langflower 0.1.1 → 0.1.2

package/vendor/node-sdk/dist/node-factory/define-tool-registrations/define-tool-registrations.d.ts

@@ -6,13 +6,13 @@ import { type ToolHandler } from './tool-handle.js';
  *
  * @example
  * ```ts
- * import { MEMORY_TOOL_CONFIGS } from '@langflower/tools/domain-tool-configs';
+ * import { CRAWL_TOOL_CONFIGS } from '@langflower/tools/domain-tool-configs';
  *
- * export const memoryToolsNode = defineToolRegistrations({
- *   type: 'common-memory-tools',
- *   displayName: 'Memory Tools',
- *   category: 'Memory',
- *   tools: MEMORY_TOOL_CONFIGS,
+ * export const crawlToolsNode = defineToolRegistrations({
+ *   type: 'common-crawl-tools',
+ *   displayName: 'Crawl Tools',
+ *   category: 'Tools',
+ *   tools: CRAWL_TOOL_CONFIGS,
  * });
  * ```
  */

package/vendor/node-sdk/dist/node-factory/define-tool-registrations/define-tool-registrations.js

@@ -9,13 +9,13 @@ import { TOOL_HANDLE_WIRE_TYPE, } from './tool-handle.js';
  *
  * @example
  * ```ts
- * import { MEMORY_TOOL_CONFIGS } from '@langflower/tools/domain-tool-configs';
+ * import { CRAWL_TOOL_CONFIGS } from '@langflower/tools/domain-tool-configs';
  *
- * export const memoryToolsNode = defineToolRegistrations({
- *   type: 'common-memory-tools',
- *   displayName: 'Memory Tools',
- *   category: 'Memory',
- *   tools: MEMORY_TOOL_CONFIGS,
+ * export const crawlToolsNode = defineToolRegistrations({
+ *   type: 'common-crawl-tools',
+ *   displayName: 'Crawl Tools',
+ *   category: 'Tools',
+ *   tools: CRAWL_TOOL_CONFIGS,
  * });
  * ```
  */

package/vendor/server/skeleton/skills/langflower-helper/SKILL.md

@@ -73,8 +73,8 @@ do not say coding pipelines “don’t exist” or are unavailable.
 - **Can:** `langflower start [project-dir]` (default port **4010**) creates
   `.langflower/`, config, `instructions.md`, packs `nodes/my-nodes/` and
   `nodes/hello-embed/`, skills
-  `langflower-helper`, `langflower-node-writer`, and
-  `langflower-workflow-writer`, and opens workflow **`starter`** first.
+  `langflower-helper`, `langflower-node-writer`,
+  `langflower-workflow-writer`, and `spec-architect`, and opens workflow **`starter`** first.
 - **Can:** Skeleton already ships coding and KB sample workflows
   (`simple-coder`, `advanced-coder`, `kb-create`, `kb-navigate`,
   `kb-ingest`, `kb-manual-search`, `kb-tool`, `kb-rag`, …). With a
@@ -95,7 +95,7 @@ do not say coding pipelines “don’t exist” or are unavailable.
 
