D13: meetings verbatim/ folder required per meeting block (v3.10.0)
+    # Walks every Evidence/*/meetings/stream/*.md, extracts per-meeting headings,
+    # and verifies a sibling Evidence/*/meetings/verbatim/<YYYY-MM-DD-HHMM>_<slug>/
+    # directory exists with at least one non-empty content file beyond captured-at.txt.
+    $verbatimInst = Join-Path $pluginDir 'instructions\meetings-verbatim-required.instructions.md'
+    if (-not (Test-Path $verbatimInst)) {
+        Add-Finding D13 'Meetings verbatim doctrine' 'warning' "plugin/instructions/meetings-verbatim-required.instructions.md is missing" "Restore the meetings-verbatim-required instruction from kushi v3.10.0." $verbatimInst 0
+    }
+    # Walk known engagement roots to find Evidence/*/meetings/stream/*.md files
+    $engagementRoots = @()
+    $envRoot = $env:KUSHI_ENGAGEMENT_ROOT
+    if ($envRoot -and (Test-Path $envRoot)) { $engagementRoots += $envRoot }
+    $defaultEngRoot = Join-Path $env:USERPROFILE 'OneDrive - Microsoft\ISE\Engagement Assets'
+    if (Test-Path $defaultEngRoot) { $engagementRoots += $defaultEngRoot }
+    foreach ($engRoot in ($engagementRoots | Select-Object -Unique)) {
+        $streamFiles = Get-ChildItem -Path $engRoot -Recurse -Filter '*_meetings-stream.md' -ErrorAction SilentlyContinue |
+                       Where-Object { $_.FullName -match '\\Evidence\\[^\\]+\\(meetings|Meetings)\\stream\\' }
+        foreach ($sf in $streamFiles) {
+            $aliasDir = Split-Path (Split-Path (Split-Path $sf.FullName -Parent) -Parent) -Parent
+            $verbatimDir = Join-Path (Split-Path (Split-Path $sf.FullName -Parent) -Parent) 'verbatim'
+            $content = Get-Content $sf.FullName -Raw
+            # Look for per-meeting headings, accepting either order:
+            #   "## <title> — <YYYY-MM-DD>" (templates/weekly default)
+            #   "## <YYYY-MM-DD> — <title>" (date-first variant used in some streams)
+            $meetingHeads = [regex]::Matches($content, '(?m)^#{2,3}\s+(?:(?<title>.+?)\s+—\s+(?<date>\d{4}-\d{2}-\d{2})|(?<date2>\d{4}-\d{2}-\d{2})\s+—\s+(?<title2>.+?))(?:\s*\(|\s*,|\s*$)')
+            foreach ($mh in $meetingHeads) {
+                $title = if ($mh.Groups['title'].Success) { $mh.Groups['title'].Value.Trim() } else { $mh.Groups['title2'].Value.Trim() }
+                $date = if ($mh.Groups['date'].Success) { $mh.Groups['date'].Value } else { $mh.Groups['date2'].Value }
+                # Strip trailing "(HH:MM–HH:MM)" or similar
+                $title = ($title -replace '\s*\([^)]*\)\s*$','').Trim()
+                # Skip placeholder/template heads
+                if ($title -match '^\{\{' -or $title -match 'NEXT_MEETING_TITLE') { continue }
+                $slug = ($title.ToLower() -replace '[^a-z0-9]+','-').Trim('-')
+                if ($slug.Length -gt 60) { $slug = $slug.Substring(0,60).TrimEnd('-') }
+                $expectedPattern = "$date-*_$slug"
+                $matches = if (Test-Path $verbatimDir) {
+                    Get-ChildItem -Path $verbatimDir -Directory -Filter $expectedPattern -ErrorAction SilentlyContinue
+                } else { @() }
+                if ($matches.Count -eq 0) {
+                    Add-Finding D13 'Meetings verbatim' 'warning' "Per-meeting block '$title' ($date) in $($sf.Name) has no sibling verbatim/<$date-HHMM>_$slug/ directory" "Re-run pull-meetings Half A for this meeting per meetings-verbatim-required.instructions.md. Verbatim folder must contain chat-messages.json + .md + transcript.* (or transcript-source.md) + recording-url.txt + captured-at.txt + coverage.md." $sf.FullName 0
+                } else {
+                    foreach ($vd in $matches) {
+                        $vdFiles = Get-ChildItem -Path $vd.FullName -File -ErrorAction SilentlyContinue
+                        $contentFiles = @($vdFiles | Where-Object { $_.Name -ne 'captured-at.txt' -and $_.Name -ne 'coverage.md' -and $_.Length -gt 0 })
+                        if ($contentFiles.Count -eq 0) {
+                            Add-Finding D13 'Meetings verbatim' 'warning' "Verbatim folder $($vd.Name) is empty (only captured-at.txt / coverage.md)" "Capture cascade failed silently. Re-run pull-meetings Half A; if all paths still fail, document in coverage.md and ask user to paste." $vd.FullName 0
+                        } else {
+                            # D13.c — transcript-class file required (transcript.vtt | transcript.txt | transcript-source.md)
