nobrainer-tech-flow 0.0.0-stage → 2.4.0

package/skills/nobrainer-build/SKILL.md

@@ -0,0 +1,173 @@
+---
+name: nobrainer-build
+description: "Use when the owner says nb-build, engineering-standards, or nobrainer-simplifier, or asks to implement or simplify an approved bounded code, configuration, documentation, or test change after outcome and acceptance are clear; apply the smallest verified edit with calibrated KISS, DRY, SOLID, YAGNI and anti-slop gates."
+---
+
+# NoBrainer Build
+
+Implement one bounded work unit without expanding the product or hiding weak
+evidence behind polished output. This skill owns the edit loop. Route ambiguous
+requirements to `nobrainer-tech-flow`, causal diagnosis to `nobrainer-rca`, and the
+independent close gate to `nobrainer-review`.
+
+## Start gate
+
+Use the actual task workspace, including an ordinary folder without Git. Repository,
+branch, commit and build fields are `NOT_APPLICABLE` when absent; do not initialize
+Git or request a repository merely to deliver an artifact. Verify documents through
+their source facts, acceptance and content/rendered readback.
+
+Before the first write, resolve:
+
+- observable outcome and acceptance IDs or checks;
+- exact repository, checkout, dirty state, write scope and exclusions;
+- expected files with one reason each, plus protected untouched files;
+- relevant instructions, current callers/consumers and baseline behavior;
+- cheapest useful failing proof, target tests, broader verifier/build/runtime;
+- side effects, owner gates, rollback and the `Done clean` condition.
+
+Preserve unrelated changes. Use an isolated worktree or disjoint write scope
+when another writer is active. If a missing requirement changes architecture,
+scope, public behavior or safety, stop at `SPEC_CHANGE_PROPOSED`; do not invent it
+inside the patch.
+
+## Engineering gate
+
+Apply these principles as decision rules, not slogans:
+
+- `KISS`: choose the simplest complete design that satisfies acceptance.
+- `YAGNI`: do not add extension points, compatibility layers or options for an
+  unproven future requirement.
+- `DRY`: keep each rule and mutable fact under one owner, but do not abstract
+  incidental similarity. Duplication can be cheaper than the wrong coupling.
+- `SOLID`: preserve cohesive responsibilities and stable dependency boundaries;
+  this is not a mandate for object-oriented ceremony, tiny classes or needless
+  interfaces.
+
+Before writing, stop at the first complete option that satisfies acceptance:
+
+1. skip or delete work when the outcome already exists or the artifact is unnecessary;
+2. reuse existing code or a maintained project capability;
+3. use the standard library or native platform;
+4. use an already-installed dependency;
+5. add the minimum local implementation.
+
+Configuration owns values that vary by environment or run; code owns invariants.
+
+When an accepted simplification has a known operational ceiling, record the
+ceiling, observable trigger to revisit it, and responsible owner in the current
+task plan/report. For example, a single-writer design must be revisited before
+introducing concurrent writers. Do not turn ordinary minimal code into a debt
+backlog: omit this record when there is no known ceiling. This never permits
+cutting required validation, security, accessibility or acceptance. A later task
+that crosses the trigger must revisit the design before relying on the shortcut.
+
+A new shared abstraction requires two real current callers or an explicit
+acceptance contract that needs the boundary. A hypothetical future caller does
+not justify it. If inspection expands the expected file set, update scope before
+editing the newly required file.
+
+## Anti-slop gate
+
+Reject a patch that contains any of the following without explicit acceptance:
+
+- invented APIs, packages, commands, files, facts or runtime claims;
+- placeholder logic, fake data, swallowed errors or success on partial output;
+- comments that restate visible code, generic generated documentation or
+  self-congratulatory best-practice prose;
+- broad renames, formatting churn or neighboring refactors unrelated to the
+  work unit;
+- duplicate state owners, speculative abstractions or fallback stacks that make
+  failure ambiguous;
+- tests that only assert a mock/fixture while the real contract remains
+  unexercised.
+
+Names should explain intent. Comments should explain only non-obvious why,
+constraints, risk or tradeoffs. Do not create a new README, framework or process
+artifact merely to make the change look substantial.