 - **Can:** First-run seed = config + **all** skeleton workflows (including
   `starter`, coding samples, `kb-create`, `kb-navigate`, `kb-ingest`,
-  `kb-manual-search`, `kb-tool`, `kb-rag`) + three skills + `my-nodes` +
+  `kb-manual-search`, `kb-tool`, `kb-rag`) + four skills + `my-nodes` +
   `hello-embed` + instructions.
 - **Can:** Skeleton inventory includes `node-writer`, `agents-dialog`,
   `simple-coder`, `advanced-coder`, `kb-create`, `kb-navigate`,
@@ -155,8 +155,10 @@ do not say coding pipelines “don’t exist” or are unavailable.
 - **Can:** Chat Input graphs start from the composer **Start** control. Plain
   **Run** stays disabled for those graphs. Prefill or last typed text lives on
   the Chat Input node (`inputs.message`) and reappears after Stop.
-- **Can:** While running — Hard **Stop**, soft **Pause**, HITL and
-  `permission.ask` in the composer. Work log **clears** on successful
+- **Can:** While running — Hard **Stop**, soft **Pause**, HITL,
+  `ask_user` (composer Send; question in the work log), and `permission.ask`
+  in the composer. Work log **clears** on
+  successful
   workflow load / create / copy (not rename).
 - **Cannot:** Switch, rename, delete, copy, or create a workflow while a run
   is active — Stop first. Same lock: inspector / canvas inline / palette
@@ -206,7 +208,7 @@ unwired — it is not a duplicate Helper, not a second node, and not a bug.
 | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `starter`          | Onboarding chat + this skill + Writer Sub-Agent (`langflower-workflow-writer` + `langflower-node-writer`) — default open after seed                                                                                                                                                               |
 | Skeleton stubs     | `simple-coder`, `advanced-coder`, `kb-create`, `kb-navigate`, `kb-ingest`, `kb-manual-search`, `kb-tool`, `kb-rag`, … seeded on first-run; with provider → Start                                                                                                                                  |
-| `simple-coder`     | Plan⇄HITL→Coder⇄HITL→Finish smoke spine + `common-memory-tools` on Plan/Coder/Researcher/Worker; Researcher Sub-Agent under Plan, Worker under Coder — **not** full multi-loop `coding-agent`                                                                                                     |
+| `simple-coder`     | Plan (`spec-architect`) ⇄ HITL → Coder ⇄ HITL → Finish smoke spine + `common-memory-tools` on Plan/Coder/Researcher/Worker; Researcher Sub-Agent under Plan, Worker under Coder — **not** full multi-loop `coding-agent`                                                                          |
 | `kb-create`        | Memory / project wiki create: Orchestrator **indexes** the repo with `glob`/`read`, persists `history/work-queue.md`, then **serially** calls Explorer → Composer **one unit at a time**; `common-memory-tools` writes `core/*` + `modules/*`; Review rejects non-empty Pending or thin overviews |
 | `kb-navigate`      | Memory navigate: Navigator + Searcher + memory tree/grep/section tools; HITL Review Gate for follow-ups                                                                                                                                                                                           |
 | `kb-ingest`        | Sample **hello-embed** ingest (Settings embedding model; pack compiles on `langflower start`)                                                                                                                                                                                                     |
@@ -232,8 +234,11 @@ These four are **not** the same thing.
 
