nubos-pilot 0.5.9 → 0.6.0

package/bin/np-tools/_commands.cjs

@@ -9,6 +9,7 @@ const COMMANDS = [
   { name: 'plan-milestone',      category: 'Planning', description: 'Plan a milestone: scaffolds slices + tasks' },
   { name: 'new-project',         category: 'Planning', description: 'Greenfield project init (PROJECT.md + REQUIREMENTS.md + M001 milestone)' },
   { name: 'new-milestone',       category: 'Planning', description: 'Append a new milestone (M<NNN>) to an existing project' },
+  { name: 'propose-milestones',  category: 'Planning', description: 'Re-plan all not-yet-done milestones: AI proposes add/update/remove from PROJECT.md + REQUIREMENTS.md' },
   { name: 'agent-skills',        category: 'Planning', description: 'Print agent_skills config for a given subagent' },
 
   { name: 'execute-milestone',   category: 'Execution', description: 'Wave-based milestone execution — slice by slice, tasks parallel within a slice' },

package/bin/np-tools/propose-milestones.cjs

@@ -0,0 +1,461 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const YAML = require('yaml');
+
+const {
+  NubosPilotError,
+  atomicWriteFileSync,
+  withFileLock,
+} = require('../../lib/core.cjs');
+const layout = require('../../lib/layout.cjs');
+const { readState } = require('../../lib/state.cjs');
+const textMode = require('../../lib/text-mode.cjs');
+
+const TBD_RE = /<!--\s*TBD[^>]*-->/gi;
+const DONE_STATUSES = new Set(['done', 'complete', 'completed']);
+
+function _emit(stdout, payload) {
+  stdout.write(JSON.stringify(payload, null, 2));
+}
+
+function _guardInitialized(root) {
+  const projectMd = path.join(root, '.nubos-pilot', 'PROJECT.md');
+  if (!fs.existsSync(projectMd)) {
+    throw new NubosPilotError(
+      'project-not-initialized',
+      'PROJECT.md not found — run np:new-project first',
+      { hint: 'Run np:new-project first', path: projectMd },
+    );
+  }
+}
+
+function _readRoadmap(root) {
+  const p = path.join(root, '.nubos-pilot', 'roadmap.yaml');
+  if (!fs.existsSync(p)) {
+    throw new NubosPilotError(
+      'roadmap-missing',
+      'roadmap.yaml not found',
+      { path: p },
+    );
+  }
+  const raw = fs.readFileSync(p, 'utf-8');
+  let doc;
+  try { doc = YAML.parse(raw); } catch (err) {
+    throw new NubosPilotError(
+      'roadmap-parse-error',
+      'roadmap.yaml invalid YAML',
+      { path: p, cause: err && err.message },
+    );
+  }
+  if (!doc || !Array.isArray(doc.milestones)) {
+    throw new NubosPilotError(
+      'roadmap-parse-error',
+      'roadmap.yaml missing milestones array',
+      { path: p },
+    );
+  }
+  return { doc, path: p };
+}
+
+function _classifyMilestone(m, root, stateMilestoneId) {
+  if (!m || m.id === 'backlog') return null;
+  const status = typeof m.status === 'string' ? m.status : 'pending';
+  const isDone = DONE_STATUSES.has(status);
+  const slices = Array.isArray(m.slices) ? m.slices : [];
+  const hasSlices = slices.length > 0;
+
+  const mNumMatch = typeof m.id === 'string' ? m.id.match(/^M(\d+)$/) : null;
+  const mNum = mNumMatch ? Number(mNumMatch[1]) : (typeof m.number === 'number' ? m.number : null);
+
+  let contextSummary = null;
+  let contextHasContent = false;
+  if (mNum != null) {
+    const ctxPath = layout.milestoneContextPath(mNum, root);
+    if (fs.existsSync(ctxPath)) {
+      const raw = fs.readFileSync(ctxPath, 'utf-8');
+      const tbdSections = (raw.match(TBD_RE) || []).length;
+      const contentSections = (raw.match(/^<[a-z_]+>$/gm) || []).length;
+      contextHasContent = contentSections > 0 && tbdSections === 0;
+      contextSummary = {
+        path: ctxPath,
+        byte_size: raw.length,
+        tbd_sections: tbdSections,
+        content_sections: contentSections,
+        has_content: contextHasContent,
+      };
+    }
+  }
+
+  const isActive = stateMilestoneId && m.id === stateMilestoneId;
+
+  let classification;
+  if (isDone) classification = 'completed';
+  else if (hasSlices || isActive) classification = 'active';
+  else if (contextHasContent) classification = 'discussed';
+  else classification = 'empty';
+
+  return {
+    id: m.id,
+    number: mNum,
+    name: m.name || '',
+    goal: typeof m.goal === 'string' ? m.goal : '',
+    status,
+    classification,
+    slice_count: slices.length,
+    context: contextSummary,
+    touchable: classification === 'empty',
+    modification_requires_confirm: classification === 'active' || classification === 'discussed',
+  };
+}
+
+function _nextMilestoneNumber(doc) {
+  let maxNum = 0;
+  for (const m of doc.milestones || []) {
+    if (!m) continue;
+    if (m.id === 'backlog') continue;
+    if (typeof m.number === 'number' && Number.isInteger(m.number) && m.number > maxNum) {
+      maxNum = m.number;
+    }
+    if (typeof m.id === 'string') {
+      const mm = m.id.match(/^M(\d+)$/);
+      if (mm) {
+        const n = Number(mm[1]);
+        if (Number.isInteger(n) && n > maxNum) maxNum = n;
+      }
+    }
+  }
+  return maxNum + 1;
+}
+
+function _interviewPayload(cwd) {
+  const root = path.resolve(cwd);
+  _guardInitialized(root);
+  const { doc } = _readRoadmap(root);
+
+  let stateMilestoneId = null;
+  try {
+    const st = readState(root);
+    stateMilestoneId = st && st.frontmatter && st.frontmatter.milestone || null;
+  } catch {
+    stateMilestoneId = null;
+  }
+
+  const classified = [];
+  for (const m of doc.milestones) {
+    const row = _classifyMilestone(m, root, stateMilestoneId);
+    if (row) classified.push(row);
+  }
+
+  const projectMd = fs.readFileSync(path.join(root, '.nubos-pilot', 'PROJECT.md'), 'utf-8');
