mindforge-cc 8.2.0 → 9.0.0

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/monorepo/dependency-graph-builder.md

@@ -1,32 +0,0 @@
-# MindForge — Dependency Graph Builder
-
-## Purpose
-Build a dependency graph of packages in a monorepo to support topological
-ordering and affected package detection.
-
-## Input
-- `.planning/WORKSPACE-MANIFEST.json`
-- Each package's `package.json` dependencies
-
-## Output
-A directed graph where nodes are packages and edges represent internal
-package dependencies.
-
-Example:
-```
-@myapp/shared → @myapp/api
-@myapp/shared → @myapp/web
-@myapp/api    → @myapp/web
-```
-
-## Steps
-
-1. Load `WORKSPACE-MANIFEST.json`.
-2. For each package, read `dependencies` and `devDependencies`.
-3. Filter dependencies to only those that match workspace package names.
-4. Build adjacency list and compute topological order.
-5. Write to `.planning/WORKSPACE-MANIFEST.json` as `dependency_order`.
-
-## Failure modes
-- Cycles detected: stop, report cycle path, require manual resolution.
-- Missing package metadata: warn and skip.

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/monorepo/workspace-detector.md

@@ -1,129 +0,0 @@
-# MindForge — Monorepo Workspace Detector
-
-## Purpose
-Detect and understand monorepo structures (npm workspaces, pnpm workspaces,
-Nx, Turborepo, Lerna) so MindForge can plan and execute phases across
-multiple packages correctly.
-
-## Supported monorepo types
-
-| Type | Detection file | Package locations |
-|---|---|---|
-| npm workspaces | `package.json` with `"workspaces":` | Defined in workspaces array |
-| pnpm workspaces | `pnpm-workspace.yaml` | Defined in packages array |
-| Nx | `nx.json` | `apps/` and `libs/` |
-| Turborepo | `turbo.json` | `apps/` and `packages/` |
-| Lerna | `lerna.json` | Defined in packages array |
-| Yarn workspaces | `package.json` with `"workspaces":` | Same as npm |
-
-## Detection protocol
-
-```bash
-detect_workspace_type() {
-  local ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
-
-  # Check in priority order
-  if [ -f "${ROOT}/nx.json" ]; then
-    echo "nx"
-  elif [ -f "${ROOT}/turbo.json" ]; then
-    echo "turborepo"
-  elif [ -f "${ROOT}/lerna.json" ]; then
-    echo "lerna"
-  elif [ -f "${ROOT}/pnpm-workspace.yaml" ]; then
-    echo "pnpm"
-  elif node -e "
-    const p = require('./package.json');
-    process.exit(p.workspaces ? 0 : 1)
-  " 2>/dev/null; then
-    echo "npm-workspaces"
-  else
-    echo "none"
-  fi
-}
-
-list_packages() {
-  local TYPE="$1"
-  case "${TYPE}" in
-    nx)
-      find apps/ libs/ -name "package.json" -not -path "*/node_modules/*" \
-        -exec dirname {} \; 2>/dev/null | sort
-      ;;
-    turborepo)
-      find apps/ packages/ -name "package.json" -not -path "*/node_modules/*" \
-        -exec dirname {} \; 2>/dev/null | sort
-      ;;
-    pnpm)
-      cat pnpm-workspace.yaml | grep "^  -" | sed "s/  - '//;s/'$//"
-      ;;
-    npm-workspaces|lerna)
-      node -e "
-        const p = require('./package.json');
-        const ws = p.workspaces || require('./lerna.json').packages || [];
-        ws.forEach(w => console.log(w.replace(/\/\*$/, '')));
-      " 2>/dev/null
-      ;;
-  esac
-}
-```
-
-## Package metadata extraction
-
-For each detected package, extract:
-```javascript
-{
-  "name": "package name from package.json",
-  "path": "relative path from monorepo root",
-  "type": "app | lib | shared | api | web | cli",
-  "dependencies": ["list of internal package dependencies"],
-  "scripts": {
-    "build": "build command",
-    "test": "test command",
-    "lint": "lint command"
-  },
-  "mindforge": {
-    "phase-scope": "global | package-specific",
-    "test-command": "override test command if needed",
-    "affected-by": ["list of packages that affect this one"]
-  }
-}
-```
-
-## Workspace manifest
-
-Write to `.planning/WORKSPACE-MANIFEST.json`:
-
-```json
-{
-  "schema_version": "1.0.0",
-  "workspace_type": "turborepo",
-  "root": "/path/to/project",
-  "packages": [
-    {
-      "name": "@myapp/api",
-      "path": "apps/api",
-      "type": "api",
-      "dependencies": ["@myapp/shared"],
-      "test_command": "npm test",
-      "build_command": "npm run build"
-    },
-    {
-      "name": "@myapp/web",
-      "path": "apps/web",
-      "type": "web",
-      "dependencies": ["@myapp/shared", "@myapp/ui"],
-      "test_command": "npm test",
-      "build_command": "npm run build"
-    },
-    {
-      "name": "@myapp/shared",
-      "path": "packages/shared",
-      "type": "lib",
-      "dependencies": [],
-      "test_command": "npm test",
-      "build_command": "npm run build"
-    }
-  ],
-  "dependency_order": ["@myapp/shared", "@myapp/api", "@myapp/web"],
-  "affected_packages": {}
-}
-```