 ### 8. Tools, permissions, MCP
 
-- **Can:** Harness builtins + `permission.ask` Allow/Deny for those builtins.
-  Wired pack / MCP tools (including memory writes and **Langflower Tools**)
+- **Can:** Harness builtins (including default `ask_user`) + `permission.ask`
+  Allow/Deny for those builtins. `ask_user` shows the question in the work
+  log and opens the composer textarea (Send), not Allow/Deny. Wired pack /
+  MCP tools (including memory writes and
+  **Langflower Tools**)
   do **not** ask — authoring the edge is consent. Write Allow does **not**
   grant bash. MCP **nodes** wire `tools` → agent `tools` (`ToolHandle[]`).
   Optional **Tool collection** (`common-tool-collection`) can merge several
@@ -291,7 +296,10 @@ Sub-Agent is an **explicit canvas node** for **control and observability**
   `kb-create` (index with `glob` → `history/work-queue.md` → serial
   Explorer/Composer units into `core/*` + `modules/*`) and `kb-navigate`.
   Managed markdown under `.langflower/memory/` (also reachable with harness
-  file tools). **Embeddings** catalog nodes + Settings default embedding model
+  file tools). **Can:** with Memory Tools wired, call `update_plan` to write
+  `history/plan.md` and print the current plan in the work log (`plan`
+  output, `feed.role: result`). There is no separate Plan mode. **Embeddings**
+  catalog nodes + Settings default embedding model
   are shipped for API checks and pack **`EmbedHandle`** wiring — separate from
   vector KB ([ADR-033](../../../../../docs/ADR.md#adr-033--markdown-memory-tools-no-embedding-as-base)).
   Obsidian vault helpers are **not** shipped (TBD-007).
@@ -332,7 +340,18 @@ When the user asks to “create a project wiki”, “build a knowledge base”,
   Pack `tsconfig.json` gates compile (`tsc --noEmit`). `from './file.ts'`
   requires `"allowImportingTsExtensions": true` next to `"noEmit": true`
   (hello-embed); otherwise the pack does not compile. Extensionless imports
-  (`my-nodes`) do not need the flag.
+  (`my-nodes`) do not need the flag. Relative `from './lib/x'` without a
+  suffix fails NodeNext `tsc` (`TS2835`) — use `.ts` + the flag for
+  multi-file packs, or keep one-file nodes with no local imports.
+  Sibling folders under `.langflower/nodes/` with their own `package.json`
+  are extra packs (no jsonc registration).
+  LLM tool `handler`s return short **strings** (expected failures as text,
+  not throws). Do not dump raw subprocess logs at the model.
+  Exclusive `ok` / `fail` gates are **`defineReactiveNode`**. Seed
+  `review-gate` uses a boolean **pulse** on `ok`. If the next stage needs
+  the original payload, `ok` **passthroughs `trigger`** (`inferTypeFrom`)
+  — not `boolean` `true`. A formatter rewrite may be a side effect that
+  does **not** fail the gate.
   Nodes may **intentionally keep in-memory internal state across runs**
   (Stop / done / Start) until the user loads another workflow or shuts down
   Langflower — not the same as Checkpoint resume after process kill.
@@ -341,6 +360,9 @@ When the user asks to “create a project wiki”, “build a knowledge base”,
   Ambient compile without Langflower Tools wired. Canvas add/remove node or
   edge tools (not shipped). Claim that every node always resets on Stop, or
   that in-memory node state survives process restart without Checkpoints.
+  `defineNode` for exclusive `ok` / `fail`. Boolean `true` on a gate `ok`
+  that should continue the graph. Shell Cap on public `ExecutionContext`
+  (seed demos use `child_process`). Hanging `start` / `dev` / watch tools.
 
 ### 11a. Recipe — write / reload a custom node
 

package/vendor/server/skeleton/skills/langflower-helper/architecture.md

@@ -71,7 +71,7 @@ Project product data for Langflower lives under **`.langflower/`**.
   Authentication/configuration failures are terminal. Generic reload of any
   failed non-LLM node is not yet shipped.
 - Also on the bus: runner start / resume / interrupt intents, `permission.ask`,
-  and related facts.
+  `askUser.ask`, and related facts.
 
 ## Agents on the canvas
 
@@ -111,6 +111,10 @@ Project product data for Langflower lives under **`.langflower/`**.
   Stop is not required for already-placed custom types.
   An already-wired custom tools pack can be invoked later in the same run
   after compile. Do not auto-place or auto-wire a new type mid-run.
+  Tool handlers return short pass/fail text (not raw logs). Exclusive
+  `ok`/`fail` gates: seed pulse is boolean `true` on `ok`; continue-the-graph
+  gates passthrough `trigger` (`inferTypeFrom`). No shell Cap on public
+  `ExecutionContext` yet.
 - Plain JS / Go / Python are not the authoring path. Sandboxed arbitrary
   user-node execution is **not** shipped. Canvas add/remove node or edge
   tools are **not** shipped (later rows on Langflower Tools).

package/vendor/server/skeleton/skills/langflower-helper/layout.md

@@ -16,7 +16,8 @@ Facts for UI chrome and on-disk paths. Prefer this file over guessing.
   **Settings**. Opening Settings (gear or empty-provider onboarding) swaps out
   feed/inspector; canvas stays. Settings open/close is server-driven.
 - **Composer (bottom)** — **Start** / Hard **Stop** / soft **Pause**; HITL
-  input and actions; `permission.ask` Allow/Deny while a run needs them.
+  input and actions; `ask_user` textarea + Send (question is in the work log);
+  `permission.ask` Allow/Deny while a run needs them.
 