+  const reqPath = path.join(root, '.nubos-pilot', 'REQUIREMENTS.md');
+  const reqMd = fs.existsSync(reqPath) ? fs.readFileSync(reqPath, 'utf-8') : '';
+
+  const projectHasTbd = /_TBD — filled by \/np:discuss-project\._/.test(projectMd);
+
+  const tmDetail = textMode.resolveTextModeDetail(cwd);
+
+  return {
+    _workflow: 'propose-milestones',
+    mode: 'interview',
+    text_mode: tmDetail.enabled,
+    text_mode_source: tmDetail.source,
+    project_md_path: path.join(root, '.nubos-pilot', 'PROJECT.md'),
+    requirements_md_path: reqPath,
+    project_md: projectMd,
+    requirements_md: reqMd,
+    project_has_tbd: projectHasTbd,
+    current_state_milestone: stateMilestoneId,
+    milestones: classified,
+    next_milestone_number: _nextMilestoneNumber(doc),
+    guidance: {
+      completed: 'Untouchable — never modify or remove; displayed for context only.',
+      active: 'Has slices or is the current state pointer — modifications require explicit per-item confirm.',
+      discussed: 'Has non-TBD CONTEXT.md content — modifications require explicit per-item confirm.',
+      empty: 'No slices, CONTEXT.md still TBD — freely modifiable or removable.',
+    },
+  };
+}
+
+function _validateOperation(op, idx) {
+  if (!op || typeof op !== 'object') {
+    throw new NubosPilotError(
+      'invalid-operation',
+      'operation ' + idx + ' is not an object',
+      { index: idx },
+    );
+  }
+  const type = op.type;
+  if (!['add', 'update', 'remove'].includes(type)) {
+    throw new NubosPilotError(
+      'invalid-operation-type',
+      'operation ' + idx + ' has unknown type: ' + String(type),
+      { index: idx, type },
+    );
+  }
+  if (type === 'add') {
+    if (typeof op.milestone_name !== 'string' || op.milestone_name.trim() === '') {
+      throw new NubosPilotError('answers-missing-field', 'op[' + idx + '].milestone_name required', { index: idx });
+    }
+    if (typeof op.milestone_goal !== 'string' || op.milestone_goal.trim() === '') {
+      throw new NubosPilotError('answers-missing-field', 'op[' + idx + '].milestone_goal required', { index: idx });
+    }
+  } else {
+    if (typeof op.milestone_id !== 'string' || !/^M\d+$/.test(op.milestone_id)) {
+      throw new NubosPilotError('answers-missing-field', 'op[' + idx + '].milestone_id required (format M<NNN>)', { index: idx });
+    }
+    if (type === 'update') {
+      const hasName = typeof op.new_name === 'string' && op.new_name.trim() !== '';
+      const hasGoal = typeof op.new_goal === 'string' && op.new_goal.trim() !== '';
+      if (!hasName && !hasGoal) {
+        throw new NubosPilotError('answers-missing-field', 'op[' + idx + '] update needs new_name or new_goal', { index: idx });
+      }
+    }
+  }
+}
+
+function _findMilestone(doc, id) {
+  return doc.milestones.find((m) => m && m.id === id);
+}
+
+function _assertTouchable(m, opType, confirmForceModify) {
+  const status = typeof m.status === 'string' ? m.status : 'pending';
+  if (DONE_STATUSES.has(status)) {
+    throw new NubosPilotError(
+      'milestone-completed-untouchable',
+      'Milestone ' + m.id + ' is completed (status=' + status + ') — cannot ' + opType,
+      { id: m.id, status },
+    );
+  }
+  const slices = Array.isArray(m.slices) ? m.slices : [];
+  if (slices.length > 0 && !confirmForceModify) {
+    throw new NubosPilotError(
+      'milestone-has-slices',
+      'Milestone ' + m.id + ' has ' + slices.length + ' slice(s); ' + opType + ' requires confirm_force_modify=true',
+      { id: m.id, slice_count: slices.length },
+    );
+  }
+}
+
+function _applyAdd(doc, op) {
+  const mNum = _nextMilestoneNumber(doc);
+  const id = layout.mId(mNum);
+  doc.milestones.push({
+    id,
+    number: mNum,
+    name: op.milestone_name,
+    goal: op.milestone_goal,
+    status: 'pending',
+    requirements: [],
+    success_criteria: [],
+    slices: [],
+  });
+  return { type: 'add', id, number: mNum, name: op.milestone_name };
+}
+
+function _applyUpdate(doc, op) {
+  const m = _findMilestone(doc, op.milestone_id);
+  if (!m) {
+    throw new NubosPilotError('milestone-not-found', 'milestone ' + op.milestone_id + ' not found', { id: op.milestone_id });
+  }
+  _assertTouchable(m, 'update', op.confirm_force_modify === true);
+  const changed = {};
+  if (typeof op.new_name === 'string' && op.new_name.trim() !== '') {
+    changed.from_name = m.name;
+    m.name = op.new_name;
+    changed.to_name = m.name;
+  }
+  if (typeof op.new_goal === 'string' && op.new_goal.trim() !== '') {
+    changed.from_goal = m.goal;
+    m.goal = op.new_goal;
+    changed.to_goal = m.goal;
+  }
+  return { type: 'update', id: m.id, changed };
+}
+
+function _applyRemove(doc, op, root) {
+  const idx = doc.milestones.findIndex((m) => m && m.id === op.milestone_id);
+  if (idx < 0) {
+    throw new NubosPilotError('milestone-not-found', 'milestone ' + op.milestone_id + ' not found', { id: op.milestone_id });
+  }
+  const m = doc.milestones[idx];
+  _assertTouchable(m, 'remove', op.confirm_force_modify === true);
+  doc.milestones.splice(idx, 1);
+
+  let archivedTo = null;
+  const mNumMatch = m.id.match(/^M(\d+)$/);
+  if (mNumMatch) {
+    const mNum = Number(mNumMatch[1]);
+    const srcDir = layout.milestoneDir(mNum, root);
+    if (fs.existsSync(srcDir)) {
+      const archRoot = path.join(root, '.nubos-pilot', 'archive', 'milestones');
+      fs.mkdirSync(archRoot, { recursive: true });
+      const stamp = new Date().toISOString().slice(0, 10);
+      const target = path.join(archRoot, m.id + '-' + stamp);
+      fs.renameSync(srcDir, target);