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/org/CONVENTIONS.md

@@ -1,62 +0,0 @@
-# Coding Conventions — [ORG NAME]
-
-<!-- These conventions are loaded by every MindForge agent session -->
-<!-- Agents follow these exactly — be precise -->
-
-## Naming conventions
-| Element          | Convention      | Example                        |
-|------------------|-----------------|--------------------------------|
-| Variables        | camelCase        | `userProfile`                  |
-| Functions        | camelCase        | `getUserById`                  |
-| Classes          | PascalCase       | `UserService`                  |
-| Constants        | SCREAMING_SNAKE  | `MAX_LOGIN_ATTEMPTS`           |
-| File names       | kebab-case       | `user-service.ts`              |
-| DB tables        | snake_case plural| `user_profiles`                |
-| DB columns       | snake_case       | `created_at`                   |
-| API endpoints    | kebab-case       | `/user-profiles/{id}`          |
-| Env variables    | SCREAMING_SNAKE  | `DATABASE_URL`                 |
-
-## File structure
-```
-src/
-  features/          ← Feature-based organisation
-    auth/
-      auth.controller.ts
-      auth.service.ts
-      auth.repository.ts
-      auth.types.ts
-      auth.test.ts
-  shared/            ← Shared utilities and types
-  config/            ← Configuration and env validation
-```
-
-## Import order (enforced by linter)
-1. Node.js built-ins
-2. External packages
-3. Internal absolute imports
-4. Internal relative imports
-(Blank line between each group)
-
-## Commit message format (Conventional Commits)
-```
-type(scope): short description
-
-[optional body]
-
-[optional footer: BREAKING CHANGE or closes #issue]
-```
-Types: feat, fix, chore, docs, test, refactor, perf, security, build, ci
-
-## Forbidden patterns
-<!-- Agents will refuse to write code that contains these -->
-- No `var` — use `const` or `let`
-- No `any` type in TypeScript without a comment explaining why
-- No `as unknown as X` type casting without a comment
-- No default exports (use named exports)
-- No `console.log` in production code
-- No empty catch blocks
-- No direct database access from route handlers (use service layer)
-- No business logic in controllers/handlers (use service layer)
-- No hardcoded URLs — use config/environment variables
-- No synchronous file I/O in request handlers
-```

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/org/ORG.md

@@ -1,51 +0,0 @@
-# Organisation Context — [ORG NAME]
-
-<!-- Replace every [placeholder] with your organisation's actual values -->
-<!-- This file is loaded at the start of every MindForge session -->
-
-## Identity
-**Organisation:** [Your organisation name]
-**Mission:** [1-2 sentences: what you build and for whom]
-**Engineering team size:** [number]
-
-## Default tech stack
-| Layer          | Technology          | Version   | Notes                    |
-|----------------|---------------------|-----------|--------------------------|
-| Frontend       | [e.g. Next.js]      | [e.g. 14] | [why this choice]        |
-| Backend        | [e.g. FastAPI]      | [e.g. 0.111] |                       |
-| Database       | [e.g. PostgreSQL]   | [e.g. 16] |                          |
-| Cache          | [e.g. Redis]        | [e.g. 7]  |                          |
-| Infrastructure | [e.g. AWS]          | —         |                          |
-| CI/CD          | [e.g. GitHub Actions] | —       |                          |
-| Monitoring     | [e.g. Datadog]      | —         |                          |
-
-## Architecture defaults
-- API style: [REST / GraphQL / gRPC]
-- Auth: [e.g. JWT with refresh tokens via Supabase Auth]
-- ORM/DB access: [e.g. Prisma with PostgreSQL]
-- Testing framework: [e.g. Vitest + Testing Library]
-- Package manager: [npm / pnpm / yarn / uv]
-
-## Team conventions
-- Git branching: [e.g. Gitflow / trunk-based]
-- PR policy: [e.g. 2 approvals required, CI must pass before merge]
-- Code review: [e.g. Conventional Comments format]
-- Sprint length: [e.g. 2 weeks]
-- Definition of ready: [criteria for a story to enter a sprint]
-- Definition of done: [criteria for a story to be marked complete]
-
-## Enterprise tools
-- Issue tracker: [e.g. Jira — your-org.atlassian.net]
-- Wiki: [e.g. Confluence — your-org.atlassian.net/wiki]
-- Source control: [e.g. GitHub — github.com/your-org]
-- Messaging: [e.g. Slack — your-org.slack.com]
-- Secrets: [e.g. AWS Secrets Manager / HashiCorp Vault]
-
-## Compliance requirements
-<!-- Check all that apply -->
-- [ ] GDPR
-- [ ] HIPAA
-- [ ] SOC 2 Type II
-- [ ] PCI-DSS
-- [ ] ISO 27001
-- [ ] Other: [specify]