 ## Where can I…?
 
@@ -27,6 +28,7 @@ Facts for UI chrome and on-disk paths. Prefer this file over guessing.
 | Start a Chat Input graph                         | Composer **Start** — not plain **Run**. Prefill lives on the node; Stop then Start reuses it.                                                                                                                                                                                                                                                                                                                                      |
 | See run output / stream                          | Right aside **feed**                                                                                                                                                                                                                                                                                                                                                                                                               |
 | Answer HITL / send into a waiting node           | Composer + feed context                                                                                                                                                                                                                                                                                                                                                                                                            |
+| Answer an agent's `ask_user` question            | Work log shows the question; composer textarea + **Send** (not Allow/Deny)                                                                                                                                                                                                                                                                                                                                                         |
 | Allow or Deny `permission.ask`                   | Composer permission controls                                                                                                                                                                                                                                                                                                                                                                                                       |
 | Soft-pause last feed agent / continue            | Composer **Pause** (per-node) / Send or Resume (soft pause ≠ Hard Stop)                                                                                                                                                                                                                                                                                                                                                            |
 | Hard-stop a run                                  | Composer **Stop**                                                                                                                                                                                                                                                                                                                                                                                                                  |
@@ -43,15 +45,15 @@ Facts for UI chrome and on-disk paths. Prefer this file over guessing.
 
 ## On-disk `.langflower/` map
 
-| Path               | Role                                                                                          |
-| ------------------ | --------------------------------------------------------------------------------------------- |
-| `langflower.jsonc` | Providers, secrets refs, project config                                                       |
-| `workflows/`       | Saved workflow graphs                                                                         |
-| `skills/`          | Agent skills (`langflower-helper/`, `langflower-node-writer/`, `langflower-workflow-writer/`) |
-| `nodes/`           | Custom node packs (`my-nodes/`, sample `hello-embed/`)                                        |
-| `instructions.md`  | Project-level agent instructions                                                              |
-| `runs/`            | Run artifacts / checkpoints when created                                                      |
-| `logs/`            | Server bridge diagnostic JSONL logs when the server runs                                      |
+| Path               | Role                                                                                                                                  |
+| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------- |
+| `langflower.jsonc` | Providers, secrets refs, project config                                                                                               |
+| `workflows/`       | Saved workflow graphs                                                                                                                 |
+| `skills/`          | Agent skills (`langflower-helper/`, `langflower-node-writer/`, `langflower-workflow-writer/`, `spec-architect/`)                      |
+| `nodes/`           | Custom node packs — one folder / `package.json` each (`my-nodes/`, sample `hello-embed/`, extra sibling packs; no jsonc registration) |
+| `instructions.md`  | Project-level agent instructions                                                                                                      |
+| `runs/`            | Run artifacts / checkpoints when created                                                                                              |
+| `logs/`            | Server bridge diagnostic JSONL logs when the server runs                                                                              |
 
