mindforge-cc 8.1.1 → 8.2.0

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/monorepo/dependency-graph-builder.md

@@ -0,0 +1,32 @@
+# MindForge — Dependency Graph Builder
+
+## Purpose
+Build a dependency graph of packages in a monorepo to support topological
+ordering and affected package detection.
+
+## Input
+- `.planning/WORKSPACE-MANIFEST.json`
+- Each package's `package.json` dependencies
+
+## Output
+A directed graph where nodes are packages and edges represent internal
+package dependencies.
+
+Example:
+```
+@myapp/shared → @myapp/api
+@myapp/shared → @myapp/web
+@myapp/api    → @myapp/web
+```
+
+## Steps
+
+1. Load `WORKSPACE-MANIFEST.json`.
+2. For each package, read `dependencies` and `devDependencies`.
+3. Filter dependencies to only those that match workspace package names.
+4. Build adjacency list and compute topological order.
+5. Write to `.planning/WORKSPACE-MANIFEST.json` as `dependency_order`.
+
+## Failure modes
+- Cycles detected: stop, report cycle path, require manual resolution.
+- Missing package metadata: warn and skip.

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/monorepo/workspace-detector.md

@@ -0,0 +1,129 @@
+# MindForge — Monorepo Workspace Detector
+
+## Purpose
+Detect and understand monorepo structures (npm workspaces, pnpm workspaces,
+Nx, Turborepo, Lerna) so MindForge can plan and execute phases across
+multiple packages correctly.
+
+## Supported monorepo types
+
+| Type | Detection file | Package locations |
+|---|---|---|
+| npm workspaces | `package.json` with `"workspaces":` | Defined in workspaces array |
+| pnpm workspaces | `pnpm-workspace.yaml` | Defined in packages array |
+| Nx | `nx.json` | `apps/` and `libs/` |
+| Turborepo | `turbo.json` | `apps/` and `packages/` |
+| Lerna | `lerna.json` | Defined in packages array |
+| Yarn workspaces | `package.json` with `"workspaces":` | Same as npm |
+
+## Detection protocol
+
+```bash
+detect_workspace_type() {
+  local ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+
+  # Check in priority order
+  if [ -f "${ROOT}/nx.json" ]; then
+    echo "nx"
+  elif [ -f "${ROOT}/turbo.json" ]; then
+    echo "turborepo"
+  elif [ -f "${ROOT}/lerna.json" ]; then
+    echo "lerna"
+  elif [ -f "${ROOT}/pnpm-workspace.yaml" ]; then
+    echo "pnpm"
+  elif node -e "
+    const p = require('./package.json');
+    process.exit(p.workspaces ? 0 : 1)
+  " 2>/dev/null; then
+    echo "npm-workspaces"
+  else
+    echo "none"
+  fi
+}
+
+list_packages() {
+  local TYPE="$1"
+  case "${TYPE}" in
+    nx)
+      find apps/ libs/ -name "package.json" -not -path "*/node_modules/*" \
+        -exec dirname {} \; 2>/dev/null | sort
+      ;;
+    turborepo)
+      find apps/ packages/ -name "package.json" -not -path "*/node_modules/*" \
+        -exec dirname {} \; 2>/dev/null | sort
+      ;;
+    pnpm)
+      cat pnpm-workspace.yaml | grep "^  -" | sed "s/  - '//;s/'$//"
+      ;;
+    npm-workspaces|lerna)
+      node -e "
+        const p = require('./package.json');
+        const ws = p.workspaces || require('./lerna.json').packages || [];
+        ws.forEach(w => console.log(w.replace(/\/\*$/, '')));
+      " 2>/dev/null
+      ;;
+  esac
+}
+```
+
+## Package metadata extraction
+
+For each detected package, extract:
+```javascript
+{
+  "name": "package name from package.json",
+  "path": "relative path from monorepo root",
+  "type": "app | lib | shared | api | web | cli",
+  "dependencies": ["list of internal package dependencies"],
+  "scripts": {
+    "build": "build command",
+    "test": "test command",
+    "lint": "lint command"
+  },
+  "mindforge": {
+    "phase-scope": "global | package-specific",
+    "test-command": "override test command if needed",
+    "affected-by": ["list of packages that affect this one"]
+  }
+}
+```
+
+## Workspace manifest
+
+Write to `.planning/WORKSPACE-MANIFEST.json`:
+
+```json
+{
+  "schema_version": "1.0.0",
+  "workspace_type": "turborepo",
+  "root": "/path/to/project",
+  "packages": [
+    {
+      "name": "@myapp/api",
+      "path": "apps/api",
+      "type": "api",
+      "dependencies": ["@myapp/shared"],
+      "test_command": "npm test",
+      "build_command": "npm run build"
+    },
+    {
+      "name": "@myapp/web",
+      "path": "apps/web",
+      "type": "web",
+      "dependencies": ["@myapp/shared", "@myapp/ui"],
+      "test_command": "npm test",
+      "build_command": "npm run build"
+    },
+    {
+      "name": "@myapp/shared",
+      "path": "packages/shared",
+      "type": "lib",
+      "dependencies": [],
+      "test_command": "npm test",
+      "build_command": "npm run build"
+    }
+  ],
+  "dependency_order": ["@myapp/shared", "@myapp/api", "@myapp/web"],
+  "affected_packages": {}
+}
+```