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/org/SECURITY.md

@@ -1,50 +0,0 @@
-# Security Policies — [ORG NAME]
-
-<!-- Loaded by MindForge Security Reviewer persona for every security-related task -->
-
-## Authentication standards
-- Passwords: bcrypt with cost factor ≥ 12, or argon2id
-- Tokens: cryptographically random, ≥ 32 bytes (use crypto.randomBytes)
-- JWT access tokens: 15-minute expiry maximum
-- JWT refresh tokens: 7-day expiry, stored in httpOnly, Secure, SameSite=Strict cookie
-- Session IDs: regenerate on any privilege change (login, role change)
-- MFA: required for all admin and privileged accounts
-
-## Authorisation standards
-- Deny by default — grant minimum required permissions
-- Verify permissions server-side on every request
-- Never trust client-sent role or permission claims
-- Log every authorisation failure: user ID, resource, timestamp, IP
-
-## Data protection
-- Encryption at rest: AES-256 for all PII and sensitive data
-- Encryption in transit: TLS 1.2 minimum, TLS 1.3 preferred
-- PII must never appear in application logs
-- Database backups encrypted at rest
-- Data retention policy: [specify your org's policy]
-
-## Secrets management
-- Zero secrets in source code — all via environment variables
-- All production secrets in [your secrets manager]
-- Rotate secrets immediately if exposure is suspected
-- Separate secrets per environment (dev/staging/prod never share)
-
-## Dependency policy
-- Audit new dependencies before adding: CVE check, licence check, maintenance status
-- `npm audit --audit-level=high` must pass in CI before merge
-- No packages with > 6 months without a commit (unless frozen intentionally)
-- Approved licences: MIT, Apache-2.0, BSD-2/3-Clause, ISC
-- Forbidden licences: GPL (without explicit legal approval), AGPL, SSPL
-
-## Incident response
-- P0 (active breach): notify [security contact] immediately, rotate all credentials
-- P1 (critical vulnerability): patch within 24 hours
-- P2 (high vulnerability): patch within 7 days
-- All incidents: postmortem required within 5 business days
-
-## Code review security checklist
-Before approving any PR touching auth, payments, or PII:
-- [ ] OWASP Top 10 reviewed (see security-reviewer.md persona)
-- [ ] No secrets in diff
-- [ ] Input validation on all user-controlled data
-- [ ] New dependencies CVE-scanned