 ## Out of chrome
 

package/vendor/server/skeleton/skills/langflower-node-writer/SKILL.md

@@ -49,6 +49,75 @@ You help the user write **custom nodes** for Langflower.
   custom types. An already-wired custom tools pack can be invoked later in
   the **same run** after compile. Failures land in `COMPILATION_ERRORS.md`
   in that pack.
+- Sibling packs: any folder under `.langflower/nodes/` with its own
+  `package.json` is discovered (no `langflower.jsonc` registration). Seed
+  `my-nodes` is the default; extra packs sit next to it (`hello-embed`).
+
+## Author patterns (do not invent forks)
+
+### Factory
+
+| Need                                                                        | Factory                   | Not                                                  |
+| --------------------------------------------------------------------------- | ------------------------- | ---------------------------------------------------- |
+| One `execute` result on **all** outputs together                            | `defineNode`              | Exclusive `ok` / `fail`                              |
+| LLM-callable `ToolHandle[]` on a `tools` port                               | `defineToolRegistrations` | `defineNode` that returns inventory as a string wire |
+| Emit on one port and **stay silent** on the other; streams; `inferTypeFrom` | `defineReactiveNode`      | `defineNode`                                         |
+
+**Wrong:** a review / QA gate with `defineNode` that returns `{ ok: true }`
+or throws on failure. `execute` maps onto every declared output at once.
+Throwing is a node error stream — it does **not** drive a separate `fail`
+branch. **Right:** `defineReactiveNode` + `of` / `EMPTY` (seed
+`review-gate.ts`).
+
+### Multi-file imports
+
+Pack `tsconfig` is NodeNext. Relative `from './lib/x'` **without** a suffix
+fails `tsc` (`TS2835`). Either keep one-file nodes with no local imports
+(seed `git-diff.ts`) **or** `from './lib/x.ts'` plus
+`"allowImportingTsExtensions": true` next to `"noEmit": true` (copy
+`hello-embed/tsconfig.json`).
+
+### LLM tools (`defineToolRegistrations`)
+
+- `handler` returns `Promise<string>`. Expected command / test failure is
+  **text to the model**, not `throw`. Throw only for contract (empty
+  `ctx.projectDir`).
+- Agent-facing text is a **short signal**: success → one line `ok  <toolId>`.
+  Failure → failed tests / `TS####` / ESLint errors only. Strip ANSI. Drop
+  `✓`, coverage tables, npm lifecycle banners, raw stdout dumps. When
+  slicing an `Issues:` block, do **not** use `$` with the `/m` flag (that
+  is end-of-line, so the match stops after the first line).
+- No shell Cap on public `ExecutionContext` yet — `child_process` like seed
+  `git-diff-tool.ts`. `shell: true` only with an **allowlisted literal**
+  (`npm run format`); never splice user paths into a shell string. Resolve
+  user paths under `ctx.projectDir` and reject `..` escapes.
+- Do not register hanging processes (`start`, `dev`, `test:watch`) as tools.
+
+### QA / review gates (`defineReactiveNode`)
+
+- Exclusive ports: pass → emit on `ok`, silent `fail`; fail → emit on
+  `fail`, silent `ok`.
+- Two honest `ok` shapes — pick from the graph, do not mix them:
+    - **Pulse** — seed `review-gate.ts` emits `boolean` `true`
+      (`wireType: 'boolean'`). Downstream only needs “passed”.
+    - **Passthrough** — when the next stage must keep the original payload:
+      `configureOutput('ok', ok$, { inferTypeFrom: trigger })`. Do **not**
+      emit `boolean` `true` on that wire (it breaks typing and the
+      continue-the-graph edge).
+- `fail` is a **string** (prefer stripped tool-handler text, not raw
+  stderr dumps).
+- A rewrite step (formatter) may run as a **side effect** and must not
+  fail the gate if the product intent is “format then typecheck/test”.
+  Typecheck / tests may fail the gate and skip later steps.
+
+### Tests
+
+Pack compile **skips** `*.test.ts`. Drive nodes with
+`createNodeHarness` from `@langflower/node-sdk/testing`. Subscribe to
+exclusive `ok` / `fail` **before** `send('trigger')` or you miss the
+emission. Mock `child_process` — do not spawn a real monorepo `build`
+from a unit test. Host `npm test` only sees pack tests if the project
+Vitest config **includes** that glob; do not assume it.
 
 ## When drafting a node
 

package/vendor/server/skeleton/skills/langflower-workflow-writer/SKILL.md

@@ -14,8 +14,8 @@ You help the user **author valid Langflower workflow JSON** under
 ## Honesty (do not invent)
 
 - Use only **catalog** node `type` strings that exist in the project palette /
-  common-nodes. Do **not** invent types (e.g. there is no `common-hitl` —
-  use `common-hitl-review-gate`).
+  common-nodes **or compiled custom packs**. Do **not** invent types (e.g.
+  there is no `common-hitl` — use `common-hitl-review-gate`).
 - Use only **real port ids** from each node’s definition / `NODE.md`. Wrong
   ports are stripped on load (graceful repair) — inventing ports breaks the
   graph.
@@ -80,6 +80,19 @@ Typical HITL revise loop:
 Do **not** feed Merge output into both gates and LLM feedback on every tick
 without a clear phase split.
 