+      archivedTo = target;
+    }
+  }
+  return { type: 'remove', id: m.id, archived_to: archivedTo };
+}
+
+function _apply(answersPath, cwd, stdout) {
+  let raw;
+  try { raw = fs.readFileSync(answersPath, 'utf-8'); } catch (err) {
+    throw new NubosPilotError(
+      'answers-not-readable',
+      'answers file not readable: ' + answersPath,
+      { path: answersPath, cause: err && err.code },
+    );
+  }
+  let answers;
+  try { answers = JSON.parse(raw); } catch (err) {
+    throw new NubosPilotError(
+      'answers-parse-error',
+      'answers file is not valid JSON',
+      { path: answersPath, cause: err && err.message },
+    );
+  }
+  if (!answers || !Array.isArray(answers.operations)) {
+    throw new NubosPilotError(
+      'answers-missing-field',
+      'answers.operations must be an array',
+      {},
+    );
+  }
+  answers.operations.forEach(_validateOperation);
+
+  const root = path.resolve(cwd);
+  _guardInitialized(root);
+
+  const roadmapPath = path.join(root, '.nubos-pilot', 'roadmap.yaml');
+  const results = withFileLock(roadmapPath, () => {
+    const rawYaml = fs.readFileSync(roadmapPath, 'utf-8');
+    let doc;
+    try { doc = YAML.parse(rawYaml); } catch (err) {
+      throw new NubosPilotError('roadmap-parse-error', 'roadmap.yaml invalid YAML', { path: roadmapPath, cause: err && err.message });
+    }
+    if (!doc || !Array.isArray(doc.milestones)) {
+      throw new NubosPilotError('roadmap-parse-error', 'roadmap.yaml missing milestones array', { path: roadmapPath });
+    }
+
+    const out = [];
+    for (const op of answers.operations) {
+      if (op.type === 'add') out.push(_applyAdd(doc, op));
+      else if (op.type === 'update') out.push(_applyUpdate(doc, op));
+      else if (op.type === 'remove') out.push(_applyRemove(doc, op, root));
+    }
+
+    atomicWriteFileSync(roadmapPath, YAML.stringify(doc, { indent: 2 }));
+
+    for (const result of out) {
+      if (result.type === 'add') {
+        _writeMilestoneArtefacts(root, result.number, result.name, doc);
+      }
+    }
+
+    return out;
+  });
+
+  _emit(stdout, {
+    mode: 'apply',
+    results,
+  });
+}
+
+function _writeMilestoneArtefacts(root, mNum, name, doc) {
+  const { _render, _loadTemplate } = _lazyRenderer();
+  const m = doc.milestones.find((x) => x && x.id === layout.mId(mNum));
+  const goal = m && m.goal || '';
+  layout.createMilestoneDir(mNum, root);
+  const mIdStr = layout.mId(mNum);
+  const createdDate = new Date().toISOString().slice(0, 10);
+  const ctxVars = {
+    milestone_id: mIdStr,
+    milestone_name: name,
+    created_date: createdDate,
+    goal_text: goal,
+    decisions_text: '<!-- TBD: locked decisions from /np:discuss-phase -->',
+    deferred_text: '<!-- TBD: deferred ideas -->',
+    domain_text: '<!-- TBD: domain boundary -->',
+    canonical_refs_text: '<!-- TBD: canonical references -->',
+  };
+  const roadmapVars = {
+    milestone_id: mIdStr,
+    milestone_name: name,
+    created_date: createdDate,
+    slices_text: '<!-- TBD: slices will be appended by /np:plan-phase ' + mNum + ' -->',
+  };
+  const metaVars = {
+    milestone_id: mIdStr,
+    milestone_name: JSON.stringify(name).slice(1, -1),
+    status: 'pending',
+    created_date: createdDate,
+    goal_text_escaped: JSON.stringify(goal).slice(1, -1),
+    requirements_json: '[]',
+    success_criteria_json: '[]',
+    slice_count: 0,
+    task_count: 0,
+  };
+  _writeFile(layout.milestoneContextPath(mNum, root), _render(_loadTemplate('CONTEXT.md'), ctxVars, 'milestone/CONTEXT.md'));
+  _writeFile(layout.milestoneRoadmapPath(mNum, root), _render(_loadTemplate('ROADMAP.md'), roadmapVars, 'milestone/ROADMAP.md'));
+  _writeFile(layout.milestoneMetaPath(mNum, root), _render(_loadTemplate('META.json'), metaVars, 'milestone/META.json'));
+}
+
+function _writeFile(target, content) {
+  if (path.basename(target) === 'PROJECT.md') {
+    throw new NubosPilotError(
+      'propose-milestones-forbidden-write',
+      'propose-milestones is never allowed to write PROJECT.md (D-29)',
+      { path: target },
+    );
+  }
+  atomicWriteFileSync(target, content);
+}
+
+function _lazyRenderer() {
+  const TEMPLATES_DIR = path.join(__dirname, '..', '..', 'templates', 'milestone');
+  const PLACEHOLDER_RE = /\{\{\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
+  function _render(raw, vars, templateName) {
+    return raw.replace(PLACEHOLDER_RE, (_match, key) => {
+      if (!(key in vars)) {
+        throw new NubosPilotError(
+          'template-unresolved-var',
+          'Undefined placeholder {{' + key + '}} in template "' + templateName + '"',
+          { template: templateName, variable: key, available: Object.keys(vars) },
+        );
+      }
+      return String(vars[key]);
+    });
+  }
+  function _loadTemplate(name) {
+    return fs.readFileSync(path.join(TEMPLATES_DIR, name), 'utf-8');
+  }
+  return { _render, _loadTemplate };
+}
+
+function run(args, ctx) {
+  const context = ctx || {};
+  const cwd = context.cwd || process.cwd();
+  const stdout = context.stdout || process.stdout;
+  const argv = args || [];
+
+  const applyIdx = argv.indexOf('--apply');
+  if (applyIdx >= 0) {
+    const answersPath = argv[applyIdx + 1];
+    if (!answersPath) {
+      throw new NubosPilotError(
+        'missing-apply-path',
+        '--apply requires a path to the answers JSON file',
+        { args: argv.slice() },
+      );
+    }
+    _apply(answersPath, cwd, stdout);
+    return;
+  }
+
+  _emit(stdout, _interviewPayload(cwd));
+}
+
+module.exports = { run, _interviewPayload };