+
+## Build loop
+
+1. Re-open the relevant source and tests from disk. Trace the affected behavior
+   through its caller and consumer boundary.
+2. For a behavior change, create a failing proof before implementation when it
+   is feasible and reliable. Otherwise record why and preserve the closest
+   reproducible baseline.
+3. Make the smallest coherent patch. Keep one behavioral concern per change and
+   update the expected file set for routine changes within the approved outcome;
+   stop only when the actual approved scope or consequences change.
+4. Run the focused proof, then affected baseline tests and the repository's
+   required verifier/build/runtime in increasing cost order.
+   Once acceptance and required checks pass, broaden or repeat only for a new
+   change, failure or unresolved concern.
+   Before changing shared fixtures, runners, mocks, defaults or test
+   infrastructure, inventory all consumers and run at least one representative
+   suite per affected behavior class. A test-helper cleanup must not silently
+   change unrelated projects' defaults.
+5. Re-read the final diff and run an acceptance trace from promised outcome back
+   through output, state, caller, validation and source data.
+   Perform a behavior-preserving simplification pass: remove unused indirection,
+   duplicate state and needless fallback layers only when references and tests
+   prove the simpler path. Do not compress readable code merely to reduce lines.
+   For a behavior-preserving rewrite, prove the tests would notice a change:
+   seed one deliberate fault per changed behavior class in a disposable copy (or
+   revert it at once), confirm a test fails, revert, and confirm a clean diff.
+   Report `TEST_SENSITIVITY: PROVEN | PARTLY_PROVEN | NOT_PROVEN` (all, some or no
+   classes caught); `NOT_PROVEN` leaves the preservation claim `UNVERIFIED`.
+   Check `Done clean`: actual files match the expected scope, no unexpected
+   status entry remains, and no placeholder or speculative layer survived.
+   If a pull request is part of the authorized delivery, bind its reported checks
+   and review state to the exact current head SHA; evidence from a replaced head is
+   stale.
+6. Route a consequential or user-requested final gate to `nobrainer-review`.
+   Every fix invalidates earlier evidence for the changed path and must be
+   rechecked.
+
+A command exit code proves only that command. Distinguish static validation,
+local runtime, deployed runtime, production behavior and user usefulness.
+
+If the work crosses authentication, authorization, secrets, sensitive data,
+untrusted input, dependency installers or another trust boundary, add a bounded
+`nobrainer-security` stage before final acceptance.
+
+## Stop and owner gates
+
+Pause the affected operation on changed frozen inputs, conflicting writer, failed required check,
+unknown destructive effect, missing credentials/toolchain or a scope-changing
+decision. Merge, deploy, publish, spend, delete, contact people, migrate data, change
+credentials, mutate production or weaken safety controls only with their explicit authority.
+
+A failed check routes to repair; a missing tool or credential routes through
+[delivery obstacle resolution](../nobrainer-tech-flow/references/delivery.md). Check
+permitted alternatives and continue independent work before reporting BLOCKED.
+
+When the [Flow corrective-attempt budget](../nobrainer-tech-flow/SKILL.md) is spent,
+preserve the failing proof, return to `nobrainer-rca` or revise the design with the owner.
+
+## Build report
+
+This schema is an audit input for Flow or another machine handoff. In ordinary
+conversation, translate it into a short natural-language outcome, evidence,
+uncertainty, rollback and next action instead of dumping the form.
+
+```text
+RESULT: FINISHED | BLOCKED | FAILED | SPEC_CHANGE_PROPOSED
+WORK_UNIT:
+FILES_CHANGED:
+ACCEPTANCE_TRACE:
+FAILING_PROOF_BEFORE:
+TARGETED_CHECKS:
+BROADER_CHECKS:
+TEST_SENSITIVITY: PROVEN | PARTLY_PROVEN | NOT_PROVEN | NOT_APPLICABLE
+RUNTIME_EVIDENCE:
+REVIEW:
+SIDE_EFFECTS:
+UNVERIFIED:
+DEFERRED_CEILINGS: <known ceiling, revisit trigger and owner | NONE>
+ROLLBACK:
+NEXT_ACTION:
+```
+
+Report `FINISHED` only when the approved work unit and required evidence pass.