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/org/TOOLS.md

@@ -1,53 +0,0 @@
-# Approved Tools & Libraries — [ORG NAME]
-
-<!-- Reference for all agents when making dependency and tooling decisions -->
-
-## Approved libraries (use these — do not use alternatives without approval)
-
-### Authentication & security
-| Purpose              | Library              | Version  | Notes                    |
-|----------------------|----------------------|----------|--------------------------|
-| Password hashing     | bcrypt               | ^5.1     | Cost factor 12 minimum   |
-| JWT                  | jose                 | ^5.0     | NOT jsonwebtoken (CJS issues) |
-| Crypto               | Node.js built-in     | —        | No third-party for basics |
-
-### HTTP & API
-| Purpose              | Library              | Version  | Notes                    |
-|----------------------|----------------------|----------|--------------------------|
-| HTTP server          | [e.g. Fastify]       | [^4.0]   |                          |
-| Validation           | [e.g. Zod]           | [^3.0]   |                          |
-| HTTP client          | [e.g. ky]            | [^1.0]   | Not axios                |
-
-### Database
-| Purpose              | Library              | Version  | Notes                    |
-|----------------------|----------------------|----------|--------------------------|
-| ORM                  | [e.g. Prisma]        | [^5.0]   |                          |
-| Migrations           | [included in ORM]    | —        |                          |
-
-### Testing
-| Purpose              | Library              | Version  | Notes                    |
-|----------------------|----------------------|----------|
-| Test runner          | [e.g. Vitest]        | [^1.0]   |                          |
-| Mocking              | [e.g. vitest mock]   | —        | Built-in preferred       |
-| E2E                  | [e.g. Playwright]    | [^1.40]  |                          |
-
-## Forbidden libraries (never use these)
-| Library              | Reason                              | Use instead            |
-|----------------------|-------------------------------------|------------------------|
-| jsonwebtoken         | CommonJS, maintenance concerns      | jose                   |
-| moment               | Large bundle, deprecated            | date-fns or Temporal   |
-| lodash               | Unnecessary in modern JS/TS         | Native array methods   |
-| request              | Deprecated                          | ky or fetch            |
-| node-uuid            | Deprecated                          | crypto.randomUUID()    |
-
-## MCP servers (for MindForge integrations)
-| Service              | URL                                 | Purpose                |
-|----------------------|-------------------------------------|------------------------|
-| [e.g. Jira]          | [mcp url]                           | Issue tracking         |
-| [e.g. Confluence]    | [mcp url]                           | Wiki                   |
-
-## CI/CD tool versions
-| Tool                 | Version  | Config file          |
-|----------------------|----------|----------------------|
-| Node.js              | 20 LTS   | .nvmrc               |
-| [package manager]    | [ver]    |                      |

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/org/integrations/INTEGRATIONS-CONFIG.md

@@ -1,58 +0,0 @@
-# MindForge Integrations Configuration
-# IMPORTANT: Never store API tokens, passwords, or private keys in this file.
-# Credentials belong in environment variables or a managed secrets service.
-
-## Jira Configuration
-JIRA_BASE_URL=https://your-org.atlassian.net
-JIRA_PROJECT_KEY=ENG
-JIRA_EPIC_LABEL=mindforge-phase
-JIRA_STORY_TYPE=Story
-JIRA_BUG_TYPE=Bug
-JIRA_STORY_POINTS_FIELD=story_points
-
-## Confluence Configuration
-CONFLUENCE_BASE_URL=https://your-org.atlassian.net/wiki
-CONFLUENCE_SPACE_KEY=ENG
-CONFLUENCE_ARCHITECTURE_PAGE_TITLE=MindForge Architecture
-CONFLUENCE_ADR_PARENT_PAGE_TITLE=Architecture Decision Records
-CONFLUENCE_PHASE_DOCS_PARENT_PAGE_TITLE=Sprint Documentation
-CONFLUENCE_AUTO_PUBLISH=false
-
-## Slack Configuration
-SLACK_CHANNEL_ID=C01234ABCDE
-SLACK_NOTIFY_ON=phase_complete,security_finding,approval_needed,blocker
-SLACK_MENTION_ON_CRITICAL=@oncall
-SLACK_USE_THREADS=true
-
-## Governance Configuration
-TIER2_APPROVERS=senior-engineer-1,senior-engineer-2,tech-lead
-TIER3_APPROVERS=security-officer,compliance-officer,cto
-EMERGENCY_APPROVERS=cto,vp-engineering
-TIER2_SLA_HOURS=24
-TIER3_SLA_HOURS=4
-TIER2_ESCALATE_AFTER_HOURS=48
-TIER3_ESCALATE_AFTER_HOURS=8
-TIER2_EXPIRY_HOURS=48
-TIER3_EXPIRY_HOURS=8
-ESCALATION_CONTACT=engineering-lead@your-org.com
-ESCALATION_SLACK_CHANNEL=C0ESCALATE
-
-## GitHub Configuration
-GITHUB_REPO=your-org/your-repo
-GITHUB_DEFAULT_BRANCH=main
-GITHUB_REQUIRED_REVIEWERS=2
-GITHUB_DEFAULT_REVIEWERS=senior-engineer-1,senior-engineer-2
-GITHUB_PR_TEMPLATE_PATH=.github/pull_request_template.md
-GITHUB_DRAFT_BY_DEFAULT=false
-
-## GitLab Configuration
-GITLAB_PROJECT_ID=
-GITLAB_DEFAULT_BRANCH=main
-GITLAB_DEFAULT_REVIEWERS=
-
-## Notification Preferences
-NOTIFY_PHASE_COMPLETE=true
-NOTIFY_SECURITY_CRITICAL=true
-NOTIFY_APPROVAL_NEEDED=true
-NOTIFY_MILESTONE_COMPLETE=true
-NOTIFY_BLOCKER_ADDED=true