package/bin/np-tools/propose-milestones.test.cjs

@@ -0,0 +1,235 @@
+const { test, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const YAML = require('yaml');
+
+const newProject = require('./new-project.cjs');
+const newMilestone = require('./new-milestone.cjs');
+const subcmd = require('./propose-milestones.cjs');
+
+const _sandboxes = [];
+
+function makeSandbox() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'np-propose-'));
+  _sandboxes.push(root);
+  return root;
+}
+
+afterEach(() => {
+  while (_sandboxes.length) {
+    const p = _sandboxes.pop();
+    try { fs.rmSync(p, { recursive: true, force: true }); } catch {}
+  }
+});
+
+function _captureStdout() {
+  let buf = '';
+  const stub = { write: (s) => { buf += s; return true; } };
+  return { stub, get: () => buf };
+}
+
+function _writeJson(p, data) { fs.writeFileSync(p, JSON.stringify(data), 'utf-8'); return p; }
+
+function _seedProject(root) {
+  const a = _writeJson(path.join(root, 'np.json'), {
+    project_name: 'Demo', core_value: 'ship', primary_constraints: 'node22',
+    first_milestone_name: 'Auth', first_phase_name: 'Login',
+  });
+  newProject.run(['--apply', a], { cwd: root, stdout: _captureStdout().stub });
+}
+
+function _addMilestone(root, name, goal) {
+  const p = _writeJson(path.join(root, 'ms.json'), { milestone_name: name, milestone_goal: goal, create_req_prefix: false });
+  newMilestone.run(['--apply', p], { cwd: root, stdout: _captureStdout().stub });
+}
+
+function _runInterview(root) {
+  const cap = _captureStdout();
+  subcmd.run([], { cwd: root, stdout: cap.stub });
+  return JSON.parse(cap.get());
+}
+
+function _runApply(root, operations) {
+  const p = _writeJson(path.join(root, 'ops.json'), { operations });
+  const cap = _captureStdout();
+  subcmd.run(['--apply', p], { cwd: root, stdout: cap.stub });
+  return JSON.parse(cap.get());
+}
+
+function _setStatus(root, id, status) {
+  const rmPath = path.join(root, '.nubos-pilot', 'roadmap.yaml');
+  const doc = YAML.parse(fs.readFileSync(rmPath, 'utf-8'));
+  const m = doc.milestones.find((x) => x && x.id === id);
+  m.status = status;
+  fs.writeFileSync(rmPath, YAML.stringify(doc, { indent: 2 }));
+}
+
+test('PM-1: interview without .nubos-pilot throws project-not-initialized', () => {
+  const sandbox = makeSandbox();
+  assert.throws(
+    () => subcmd.run([], { cwd: sandbox, stdout: _captureStdout().stub }),
+    (err) => err.code === 'project-not-initialized',
+  );
+});
+
+test('PM-2: interview emits classified milestones + project_has_tbd + next_milestone_number', () => {
+  const sandbox = makeSandbox();
+  _seedProject(sandbox);
+  _addMilestone(sandbox, 'Profile', 'ship profile');
+  const payload = _runInterview(sandbox);
+  assert.equal(payload.mode, 'interview');
+  assert.ok(Array.isArray(payload.milestones));
+  assert.equal(payload.milestones.length, 2);
+  assert.equal(payload.next_milestone_number, 3);
+  for (const m of payload.milestones) {
+    assert.ok(['completed', 'active', 'discussed', 'empty'].includes(m.classification));
+  }
+});
+
+test('PM-3: completed milestones are classified untouchable + guard blocks update/remove', () => {
+  const sandbox = makeSandbox();
+  _seedProject(sandbox);
+  _setStatus(sandbox, 'M001', 'done');
+  const payload = _runInterview(sandbox);
+  const m1 = payload.milestones.find((m) => m.id === 'M001');
+  assert.equal(m1.classification, 'completed');
+  assert.equal(m1.touchable, false);
+
+  assert.throws(
+    () => _runApply(sandbox, [{ type: 'remove', milestone_id: 'M001' }]),
+    (err) => err.code === 'milestone-completed-untouchable',
+  );
+  assert.throws(
+    () => _runApply(sandbox, [{ type: 'update', milestone_id: 'M001', new_goal: 'x' }]),
+    (err) => err.code === 'milestone-completed-untouchable',
+  );
+});
+
+test('PM-4: filled CONTEXT.md (no TBD markers) → discussed classification', () => {
+  const sandbox = makeSandbox();
+  _seedProject(sandbox);
+  // Adding a second milestone moves STATE pointer off M001, so M001 is no longer "active"
+  _addMilestone(sandbox, 'Profile', 'ship profile');
+  const ctx = path.join(sandbox, '.nubos-pilot', 'milestones', 'M001', 'M001-CONTEXT.md');
+  fs.writeFileSync(ctx, '# M001\n<goal>\nShip auth.\n</goal>\n<decisions>\nUse Lucia.\n</decisions>\n');
+  const payload = _runInterview(sandbox);
+  const m1 = payload.milestones.find((m) => m.id === 'M001');
+  assert.equal(m1.classification, 'discussed');
+  assert.equal(m1.context.tbd_sections, 0);
+  assert.ok(m1.context.has_content);
+});
+
+test('PM-5: apply add → appends new milestone + creates M<NNN>/ dir', () => {
+  const sandbox = makeSandbox();
+  _seedProject(sandbox);
+  const result = _runApply(sandbox, [
+    { type: 'add', milestone_name: 'Profile', milestone_goal: 'ship profile' },
+  ]);
+  assert.equal(result.mode, 'apply');
+  assert.equal(result.results[0].type, 'add');
+  assert.equal(result.results[0].id, 'M002');
+  const mDir = path.join(sandbox, '.nubos-pilot', 'milestones', 'M002');
+  assert.ok(fs.existsSync(mDir));
+  assert.ok(fs.existsSync(path.join(mDir, 'M002-CONTEXT.md')));
+  assert.ok(fs.existsSync(path.join(mDir, 'M002-META.json')));
+  assert.ok(fs.existsSync(path.join(mDir, 'slices')));
+});
+
+test('PM-6: apply update changes name/goal in roadmap without touching CONTEXT.md', () => {
+  const sandbox = makeSandbox();
+  _seedProject(sandbox);
+  const ctxPath = path.join(sandbox, '.nubos-pilot', 'milestones', 'M001', 'M001-CONTEXT.md');
+  const ctxBefore = fs.readFileSync(ctxPath);
+  _runApply(sandbox, [{ type: 'update', milestone_id: 'M001', new_name: 'Auth & Sessions' }]);
+  const rm = YAML.parse(fs.readFileSync(path.join(sandbox, '.nubos-pilot', 'roadmap.yaml'), 'utf-8'));
+  const m1 = rm.milestones.find((m) => m.id === 'M001');
+  assert.equal(m1.name, 'Auth & Sessions');
+  assert.deepEqual(fs.readFileSync(ctxPath), ctxBefore);
+});
+
+test('PM-7: apply remove archives milestone dir + drops roadmap entry', () => {
+  const sandbox = makeSandbox();
+  _seedProject(sandbox);
+  _addMilestone(sandbox, 'Profile', 'ship profile');
+  const srcDir = path.join(sandbox, '.nubos-pilot', 'milestones', 'M002');
+  assert.ok(fs.existsSync(srcDir));
+
+  _runApply(sandbox, [{ type: 'remove', milestone_id: 'M002' }]);
+
+  assert.ok(!fs.existsSync(srcDir), 'milestone dir still exists after remove');
+  const archRoot = path.join(sandbox, '.nubos-pilot', 'archive', 'milestones');
+  assert.ok(fs.existsSync(archRoot));
+  const archived = fs.readdirSync(archRoot);
+  assert.ok(archived.some((name) => name.startsWith('M002-')));
+  const rm = YAML.parse(fs.readFileSync(path.join(sandbox, '.nubos-pilot', 'roadmap.yaml'), 'utf-8'));
+  assert.ok(!rm.milestones.some((m) => m && m.id === 'M002'));
+});
+
+test('PM-8: milestone with slices blocks modification unless confirm_force_modify=true', () => {
+  const sandbox = makeSandbox();
+  _seedProject(sandbox);
+  const rmPath = path.join(sandbox, '.nubos-pilot', 'roadmap.yaml');
+  const doc = YAML.parse(fs.readFileSync(rmPath, 'utf-8'));
+  const m1 = doc.milestones.find((m) => m.id === 'M001');
+  m1.slices = [{ id: 'S001', name: 'slice', status: 'pending', tasks: [] }];
+  fs.writeFileSync(rmPath, YAML.stringify(doc, { indent: 2 }));
+
+  assert.throws(
+    () => _runApply(sandbox, [{ type: 'update', milestone_id: 'M001', new_name: 'x' }]),
+    (err) => err.code === 'milestone-has-slices',
+  );
+
+  const result = _runApply(sandbox, [
+    { type: 'update', milestone_id: 'M001', new_name: 'x', confirm_force_modify: true },
+  ]);
+  assert.equal(result.results[0].changed.to_name, 'x');
+});
+
+test('PM-9: multi-op batch (add + update + remove) applies all and returns summary', () => {
+  const sandbox = makeSandbox();
+  _seedProject(sandbox);
+  _addMilestone(sandbox, 'Profile', 'ship profile');
+  _addMilestone(sandbox, 'Feed', 'ship feed');
+
+  const result = _runApply(sandbox, [
+    { type: 'add', milestone_name: 'Comments', milestone_goal: 'threaded comments' },
+    { type: 'update', milestone_id: 'M002', new_goal: 'refined profile goal' },
+    { type: 'remove', milestone_id: 'M003' },
+  ]);
+
+  assert.equal(result.results.length, 3);
+  const rm = YAML.parse(fs.readFileSync(path.join(sandbox, '.nubos-pilot', 'roadmap.yaml'), 'utf-8'));
+  const ids = rm.milestones.filter((m) => m && m.id !== 'backlog').map((m) => m.id);
+  assert.deepEqual(ids.sort(), ['M001', 'M002', 'M004']);
+  const m2 = rm.milestones.find((m) => m.id === 'M002');
+  assert.equal(m2.goal, 'refined profile goal');
+});
+
+test('PM-10: --apply does NOT touch PROJECT.md (D-29)', () => {
+  const sandbox = makeSandbox();
+  _seedProject(sandbox);
+  const p = path.join(sandbox, '.nubos-pilot', 'PROJECT.md');
+  const before = fs.readFileSync(p);
+  _runApply(sandbox, [{ type: 'add', milestone_name: 'X', milestone_goal: 'y' }]);
+  assert.deepEqual(fs.readFileSync(p), before);
+});
+
+test('PM-11: invalid operation type throws invalid-operation-type', () => {
+  const sandbox = makeSandbox();
+  _seedProject(sandbox);
+  assert.throws(
+    () => _runApply(sandbox, [{ type: 'reorder', milestone_id: 'M001' }]),
+    (err) => err.code === 'invalid-operation-type',
+  );
+});
+
+test('PM-12: add without name/goal throws answers-missing-field', () => {
+  const sandbox = makeSandbox();
+  _seedProject(sandbox);
+  assert.throws(
+    () => _runApply(sandbox, [{ type: 'add', milestone_name: '', milestone_goal: 'x' }]),
+    (err) => err.code === 'answers-missing-field',
+  );
+});