+Do not claim merge, deployment or production state without readback from that
+system.

package/skills/nobrainer-codex-context/SKILL.md

@@ -0,0 +1,111 @@
+---
+name: nobrainer-codex-context
+description: "Use when setting up, auditing or repairing one project's Codex context; use nb-codex-context to inspect AGENTS files, configured fallbacks and byte limits, then make one evidence-backed project-local context change without changing global Codex configuration by default."
+---
+
+# NoBrainer Codex Context
+
+Prepare the smallest useful project context for Codex. This skill owns the
+project-instruction boundary that Codex reads before a turn; it does not own
+model selection, subagent topology, session transfer, or the whole delivery
+workflow.
+
+## Select a mode
+
+- `inspect` - read the current project root, instruction candidates, configured
+  fallbacks, byte cap and effective document set. Do not write.
+- `setup` - inspect first, reconcile the existing instruction files, and add or
+  update one marked project-local context block only when it improves the
+  actual repository. Run the inspection again after the edit.
+- `repair` - fix a known context defect such as duplicate managed markers,
+  stale generated content or a truncation-risk block. Do not rewrite unrelated
+  instructions.
+
+Use `inspect` for a question. Use `setup` only when the owner asks to prepare
+the project or the project has a demonstrated context gap. A clean result is
+`CURRENT`; absence, truncation or an unknown runtime is evidence to report, not
+permission to invent a fix.
+
+## Codex context contract
+
+Codex's effective project instructions are assembled from the nearest project
+root through the current directory. The normal candidates are
+`AGENTS.override.md` and `AGENTS.md`; configured fallback names are considered
+after them. The configured project-document byte budget applies to the loaded
+instruction set and defaults to the host's documented value when no override is
+read.
+
+Run the bundled read-only probe with Python 3.11+ before deciding what to change.
+Run it from the project, replacing `<context-skill-dir>` with this skill's
+directory wherever it is installed; the probe inspects the current directory,
+or the one given with `--cwd`:
+
+```bash
+python3 <context-skill-dir>/scripts/codex_context.py --check --json
+```
+
+The probe is an inventory and truncation check; its exit status does not prove
+that a live Codex client followed the instructions.
+
+When a project needs a durable NoBrainer context block, preserve all existing
+bytes and use exactly these markers in the applicable `AGENTS.md`:
+
+```markdown
+<!-- NOBRAINER-CODEX-CONTEXT:START -->
+## Project context
+
+- Source of truth: `<verified project files>`.
+- First checks: `<verified commands or tests>`.
+- Keep this block compact; link to deeper project docs instead of copying them.
+<!-- NOBRAINER-CODEX-CONTEXT:END -->
+```
+
+Replace the placeholders only with facts read from the current project. Do not
+put credentials, private machine paths, mutable runtime state, guessed commands
+or model names in the block. If an existing managed block is present, update it
+in place; do not create a second one. If an `AGENTS.md` is absent, create it
+only when setup is explicitly requested and the project has enough inspected
+source facts to make the block useful.
+
+Do not create a `CODEX_CONTEXT.md` file and call it automatically loaded. Codex
+will only use an alternate filename when the host's `project_doc_fallback_filenames`
+configuration actually includes it; changing that global configuration is an
+owner-gated action outside this skill's default setup.
+
+## Safe setup boundaries
+
+- Keep `AGENTS.override.md` precedence and client-managed blocks intact.
+- Never replace a whole `AGENTS.md` because it is long, old or from another
+  client. Reduce duplication only when the exact duplicate and its owner are
+  clear.
+- Do not edit `~/.codex/config.toml`, credentials, plugin installation or
+  client settings unless the owner explicitly requests that separate action.
+- Do not claim `RUNTIME_VERIFIED` from a file read, probe exit code or installed
+  skill. If `codex debug prompt-input` or `codex debug agents-md` is available,
+  use it for a fresh readback; otherwise report `RUNTIME_READBACK: UNKNOWN`.
