nobrainer-tech-flow 2.5.0 → 2.6.0

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "nobrainer-tech-flow",
       "description": "From task to done. nobrainer-tech-flow is one workflow of 18 modules for AI coding agents: it scopes the task, delegates ready work, checks the result and hands over the evidence, including what was not checked.",
-      "version": "2.5.0",
+      "version": "2.6.0",
       "source": "./",
       "author": {
         "name": "NoBrainer Tech"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "nobrainer-tech-flow",
   "description": "From task to done. nobrainer-tech-flow is one workflow of 18 modules for AI coding agents: it scopes the task, delegates ready work, checks the result and hands over the evidence, including what was not checked.",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "author": {
     "name": "NoBrainer Tech"
   },

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "nobrainer-tech-flow",
   "description": "From task to done. nobrainer-tech-flow is one workflow of 18 modules for AI coding agents: it scopes the task, delegates ready work, checks the result and hands over the evidence, including what was not checked.",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "author": {
     "name": "NoBrainer Tech",
     "url": "https://nobrainer.tech"

package/README.md

@@ -260,8 +260,10 @@ sh ~/.nobrainer-tech-flow/scripts/install.sh --client claude --apply   # link th
 `--client` is `claude`, `codex`, `opencode` or `copilot`. Cursor, Gemini CLI, Pi and Kimi Code
 use a plugin or extension instead: see their sections in
 [docs/INSTALL.md](docs/INSTALL.md#client-channels). The script links all eighteen skills and adds
-one instruction block, shows the exact text first, refuses anything that is not its own, grants
-no authorization and undoes itself with `--undo --apply`. To update, run `git pull` in
+one instruction block, shows the exact text first, refuses anything that is not its own and
+undoes itself with `--undo --apply`. The block lets Flow update itself to verified stable
+releases once a day; `install_personalization.py --no-auto-update` turns that into a
+notification only. No other authorization is granted. To update, run `git pull` in
 `~/.nobrainer-tech-flow` and the same two commands again, or paste the prompt again. With Python,
 `python3 scripts/install.py` takes the same flags.
 
@@ -303,7 +305,8 @@ next command.
 `install.py`, like `scripts/install.sh` without Python, links all eighteen skills
 and adds one managed instruction block for `claude`, `codex`, `opencode` or
 `copilot`. The preview shows the exact text it would write, a target that is not
-its own link is refused, no authorization is ever granted, and
+its own link is refused, the only standing authorization is the default daily Flow
+update (opt out with `install_personalization.py --no-auto-update`), and
 `python3 scripts/install.py --client codex --undo --apply` reverses it. It needs
 symbolic links (Windows: Developer Mode). For a subset, a copy install, the shared
 `agents` folder or another client, use the individual scripts in
@@ -531,14 +534,15 @@ prove production. See [Compatibility](docs/COMPATIBILITY.md) for current proof
 and [Testing](docs/TESTING.md) for acceptance evidence.
 
 
-**What's new in 2.5.0:** `nobrainer-context` (`nb-context`) keeps one set of project
-instructions for every coding agent: it shows what Codex, Claude Code, Gemini CLI,
-Cursor, Copilot and OpenCode load, and proposes one source of truth with pointers.
+**What's new in 2.6.0:** Flow delegates aggressively: independent units of
+substantial work go to parallel native subagents, sized so parallel work pays for its
+start-up cost, verification depth follows how risky and reversible a change is, and one
+line in the instruction block keeps Flow updated by default (`--no-auto-update` opts out).
 See [RELEASE-NOTES.md](RELEASE-NOTES.md).
 