+                            $transcriptFiles = @($vdFiles | Where-Object { $_.Name -in @('transcript.vtt','transcript.txt','transcript-source.md') -and $_.Length -gt 0 })
+                            if ($transcriptFiles.Count -eq 0) {
+                                Add-Finding D13 'Meetings verbatim' 'warning' "Verbatim folder $($vd.Name) has chat but NO transcript-class file (transcript.vtt | transcript.txt | transcript-source.md)" "Run the exhaustive transcript cascade per meetings-verbatim-required.instructions.md: m365_get_transcript → Graph REST /onlineMeetings/.../transcripts/.../content → m365_get_facilitator_notes → WorkIQ strict full-text pull → recording download. Chat alone is NOT a transcript. If all paths fail, document in coverage.md and prompt user to paste — paste lands in transcript.txt." $vd.FullName 0
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
     # D8: live templates/fde/ matches repo
     $liveFdeTpl = Join-Path $env:USERPROFILE '.copilot\m-skills\kushi\templates\fde'
     $repoFdeTpl = Join-Path $pluginDir 'templates\fde'
@@ -473,6 +607,54 @@ if ($Deep) {
             }
         }
     }
+
+    # D14: evidence-layout-canonical — no non-canonical source-output folders under <project>/
+    # Per evidence-layout-canonical.instructions.md: every per-source artifact MUST live under
+    # <project>/Evidence/<alias>/<source>/. Sibling folders under <project>/ that contain
+    # source-output markdown (email-context/, notes/, _Weekly Summaries/, <source>/, ...) are defects.
+    $layoutInst = Join-Path $pluginDir 'instructions\evidence-layout-canonical.instructions.md'
+    if (-not (Test-Path $layoutInst)) {
+        Add-Finding D14 'Evidence layout' 'warning' "plugin/instructions/evidence-layout-canonical.instructions.md is missing" "Restore the canonical-layout doctrine from kushi v3.12.1." $layoutInst 0
+    }
+    $allowedSiblings = @('Evidence','State','Reports','.kushi','.kushi-reference','.project-evidence','.vscode','.git')
+    $sourceTokens = @(
+        'email-context','email-summary','email-summaries',
+        'teams-context','teams-summary','teams-summaries',
+        'meeting-context','meetings-context','meeting-notes','meetings-notes',
+        'onenote-context','onenote-notes','notes',
+        'sharepoint-context','sp-context',
+        'crm-context','ado-context',
+        '_Weekly Summaries','_WeeklySummaries','weekly-summaries',
+        'email','teams','meetings','onenote','sharepoint','crm','ado'
+    )
+    $layoutEngRoots = @()
+    if ($env:KUSHI_ENGAGEMENT_ROOT -and (Test-Path $env:KUSHI_ENGAGEMENT_ROOT)) { $layoutEngRoots += $env:KUSHI_ENGAGEMENT_ROOT }
+    $layoutDefaultRoot = Join-Path $env:USERPROFILE 'OneDrive - Microsoft\ISE\Engagement Assets'
+    if (Test-Path $layoutDefaultRoot) { $layoutEngRoots += $layoutDefaultRoot }
+    foreach ($engRoot in ($layoutEngRoots | Select-Object -Unique)) {
+        $projectDirs = Get-ChildItem -Path $engRoot -Directory -ErrorAction SilentlyContinue |
+                       Where-Object { Test-Path (Join-Path $_.FullName 'Evidence') }
+        foreach ($pd in $projectDirs) {
+            $siblings = Get-ChildItem -Path $pd.FullName -Directory -ErrorAction SilentlyContinue |
+                        Where-Object { $allowedSiblings -notcontains $_.Name }
+            foreach ($sib in $siblings) {
+                $sibName = $sib.Name
+                $isSourceLike = $false
+                foreach ($tok in $sourceTokens) {
+                    if ($sibName -ieq $tok) { $isSourceLike = $true; break }
+                }
+                if (-not $isSourceLike) {
+                    # Heuristic: also flag folders containing *-summary.md / *-stream.md / current-state.md / index.md
+                    $mdHits = Get-ChildItem -Path $sib.FullName -Recurse -File -Include '*-summary.md','*-stream.md','current-state.md','index.md' -ErrorAction SilentlyContinue | Select-Object -First 1
+                    if ($mdHits) { $isSourceLike = $true }
+                }
+                if ($isSourceLike) {
+                    $canonical = "$($pd.FullName)\Evidence\<alias>\<source>\(snapshot|stream|_legacy_${sibName}_pre-bootstrap)\"
+                    Add-Finding D14 'Evidence layout' 'warning' "Non-canonical source folder '$sibName' under project '$($pd.Name)' — violates evidence-layout-canonical.instructions.md" "Move contents to $canonical (preserve mtimes; do not delete). Log under '## Layout migrations' in next refresh report; add runs: entry with type: layout-migration in Evidence/run-log.yml." $sib.FullName 0
+                }
+            }
+        }
+    }
 }
 