+## Custom QA / review gates
+
+Custom exclusive-branch nodes (`defineReactiveNode`, seed `review-gate.ts`):
+
+- in **`trigger`** (dynamic)
+- out **`ok`** — **pulse** (`boolean` `true`, seed) **or** **passthrough of
+  `trigger`** (`inferTypeFrom`) when the next stage must keep the payload
+- out **`fail`** — string (stripped errors) → Preview / LLM `feedback`
+
+Do **not** emit boolean `true` on `ok` if the downstream graph needs the
+trigger payload. Do not use `defineNode` that returns `{ ok: true }` for
+this shape (`execute` cannot stay silent on `fail`).
+
 ## Sub-Agent (one registration wire)
 
 Mirror `.langflower/workflows/kb-navigate.json`:

package/vendor/server/skeleton/skills/spec-architect/SKILL.md

@@ -0,0 +1,232 @@
+---
+name: spec-architect
+description: >-
+    Discovery skill for the Plan role. Converts a short feature prompt into an
+    explicit specification. When update_plan is wired, the full spec lives in
+    the memory plan (work log) — do not write spec.md into a project folder.
+    Sequences environment audit, requirements, blast radius, dependencies,
+    contracts, mechanics, patterns, and verification.
+---
+
+# Spec architect (Plan)
+
+You convert a short, ambiguous feature request into an explicit specification.
+Do **not** jump into application source implementation, refactoring, or
+unsolicited file creation while this skill is active.
+
+You are a defensive principal architect: uncover hidden constraints, map
+invariants, and force alignment with local patterns. Do not guess when the
+repo shows competing styles — ask.
+
+## Honesty (Langflower, not Cursor)
+
+- There is **no** Cursor Plan mode and **no** `CreatePlan` tool.
+- **Memory plan available** (`update_plan` / `read_plan` in your tool list):
+  deliver the **full** Output Target Layout through `update_plan` so the
+  operator sees it in the work log. Call `read_plan` first if you need the
+  current plan. **Do not** write `spec.md` (or any other spec file) into a
+  project folder. Generic `update_memory_section` on `history/plan.md` does
+  **not** show the plan in the feed.
+- **No memory plan** (`update_plan` not wired): fallback only — write
+  `{designatedBaseFolder}/spec.md` with the same layout via harness `create`
+  / `write` (Plan preset typically **asks** the operator first). Do not
+  `edit` application source (`edit` is denied on Plan).
+- **Clarify** → use `ask_user` when that tool is wired. Otherwise put **one**
+  focused question in the response so the HITL / Clarify Review Gate can
+  reply on feedback. Multiple sequential rounds are allowed; do not dump a
+  questionnaire.
+- **Sub-agents** → if a specialist tool is already wired (for example
+  Researcher on simple-coder), prefer it for long read-only survey. Keep
+  architectural decisions yourself. Do **not** invent extra spawn or
+  un-wired specialists.
+- **MCP / external SoT** → if MCP or other tool packs are wired on this
+  node, use them. If Jira, Confluence, or Figma are missing, note that once
+  (non-blocking) and continue. Do not stall the spec on unconnected servers.
+- Persist heavy artifacts through memory tools when they are wired
+  (`core/project_summary.md`, `core/codebase_map.md`, …). Do not paste entire
+  files into the next-node payload.
+
+## Execution protocol
+
+Work the phases in order. Do not deliver the spec until Phases 1–7 are
+satisfied or the operator explicitly tells you to proceed with stated
+assumptions.
+
+### Phase 1 — Environment audit
+
+Scan wired tools. If ticket/design servers are present, ask for ticket IDs,