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/org/skills/MANIFEST.md

@@ -1,15 +0,0 @@
-# MindForge Skills Manifest
-
-This file tracks all active, validated, and legacy skills within the MindForge ecosystem.
-
-## Core Multi-Agent Skills
-- [x] agency-agents-orchestrator (Tier 1)
-- [x] agency-senior-developer (Tier 1)
-- [x] agency-software-architect (Tier 1)
-
-## Enterprise Governance
-- [x] sovereign-integrity-checker (v6.2.0)
-- [x] proactive-intent-harvester (v6.2.0)
-
-## Knowledge Base
-- [ ] project-specific-knowledge

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/personas/advisor-researcher.md

@@ -1,89 +0,0 @@
----
-name: mindforge-advisor-researcher
-description: Researches single decision points and provides structured comparisons with rationale. Specialized in evaluating trade-offs between libraries, patterns, and tools.
-tools: Read, Write, Bash, Grep, Glob, search_web, read_url_content, Context7
-color: cyan
----
-
-<role>
-You are the MindForge Advisor Researcher. Your mission is to research specific technical gray areas and produce objective, structured comparisons to guide decision-making.
-
-You are typically invoked when a project phase faces a choice between multiple viable paths (e.g., Choosing between two libraries, or deciding between a local vs. cloud strategy).
-</role>
-
-<why_this_matters>
-Your research provides the data needed for high-quality architectural decisions:
-- **Architect** uses your comparison tables to write finalized ADRs.
-- **Planner** uses your complexity assessments to sequence tasks correctly.
-- **Developer** depends on your verified best practices to implement robust solutions.
-</why_this_matters>
-
-<philosophy>
-**Objective Comparison:**
-Never pick a "winner" for its own sake. Identify the constraints under which each option excels.
-
-**Data-Driven Rationale:**
-A recommendation without evidence is just an opinion. Use web research and codebase analysis to ground every claim.
-
-**Complexity as Impact:**
-Complexity isn't just "hard to write." It's the surface area of change, new dependencies, and operational risks introduced to the system.
-</philosophy>
-
-<process>
-
-<step name="research">
-Use `Context7` as the primary source for technical documentation and code examples. Supplement with `search_web` and `read_url_content` for community sentiment, library maturity signals (stars, age), and recent pitfalls.
-Search the codebase using `Grep` and `Glob` to understand existing stack constraints.
-</step>
-
-<step name="calibration">
-Adjust the depth of your output based on the required "Maturity Tier":
-- **High Maturity:** 3-5 options, detailed maturity signals, conditional recommendations.
-- **Standard:** 2-4 options, conditional recommendations, grounded rationale.
-- **Decisive:** 2 options max, single clear recommendation, brief rationale.
-</step>
-
-<step name="comparison">
-Produce a structured comparison table with the following columns:
-- **Option:** Name of the approach/tool.
-- **Pros:** Key advantages.
-- **Cons:** Key disadvantages.
-- **Complexity:** Impact surface + risk (e.g., "3 files, new dep -- Risk: memory leak").
-- **Recommendation:** Conditional advice (e.g., "Rec if mobile-first").
-</step>
-
-</process>
-
-<templates>
-
-## Comparison Table Template
-
-| Option | Pros | Cons | Complexity | Recommendation |
-|--------|------|------|------------|----------------|
-| [Tool A] | [Advantage 1] | [Disadvantage 1] | [Surface + Risk] | [Condition] |
-
-**Rationale:** [Context-grounded explanation for the recommended path]
-
-</templates>
-
-<forbidden_files>
-**NEVER read or quote contents from these files:**
-- `.env`, `*.env`
-- `credentials.*`, `secrets.*`
-- `*.pem`, `*.key`
-- `.npmrc`, `.netrc`
-</forbidden_files>
-
-<critical_rules>
-- **NO TIME ESTIMATES**: Never use hours or days in complexity assessments. Focus on architectural impact.
-- **CONDITIONAL RECOMMENDATIONS**: Avoid absolute "Best" rankings. Always specify the context where an option wins.
-- **VERIFY BEST PRACTICES**: Always check for the latest versions and community sentiment before recommending a tool.
-</critical_rules>
-
-<success_criteria>
-- [ ] Research conducted across multiple sources
-- [ ] At least two genuinely viable options presented
-- [ ] Complexity expressed as impact/risk surface
-- [ ] Rationale grounded in the specific project context
-- [ ] Comparison table follows the 5-column structure
-</success_criteria>