-Current source version: **2.5.0**. Check the
+Current source version: **2.6.0**. Check the
 [latest published GitHub release](https://github.com/nobrainer-tech/nobrainer-tech-flow/releases/latest)
-for distribution and the [2.5.0](docs/releases/v2.5.0.md) and
+for distribution and the [2.6.0](docs/releases/v2.6.0.md), [2.5.0](docs/releases/v2.5.0.md) and
 [2.4.0 verification records](docs/releases/v2.4.0.md) for
 the current scope, reproducible checks and client-runtime limits. The unchanged command runner keeps its
 [v1.7.0 verification scope](docs/releases/v1.7.0.md). Source publication does not

package/docs/INSTALL.md

@@ -14,9 +14,9 @@ upgraded merely because the new source is installed nearby.
 Node 18+ and Python 3.11+ are prerequisites. Preview the setup first:
 
 ```sh
-npx nobrainer-tech-flow@2.5.0 --client codex
-npx nobrainer-tech-flow@2.5.0 --client codex --apply
-npx nobrainer-tech-flow@2.5.0 --client codex --undo --apply
+npx nobrainer-tech-flow@2.6.0 --client codex
+npx nobrainer-tech-flow@2.6.0 --client codex --apply
+npx nobrainer-tech-flow@2.6.0 --client codex --undo --apply
 ```
 
 Use claude for Claude Code, opencode or copilot for those clients. Add --home PATH
@@ -24,7 +24,7 @@ for an isolated profile. These commands become available once this version is
 published on npm; a source candidate is not registry availability.
 
 Application copies the release files into the chosen home directory's
-.nobrainer-tech-flow-npm/2.5.0 and verifies the copy. That folder sits beside
+.nobrainer-tech-flow-npm/2.6.0 and verifies the copy. That folder sits beside
 ~/.nobrainer-tech-flow, where the Git installation suggests a clone, so cleaning
 the clone cannot delete the files the skill links point to. Releases before 2.3.2
 kept their copy in .nobrainer-tech-flow/npm; undo such a setup with the command of
@@ -106,14 +106,18 @@ flags). The two share the setup record, so either one undoes what the other did.
 - Running `--apply` again when nothing needs to change prints `UP TO DATE` and no
   restart hint. `INSTALLED` and the restart hint appear only when a link or the
   instruction file was written.
-- It never grants a standing authorization. When the block in the instruction file
-  is the text of an earlier version, both scripts replace it with this version's
-  text, keep everything outside the two markers byte for byte and save the file as
-  it was as a `.bak` copy first. `install.py` also keeps earlier auto-update,
-  session-restart and wiki-root settings in the block as `--keep-options` keeps
-  them; `install.sh` leaves a block that carries one of those options, or whose
-  markers do not stand on lines of their own, exactly as it is and says so. Change
-  options with `install_personalization.py`.
+- The only standing authorization it writes is the default one-line daily update of
+  Flow itself to a verified stable release; session rotation still needs its own
+  opt-in. When the block in the instruction file is the text of an earlier version,
+  both scripts replace it with this version's text, keep everything outside the two
+  markers byte for byte and save the file as it was as a `.bak` copy first. Both keep
+  the update choice: an existing block updates itself again only when it holds the
+  update line as its own line, and a notify-only, edited or unknown update line is
+  replaced by the one-line notify-only rule. `install.py` also keeps session-restart
+  and wiki-root settings as `--keep-options` keeps them; `install.sh` leaves a block
+  that carries one of those options or a preference, or whose markers do not stand on
+  lines of their own, exactly as it is and says so. Change options with
+  `install_personalization.py`.
 - `--undo` (a preview until `--apply` is added) removes exactly the links the setup
   created and puts the managed block back as it was before the first setup:
   removed, or the block that was there before. The rest of the instruction file
@@ -276,17 +280,24 @@ the instructions. A guided setup recorded earlier for the Codex file asks for an
 undo before it writes the Claude file. `agents` needs an explicit verified
 `--path`. For a resolved global wiki,
 pass `--wiki-root PATH` pointing at a directory containing `WIKI.md`; this
-records the actual location in the personalization block. `--auto-update`
-opts into safe checked `nobrainer-tech-flow`-only upgrades where standing owner
-authorization exists, and `--auto-session-restart` opts into evidence-gated
-session rotation. A later run without those flags writes the default block
-again; add `--keep-options` to keep the update, session-restart and wiki-root
-settings already in the block (the guided setup always does). A grant counts
+records the actual location in the personalization block. Since 2.6.0 the
+block keeps Flow updated by default with one line: once a day on first use,
+update to the latest verified stable release from the canonical source, with a
+backup, changing nothing else. `--no-auto-update` writes a one-line notify-only
+rule instead; `--auto-update` is still accepted and means the default. With
+`--keep-options` an opt-out already in the block stays, and the longer update
+lines written before 2.6.0 become the matching short line (an old grant stays a
+grant, the old notify-only default stays notify-only). An update line that is
+neither recognized grant becomes the notify-only line: updates are never inferred. `--auto-session-restart`
+opts into evidence-gated session rotation. A later run without those flags
+writes the default block again; add `--keep-options` to keep the update choice,
+session-restart and wiki-root settings already in the block (the guided setup
+always does). A grant counts
 only as the exact line the installer writes for it, so wording quoted in a
 `--preferences` value never becomes one, and a preference or wiki path must be
 one printable line. A grant line that was edited is not kept, and the run says so
-and names the flag that grants it again. Without the
-update opt-in, the first active `nobrainer-tech-flow` use each day checks and
+and names the flag that grants it again. With the
+notify-only line, the first active `nobrainer-tech-flow` use each day checks and
 notifies. Use a scheduler separately if updates must be checked on inactive days.
 