+doc URLs, or design links. If they are absent, continue with the repo.
+
+### Phase 2 — Intent, base folder, blast radius
+
+Interview for a verifiable functional checklist. Lock the **Designated Base
+Folder** (where most code changes will land — not a spec.md dump when memory
+plan is available). Classify impact:
+
+1. **New files** — path + architectural purpose.
+2. **Changed files** — path + what logic changes.
+3. **Deleted files** — path + why.
+
+### Phase 3 — Ecosystem
+
+Read package manifests (`package.json`, and others if present). Ask whether
+new dependencies are required. Record version / peer / runtime constraints.
+
+### Phase 4 — Contracts and data access
+
+Find how this repo crosses layers (HTTP, WS, files, stores). Lock:
+
+- DAL / persistence pattern actually used (do not invent a Repository if
+  none exists)
+- Endpoints, routes, wrappers, SDKs
+- Data contracts (types, schemas, DTOs)
+- Authoritative source of truth (OpenAPI, DB schema, code-first types, …)
+- Reuse vs amend vs new wrappers
+- Backward-compatibility breaks
+
+### Phase 5 — Mechanics and risk
+
+Lock dataflow, validation and empty/extreme states, auth/privacy/tenancy,
+concurrency, **complexity (Big-O of hot paths)**, expected failures and
+degradation, and schema/migration needs. Do not skip Big-O: name `n` (and
+other variables), give time and space for each hot path, and call out
+worse-than-linear risks.
+
+### Phase 6 — Patterns and frontend (if UI)
+
+Scan the repo. If several styles coexist, present them as choices — do not
+pick silently. Cite **exact** boilerplate files and which fragments to
+mirror. If a pattern library is missing, note that the team should add one.
+When UI is in scope, ask component-library vs custom, styling rules, i18n,
+and env/config mechanics. Align telemetry with what already exists.
+
+### Phase 7 — Verification
+
+Do not assume test levels. Ask which of unit, integration, E2E, and manual
+apply. Align with local runners (this repo: `npm run test` / full `verify`
+for close-out; `--quick` is intermediate only). If manual is selected, write
+step-by-step scripts with expected results.
+
+### Phase 8 — Deliver
+
+1. If `update_plan` is wired: call it with the **entire** filled Output
+   Target Layout. Do **not** write `spec.md` into the base folder or anywhere
+   else in the project.
+2. If `update_plan` is **not** wired: write that layout to
+   `{baseFolder}/spec.md`.
+3. Put the next-agent directive in the response (paths + headings, not the
+   full spec body). Point at the memory plan (`read_plan` / `history/plan.md`
+   `## Plan`) when that is the SoT.
+
+## Output Target Layout (`update_plan` body; fallback `spec.md`)
+
+```markdown
+# Specification: [Feature Name]
+
+## 1. Executive Summary & Intent
+
+- **Problem Statement:** (What operational pain point, technical debt, or feature deficiency is this fixing?)
+- **User Prompt Source:** (The original raw prompt text or requirement that initiated this blueprint)
+- **External Context:** (Linked tickets, docs, or design files)
+
+## 2. Codebase Guardrails & Local Alignment
+
+- **Designated Base Folder:** (Primary workspace folder where code changes are centered)
+- **Target Directories:** (Explicit paths for new or modified files)
+- **Architectural Patterns & Boilerplates Enforced:** (Required structural patterns)
+- **Pattern & Boilerplate Reference Baseline:**
+    - `[File Path Reference 1]`: (Exact parts to replicate)
+    - `[File Path Reference 2]`: (Exact parts to replicate)
+- **Third-Party Dependencies & Packages:** (New packages, version caps)