+- Keep the context block below the project's own required instructions when the
+  file's structure makes that safer. Follow the nearest `AGENTS.md` rules.
+
+## Closeout
+
+Return a compact readback:
+
+```text
+CODEX_CONTEXT: CURRENT | UPDATED | BLOCKED
+PROJECT_ROOT: <path or UNKNOWN>
+DOCUMENTS: <ordered discovered files>
+FALLBACKS: <configured names or NONE>
+BYTE_BUDGET: <observed value or UNKNOWN>
+LOADED_BYTES: <observed value or UNKNOWN>
+TRUNCATED: YES | NO | UNKNOWN
+PROJECT_WRITE: NONE | AGENTS_BLOCK_UPDATED | AGENTS_CREATED
+RUNTIME_READBACK: VERIFIED | UNKNOWN | UNSUPPORTED
+OWNER_ACTION_REQUIRED: <one exact action or NONE>
+ROLLBACK: <exact preimage or NOT_APPLICABLE>
+```
+
+Route portfolio-wide semantic instruction or skill audits to
+`nobrainer-skill-doctor`; keep one-project Codex context setup and repair here.
+Route broader setup, installation or delivery work back to `nobrainer-tech-flow`.
+Use `nobrainer-sessions` for context transfer and `nobrainer-review` for a
+release or adversarial closeout; do not duplicate their contracts here.

package/skills/nobrainer-codex-context/scripts/codex_context.py

@@ -0,0 +1,175 @@
+#!/usr/bin/env python3
+"""Read-only inspection of the project instructions Codex can load."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+import tomllib
+from pathlib import Path
+from typing import Any
+
+
+DEFAULT_MAX_BYTES = 32 * 1024
+DEFAULT_MARKERS = (".git",)
+DEFAULT_FILENAMES = ("AGENTS.override.md", "AGENTS.md")
+
+
+def _section(config: dict[str, Any], name: str) -> dict[str, Any]:
+    value = config.get(name)
+    return value if isinstance(value, dict) else {}
+
+
+def load_config(path: Path) -> tuple[dict[str, Any], list[str]]:
+    if not path.is_file():
+        return {}, []
+    try:
+        return tomllib.loads(path.read_text(encoding="utf-8")), []
+    except (OSError, tomllib.TOMLDecodeError) as exc:
+        return {}, [f"config unreadable: {exc}"]
+
+
+def config_value(config: dict[str, Any], key: str, default: Any) -> Any:
+    project = _section(config, "project")
+    if key in project:
+        return project[key]
+    return config.get(key, default)
+
+
+def find_root(cwd: Path, markers: tuple[str, ...]) -> tuple[Path | None, str | None]:
+    if not markers:
+        return cwd, "<cwd>"
+    cursor = cwd
+    while True:
+        for marker in markers:
+            if (cursor / marker).exists():
+                return cursor, marker
+        if cursor.parent == cursor:
+            return None, None
+        cursor = cursor.parent
+
+
+def search_dirs(root: Path | None, cwd: Path) -> list[Path]:
+    if root is None:
+        return [cwd]
+    dirs: list[Path] = []
+    cursor = cwd
+    while True:
+        dirs.append(cursor)
+        if cursor == root:
+            return list(reversed(dirs))
+        if cursor.parent == cursor:
+            return list(reversed(dirs))
+        cursor = cursor.parent
+
+
+def unique_names(names: list[str]) -> list[str]:
+    result: list[str] = []
+    for name in names:
+        if isinstance(name, str) and name and name not in result:
+            result.append(name)
+    return result
+
+
+def inspect_context(cwd: Path, config_path: Path) -> dict[str, Any]:
+    config, config_errors = load_config(config_path)
+    raw_markers = config_value(config, "project_root_markers", list(DEFAULT_MARKERS))
+    markers = (
+        tuple(item for item in raw_markers if isinstance(item, str))
+        if isinstance(raw_markers, list)
+        else DEFAULT_MARKERS
+    )
+    raw_fallbacks = config_value(config, "project_doc_fallback_filenames", [])
+    fallbacks = (
+        [item for item in raw_fallbacks if isinstance(item, str)]
+        if isinstance(raw_fallbacks, list)
+        else []
+    )
+    raw_max = config_value(config, "project_doc_max_bytes", DEFAULT_MAX_BYTES)
+    max_bytes = raw_max if isinstance(raw_max, int) and raw_max >= 0 else DEFAULT_MAX_BYTES