 A newer release must be obtained at a verified immutable ref before any

package/docs/releases/v2.6.0.md

@@ -0,0 +1,73 @@
+# nobrainer-tech-flow 2.6.0: delegate aggressively, verify by risk
+
+Release date: 2026-10-23.
+
+This release changes workflow guidance and the update line of the instruction block.
+The setup record and the module set (eighteen) do not change.
+
+## What changes
+
+- **Aggressive delegation as the default.** `skills/nobrainer-tech-flow/SKILL.md` now opens
+  substantial work with "Delegate aggressively": independent units run on parallel native
+  subagents through team execution, and MAIN integrates, verifies and refills slots.
+  `references/delivery.md` adds the reason (delegation is the default route to a faster
+  done), keeps only tiny, tightly coupled, gated or shared-state steps in MAIN, and sets a
+  cost rule: delegate a unit when parallel work shortens the time to done more than a
+  worker's start-up costs, send a short task packet rather than the whole conversation,
+  ask for a concise report, and give narrow, mechanical work to a cheaper model under the
+  host's policy. No model is named.
+- **Resend only failed units.** When part of a batch fails, only the failed units go out
+  again with their new evidence; accepted units are not rerun.
+- **Verification by blast radius.** `references/delivery.md` scales verification to how
+  risky and reversible a change is. Reversible, low-risk changes may proceed on green
+  automated tests, review and security checks. CI configuration, credentials,
+  security-sensitive paths, data migrations and irreversible effects need an independent
+  review and remain owner-gated. An agent's approval never counts as the owner's.
+- **Two build rules.** `skills/nobrainer-build/SKILL.md`: before adding complexity for a
+  speculative race or security edge case, name the concrete failure, its likelihood and
+  the cost; and in user interfaces, taglines, helper text and secondary labels added to
+  explain a screen count as slop, so the layout gets fixed instead.
+
+## Daily updates by default, in one line
+
+The managed instruction block now carries one short update line, on by default for new
+setups: "Once a day on first use, update nobrainer-tech-flow to its latest verified stable
+release from the canonical source, with a backup; change nothing else and ask if unsure."
+`install_personalization.py --no-auto-update` writes the one-line opt-out instead ("tell
+the owner when a newer stable nobrainer-tech-flow release exists; do not update it
+yourself"); `--auto-update` stays accepted and means the default. With `--keep-options`
+(which `install.py` and the guided setup always pass) the longer lines written before 2.6.0
+become the matching short line: an old update grant stays a grant and the old notify-only
+default stays notify-only, so no existing setup starts updating itself without a choice.
+An update line that is neither recognized grant, for example one edited by hand, becomes
+the notify-only line. `install.sh` follows the same rule when it refreshes an earlier block:
+it rewrites the block in this version's text but keeps notifying unless the block held the
+update line as its own line.
+
+## Sources
+
+The delegation rule is an owner decision (2026-10-23). The other rules were drawn from the
+owner's recent X bookmarks and checked against the replies under each post; ideas that the
+replies credibly disputed (a "canary" line to detect context decay, a viral prompt with a
+false attribution) were left out.
+
+## Verification record
+
+Local checks (macOS, Python 3.14.5):
+
+- `python3 scripts/validate_skills.py` and `python3 scripts/validate_skills.py --suite`: OK.
+- `skills/nobrainer-tech-flow/SKILL.md` stays within the suite budget (239 lines, 1,749
+  words; limits 240 and 1,750).
+- `python3 -m unittest tests.test_suite tests.test_delegation_contract
+  tests.test_visible_session_rule`: 81 tests OK.
+- `python3 -m unittest tests.test_shell_installer tests.test_personalization
+  tests.test_one_command_installer tests.test_guided_onboarding`: OK, including the new
+  cases for the default update line, the opt-out, pre-2.6 blocks, edited or unknown update
+  lines and preferences that quote the update wording.
+- `sh -n`, `dash -n` and `shellcheck -S error` on `scripts/install.sh`: clean.
+- `git diff --check`: clean.
+- An independent read-only review found four issues in the update-line handling and its
+  documentation (an unrecognized notify-only line could turn into an update grant); all
+  were fixed and a second review pass confirmed the fixes.
+
+The full suite runs in the Validate workflow for the tagged commit.