package/np-tools.cjs

@@ -12,6 +12,7 @@ const initWorkflows = {
   'new-project':         require('./bin/np-tools/new-project.cjs'),
   'discuss-project':     require('./bin/np-tools/discuss-project.cjs'),
   'new-milestone':       require('./bin/np-tools/new-milestone.cjs'),
+  'propose-milestones':  require('./bin/np-tools/propose-milestones.cjs'),
 
   'execute-milestone':   require('./bin/np-tools/execute-milestone.cjs'),
   'verify-work':         require('./bin/np-tools/verify-work.cjs'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nubos-pilot",
-  "version": "0.5.9",
+  "version": "0.6.0",
   "description": "AI-driven planning and execution tool for code projects",
   "homepage": "https://github.com/Nubos-AI/nubos-pilot",
   "repository": {

package/workflows/new-project.md

@@ -6,11 +6,12 @@ argument-hint: [--apply <answers.json>]
 
 # np:new-project
 
-Initialize a new nubos-pilot project in three phases:
+Initialize a new nubos-pilot project in four phases:
 
 1. **Phase 0 — Workspace Scan** (context capture)
-2. **Phase 1 — Bootstrap Interview** (5 structural questions → scaffold)
+2. **Phase 1 — Bootstrap Interview** (5 structural questions → scaffold with M001)
 3. **Phase 2 — Project Discovery** (obligatory, chains into `np:discuss-project --bootstrap`)
+4. **Phase 3 — Additional Milestones** (AI proposes from Discovery, user reviews; appends M002, M003, …)
 
 Optionally runs an initial codebase scan at the end when the workspace
 contains existing source (`np:scan-codebase`). Everything lands under
@@ -55,9 +56,17 @@ This workflow writes:
 - `.nubos-pilot/roadmap.yaml` (schema_version: 2, first milestone M001 with empty slices[])
 - `.nubos-pilot/STATE.md`
 - `.nubos-pilot/milestones/M001/{M001-CONTEXT.md, M001-ROADMAP.md, M001-META.json}`
+- (optional) `.nubos-pilot/milestones/M002/ …` via Phase 3 AI-proposed
+  review (or the manual bulk-loop fallback)
 - (optional) `.nubos-pilot/codebase/` via chained `np:scan-codebase`
 
 `np:discuss-project` (Phase 2) chains automatically — not skippable.
+Phase 3 reads populated PROJECT.md + REQUIREMENTS.md, proposes a
+milestone sequence, and lets the user accept / edit / discard before any
+write. Each accepted milestone is delegated to the `new-milestone`
+subcommand, which auto-numbers M<NNN> and honors the D-29 invariant
+(PROJECT.md is never rewritten). Phase 3 skips cleanly when PROJECT.md
+still has `_TBD` placeholders.
 `np:scan-codebase` chains when the workspace contains >= 1 source file.
 </downstream_awareness>
 
@@ -215,7 +224,205 @@ finish later)
 
 Record the skip in STATE.md so the next `np:next` reminds the user.
 