 # === Output ===
@@ -514,4 +696,4 @@ if ($Json) {
 }
 
 if ($StrictExit -and $findings.Count -gt 0) { exit 1 }
-exit 0
+exit 0

package/plugin/templates/ado-update/discussion-comment.template.md

@@ -0,0 +1,26 @@
+**Kushi weekly update — {{consolidatedDate}}**
+
+**TL;DR:** {{tldr}}
+
+**Decisions this week**
+
+{{decisionsList}}
+
+**Action items**
+
+{{actionItemsList}}
+
+**Risks / blockers**
+
+{{risksList}}
+
+**Asks**
+
+{{asksList}}
+
+**Evidence pack**
+
+- [Consolidated week of {{consolidatedDate}}]({{consolidatedLink}})
+- {{numCitedSources}} cited sources
+
+— Generated by Kushi v{{kushiVersion}} · proposed {{generatedDate}} · ledger:ado-updates/{{generatedDate}}/ledger.jsonl

package/plugin/templates/ado-update/integrations-ado-writes.example.yml

@@ -0,0 +1,49 @@
+# Per-project ADO write block — append this to `<project>/integrations.yml` under the existing `ado:` key.
+# This template is the "writes" sub-block ONLY; the existing `engagement_id`, `area_path`, `tag`,
+# `title_filter`, `discovery_hints` keys stay as they are. propose-ado-update + apply-ado-update
+# read from the SAME integrations.yml that pull-ado already uses — no separate config file.
+#
+# Global ADO connection (tenantId, organization, apiVersion, auth) lives at:
+#   <engagement-root>/.project-evidence/ado/config.yml
+# Do NOT duplicate those keys here.
+
+ado:
+  # --- existing keys (managed by pull-ado / bootstrap) ---
+  engagement_id: 12345              # REQUIRED for writes. Must be a real ADO Initiative work-item ID.
+  area_path: ''
+  tag: ''
+  title_filter: '<project>'
+
+  # --- new "writes" sub-block (read by propose-ado-update + apply-ado-update) ---
+  writes:
+    statusSummary:
+      enabled: true                   # produce a field-update item in proposed.md
+      fieldRefName: "Custom.FDEStatusSummary"
+      # Strategy options:
+      #   append-month  (default) — append "<MMM YYYY>: <one-liner>" if no entry exists for this month
+      #   replace                 — single-line replacement
+      #   rolling-6               — keep last 6 month lines, prepend new
+      strategy: "append-month"
+      # autoApply: when true AND confidence == "high" AND value matches the strategy pattern,
+      #            apply-ado-update will write without interactive approval (logged as auto:<rule>).
+      # Safe to start true for append-month: format is narrow and the test-on-rev guards drift.
+      autoApply: true
+
+    discussionComment:
+      enabled: true                   # produce a comment-update item in proposed.md
+      # autoApply: discussion comments are content-rich and harder to validate by pattern.
+      # Default false — flip to true only after several weeks of clean dry-runs.
+      autoApply: false
+
+    approvals:
+      # defaultGate: "review" (always prompt) | "auto" (apply if every item meets autoApply rules above)
+      defaultGate: "review"
+      # notifyOnApply: post a one-line summary to the user via Teams DM after a successful apply run.
+      # Options: "teams" | "off"
+      notifyOnApply: "teams"
+
+    # Hard allowlist — apply-ado-update will refuse to write any field reference name not in this list,
+    # even if it appears in proposed.md. This is the last-line guard against a malformed proposal.
+    allowlist:
+      fields:
+        - "Custom.FDEStatusSummary"

package/plugin/templates/ado-update/proposed.template.md

@@ -0,0 +1,78 @@
+# Proposed ADO update — {{project}}
+
+> Generated by `propose-ado-update` v{{kushiVersion}} · {{generatedDate}}
+> Source: `<project>/Evidence/_Consolidated/{{consolidatedDate}}_consolidated.md`
+> Initiative (from `integrations.yml ado.engagement_id`): [#{{engagementId}}]({{adoLink}})
+>
+> **No ADO writes have happened.** Review below, then run `@Kushi apply ado {{project}}` to (in v0.1.0-preview) write a planned.jsonl, or (when the write path lands) actually apply the approved items.
+
+{{staleEvidenceWarning}}
+
+---
+
+## 1. Field update — `{{fieldRefName}}`
+
+**Strategy:** `{{strategy}}` · **Confidence:** `{{fieldConfidence}}` · **Auto-apply eligible:** `{{fieldAutoApplyEligible}}`
+
+**Current value (live from ADO):**
+
+```text
+{{currentSummary}}
+```
+
+**Proposed new value:**
+
+```text
+{{proposedSummary}}
+```
+
+**Diff:**
+
+```diff
+{{summaryDiff}}
+```
+
+**Citations:**
+
+{{fieldCitations}}
+
+---
+
+## 2. Discussion comment
+
+**Confidence:** `{{commentConfidence}}` · **Auto-apply eligible:** `{{commentAutoApplyEligible}}`
+
+```markdown
+{{discussionCommentRendered}}
+```
+
+**Per-bullet citations:**
+
+{{commentCitations}}
+
+---
+
+## Apply
+
+```text
+@Kushi apply ado {{project}}
+```
+
+This will (in v0.1.0-preview):
+
+- Re-fetch live ADO state and verify no drift since this proposal.
+- Check for duplicate Kushi comments on the same work item this week.
+- Prompt for approval (or apply auto-allowlisted items per `.kushi/ado-update.yml`).
+- Write `ado-updates/{{generatedDate}}/planned.jsonl` (preview-stub) — no real ADO calls.
+
+When the write path lands in a follow-up release:
+
+- Apply approved items via ADO REST (PATCH for field, POST for comment).
+- Append to `ado-updates/{{generatedDate}}/ledger.jsonl` with a reverse op for every applied write.
+- Optionally post a one-line Teams DM summary to the approver.
+
+---
+
+## Stats
+
+`{{numFieldItems}} field · {{numCommentItems}} comment · {{numCitedBullets}} cited bullets · {{highCount}} high / {{medCount}} medium / {{lowCount}} low confidence`