package/.mindforge/mirrors/mirror-sre-776a1cf9/.mindforge/personas/analyst.md

@@ -1,112 +0,0 @@
----
-name: mindforge-analyst
-description: Senior product analyst and requirements engineer. Translates ambiguous business intent into precise, testable, scoped specifications.
-tools: Read, Write, Bash, Grep
-color: blue
----
-
-<role>
-You are a MindForge Project Analyst. Your mission is to eliminate ambiguity at the start of the project lifecycle.
-You translate raw user requests into a structured `.planning/REQUIREMENTS.md` that serves as the source of truth for all downstream agents (Architect, Developer, QA).
-
-You never assume. You ask until you understand completely. If a requirement is vague, you flag it.
-</role>
-
-<why_this_matters>
-Your output is the foundation of the entire MindForge workflow:
-- **Architect** uses your NFRs (Non-Functional Requirements) to make design decisions.
-- **Roadmapper** uses your features list to sequence phases.
-- **QA Engineer** uses your acceptance criteria to write UAT protocols.
-- **Developer** uses your scoped tasks to avoid scope creep.
-</why_this_matters>
-
-<philosophy>
-**Socratic and Systematic:**
-Don't just accept a request. Ask "Why?", "Who is this for?", "What happens if this fails?".
-
-**Acceptance-Driven:**
-A requirement without an acceptance criterion is just a wish. Every feature must have a "How we know it works" clause.
-
-**Scope Guardian:**
-Be explicit about what is OUT of scope to prevent the infinite expansion of the project.
-</philosophy>
-
-<process>
-
-<step name="parse_intent">
-Analyze the user's prompt or the existing `PROJECT.md`. Identify:
-- Primary user persona.
-- The "Job to be Done".
-- Success metrics.
-</step>
-
-<step name="clarification_loop">
-Ask targeted, one-at-a-time questions to resolve:
-- Implicit constraints (performance, security, scale).
-- Technology preferences or restrictions.
-- Third-party integration requirements.
-</step>
-
-<step name="draft_requirements">
-Write or update `.planning/REQUIREMENTS.md` using the standard template.
-Group features by logical area and tag them by priority (Must/Should/Could).
-</step>
-
-<step name="write_project_charter">
-Synchronize `.planning/PROJECT.md` to reflect the refined goals and stakeholders.
-</step>
-
-</process>
-
-<templates>
-
-## REQUIREMENTS.md Template
-
-```markdown
-# Project Requirements
-
-## Core Objective
-[1-sentence summary of the goal]
-
-## Stakeholders & Users
-- [User Type]: [What they want to achieve]
-
-## Functional Requirements
-### [Area 1: e.g., Authentication]
-- **FR-01**: [Description]
-  - Acceptance Criteria: [Testable condition]
-  - Priority: [Must/Should/Could]
-  - Status: [Pending/Approved]
-
-## Non-Functional Requirements
-- **NFR-01**: [e.g., Latency < 200ms]
-- **NFR-02**: [e.g., WCAG 2.1 AA Compliance]
-
-## Out of Scope
-- [Feature X]
-- [Platform Y]
-```
-
-</templates>
-
-<forbidden_files>
-**NEVER read or quote contents from these files:**
-- `.env`, `*.env` - API keys and secrets
-- `credentials.*`, `secrets.*`
-- `*.pem`, `*.key` - Private keys
-- `.npmrc`, `.netrc` - Auth tokens
-</forbidden_files>
-
-<critical_rules>
-- **ASK FIRST**: Do not commit to a requirement if it seems architecturally impossible without checking with the Architect or User.
-- **ONE QUESTION**: When clarifying, ask one high-impact question at a time to keep the user focused.
-- **NO PLACEHOLDERS**: Never leave `TODO` or `[TBD]` in the requirements. If it's TBD, it's not a requirement yet.
-</critical_rules>
-
-<success_criteria>
-- [ ] Primary user and goals identified
-- [ ] All features have measurable acceptance criteria
-- [ ] Out-of-scope items explicitly listed
-- [ ] Priority tags applied (Must/Should/Could)
-- [ ] REQUIREMENTS.md written to `.planning/`
-</success_criteria>