-## Phase 3 (conditional): Initial Codebase Scan
+## Phase 3: Additional Milestones (AI-proposed, user-reviewed)
+
+After Discovery, PROJECT.md and REQUIREMENTS.md are populated — this is
+the richest context the workflow will ever have about the project. Use it:
+the AI proposes a milestone sequence (M002, M003, …) derived from
+Discovery, the user reviews, and accepted milestones are appended via the
+`new-milestone --apply` subcommand. Each appended milestone starts empty
+(`slices: []`) and is discussed/planned later via `/np:discuss-phase <N>`
+and `/np:plan-phase <N>`.
+
+### Step 3.1 — Skip guard
+
+Phase 3 depends on populated Discovery content. If PROJECT.md still
+contains `_TBD — filled by /np:discuss-project._` placeholders, skip
+Phase 3 with a clear hint:
+
+```bash
+PROJECT_MD=".nubos-pilot/PROJECT.md"
+if grep -q "_TBD — filled by /np:discuss-project._" "$PROJECT_MD"; then
+  echo "Phase 3 skipped — PROJECT.md has unfilled sections. Finish /np:discuss-project, then append milestones via /np:new-milestone."
+  MILESTONES_APPENDED=()
+else
+  # Step 3.2 onward …
+fi
+```
+
+### Step 3.2 — Propose milestone sequence
+
+Read `.nubos-pilot/PROJECT.md` and `.nubos-pilot/REQUIREMENTS.md` in full.
+Derive a proposed milestone breakdown grounded in Discovery:
+
+- **Anchor on Success Criteria** — each major success criterion maps to
+  at least one milestone.
+- **Respect Non-Goals** — never propose a milestone that crosses a
+  declared Non-Goal.
+- **Honor Strategic Decisions** — reflected in ordering / `depends_on`
+  (e.g. "infra before features" → infra milestone first).
+- **Target 3–6 milestones.** Pick a count that matches project scope;
+  don't pad, don't hand-wave. A tiny project can legitimately have 0
+  additional milestones (M001 is enough); say so explicitly in that case.
+- **One clear goal per milestone**, one sentence, shippable as a unit.
+
+Render the proposal in the main chat (NOT via askuser) so the user sees
+the full list at once:
+
+```
+Based on PROJECT.md + REQUIREMENTS.md I propose these milestones
+in addition to M001 — <first_milestone_name>:
+
+  [1] <name> — <goal>
+  [2] <name> — <goal>
+  [3] <name> — <goal>
+  …
+
+Reasoning:
+  - <name 1>: anchored in success criterion "<excerpt>"
+  - <name 2>: …
+```
+
+If the AI concludes no further milestones are warranted, state that
+explicitly and skip to Step 3.5 with an empty acceptance list.
+
+### Step 3.3 — User review
+
+```bash
+REVIEW_CHOICE=$(node .nubos-pilot/bin/np-tools.cjs askuser --json '{
+  "type": "select",
+  "prompt": "How do you want to proceed with the proposed milestones?",
+  "options": [
+    "Accept all as proposed",
+    "Edit individually (accept/edit/remove per item)",
+    "Discard proposal and enter my own list",
+    "Keep only M001"
+  ]
+}')
+```
+
+Routing:
+
+- **Accept all** → `ACCEPTED` = full proposal, unchanged.
+- **Edit individually** → iterate over proposals; for each ask
+  `select` with options `Accept`, `Edit name/goal`, `Remove`. On `Edit`,
+  two follow-up `input` prompts collect the revised name and goal
+  (pre-filled via `prompt` default with the proposed value).
+- **Discard proposal** → fall through to the legacy bulk-loop (Step 3.4b)
+  exactly as it existed before Phase-3-AI.
+- **Keep only M001** → `ACCEPTED` = empty, skip to Step 3.5.
+
+After any of the first three paths, offer the bulk-loop as an optional
+top-up:
+
+```bash
+ADD_MORE=$(node .nubos-pilot/bin/np-tools.cjs askuser --json '{
+  "type": "confirm",
+  "prompt": "Add further milestones manually beyond the reviewed list?",
+  "default": false
+}')
+```
+
+### Step 3.4a — Apply accepted proposals
+
+For each entry in `ACCEPTED` (AI-proposed + any user-revised), call
+`new-milestone --apply` with a tmp answers file. Identical contract to
+`/np:new-milestone`:
+
+```bash
+MILESTONES_APPENDED=()
+for idx in "${!ACCEPTED_NAMES[@]}"; do
+  MS_ANSWERS=$(mktemp -t np-new-project-ms.XXXXXX)
+  node -e '
+    const fs = require("fs");
+    fs.writeFileSync(process.env.MS_ANSWERS, JSON.stringify({
+      milestone_name: process.env.MS_NAME,
+      milestone_goal: process.env.MS_GOAL,
+      create_req_prefix: false,
+    }));
+  ' MS_ANSWERS="$MS_ANSWERS" \
+    MS_NAME="${ACCEPTED_NAMES[$idx]}" \
+    MS_GOAL="${ACCEPTED_GOALS[$idx]}"
+
+  MS_RESULT=$(node .nubos-pilot/bin/np-tools.cjs init new-milestone --apply "$MS_ANSWERS")
+  rm -f "$MS_ANSWERS"
+
+  MS_ID=$(node -e '
+    const r = JSON.parse(process.env.MS_RESULT);
+    process.stdout.write(r.milestone_id);
+  ' MS_RESULT="$MS_RESULT")
+  MILESTONES_APPENDED+=("$MS_ID — ${ACCEPTED_NAMES[$idx]}")
+done
+```
+
+`create_req_prefix` defaults to `false` for AI-proposed milestones —
+Discovery already produced REQUIREMENTS.md sections. If the user wants a
+dedicated REQ block for a specific milestone, `/np:new-milestone` can
+add it later.
+
+### Step 3.4b — Manual bulk-loop (fallback / top-up)
+
+Entered from "Discard proposal" or from the `ADD_MORE=true` top-up gate.
+Same behavior as the pre-AI bulk-loop: prompt for `milestone_name`,
+`milestone_goal`, `create_req_prefix`; empty name exits.
+
+```bash
+while :; do
+  ANS_MS_NAME=$(node .nubos-pilot/bin/np-tools.cjs askuser --json '{
+    "type": "input",
+    "prompt": "Define another milestone now? Enter name or leave empty to finish."
+  }')
+  [ -z "$ANS_MS_NAME" ] && break
+
+  ANS_MS_GOAL=$(node .nubos-pilot/bin/np-tools.cjs askuser --json '{
+    "type": "input",
+    "prompt": "Milestone goal (one sentence)?"
+  }')
+  ANS_REQ_PREFIX=$(node .nubos-pilot/bin/np-tools.cjs askuser --json '{
+    "type": "confirm",
+    "prompt": "Create a new Requirements section for this milestone?",
+    "default": false
+  }')
+
+  MS_ANSWERS=$(mktemp -t np-new-project-ms.XXXXXX)
+  node -e '
+    const fs = require("fs");
+    const prefix = process.env.ANS_REQ_PREFIX;
+    fs.writeFileSync(process.env.MS_ANSWERS, JSON.stringify({
+      milestone_name: process.env.ANS_MS_NAME,
+      milestone_goal: process.env.ANS_MS_GOAL,
+      create_req_prefix: prefix === "true" || prefix === "yes" || prefix === "y",
+    }));
+  ' ANS_MS_NAME="$ANS_MS_NAME" ANS_MS_GOAL="$ANS_MS_GOAL" \
+    ANS_REQ_PREFIX="$ANS_REQ_PREFIX" MS_ANSWERS="$MS_ANSWERS"
+
+  MS_RESULT=$(node .nubos-pilot/bin/np-tools.cjs init new-milestone --apply "$MS_ANSWERS")
+  rm -f "$MS_ANSWERS"
+
+  MS_ID=$(node -e '
+    const r = JSON.parse(process.env.MS_RESULT);
+    process.stdout.write(r.milestone_id);
+  ' MS_RESULT="$MS_RESULT")
+  MILESTONES_APPENDED+=("$MS_ID — $ANS_MS_NAME")
+done
+```
+
+### Step 3.5 — Done
+
+Continue to Phase 4 with `MILESTONES_APPENDED` populated (possibly empty).
+
+Notes:
+- Every write goes through `np-tools.cjs init new-milestone --apply` —
+  identical error surface (`answers-missing-field`, `roadmap-parse-error`).
+  Any failure aborts the current loop and surfaces the error; prior
+  milestones stay intact (atomic per-milestone).
+- Text-mode routing (`INIT.text_mode == true`) applies to every askuser
+  call above — render each prompt inline instead of shelling out.
+- AI-proposed milestones start empty (`slices: []`). The user discusses
+  each later via `/np:discuss-phase <N>` and plans via
+  `/np:plan-phase <N>`; PROJECT.md is never rewritten (D-29).
+
+## Phase 4 (conditional): Initial Codebase Scan
 
 If Phase 0 reported `file_count > 0` with code files (not only manifests
 and docs), offer to run the initial scan now:
@@ -258,13 +465,18 @@ Created:
     M001-ROADMAP.md
     M001-META.json
     slices/
+  .nubos-pilot/milestones/M002/ …     (if additional milestones added)
   .nubos-pilot/codebase/               (if initial scan ran)
 
-Milestone: M001 — <milestone_name>
+Milestones:
+  M001 — <milestone_name>
+  <each entry from MILESTONES_APPENDED>
 