package/plugin/templates/init/external-links.template.txt

@@ -0,0 +1,30 @@
+# External Context Links - <PROJECT_NAME>
+# One link per line:
+# <type>|<owner>|<title>|<url-or-path>|<notes>
+#
+# Supported types (kushi v3.10.0+):
+#   onenote     — delegated to pull-onenote
+#   sharepoint  — delegated to pull-sharepoint
+#   ado         — delegated to pull-ado
+#   loop        — Microsoft Loop page (browser capture via persisted profile)
+#   web         — public webpage (HTTP fetch + Readability)
+#   confluence  — anonymous Confluence page (HTTP fetch)
+#   learn       — learn.microsoft.com (HTTP)
+#   docs        — generic docs site (HTTP)
+#   pdf         — public PDF (HTTP fetch + extract)
+#   github      — GitHub repo or file (HTTP, raw)
+#   file        — local file under <engagement-root>/<project>/ (relative path)
+#
+# Rules:
+# - Keep owner as a real person or team name
+# - Keep title short and stable for source attribution
+# - Use project-relative paths for type=file
+# - Lines starting with # are comments and ignored
+# - URLs containing <PASTE_*_URL> or <TODO*> are flagged as `placeholder`
+#
+# Example entries (delete after seeding real ones):
+# onenote|Usha Krishnan|<Project> OneNote Section|<PASTE_ONENOTE_URL>|Section discovered via WorkIQ
+# sharepoint|<Owner>|<Title>|<PASTE_SHAREPOINT_URL>|Workshop deck / planning doc
+# loop|<Owner>|<Loop Page Title>|<PASTE_LOOP_URL>|Live planning page in Loop
+# web|Microsoft|Relevant Product Documentation|<PASTE_PUBLIC_URL>|External reference material
+# file|<Owner>|Action Register|action-register.md|Master action list with owner and due date

package/plugin/templates/init/project-integrations.template.yml

@@ -1,9 +1,61 @@
 # Per-project integration filter.  Lives at: <project>\integrations.yml
-# Tells the skill how to find THIS project's records in the (global) CRM and ADO.
-# Connection / auth / field mappings are NOT here — those are global.
+# Tells the skill how to find THIS project's records in the (global) CRM and ADO,
+# AND declares the explicit boundaries inside which Kushi is allowed to query.
+#
+# Connection / auth / field mappings are NOT here — those are global at:
+#   <engagement-root>/.project-evidence/crm/config.yml
+#   <engagement-root>/.project-evidence/ado/config.yml
+#
+# Boundaries doctrine: see plugin/instructions/scope-boundaries.instructions.md.
+# Required boundary keys MUST be filled or the source is disabled (not silently widened).
 
 project: '{{PROJECT_NAME}}'
 