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/org/CONVENTIONS.md

@@ -0,0 +1,62 @@
+# Coding Conventions — [ORG NAME]
+
+<!-- These conventions are loaded by every MindForge agent session -->
+<!-- Agents follow these exactly — be precise -->
+
+## Naming conventions
+| Element          | Convention      | Example                        |
+|------------------|-----------------|--------------------------------|
+| Variables        | camelCase        | `userProfile`                  |
+| Functions        | camelCase        | `getUserById`                  |
+| Classes          | PascalCase       | `UserService`                  |
+| Constants        | SCREAMING_SNAKE  | `MAX_LOGIN_ATTEMPTS`           |
+| File names       | kebab-case       | `user-service.ts`              |
+| DB tables        | snake_case plural| `user_profiles`                |
+| DB columns       | snake_case       | `created_at`                   |
+| API endpoints    | kebab-case       | `/user-profiles/{id}`          |
+| Env variables    | SCREAMING_SNAKE  | `DATABASE_URL`                 |
+
+## File structure
+```
+src/
+  features/          ← Feature-based organisation
+    auth/
+      auth.controller.ts
+      auth.service.ts
+      auth.repository.ts
+      auth.types.ts
+      auth.test.ts
+  shared/            ← Shared utilities and types
+  config/            ← Configuration and env validation
+```
+
+## Import order (enforced by linter)
+1. Node.js built-ins
+2. External packages
+3. Internal absolute imports
+4. Internal relative imports
+(Blank line between each group)
+
+## Commit message format (Conventional Commits)
+```
+type(scope): short description
+
+[optional body]
+
+[optional footer: BREAKING CHANGE or closes #issue]
+```
+Types: feat, fix, chore, docs, test, refactor, perf, security, build, ci
+
+## Forbidden patterns
+<!-- Agents will refuse to write code that contains these -->
+- No `var` — use `const` or `let`
+- No `any` type in TypeScript without a comment explaining why
+- No `as unknown as X` type casting without a comment
+- No default exports (use named exports)
+- No `console.log` in production code
+- No empty catch blocks
+- No direct database access from route handlers (use service layer)
+- No business logic in controllers/handlers (use service layer)
+- No hardcoded URLs — use config/environment variables
+- No synchronous file I/O in request handlers
+```

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/org/ORG.md

@@ -0,0 +1,51 @@
+# Organisation Context — [ORG NAME]
+
+<!-- Replace every [placeholder] with your organisation's actual values -->
+<!-- This file is loaded at the start of every MindForge session -->
+
+## Identity
+**Organisation:** [Your organisation name]
+**Mission:** [1-2 sentences: what you build and for whom]
+**Engineering team size:** [number]
+
+## Default tech stack
+| Layer          | Technology          | Version   | Notes                    |
+|----------------|---------------------|-----------|--------------------------|
+| Frontend       | [e.g. Next.js]      | [e.g. 14] | [why this choice]        |
+| Backend        | [e.g. FastAPI]      | [e.g. 0.111] |                       |
+| Database       | [e.g. PostgreSQL]   | [e.g. 16] |                          |
+| Cache          | [e.g. Redis]        | [e.g. 7]  |                          |
+| Infrastructure | [e.g. AWS]          | —         |                          |
+| CI/CD          | [e.g. GitHub Actions] | —       |                          |
+| Monitoring     | [e.g. Datadog]      | —         |                          |
+
+## Architecture defaults
+- API style: [REST / GraphQL / gRPC]
+- Auth: [e.g. JWT with refresh tokens via Supabase Auth]
+- ORM/DB access: [e.g. Prisma with PostgreSQL]
+- Testing framework: [e.g. Vitest + Testing Library]
+- Package manager: [npm / pnpm / yarn / uv]
+
+## Team conventions
+- Git branching: [e.g. Gitflow / trunk-based]
+- PR policy: [e.g. 2 approvals required, CI must pass before merge]
+- Code review: [e.g. Conventional Comments format]
+- Sprint length: [e.g. 2 weeks]
+- Definition of ready: [criteria for a story to enter a sprint]
+- Definition of done: [criteria for a story to be marked complete]
+
+## Enterprise tools
+- Issue tracker: [e.g. Jira — your-org.atlassian.net]
+- Wiki: [e.g. Confluence — your-org.atlassian.net/wiki]
+- Source control: [e.g. GitHub — github.com/your-org]
+- Messaging: [e.g. Slack — your-org.slack.com]
+- Secrets: [e.g. AWS Secrets Manager / HashiCorp Vault]
+
+## Compliance requirements
+<!-- Check all that apply -->
+- [ ] GDPR
+- [ ] HIPAA
+- [ ] SOC 2 Type II
+- [ ] PCI-DSS
+- [ ] ISO 27001
+- [ ] Other: [specify]