+    names = unique_names([*DEFAULT_FILENAMES, *fallbacks])
+    root, root_marker = find_root(cwd, markers)
+    documents: list[dict[str, Any]] = []
+    for directory in search_dirs(root, cwd):
+        selected: Path | None = None
+        for name in names:
+            candidate = directory / name
+            if candidate.is_file():
+                selected = candidate
+                break
+        if selected is None:
+            continue
+        size = selected.stat().st_size
+        documents.append({"path": str(selected), "bytes": size})
+
+    loaded = 0
+    for document in documents:
+        remaining = max(max_bytes - loaded, 0)
+        used = min(document["bytes"], remaining)
+        document["loaded_bytes"] = used
+        document["truncated"] = used < document["bytes"]
+        loaded += used
+
+    truncated = any(document["truncated"] for document in documents)
+    if config_errors:
+        status = "CONFIG_INVALID"
+    elif not documents:
+        status = "MISSING"
+    elif truncated:
+        status = "TRUNCATED"
+    else:
+        status = "CURRENT"
+    return {
+        "schema": 1,
+        "status": status,
+        "cwd": str(cwd),
+        "project_root": str(root) if root else None,
+        "root_marker": root_marker,
+        "config_path": str(config_path),
+        "config_errors": config_errors,
+        "candidate_filenames": names,
+        "project_doc_max_bytes": max_bytes,
+        "loaded_bytes": loaded,
+        "documents": documents,
+    }
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--cwd", type=Path, default=Path.cwd())
+    parser.add_argument("--config", type=Path, help="Codex config.toml to inspect")
+    parser.add_argument(
+        "--json", action="store_true", help="print machine-readable JSON"
+    )
+    parser.add_argument(
+        "--check", action="store_true", help="return non-zero unless context is CURRENT"
+    )
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = parse_args()
+    cwd = args.cwd.expanduser().resolve()
+    config_path = (
+        args.config.expanduser().resolve()
+        if args.config
+        else Path(os.environ.get("CODEX_HOME", "~/.codex")).expanduser().resolve()
+        / "config.toml"
+    )
+    result = inspect_context(cwd, config_path)
+    if args.json:
+        print(json.dumps(result, indent=2, sort_keys=True))
+    else:
+        print(f"CODEX_CONTEXT: {result['status']}")
+        print(f"PROJECT_ROOT: {result['project_root'] or 'UNKNOWN'}")
+        print(f"DOCUMENTS: {', '.join(item['path'] for item in result['documents']) or 'NONE'}")
+        print(f"BYTE_BUDGET: {result['project_doc_max_bytes']}")
+        print(f"LOADED_BYTES: {result['loaded_bytes']}")
+        print(f"TRUNCATED: {'YES' if result['status'] == 'TRUNCATED' else 'NO'}")
+    return 0 if not args.check or result["status"] == "CURRENT" else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skills/nobrainer-decide/SKILL.md

@@ -0,0 +1,198 @@
+---
+name: nobrainer-decide
+description: "Use when choosing between options: just decide for a quick choice, decide or nb-decide for standard analysis, deep decide or deep-decide for deep analysis. Evaluate feasibility, reliability, total cost, delivery time, scale and reversibility."
+---
+
+# NoBrainer Decide
+
+Deliver one ranked decision with evidence, confidence, watchpoints and kill
+criteria. Do not hide behind several flavors of "it depends". This skill decides;
+it does not diagnose an unknown failure or execute the chosen option.
+
+Use `nobrainer-rca` first when the unresolved question is causal. Use
+`nobrainer-research` when current external facts or a broader option space must
+be established before scoring.
+
+## Select the requested depth
+
+Do not run a panel for a factual lookup, an already-made choice, or an obvious
+reversible edit.