+# ─────────────────────────────────────────────────────────────────────────────
+# BOUNDARIES — partial-determinism contract (kushi v3.7.0+)
+# Every WorkIQ / m365 / Graph / REST query in every pull-* skill is scoped to
+# the values below. Empty required key for a source = source disabled.
+# ─────────────────────────────────────────────────────────────────────────────
+boundaries:
+  date_window_days: 30                          # default lookback window for streams
+
+  email:
+    mailboxes: []                               # required: e.g. ["Inbox", "Inbox/FDE Intake"]
+    sender_domains: []                          # optional: narrow by sender domain
+    subject_keywords: []                        # optional: additional narrowing
+
+  teams:
+    chat_ids: []                                # required: pinned chat IDs (no fuzzy discovery)
+    channel_ids: []                             # required for channel evidence (empty = none)
+
+  meetings:
+    series_join_urls: []                        # required: pinned join URLs (not subject-keyword-fuzzy)
+    organizer_emails: []                        # optional
+
+  onenote:
+    section_file_ids: []                        # required (one of these): drive-item IDs of section files (.one) — narrowest, IDs survive renames
+    section_group_ids: []                       # required (one of these): drive-item IDs of section GROUPS (folders containing sections); pull-onenote enumerates every section + page within
+    notebooks: []                               # optional: broaden if neither sections nor section groups known
+
+  sharepoint:
+    local_folders: []                           # required: e.g. ["C:\\…\\<Project>"]
+    site_urls: []                               # optional: online-only docs
+    drive_ids: []                               # optional: Graph-direct access
+
+  crm:
+    entity_sets: []                             # optional: overrides global defaultEntitySet
+    record_ids: []                              # required if crm enabled: pinned record GUIDs
+    request_ids: []                             # OR pinned FE-XXXXX IDs
+
+  ado:
+    area_paths: []                              # required if ado enabled: ["ISE-Engagements\\<Project>"]
+    iteration_paths: []                         # optional
+    initiative_query: ''                        # optional: saved WIQL query ID
+    work_item_ids: []                           # optional: pin specific work items
+
+# ─────────────────────────────────────────────────────────────────────────────
+# CRM resolution hints (consumed once boundaries.crm is satisfied)
+# ─────────────────────────────────────────────────────────────────────────────
 crm:
   # Provide ONE of these:
   record_id: ''                          # e.g. 00000000-0000-0000-0000-000000000000  (preferred)
@@ -12,6 +64,9 @@ crm:
   # Optional: override default app context
   # app_id: 833534b8-5db0-4036-a029-4e4e4d7d4315
 
+# ─────────────────────────────────────────────────────────────────────────────
+# ADO resolution hints (consumed once boundaries.ado is satisfied)
+# ─────────────────────────────────────────────────────────────────────────────
 ado:
   # Provide ONE primary locator (more specific = better):
   engagement_id: 0                       # ADO Engagement work item ID  (preferred)