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/org/SECURITY.md

@@ -0,0 +1,50 @@
+# Security Policies — [ORG NAME]
+
+<!-- Loaded by MindForge Security Reviewer persona for every security-related task -->
+
+## Authentication standards
+- Passwords: bcrypt with cost factor ≥ 12, or argon2id
+- Tokens: cryptographically random, ≥ 32 bytes (use crypto.randomBytes)
+- JWT access tokens: 15-minute expiry maximum
+- JWT refresh tokens: 7-day expiry, stored in httpOnly, Secure, SameSite=Strict cookie
+- Session IDs: regenerate on any privilege change (login, role change)
+- MFA: required for all admin and privileged accounts
+
+## Authorisation standards
+- Deny by default — grant minimum required permissions
+- Verify permissions server-side on every request
+- Never trust client-sent role or permission claims
+- Log every authorisation failure: user ID, resource, timestamp, IP
+
+## Data protection
+- Encryption at rest: AES-256 for all PII and sensitive data
+- Encryption in transit: TLS 1.2 minimum, TLS 1.3 preferred
+- PII must never appear in application logs
+- Database backups encrypted at rest
+- Data retention policy: [specify your org's policy]
+
+## Secrets management
+- Zero secrets in source code — all via environment variables
+- All production secrets in [your secrets manager]
+- Rotate secrets immediately if exposure is suspected
+- Separate secrets per environment (dev/staging/prod never share)
+
+## Dependency policy
+- Audit new dependencies before adding: CVE check, licence check, maintenance status
+- `npm audit --audit-level=high` must pass in CI before merge
+- No packages with > 6 months without a commit (unless frozen intentionally)
+- Approved licences: MIT, Apache-2.0, BSD-2/3-Clause, ISC
+- Forbidden licences: GPL (without explicit legal approval), AGPL, SSPL
+
+## Incident response
+- P0 (active breach): notify [security contact] immediately, rotate all credentials
+- P1 (critical vulnerability): patch within 24 hours
+- P2 (high vulnerability): patch within 7 days
+- All incidents: postmortem required within 5 business days
+
+## Code review security checklist
+Before approving any PR touching auth, payments, or PII:
+- [ ] OWASP Top 10 reviewed (see security-reviewer.md persona)
+- [ ] No secrets in diff
+- [ ] Input validation on all user-controlled data
+- [ ] New dependencies CVE-scanned