+
+Match the owner's invocation, case-insensitively, longest phrase first:
+
+| Invocation | Rigor | Work and output |
+|---|---|---|
+| `just decide`, `just-decide` | LIGHT | One pass; compare the credible alternatives and status quo; choice, decisive reason, main risk and next action in a short paragraph. No mandatory scorecard or panel. |
+| `decide`, `nb-decide`, `nobrainer-decide` | STANDARD | Compare at least three distinct mechanisms including status quo; feasibility screen, compact comparison, challenge the leader and recommend one next action. |
+| `deep decide`, `deep-decide` | HIGH | Standard analysis plus future scenarios, sensitivity, strongest counterargument, exit plan and bounded evidence gathering. |
+
+Treat phrases as instructions only when the owner invokes them, not when they
+occur in a quotation, filename or a request to edit this skill. An implicit
+decision request defaults to STANDARD. A later explicit depth choice overrides
+an earlier one. Depth never changes the selected model, permissions or budget.
+
+Preserve the owner's model, effort, depth and budget. Delegate independent research,
+comparison or challenge units promptly under nobrainer-tech-flow
+[team execution](../nobrainer-tech-flow/references/delivery.md#coordinated-team-execution);
+keep a tiny or tightly coupled step in MAIN. MAIN reconciles findings; do not require a fixed panel
+size. Never create visible conversations as substitutes. If independent review is
+unavailable, complete the analysis in MAIN and disclose that limitation; self-review
+is not an independent review. Blind attacks and fresh review apply only to actual
+independent runs; otherwise perform their checks once in MAIN without claiming blindness.
+
+Set a finite analysis budget appropriate to stakes and the owner's deadline.
+Default to one comparison and one challenge/revision cycle; further research
+needs a named uncertainty that could change the choice. Stop when the choice is
+stable, the evidence budget is exhausted or a decisive fact remains unavailable.
+LIGHT still checks hard constraints and serious downside. For a high-stakes
+quick request, give a concise conditional recommendation or bounded next check;
+do not silently launch HIGH or manufacture certainty to finish quickly.
+
+## 1. Frame the actual decision
+
+Restate:
+
+- decision, owner, deadline and observable outcome;
+- baseline/status quo and what happens if nothing changes;
+- hard constraints, reversible vs irreversible effects, and owner gates;
+- evidence freshness and consequential unknowns.
+
+Rewrite the problem once without project nouns. Ask "what system property makes
+this decision necessary?" until symptom and root cause are separated. If a
+candidate appears immediately, record it as an anchor to challenge, not the
+answer.
+
+Ask at most one focused clarification round. Then either decide or identify the
+single missing owner choice/evidence that truly blocks a decision.
+
+## 2. Generate different shapes
+
+For STANDARD and HIGH produce at least three mechanisms, not parameter variants. Always include the
+status quo. Include at least one shape from outside the user's initial frame:
+
+- measure first;
+- fix the systemic cause;
+- remove the requirement;
+- accept and observe within an explicit budget.
+
+For every option state mechanism, expected benefit, key dependency, worst
+failure, reversibility and earliest useful evidence. Reject duplicate shapes.
+
+## 3. Score transparently
+
+Before ranking, mark each option FEASIBLE, INFEASIBLE or UNVERIFIED against the
+owner's hard limits: delivery deadline, implementation effort, available skills,
+budget and minimum reliability. Reliability must mean an observable requirement
+appropriate to the decision (for example acceptable downtime, error rate,
+recovery time or loss). Never invent a threshold or treat an unknown as passing.
+An infeasible option cannot win through points elsewhere. If no option passes,
+recommend one bounded experiment or identify the constraint that needs changing;
+do not relax it silently.
+
+Prefer the simplest feasible solution that achieves the outcome. Estimate total
+cost over the same stated horizon: build, migration, operation, maintenance,
+attention, failure recovery and exit. Use ranges and sources; label estimates.
+Include time to first useful result and time to a reliable finished solution.
+Do not equate a cheap subscription with low total cost.
+
+For HIGH compare current demand, plausible growth and an adverse scenario.