+- **Frontend Presentation Strategy (If UI Affected):**
+    - **Component Library Standards:**
+    - **Styling & CSS Architecture Guardrails:**
+- **Shared Utilities & Hooks:** (Existing helpers/types that must be reused)
+- **Internationalization (i18n) Mechanics:**
+- **Environment Configuration (ENV):**
+
+## 3. Deep System Mechanics & System Analysis
+
+### A. Blast Radius & Impact Assessment
+
+- **Affected Modules / Components:**
+- **Affected Files Inventory:**
+    - **New Files:**
+        - `[Proposed File Path 1]`: (Purpose)
+    - **Changed Files:**
+        - `[Existing File Path 1]`: (Targeted logic)
+    - **Deleted Files:**
+        - `[Legacy File Path 1]`: (Deletion reason)
+- **Backward Compatibility Plan:**
+
+### B. API, Data Contracts & DAL Strategy
+
+- **Authoritative Source of Truth:**
+- **Data Access Layer (DAL) Pattern:**
+- **Endpoints & Routes Impacted:**
+- **Data Contracts (Schemas & Type Specs):**
+- **Wrapper Strategy:** (reuse / amend / new)
+- **Reverse Compatibility Risk Matrix:**
+
+### C. Security, Identity & Compliance
+
+- **Authentication & Authorization:**
+- **Data Privacy & Multi-Tenancy:**
+
+### D. Dataflow Architecture & Evolution
+
+- **State Lifecycle & Pipeline:**
+- **State Authority:**
+- **Schema Evolution & Migration:**
+
+### E. Validations & Boundary Conditions
+
+- **Input Validation Schemas:**
+- **Zero / Empty States:**
+- **Extreme Constraints:**
+
+### F. Concurrency & State Collisions
+
+- **Race Condition Mitigation:**
+
+### G. Complexity Estimate (Big-O)
+
+- **Scaling Variables:** (`n`, `m`, … — what each counts: items, nodes, edges, tokens, bytes, concurrent clients)
+- **Hot Paths:**
+    - `[Path / operation 1]`: **Time** `O(…)` · **Space** `O(…)` · (why; dominant term)
+    - `[Path / operation 2]`: **Time** `O(…)` · **Space** `O(…)` · (why; dominant term)
+- **Amortized / Average vs Worst Case:** (if they differ, state both)
+- **I/O & Fan-out:** (network/disk calls per request; N+1; fan-out `O(n)` fan-in)
+- **Unacceptable Bounds:** (paths that must stay `O(1)` / `O(log n)` / linear; anything worse is a spec defect)
+
+### H. Error Handling & Resiliency
+
+- **Expected Failure Modes:**
+- **Graceful Degradation:**
+- **Telemetry, Logging & Observability:**
+
+## 4. Verification & Definition of Done (DoD)
+
+### A. Testing Strategy Matrix
+
+- [ ] **Unit Testing:** -> Isolation: mock DB, storage, and network.
+- [ ] **Integration Testing:** -> Isolation: mock third-party endpoints only.
+- [ ] **E2E / Smoke Testing:** -> Live local environment, minimal mocks.
+- [ ] **Manual Verification:** -> Human UI or terminal script.
+
+### B. Manual Verification Script
+
+_(Mandatory if Manual Verification is checked.)_
+
+#### Test Case 1: [Short Title]
+
+- **Prerequisites:**
+- **Step-by-Step Actions:** 1.
+- **Expected Inputs / Payloads:**
+- **Expected Output / Observable Result:**
+
+### C. Functional Requirements Checklist
+
+- [ ] Requirement 1 (Verifiable functional behavior)
+- [ ] Requirement 2 (Verifiable functional behavior)
+```

package/vendor/server/skeleton/workflows/advanced-coder.json

@@ -33,6 +33,7 @@
 				"type": "common-openai-llm",
 				"params": {
 					"rolePreset": "plan",
+					"skillId": "spec-architect",
 					"providerId": "",
 					"model": "",
 					"maxIterations": 8,

package/vendor/server/skeleton/workflows/simple-coder.json

@@ -46,6 +46,7 @@
 				"type": "common-openai-llm",
 				"params": {
 					"rolePreset": "plan",
+					"skillId": "spec-architect",
 					"providerId": "",
 					"model": "",
 					"maxIterations": 8