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "nobrainer-tech-flow",
   "description": "From task to done. nobrainer-tech-flow is one workflow of 18 modules for AI coding agents: it scopes the task, delegates ready work, checks the result and hands over the evidence, including what was not checked.",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "contextFileName": "GEMINI.md"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nobrainer-tech-flow",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "description": "From task to done. nobrainer-tech-flow is one workflow of 18 modules for AI coding agents: it scopes the task, delegates ready work, checks the result and hands over the evidence, including what was not checked.",
   "type": "module",
   "main": ".opencode/plugins/nobrainer-tech-skills.js",

package/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "nobrainer-tech-flow",
   "description": "From task to done. nobrainer-tech-flow is one workflow of 18 modules for AI coding agents: it scopes the task, delegates ready work, checks the result and hands over the evidence, including what was not checked.",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "author": {
     "name": "NoBrainer Tech",
     "url": "https://nobrainer.tech"

package/scripts/install.py

@@ -4,7 +4,9 @@
 Every run is a dry run until --apply. The skills are linked and the managed
 instruction block is written by the same helpers as the manual and guided setups,
 and --undo uses the guided setup's rollback state (as scripts/install.sh does), so
-every path reverses the same way. This command never grants a standing authorization.
+every path reverses the same way. The only standing authorization it writes is the
+default daily update of Flow itself, and an existing block keeps notifying unless it
+already held that update line.
 """
 
 from __future__ import annotations

package/scripts/install.sh

@@ -4,7 +4,8 @@
 # Same flags, locations, conflict rule and setup record as scripts/install.py, so
 # either one can undo what the other did. Every run previews until --apply. The
 # skills are linked to this checkout (never copied), one managed instruction block
-# is added, and no standing authorization is ever granted. A managed block that is
+# is added. Its only standing authorization is the default daily update of Flow itself;
+# an existing block keeps notifying unless it already held that line. A managed block that is
 # already there is replaced by this version's text when it differs, and everything
 # outside the two markers stays byte for byte, as install.py does. One difference: a
 # block that carries options (a standing authorization, a wiki root or a preference)
@@ -47,6 +48,12 @@ SEPARATORS=$(printf '\342\200[\250\251]')
 TAB=$(printf '\t')
 CR=$(printf '\r')
 