+State capacity evidence, likely bottleneck and the measurable trigger for an
+upgrade. Preserve a practical migration path instead of paying now for imagined
+scale. A staged decision (X now, Y after threshold Z) is a valid single choice.
+
+Define criteria from the actual outcome before scoring. The default ledger is:
+
+| Criterion | Default weight |
+|---|---:|
+| outcome/metric movement | 3 |
+| correctness and evidence | 3 |
+| optionality and lock-in | 3 |
+| downside/antifragility | 3 |
+| production or operational readiness | 2 |
+| recurring cost and attention tax | 2 |
+| simplicity and maintainability | 2 |
+| reversibility | 1 |
+| one-time cost | 1 |
+| time to useful result | 3 |
+
+Change weights only with an explicit reason. Score 1–5 and show weighted totals,
+source quality, sensitivity to uncertain assumptions, one-time and recurring
+cost. Use a qualitative comparison when numeric scores would imply unsupported
+precision. Numbers do not auto-select the winner; they expose the tradeoff.
+Accept ties. Prefer the simpler, cheaper-to-reverse feasible option when evidence
+does not distinguish them; state that tie-break. Do not re-score to force a gap.
+
+Distinguish robustness (survives stress), resilience (recovers) and antifragility
+(improves through bounded exposure and feedback). Redundancy alone proves none
+of the improvement claim. Name the feedback mechanism and measurable improvement
+before crediting antifragility. Never introduce harmful stress or uncontrolled
+downside to earn that label. Check correlated failures and costly exit paths.
+
+## 4. Attack the leader
+
+A blind attacker receives the problem, evidence and leading option but not the
+scorer's rationale. It must answer:
+
+1. What if the problem framing is wrong?
+2. Which rejected option deserves the strongest steelman?
+3. Is the leader winning because it is familiar or easy?
+4. Which assumption can reverse the ranking?
+5. Is this systemic, a fallback, or a workaround?
+
+Re-score when an attack changes a criterion or assumption. A fallback may win,
+but name the systemic alternative and the trigger for revisiting it.
+
+## 5. Cold review and commitment
+
+A fresh reviewer sees the original decision, evidence and options, not prior
+reasoning. It checks missing shapes, stale evidence, score sensitivity,
+operational burden, rollback and owner gates. The synthesizer reconciles both
+attacks and selects exactly one option.
+
+Do not turn a recommendation into execution authority. Publishing, spending,
+merging, deployment, credentials, production mutation, destructive action, and
+safety changes remain explicit owner gates.
+
+## Decision record
+
+Use the short output above for LIGHT. For STANDARD keep only useful fields;
+HIGH uses the fuller record below. Include feasibility, delivery range, total
+cost horizon and reliability evidence in the comparison. Separate confirmed
+facts, assumptions and forecasts. Confidence reflects evidence and ranking
+stability, not the number of agents. An unresolved decisive fact permits a
+conditional choice or time-boxed experiment, not an unsupported commitment.
+
+```text
+DECISION
+  Choice: <one option>
+  Confidence: LOW | MEDIUM | HIGH - <reason>
+  Why it beats #2: <one evidence-bound sentence>
+  Type: SYSTEMIC | FALLBACK | WORKAROUND
+  Rigor: LIGHT | STANDARD | HIGH
+
+SCORECARD
+  <criteria, weights, scores, totals, sensitivity>
+
+WATCHPOINTS
+  - <metric + threshold + review/action>
+  - <metric + threshold + review/action>
+
+KILL_CRITERIA
+  - If <observable condition> by <time/event>, stop or revert to <option>.
+
+ROLLBACK
+  - <procedure, owner, and readback>
+
+REJECTED_OPTIONS
+  - <option>: <decisive reason and revisit trigger>
+
+OPEN_ASSUMPTIONS
+  - <at most two genuinely decision-relevant assumptions or NONE>
+
+OWNER_GATE
+  - <exact approval needed before action or NONE>
+```
+
+End with one next action. Preserve the decision and evidence in the project's
+existing durable record only when it will guide future work; do not create a
+second source of truth.