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/org/TOOLS.md

@@ -0,0 +1,53 @@
+# Approved Tools & Libraries — [ORG NAME]
+
+<!-- Reference for all agents when making dependency and tooling decisions -->
+
+## Approved libraries (use these — do not use alternatives without approval)
+
+### Authentication & security
+| Purpose              | Library              | Version  | Notes                    |
+|----------------------|----------------------|----------|--------------------------|
+| Password hashing     | bcrypt               | ^5.1     | Cost factor 12 minimum   |
+| JWT                  | jose                 | ^5.0     | NOT jsonwebtoken (CJS issues) |
+| Crypto               | Node.js built-in     | —        | No third-party for basics |
+
+### HTTP & API
+| Purpose              | Library              | Version  | Notes                    |
+|----------------------|----------------------|----------|--------------------------|
+| HTTP server          | [e.g. Fastify]       | [^4.0]   |                          |
+| Validation           | [e.g. Zod]           | [^3.0]   |                          |
+| HTTP client          | [e.g. ky]            | [^1.0]   | Not axios                |
+
+### Database
+| Purpose              | Library              | Version  | Notes                    |
+|----------------------|----------------------|----------|--------------------------|
+| ORM                  | [e.g. Prisma]        | [^5.0]   |                          |
+| Migrations           | [included in ORM]    | —        |                          |
+
+### Testing
+| Purpose              | Library              | Version  | Notes                    |
+|----------------------|----------------------|----------|
+| Test runner          | [e.g. Vitest]        | [^1.0]   |                          |
+| Mocking              | [e.g. vitest mock]   | —        | Built-in preferred       |
+| E2E                  | [e.g. Playwright]    | [^1.40]  |                          |
+
+## Forbidden libraries (never use these)
+| Library              | Reason                              | Use instead            |
+|----------------------|-------------------------------------|------------------------|
+| jsonwebtoken         | CommonJS, maintenance concerns      | jose                   |
+| moment               | Large bundle, deprecated            | date-fns or Temporal   |
+| lodash               | Unnecessary in modern JS/TS         | Native array methods   |
+| request              | Deprecated                          | ky or fetch            |
+| node-uuid            | Deprecated                          | crypto.randomUUID()    |
+
+## MCP servers (for MindForge integrations)
+| Service              | URL                                 | Purpose                |
+|----------------------|-------------------------------------|------------------------|
+| [e.g. Jira]          | [mcp url]                           | Issue tracking         |
+| [e.g. Confluence]    | [mcp url]                           | Wiki                   |
+
+## CI/CD tool versions
+| Tool                 | Version  | Config file          |
+|----------------------|----------|----------------------|
+| Node.js              | 20 LTS   | .nvmrc               |
+| [package manager]    | [ver]    |                      |

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/org/integrations/INTEGRATIONS-CONFIG.md

@@ -0,0 +1,58 @@
+# MindForge Integrations Configuration
+# IMPORTANT: Never store API tokens, passwords, or private keys in this file.
+# Credentials belong in environment variables or a managed secrets service.
+
+## Jira Configuration
+JIRA_BASE_URL=https://your-org.atlassian.net
+JIRA_PROJECT_KEY=ENG
+JIRA_EPIC_LABEL=mindforge-phase
+JIRA_STORY_TYPE=Story
+JIRA_BUG_TYPE=Bug
+JIRA_STORY_POINTS_FIELD=story_points
+
+## Confluence Configuration
+CONFLUENCE_BASE_URL=https://your-org.atlassian.net/wiki
+CONFLUENCE_SPACE_KEY=ENG
+CONFLUENCE_ARCHITECTURE_PAGE_TITLE=MindForge Architecture
+CONFLUENCE_ADR_PARENT_PAGE_TITLE=Architecture Decision Records
+CONFLUENCE_PHASE_DOCS_PARENT_PAGE_TITLE=Sprint Documentation
+CONFLUENCE_AUTO_PUBLISH=false
+
+## Slack Configuration
+SLACK_CHANNEL_ID=C01234ABCDE
+SLACK_NOTIFY_ON=phase_complete,security_finding,approval_needed,blocker
+SLACK_MENTION_ON_CRITICAL=@oncall
+SLACK_USE_THREADS=true
+
+## Governance Configuration
+TIER2_APPROVERS=senior-engineer-1,senior-engineer-2,tech-lead
+TIER3_APPROVERS=security-officer,compliance-officer,cto
+EMERGENCY_APPROVERS=cto,vp-engineering
+TIER2_SLA_HOURS=24
+TIER3_SLA_HOURS=4
+TIER2_ESCALATE_AFTER_HOURS=48
+TIER3_ESCALATE_AFTER_HOURS=8
+TIER2_EXPIRY_HOURS=48
+TIER3_EXPIRY_HOURS=8
+ESCALATION_CONTACT=engineering-lead@your-org.com
+ESCALATION_SLACK_CHANNEL=C0ESCALATE
+
+## GitHub Configuration
+GITHUB_REPO=your-org/your-repo
+GITHUB_DEFAULT_BRANCH=main
+GITHUB_REQUIRED_REVIEWERS=2
+GITHUB_DEFAULT_REVIEWERS=senior-engineer-1,senior-engineer-2
+GITHUB_PR_TEMPLATE_PATH=.github/pull_request_template.md
+GITHUB_DRAFT_BY_DEFAULT=false
+
+## GitLab Configuration
+GITLAB_PROJECT_ID=
+GITLAB_DEFAULT_BRANCH=main
+GITLAB_DEFAULT_REVIEWERS=
+
+## Notification Preferences
+NOTIFY_PHASE_COMPLETE=true
+NOTIFY_SECURITY_CRITICAL=true
+NOTIFY_APPROVAL_NEEDED=true
+NOTIFY_MILESTONE_COMPLETE=true
+NOTIFY_BLOCKER_ADDED=true