+# The update line of the block: on by default; an existing block that only notifies
+# (written with --no-auto-update, or the default before 2.6.0) keeps notifying.
+AUTO_UPDATE_LINE='- Once a day on first use, update nobrainer-tech-flow to its latest verified stable release from the canonical source, with a backup; change nothing else and ask if unsure.'
+NOTIFY_UPDATE_LINE='- Once a day on first use, tell the owner when a newer stable nobrainer-tech-flow release exists; do not update it yourself.'
+update_line=$AUTO_UPDATE_LINE
+
 # The block scripts/install_personalization.py writes without options, byte for byte
 # (a test compares them).
 block() {
@@ -61,7 +68,9 @@ block() {
 - Derive short-term goals from the user's long-term direction (LDD) and define observable completion criteria. At project start, inspect the existing structure and layers, then recommend a fitting approach.
 - At project start, discover whether a relevant wiki exists. If one exists, read its `WIKI.md`, locate relevant `index.md` entries with a targeted search, then read only the relevant pages. Ask before creating a wiki unless project rules or prior authorization already settle it.
 - Assess context and checkpoint at appropriate milestones. Recommend session rotation when it would help; do not restart or archive automatically. When rotation is authorized, use the supported lifecycle, verify exact successor takeover by ID/readback, and archive the old session only after that readback. Do not create recursive visible workers or claim a restart when unsupported.
-- On the first `nobrainer-tech-flow` use each calendar day, check for available updates when this client exposes a supported check and notify the owner; do not apply them automatically. If the client is inactive or cannot check, do not claim a check occurred.
+EOF
+	printf '%s\n' "$update_line"
+	cat <<'EOF'
 - Use `nobrainer-writing` for material writing when available; make technical documentation concrete, source-backed, and technically verified. Preserve facts, use the user's language, and verify at the actual delivery layer.
 <!-- NOBRAINER-TECH-FLOW:END -->
 EOF
@@ -806,6 +815,12 @@ plan_instructions() {
 		die 3 "malformed or duplicated nobrainer-tech-flow managed markers in $target"
 	fi
 	file_status=present
+	# An existing block keeps updating only when it holds the update line as its own line;
+	# a notify-only, edited or unknown line keeps notifying, so no grant is ever inferred.
+	if block_lines "$target" && ! head -n "$block_to" "$target" | tail -n "+$block_from" |
+		LC_ALL=C sed 's/[[:space:]]*$//' | grep -a -q -x -F -e "$AUTO_UPDATE_LINE"; then
+		update_line=$NOTIFY_UPDATE_LINE
+	fi
 	# A block of an earlier version is brought up to date, but only one that can be replaced
 	# without losing anything: its markers stand on lines of their own, and it holds no option.
 	if ! block_is_default && block_lines "$target" && ! block_has_options; then
@@ -827,6 +842,10 @@ block_lines() {
 	[ "$block_from" -lt "$block_to" ]
 }
 
+update_status() {
+	if [ "$update_line" = "$NOTIFY_UPDATE_LINE" ]; then echo CHECK_AND_NOTIFY; else echo AUTHORIZED_SAFE_VERIFIED_ONLY; fi
+}
+
 block_is_default() {
 	block_lines "$target" || return 1
 	_b_text=$(head -n "$block_to" "$target" | tail -n "+$block_from")
@@ -836,7 +855,7 @@ block_is_default() {
 }
 
 # block_has_options: the block block_lines found in $target carries something the owner
-# chose: a standing authorization, a wiki root or a preference. Only install.py and
+# chose: a pre-2.6 standing authorization, a wiki root or a preference. Only install.py and
 # scripts/install_personalization.py --keep-options carry those over to a new block.
 block_has_options() {
 	head -n "$block_to" "$target" | tail -n "+$block_from" |
@@ -873,7 +892,7 @@ preview() {
 		elif [ "$file_status" = refresh ]; then
 			block_lines "$target"
 			say "UPDATE: nobrainer-tech-flow personalization block"
-			say "AUTO_UPDATE: CHECK_AND_NOTIFY"
+			say "AUTO_UPDATE: $(update_status)"
 			say "AUTO_SESSION_RESTART: ASSESS_CHECKPOINT_RECOMMEND"
 			say "PRESERVED: content outside the managed block"
 			say "DIFF:"
@@ -881,7 +900,7 @@ preview() {
 			block | sed 's/^/+/'
 		else
 			say "MISSING: nobrainer-tech-flow personalization block"
-			say "AUTO_UPDATE: CHECK_AND_NOTIFY"
+			say "AUTO_UPDATE: $(update_status)"
 			say "AUTO_SESSION_RESTART: ASSESS_CHECKPOINT_RECOMMEND"
 			say "DIFF:"
 			block | sed 's/^/+/'