package/plugin/templates/snapshot/meeting-verbatim.template.md

@@ -0,0 +1,110 @@
+# Meeting Verbatim Folder — Template
+
+> **This is a verbatim/ folder template.** It defines what files belong inside `Evidence/<alias>/meetings/verbatim/<YYYY-MM-DD-HHMM>_<slug>/` per `meetings-verbatim-required.instructions.md`. The actual folder contains files, not this README.
+
+## Required files
+
+### `captured-at.txt`
+```
+started_at: 2026-05-18T09:43:12-04:00
+completed_at: 2026-05-18T09:43:47-04:00
+kushi_version: 3.10.0
+capture_paths_attempted:
+  - workiq: returned summary (transcript-source.md)
+  - m365_get_transcript: failed (Tool execution failed)
+  - m365_list_chat_messages: ok (22 messages → chat-messages.json)
+  - attachments: 1 image downloaded
+  - copilot_recap: not posted to chat
+final_status: ok-summary-and-chat (no raw VTT)
+```
+
+### `coverage.md`
+```markdown
+# Coverage — <meeting title> — <date>
+
+## What was captured
+- Chat thread (N messages, all bodies verbatim) — chat-messages.json + chat-messages.md
+- WorkIQ-derived Copilot summary (NOT a verbatim transcript) — transcript-source.md
+- Recording URL (may expire — capture content while live) — recording-url.txt
+- Shared chat attachments (M files) — attachments/
+
+## What was attempted but unavailable
+- Raw VTT transcript via m365_get_transcript — Tool execution failed
+- Copilot recap card on chat — not posted
+
+## Expiry risk
+- Recording URL points to SharePoint; subject to tenant retention (default 60 days). Capture content NOW; do not assume the URL will still resolve.
+- Chat messages persist with the Teams chat object — lower expiry risk but still subject to user/admin retention.
+
+## Source basis classification (for stream/ citation)
+`reconstructed from meeting chat + WorkIQ summary (no raw transcript)`
+```
+
+### `chat-messages.json`
+Raw `m365_list_chat_messages` response. Do NOT re-pretty-print; preserve API field names and order.
+
+### `chat-messages.md`
+```markdown
+# Chat verbatim — <meeting title> — <chat id>
+
+> Captured <ISO timestamp>. <N> messages. Full bodies verbatim.
+
+---
+
+## [2026-05-13T15:32:11-04:00] Usha Krishnan
+<full message body verbatim, HTML-stripped to markdown if possible, otherwise raw text>
+
+## [2026-05-13T15:34:02-04:00] Sachin Gandhi
+<...>
+
+(... one heading-block per message, chronological ...)
+```
+
+## Conditional files
+
+### `transcript.vtt`
+Raw VTT bytes returned by `m365_get_transcript` or any tool that yields the actual transcript. Do not edit, do not summarize.
+
+### `transcript.txt`
+Plain-text transcript when only plain text is available. Same shape: verbatim, no summarization.
+
+### `transcript-source.md`
+When the only available "transcript" is a WorkIQ Copilot summary (not raw turns):
+
+```markdown
+# Transcript source — <meeting title> — <date>
+