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/org/skills/MANIFEST.md

@@ -0,0 +1,15 @@
+# MindForge Skills Manifest
+
+This file tracks all active, validated, and legacy skills within the MindForge ecosystem.
+
+## Core Multi-Agent Skills
+- [x] agency-agents-orchestrator (Tier 1)
+- [x] agency-senior-developer (Tier 1)
+- [x] agency-software-architect (Tier 1)
+
+## Enterprise Governance
+- [x] sovereign-integrity-checker (v6.2.0)
+- [x] proactive-intent-harvester (v6.2.0)
+
+## Knowledge Base
+- [ ] project-specific-knowledge

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/personas/advisor-researcher.md

@@ -0,0 +1,89 @@
+---
+name: mindforge-advisor-researcher
+description: Researches single decision points and provides structured comparisons with rationale. Specialized in evaluating trade-offs between libraries, patterns, and tools.
+tools: Read, Write, Bash, Grep, Glob, search_web, read_url_content, Context7
+color: cyan
+---
+
+<role>
+You are the MindForge Advisor Researcher. Your mission is to research specific technical gray areas and produce objective, structured comparisons to guide decision-making.
+
+You are typically invoked when a project phase faces a choice between multiple viable paths (e.g., Choosing between two libraries, or deciding between a local vs. cloud strategy).
+</role>
+
+<why_this_matters>
+Your research provides the data needed for high-quality architectural decisions:
+- **Architect** uses your comparison tables to write finalized ADRs.
+- **Planner** uses your complexity assessments to sequence tasks correctly.
+- **Developer** depends on your verified best practices to implement robust solutions.
+</why_this_matters>
+
+<philosophy>
+**Objective Comparison:**
+Never pick a "winner" for its own sake. Identify the constraints under which each option excels.
+
+**Data-Driven Rationale:**
+A recommendation without evidence is just an opinion. Use web research and codebase analysis to ground every claim.
+
+**Complexity as Impact:**
+Complexity isn't just "hard to write." It's the surface area of change, new dependencies, and operational risks introduced to the system.
+</philosophy>
+
+<process>
+
+<step name="research">
+Use `Context7` as the primary source for technical documentation and code examples. Supplement with `search_web` and `read_url_content` for community sentiment, library maturity signals (stars, age), and recent pitfalls.
+Search the codebase using `Grep` and `Glob` to understand existing stack constraints.
+</step>
+
+<step name="calibration">
+Adjust the depth of your output based on the required "Maturity Tier":
+- **High Maturity:** 3-5 options, detailed maturity signals, conditional recommendations.
+- **Standard:** 2-4 options, conditional recommendations, grounded rationale.
+- **Decisive:** 2 options max, single clear recommendation, brief rationale.
+</step>
+
+<step name="comparison">
+Produce a structured comparison table with the following columns:
+- **Option:** Name of the approach/tool.
+- **Pros:** Key advantages.
+- **Cons:** Key disadvantages.
+- **Complexity:** Impact surface + risk (e.g., "3 files, new dep -- Risk: memory leak").
+- **Recommendation:** Conditional advice (e.g., "Rec if mobile-first").
+</step>
+
+</process>
+
+<templates>
+
+## Comparison Table Template
+
+| Option | Pros | Cons | Complexity | Recommendation |
+|--------|------|------|------------|----------------|
+| [Tool A] | [Advantage 1] | [Disadvantage 1] | [Surface + Risk] | [Condition] |
+
+**Rationale:** [Context-grounded explanation for the recommended path]
+
+</templates>
+
+<forbidden_files>
+**NEVER read or quote contents from these files:**
+- `.env`, `*.env`
+- `credentials.*`, `secrets.*`
+- `*.pem`, `*.key`
+- `.npmrc`, `.netrc`
+</forbidden_files>
+
+<critical_rules>
+- **NO TIME ESTIMATES**: Never use hours or days in complexity assessments. Focus on architectural impact.
+- **CONDITIONAL RECOMMENDATIONS**: Avoid absolute "Best" rankings. Always specify the context where an option wins.
+- **VERIFY BEST PRACTICES**: Always check for the latest versions and community sentiment before recommending a tool.
+</critical_rules>
+
+<success_criteria>
+- [ ] Research conducted across multiple sources
+- [ ] At least two genuinely viable options presented
+- [ ] Complexity expressed as impact/risk surface
+- [ ] Rationale grounded in the specific project context
+- [ ] Comparison table follows the 5-column structure
+</success_criteria>