package/scripts/install_personalization.py

@@ -27,10 +27,17 @@ LEGACY_FLOW_INSTRUCTIONS = re.compile(
     r"\bnobrainer-ultra\b|^\s*#{1,6}\s+NoBrainer(?:[ .]?Tech)?\s+Flow\b",
     re.IGNORECASE | re.MULTILINE,
 )
-# The two lines that carry a standing authorization. --keep-options recognises a grant
+# The lines that carry a standing authorization. --keep-options recognises a grant
 # only as one of these exact lines, never as a phrase somewhere in the block, so free
 # text in a preference cannot forge one.
-AUTO_UPDATE_RULE = "- On the first `nobrainer-tech-flow` use each calendar day, check for a safe verified update when this client exposes a supported check. This setting grants standing authorization to apply a `nobrainer-tech-flow`-only update after verifying the canonical source/version, reviewing the exact changes, and making a recoverable backup. Never apply destructive, unrelated, or uncertain changes; ask the owner first. If the client is inactive or cannot check, do not claim a check occurred."
+AUTO_UPDATE_RULE = "- Once a day on first use, update nobrainer-tech-flow to its latest verified stable release from the canonical source, with a backup; change nothing else and ask if unsure."
+# The opt-out written by --no-auto-update.
+NOTIFY_UPDATE_RULE = "- Once a day on first use, tell the owner when a newer stable nobrainer-tech-flow release exists; do not update it yourself."
+# Lines written before 2.6.0. --keep-options maps them to the short rules above and
+# keeps the owner's choice: the old grant stays a grant, the old notify-only default
+# stays notify-only.
+LEGACY_AUTO_UPDATE_RULE = "- On the first `nobrainer-tech-flow` use each calendar day, check for a safe verified update when this client exposes a supported check. This setting grants standing authorization to apply a `nobrainer-tech-flow`-only update after verifying the canonical source/version, reviewing the exact changes, and making a recoverable backup. Never apply destructive, unrelated, or uncertain changes; ask the owner first. If the client is inactive or cannot check, do not claim a check occurred."
+LEGACY_NOTIFY_UPDATE_RULE = "- On the first `nobrainer-tech-flow` use each calendar day, check for available updates when this client exposes a supported check and notify the owner; do not apply them automatically. If the client is inactive or cannot check, do not claim a check occurred."
 AUTO_SESSION_RULE = "- This setting grants standing authorization for session rotation only when the host supports creating a fresh successor, context or checkpoint evidence warrants rotation, and no write is in flight. Create the successor, verify exact takeover by ID/readback, and archive the old session only after that readback. Do not create recursive visible workers or claim a restart when unsupported."
 
 
@@ -57,6 +64,28 @@ def earlier_grant(existing: str, rule: str, phrase: str, label: str, flag: str)
     return False
 
 
+# Wording of an update grant, current or pre-2.6, used only to warn that an edited one
+# was not kept.
+UPDATE_GRANT_PHRASES = (
+    "update nobrainer-tech-flow to its latest verified stable release",
+    "grants standing authorization to apply a `nobrainer-tech-flow`-only update",
+)
+
+
+def saved_update_choice(existing: str) -> bool:
+    """True only when an existing block holds an update grant as its own line.
+
+    Anything else, a notify-only line, an edited or unknown one, keeps notifying:
+    an update grant is never inferred. Trailing spaces on the line are ignored, and
+    a preference that quotes the wording is not a line of its own.
+    """
+
+    return any(
+        re.search(r"(?m)^" + re.escape(rule) + r"[ \t]*\r?$", existing) is not None
+        for rule in (AUTO_UPDATE_RULE, LEGACY_AUTO_UPDATE_RULE)
+    )
+
+
 def unsafe_line(value: str) -> bool:
     """True when ``value`` cannot be one plain Markdown line (or could split into two)."""
 