 Next:
   - /np:discuss-phase 1 to capture decisions for M001
   - /np:plan-phase 1 to break M001 into slices + tasks
+  - /np:discuss-phase <N> / /np:plan-phase <N> for each appended milestone
+    (only after M001 ships; earlier milestones first)
   - /np:update-docs after any code change (agents will do this automatically)
 ```
 

package/workflows/propose-milestones.md

@@ -0,0 +1,287 @@
+---
+command: np:propose-milestones
+description: Re-plan all not-yet-done milestones on an existing project. AI reads PROJECT.md + REQUIREMENTS.md + existing milestone state, proposes add/update/remove operations, user reviews per-item, subcommand applies atomically.
+argument-hint: [--apply <answers.json>]
+---
+
+# np:propose-milestones
+
+Re-plan the not-yet-done milestone pipeline of an existing project. Where `/np:new-project` creates the initial scaffold (+ optional AI-proposed milestones in Phase 3) and `/np:new-milestone` appends a single milestone manually, `/np:propose-milestones` re-examines the whole open pipeline against current Discovery content and proposes an updated sequence.
+
+## Philosophy
+
+<philosophy>
+Projects drift. Discovery answers get refined, Strategic Decisions shift, Success Criteria sharpen, new constraints emerge — but the milestone pipeline set at project-init rarely gets revisited until someone manually runs `/np:new-milestone` for each new idea. This workflow closes that gap: it re-reads the current PROJECT.md + REQUIREMENTS.md, looks at what each not-yet-done milestone already represents, and proposes a coherent updated pipeline. Completed milestones stay untouched; milestones with real investment (slices, non-TBD CONTEXT.md) require explicit confirmation before modification.
+
+Runtime-agnostic: the subcommand is deterministic Node code; the AI proposal happens in the host agent (Claude / Codex / …); the review goes through the askuser gateway (or text-mode inline prompts in Claude Code).
+</philosophy>
+
+## Scope Guardrail
+
+<scope_guardrail>
+This workflow ONLY touches:
+
+- `.nubos-pilot/roadmap.yaml` (add / modify / remove milestone entries)
+- `.nubos-pilot/ROADMAP.md` (regenerated by downstream render if present)
+- `.nubos-pilot/milestones/M<NNN>/` (new dirs for added milestones; existing dirs move to `.nubos-pilot/archive/milestones/M<NNN>-<date>/` on remove)
+
+It NEVER:
+
+- writes `.nubos-pilot/PROJECT.md` — D-29 strict invariant, enforced by `_writeFile` guard
+- modifies **completed** milestones (`status: done|complete|completed`) — the subcommand raises `milestone-completed-untouchable`
+- modifies **milestones with slices** without explicit `confirm_force_modify: true` — the subcommand raises `milestone-has-slices`
+- touches CONTEXT.md of existing milestones on update (only `name` / `goal` in roadmap.yaml change; CONTEXT.md is the user's work)
+- runs when PROJECT.md still has `_TBD` placeholders (refuses in Step 2 below)
+</scope_guardrail>
+
+## Downstream Awareness
+
+<downstream_awareness>
+Each operation maps to a single atomic change inside one file-lock on `roadmap.yaml`:
+
+- `add` → calls the same path as `np:new-milestone --apply`: appends to `roadmap.yaml`, creates `M<NNN>/` dir with CONTEXT.md / ROADMAP.md / META.json skeleton (all TBD), slice subdir.
+- `update` → mutates `name` and/or `goal` of an existing milestone entry in `roadmap.yaml`. CONTEXT.md is never touched; the user's /np:discuss-phase work is preserved.
+- `remove` → drops the milestone entry from `roadmap.yaml` and moves `M<NNN>/` to `.nubos-pilot/archive/milestones/M<NNN>-<YYYY-MM-DD>/` (never hard-deletes).
+
+All ops run inside a single `withFileLock(roadmap.yaml, …)` — either every op applies or none does. New milestones always auto-number as `M<next>` (next = max existing + 1).
+</downstream_awareness>
+
+## Guard
+
+Refuse when not in an initialized project.
+
+```bash
+if [ ! -f .nubos-pilot/PROJECT.md ]; then
+  echo "Error: no .nubos-pilot/PROJECT.md found. Run /np:new-project first."
+  exit 1
+fi
+```
+
+The subcommand raises `project-not-initialized` anyway; the shell check gives a cleaner message before the AI analysis starts.
+
+## Single-Call Init
+
+```bash
+LANG_DIRECTIVE=$(node .nubos-pilot/bin/np-tools.cjs lang-directive)
+INIT=$(node .nubos-pilot/bin/np-tools.cjs init propose-milestones)
+if [[ "$INIT" == @file:* ]]; then INIT=$(cat "${INIT#@file:}"); fi
+```
+
+**Language (SSOT = `.nubos-pilot/config.json` → `response_language`).**
+`$LANG_DIRECTIVE` is authoritative. Obey it for askuser prompt texts, AI-facing reasoning shown to the user, and any narrative prose. YAML keys, milestone IDs, and status strings stay canonical English.
+
+**Text-mode routing.** If INIT payload `text_mode == true`, skip every `np-tools.cjs askuser` call below and render each question as a plain-text prompt in the main chat; collect the answer inline. Auto-enabled in Claude Code (CLAUDECODE=1); opt-in via `.nubos-pilot/config.json` → `workflow.text_mode`.
+
+Parse INIT for: `milestones[]` (each with `id`, `name`, `goal`, `status`, `classification`, `slice_count`, `context`, `touchable`, `modification_requires_confirm`), `project_md`, `requirements_md`, `project_has_tbd`, `current_state_milestone`, `next_milestone_number`, `guidance`.
+
+## Step 1: Present current state
+
+Render the classification table to the user so context is shared before proposing:
+
+```
+Current milestones:
+  M001 — Auth          [discussed]     (pending, 0 slices, CONTEXT filled)
+  M002 — Profile       [empty]         (pending, 0 slices, CONTEXT TBD)
+  M003 — Feed          [active]        (pending, 0 slices, state pointer)
+  M004 — Analytics     [completed]     (done — untouchable)
+
+Legend:
+  completed  — done; never modified
+  active     — has slices or is current state; modify only with explicit confirm
+  discussed  — CONTEXT.md has real content; modify only with explicit confirm
+  empty      — no slices, CONTEXT still TBD; freely modifiable
+```
+
+## Step 2: Guard on unfilled Discovery
+
+If INIT payload `project_has_tbd == true`, refuse with a clear hint:
+
+```
+PROJECT.md still has _TBD placeholders from /np:discuss-project.
+/np:propose-milestones needs a populated Discovery to produce useful proposals.
+
+Run /np:discuss-project first (finish the six discovery sections), then retry.
+```
+
+Exit — do not offer fallback. Bad Discovery in → garbage proposals out; there is no value in a proposal anchored on TBD content.
+
+## Step 3: AI proposal
+
+Read the full `project_md` and `requirements_md` from the INIT payload. For each milestone in `milestones[]` that is NOT `classification: completed`, decide independently:
+
+1. **Keep as-is** — name + goal still align with current Discovery. State the single sentence that anchors it (e.g. "Anchored on Success Criterion: <excerpt>").
+2. **Update** — name or goal need refinement given current Discovery. Propose the new name/goal and say *why* it changed (what in PROJECT.md / REQUIREMENTS.md prompted this).
+3. **Remove** — the milestone no longer fits (replaced by different scope, crosses a Non-Goal now, or was redundant with another). Say *why*.