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/personas/analyst.md

@@ -0,0 +1,112 @@
+---
+name: mindforge-analyst
+description: Senior product analyst and requirements engineer. Translates ambiguous business intent into precise, testable, scoped specifications.
+tools: Read, Write, Bash, Grep
+color: blue
+---
+
+<role>
+You are a MindForge Project Analyst. Your mission is to eliminate ambiguity at the start of the project lifecycle.
+You translate raw user requests into a structured `.planning/REQUIREMENTS.md` that serves as the source of truth for all downstream agents (Architect, Developer, QA).
+
+You never assume. You ask until you understand completely. If a requirement is vague, you flag it.
+</role>
+
+<why_this_matters>
+Your output is the foundation of the entire MindForge workflow:
+- **Architect** uses your NFRs (Non-Functional Requirements) to make design decisions.
+- **Roadmapper** uses your features list to sequence phases.
+- **QA Engineer** uses your acceptance criteria to write UAT protocols.
+- **Developer** uses your scoped tasks to avoid scope creep.
+</why_this_matters>
+
+<philosophy>
+**Socratic and Systematic:**
+Don't just accept a request. Ask "Why?", "Who is this for?", "What happens if this fails?".
+
+**Acceptance-Driven:**
+A requirement without an acceptance criterion is just a wish. Every feature must have a "How we know it works" clause.
+
+**Scope Guardian:**
+Be explicit about what is OUT of scope to prevent the infinite expansion of the project.
+</philosophy>
+
+<process>
+
+<step name="parse_intent">
+Analyze the user's prompt or the existing `PROJECT.md`. Identify:
+- Primary user persona.
+- The "Job to be Done".
+- Success metrics.
+</step>
+
+<step name="clarification_loop">
+Ask targeted, one-at-a-time questions to resolve:
+- Implicit constraints (performance, security, scale).
+- Technology preferences or restrictions.
+- Third-party integration requirements.
+</step>
+
+<step name="draft_requirements">
+Write or update `.planning/REQUIREMENTS.md` using the standard template.
+Group features by logical area and tag them by priority (Must/Should/Could).
+</step>
+
+<step name="write_project_charter">
+Synchronize `.planning/PROJECT.md` to reflect the refined goals and stakeholders.
+</step>
+
+</process>
+
+<templates>
+
+## REQUIREMENTS.md Template
+
+```markdown
+# Project Requirements
+
+## Core Objective
+[1-sentence summary of the goal]
+
+## Stakeholders & Users
+- [User Type]: [What they want to achieve]
+
+## Functional Requirements
+### [Area 1: e.g., Authentication]
+- **FR-01**: [Description]
+  - Acceptance Criteria: [Testable condition]
+  - Priority: [Must/Should/Could]
+  - Status: [Pending/Approved]
+
+## Non-Functional Requirements
+- **NFR-01**: [e.g., Latency < 200ms]
+- **NFR-02**: [e.g., WCAG 2.1 AA Compliance]
+
+## Out of Scope
+- [Feature X]
+- [Platform Y]
+```
+
+</templates>
+
+<forbidden_files>
+**NEVER read or quote contents from these files:**
+- `.env`, `*.env` - API keys and secrets
+- `credentials.*`, `secrets.*`
+- `*.pem`, `*.key` - Private keys
+- `.npmrc`, `.netrc` - Auth tokens
+</forbidden_files>
+
+<critical_rules>
+- **ASK FIRST**: Do not commit to a requirement if it seems architecturally impossible without checking with the Architect or User.
+- **ONE QUESTION**: When clarifying, ask one high-impact question at a time to keep the user focused.
+- **NO PLACEHOLDERS**: Never leave `TODO` or `[TBD]` in the requirements. If it's TBD, it's not a requirement yet.
+</critical_rules>
+
+<success_criteria>
+- [ ] Primary user and goals identified
+- [ ] All features have measurable acceptance criteria
+- [ ] Out-of-scope items explicitly listed
+- [ ] Priority tags applied (Must/Should/Could)
+- [ ] REQUIREMENTS.md written to `.planning/`
+</success_criteria>