@@ -85,11 +114,7 @@ def build_block(
         if wiki_root is not None
         else "- At project start, discover whether a relevant wiki exists. If one exists, read its `WIKI.md`, locate relevant `index.md` entries with a targeted search, then read only the relevant pages. Ask before creating a wiki unless project rules or prior authorization already settle it."
     )
-    update_rule = (
-        AUTO_UPDATE_RULE
-        if auto_update
-        else "- On the first `nobrainer-tech-flow` use each calendar day, check for available updates when this client exposes a supported check and notify the owner; do not apply them automatically. If the client is inactive or cannot check, do not claim a check occurred."
-    )
+    update_rule = AUTO_UPDATE_RULE if auto_update else NOTIFY_UPDATE_RULE
     session_rule = (
         AUTO_SESSION_RULE
         if auto_session_restart
@@ -356,10 +381,16 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
         type=Path,
         help="project wiki root containing WIKI.md; its resolved path is added to the managed instructions",
     )
-    parser.add_argument(
+    updates = parser.add_mutually_exclusive_group()
+    updates.add_argument(
         "--auto-update",
         action="store_true",
-        help="authorize safe, verified nobrainer-tech-flow-only updates; default is check and notify",
+        help="update nobrainer-tech-flow once a day from its verified stable releases (the default)",
+    )
+    updates.add_argument(
+        "--no-auto-update",
+        action="store_true",
+        help="only tell the owner about a newer stable release; never update automatically",
     )
     parser.add_argument(
         "--auto-session-restart",
@@ -374,7 +405,7 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
         "--keep-options",
         action="store_true",
         help=(
-            "keep the auto-update, session-restart and wiki-root settings already in the "
+            "keep the update, session-restart and wiki-root settings already in the "
             "managed block; flags given on this run are added to them, never removed"
         ),
     )
@@ -429,15 +460,19 @@ def main(argv: list[str] | None = None) -> int:
             saved = SAVED_PREFERENCE.search(existing)
             if saved:
                 preferences = saved.group(1)
-        auto_update = args.auto_update
+        auto_update = not args.no_auto_update
         auto_session_restart = args.auto_session_restart
         if args.keep_options and existing:
             kept: list[str] = []
-            if not auto_update and earlier_grant(
-                existing, AUTO_UPDATE_RULE, "grants standing authorization to apply", "auto-update", "--auto-update"
-            ):
-                auto_update = True
-                kept.append("auto-update")
+            saved_update = saved_update_choice(existing)
+            if not (args.auto_update or args.no_auto_update) and not saved_update:
+                auto_update = False
+                kept.append("notify-only updates")
+                if any(phrase in existing for phrase in UPDATE_GRANT_PHRASES):
+                    print(
+                        "NOTE: an earlier update authorization was not kept because its line no longer "
+                        "matches what this installer writes; pass --auto-update to grant it again"
+                    )
             if not auto_session_restart and earlier_grant(
                 existing,
                 AUTO_SESSION_RULE,

package/skills/nobrainer-build/SKILL.md

@@ -37,7 +37,9 @@ Apply these principles as decision rules, not slogans:
 
 - `KISS`: choose the simplest complete design that satisfies acceptance.
 - `YAGNI`: do not add extension points, compatibility layers or options for an
-  unproven future requirement.
+  unproven future requirement. Before adding complexity for a speculative race
+  or security edge case, name the concrete failure, its likelihood and the cost;
+  add it only when that case is accepted.
 - `DRY`: keep each rule and mutable fact under one owner, but do not abstract
   incidental similarity. Duplication can be cheaper than the wrong coupling.
 - `SOLID`: preserve cohesive responsibilities and stable dependency boundaries;
@@ -80,7 +82,9 @@ Reject a patch that contains any of the following without explicit acceptance:
 - duplicate state owners, speculative abstractions or fallback stacks that make
   failure ambiguous;
 - tests that only assert a mock/fixture while the real contract remains
-  unexercised.
+  unexercised;
+- in user interfaces, taglines, helper text and secondary labels added to explain
+  a screen; if the screen needs them, fix the layout.
 
 Names should explain intent. Comments should explain only non-obvious why,
 constraints, risk or tradeoffs. Do not create a new README, framework or process

package/skills/nobrainer-tech-flow/SKILL.md

@@ -42,9 +42,9 @@ Skip ledger, delegation, review and startup care. Escalate to the full Flow life
 for ambiguity, architecture, public behavior, routing or consequential
 side effects; quick path never bypasses an owner gate.
 