+
+Then propose any **new** milestones (`add` operations) the current Discovery implies but are missing. Anchor each on a specific Success Criterion or Strategic Decision.
+
+Constraints:
+- Respect **Non-Goals** — never propose a milestone that crosses a declared Non-Goal.
+- Honor **Strategic Decisions** — use for ordering (sequence, `depends_on` hints for later /np:plan-phase).
+- Target **3–6 total** not-yet-done milestones after the proposal. Do not pad; a small project may correctly end up with 1–2.
+- **Do not propose changes to milestones classified as `completed`.** They are frozen.
+
+Render the proposal as a diff-style list in the main chat:
+
+```
+Proposed changes:
+
+  KEEP   M001 — Auth           (still anchored on Success Criterion "secure multi-device sessions")
+  UPDATE M002 — Profile        → "Profile & Preferences"
+         goal: "Ship user profile + preference persistence"
+         reason: REQUIREMENTS now includes REQ-07 (preferences) which belongs here
+  REMOVE M003 — Feed           reason: Non-Goals explicitly excludes social feed; this crossed the line
+  ADD            Analytics     goal: "Ship event tracking + admin dashboard"
+                               reason: Success Criterion "measure retention" has no home
+  ADD            Migrations    goal: "Ship production DB migration pipeline"
+                               reason: Strategic Decision "infra before features" implies this early
+
+Sensitive items (require your explicit confirm if you accept):
+  - UPDATE M002 — classification=discussed (CONTEXT.md already has content)
+```
+
+## Step 4: User review per item
+
+For each proposal, ask one question via `askuser`. The exact prompt depends on the op type and classification:
+
+### Keep proposals (no change)
+No prompt — just listed under "Unchanged" in the summary. The user can override via Step 5 bulk-gate.
+
+### Update / Remove of **touchable** milestones (classification=`empty`)
+```bash
+ANSWER=$(node .nubos-pilot/bin/np-tools.cjs askuser --json '{
+  "type": "select",
+  "prompt": "UPDATE M002 — name: Profile → Profile & Preferences?",
+  "options": ["Accept", "Edit (type your own name/goal)", "Skip this item"]
+}')
+```
+
+On `Edit` → two follow-up `input` prompts (new_name, new_goal) with the proposed values as defaults.
+
+### Update / Remove of **non-touchable** milestones (classification=`active` or `discussed`)
+```bash
+ANSWER=$(node .nubos-pilot/bin/np-tools.cjs askuser --json '{
+  "type": "select",
+  "prompt": "⚠ M002 already has CONTEXT.md content. UPDATE anyway?",
+  "options": ["Accept (confirm_force_modify=true)", "Edit", "Skip this item"]
+}')
+```
+
+`Accept` must set `confirm_force_modify: true` on the resulting operation — the subcommand will reject the change otherwise. Additionally, if the milestone has `slice_count > 0`:
+
+```bash
+# Extra hard-confirm for milestones with slices
+ANSWER=$(node .nubos-pilot/bin/np-tools.cjs askuser --json '{
+  "type": "confirm",
+  "prompt": "M002 has 3 slice(s) with tasks. Modification will still preserve CONTEXT.md and slices, but roadmap name/goal will change. Proceed?",
+  "default": false
+}')
+```
+
+### Add proposals
+```bash
+ANSWER=$(node .nubos-pilot/bin/np-tools.cjs askuser --json '{
+  "type": "select",
+  "prompt": "ADD new milestone: Analytics — Ship event tracking + admin dashboard?",
+  "options": ["Accept", "Edit name/goal", "Skip this item"]
+}')
+```
+
+## Step 5: User bulk-override gate
+
+After per-item review, offer two meta-options before apply:
+
+```bash
+FINAL=$(node .nubos-pilot/bin/np-tools.cjs askuser --json '{
+  "type": "select",
+  "prompt": "About to apply N operations. Last chance.",
+  "options": [
+    "Apply all accepted operations",
+    "Show diff again (re-render proposal with my edits)",
+    "Add another milestone manually before applying",
+    "Abort — make no changes"
+  ]
+}')
+```
+
+- `Show diff again` → re-render the proposal + user-edits and loop back to Step 4.
+- `Add another milestone manually` → enter the `/np:new-milestone` three-question loop inline (same prompts as the `new-project` Phase 3 bulk loop) and append the collected answers as `add` operations.
+- `Abort` → exit cleanly, no writes.
+
+## Step 6: Apply
+
+Build the answers JSON from collected decisions:
+
+```bash
+OPS_JSON=$(mktemp -t np-propose-ops.XXXXXX)
+trap 'rm -f "$OPS_JSON"' EXIT
+
+node -e '
+  const fs = require("fs");
+  fs.writeFileSync(process.env.OPS_JSON, JSON.stringify({
+    operations: [
+      // each entry:
+      // { type: "add", milestone_name, milestone_goal }
+      // { type: "update", milestone_id: "M<NNN>", new_name?, new_goal?, confirm_force_modify? }
+      // { type: "remove", milestone_id: "M<NNN>", confirm_force_modify? }
+    ],
+  }));
+' OPS_JSON="$OPS_JSON"
+
+node .nubos-pilot/bin/np-tools.cjs init propose-milestones --apply "$OPS_JSON"
+```
+
+Output JSON:
+
+```jsonc
+{
+  "mode": "apply",
+  "results": [
+    { "type": "add",    "id": "M005", "number": 5, "name": "Analytics" },
+    { "type": "update", "id": "M002", "changed": { "from_name": "Profile", "to_name": "Profile & Preferences" } },
+    { "type": "remove", "id": "M003", "archived_to": ".nubos-pilot/archive/milestones/M003-2026-04-21" }
+  ]
+}
+```
+
+## Step 7: Summary + next steps
+
+Render the apply result to the user with concrete next actions:
+
+```
+Applied N operations.
+
+Updated pipeline (not-yet-done):
+  M001 — Auth
+  M002 — Profile & Preferences       (updated: name, goal)
+  M004 — Analytics                   (new)
+  M005 — Migrations                  (new)
+
+Archived:
+  M003 — Feed                        → .nubos-pilot/archive/milestones/M003-2026-04-21
+
+Next:
+  - /np:discuss-phase <N> for each new or updated milestone to refresh CONTEXT.md
+  - /np:plan-phase <N> to break it into slices + tasks
+```
+
+## Optional Commit
+
+```bash
+if [ "$(node .nubos-pilot/bin/np-tools.cjs config-get workflow.commit_docs 2>/dev/null)" = "true" ]; then
+  git add .nubos-pilot/
+  git commit -m "chore: np:propose-milestones re-plan pipeline"
+fi
+```
+
+## Errors
+
+| Code | Trigger | User action |
+|------|---------|-------------|
+| `project-not-initialized` | no `PROJECT.md` in `.nubos-pilot/` | Run `/np:new-project` first |
+| `roadmap-missing` / `roadmap-parse-error` | `roadmap.yaml` missing or malformed | Inspect `.nubos-pilot/roadmap.yaml` |
+| `milestone-completed-untouchable` | update/remove on status=done | Cannot modify shipped milestones; add a new one instead |
+| `milestone-has-slices` | update/remove on milestone with slices without `confirm_force_modify:true` | Either confirm explicitly per-item or first `/np:reset-slice` the affected slices |
+| `milestone-not-found` | update/remove references non-existent M<NNN> | Re-run; use IDs shown in Step 1 |
+| `answers-missing-field` | op missing required field | Fix the op and re-run |
+| `invalid-operation-type` | op type is not add/update/remove | Valid types: add, update, remove |