+> **WARNING: This is NOT a verbatim transcript.** This is a Copilot-generated summary returned by WorkIQ as the only available transcript-derived artifact. Treat it as best-effort evidence, not as ground truth. Raw VTT was not retrievable on <date> via <method>.
+
+---
+
+<WorkIQ markdown output verbatim, untouched>
+```
+
+### `recording-url.txt`
+One URL per line. Include the SharePoint Stream URL plus any redirect URLs found in chat. Example:
+```
+https://microsoft-my.sharepoint-df.com/personal/.../Recordings/<file>.mp4?web=1
+```
+
+### `recap-card.md`
+Verbatim text of any Copilot recap card posted to the chat. Preserve markdown.
+
+### `attachments/`
+Subfolder; one file per attachment. Use the original filename. If two attachments share a name, append `-2`, `-3`. Captured via `m365_download_file` against the URL in the chat message.
+
+## Validation
+
+> This template documents a FOLDER, not a single file. Per meetings-verbatim-required.instructions.md and 	horoughness-detector.instructions.md, the skill validates the verbatim folder it produces (not this README). Checklist:
+
+- [ ] captured-at.txt exists with started_at + completed_at + final_status
+- [ ] At least one of: transcript.vtt, transcript.txt, transcript-source.md (transcript-class file — chat alone is NOT a transcript)
+- [ ] If transcript-source.md used: WARNING header is present and coverage.md confirms VTT + plain-text paths were attempted first
+- [ ] chat-messages.md rendered when chat-messages.json present (verbatim bodies, chronological, one heading per message)
+- [ ] recording-url.txt present when meeting had a recording; recording.mp4 present if size < 200MB
+- [ ] facilitator-notes.md present when m365_get_facilitator_notes returned content
+- [ ] attachments/ populated when chat referenced any shared files
+- [ ] coverage.md explains every attempted capture path (success + failure) and final source-basis classification
+- [ ] captured-at.txt logs every transcript cascade step taken (a, b, c, d, e) — proves cascade was exhaustive, not first-success
+- [ ] no-link-only-stubs (no file is a single URL pointing offsite when the content was retrievable)
+- [ ] sibling stream/ per-meeting block cites this folder by relative path, prefers transcript-class file over chat for source citations

package/plugin/templates/snapshot/meetings-series-index.template.md

@@ -20,7 +20,9 @@
 
 ## Notes
 
-- Per-meeting transcripts and decisions are in `stream/<week>_meetings-stream.md`.
+- Per-meeting curated blocks (attendees, decisions, transcript walk-through) are in `stream/<week>_meetings-stream.md`.
+- Per-meeting **raw immutable verbatim** (chat-messages.json/md, transcript.vtt or transcript-source.md, recording-url.txt, attachments/) lives in `verbatim/<YYYY-MM-DD-HHMM>_<slug>/` siblings. Required per `meetings-verbatim-required.instructions.md` (v3.10.0) because meetings expire (tenant retention purges recordings + VTT).
+- The curated stream blocks cite the verbatim files; the two are not interchangeable.
 
 ## Validation