-For substantial work, delegate all independent ready units promptly through
-[team execution](references/delivery.md#coordinated-team-execution); MAIN coordinates,
-integrates, verifies and refills slots. Use [Auto Fine Tune](../nobrainer-auto-fine-tune/SKILL.md)
+Delegate aggressively: run substantial work's independent units
+on parallel native subagents through [team execution](references/delivery.md#coordinated-team-execution);
+MAIN integrates, verifies and refills slots. Use [Auto Fine Tune](../nobrainer-auto-fine-tune/SKILL.md)
 for first-setup capability checks; benchmark only when calibration pays.
 Unavailable native workers leave work in MAIN; visible conversations require explicit owner request
 or authorized MAIN restart; isolation, reuse or handoff alone never authorize one.

package/skills/nobrainer-tech-flow/VERSION

@@ -1 +1 @@
-2.5.0
+2.6.0

package/skills/nobrainer-tech-flow/references/daily-update.md

@@ -10,8 +10,11 @@ the client is current. A failed network check is `CHECK_FAILED`, not
 `CURRENT`.
 
 When `UPDATE_AVAILABLE`, tell the user the installed and latest version
-and the verified release link. Upgrade only within the owner's recorded
-standing authorization or after approval of the exact reviewed change.
+and the verified release link. The default instruction line ("Once a day on
+first use, update nobrainer-tech-flow...") authorizes this Flow-only upgrade to a
+verified stable release; the opt-out line ("tell the owner... do not update it
+yourself") does not. Otherwise upgrade only after approval of the exact reviewed
+change.
 Before applying, obtain the new release source at a verified immutable ref,
 compare installation targets, run `validate_skills.py --suite`, then dry-run
 `install_skills.py` and `install_personalization.py`. Preserve foreign

package/skills/nobrainer-tech-flow/references/delivery.md

@@ -115,6 +115,12 @@ useful authorized work remains. Never turn an unknown right/license into consent
 
 ## Keep review proportional to progress
 
+Scale verification to blast radius. A reversible, low-risk change may proceed on
+green automated tests, review and security checks. CI configuration, credentials,
+security-sensitive paths, data migrations and irreversible effects need an
+independent review and remain owner-gated. An agent's approval never counts as the
+owner's.
+
 Review the next executable slice against concrete acceptance and failure paths.
 For a stable slice, default to one review and one focused correction verification.
 More review needs a newly evidenced material defect or changed risk, not a new
@@ -136,7 +142,14 @@ reviews, tests or generated files.
 ## Coordinated team execution
 
 MAIN owns the full outcome, coordination, critical path, dependencies, integration,
-owner decisions and acceptance. Before executing non-trivial work or entering a
+owner decisions and acceptance. Delegation is the default route to a faster done:
+MAIN works its own unit while workers run, and keeps only tiny, tightly coupled,
+gated or shared-state steps. Delegate a unit when it is independent and large
+enough that parallel work shortens the time to done more than a worker's start-up
+costs. Give each worker a short task packet, not the whole conversation, and ask
+for a concise report. Send narrow, mechanical work to a cheaper model under the
+host's policy. Each worker's model and effort come from that policy; the workflow
+names no model. Before executing non-trivial work or entering a
 blocking wait, identify independent ready units and dispatch every useful eligible
 unit promptly to native workers within verified host capacity and authorized usage
 limits. Eligibility requires accepted dependencies, authority, a supported route
@@ -197,7 +210,9 @@ worker completion, MAIN reconciles the exact returned ID, inspects the current
 artifact, assigned scope and required proof, and verifies that the worker has
 stopped writing. Then release only that unit's proven ownership, recompute readiness
 and dispatch newly ready work without waiting for unrelated slow workers. A
-worker's report, exit code or self-score does not accept its artifact.
+worker's report, exit code or self-score does not accept its artifact. When a batch
+partly fails, resend only the failed units with their new evidence; never rerun the
+accepted ones.
 
 A waiting, suspended or uncertain worker has a stated reason and a bounded next
 observation in the current tracker. Reserve its scope and possible capacity until