npm - prizmkit - Versions diffs - 1.1.23 → 1.1.24 - Mend

prizmkit 1.1.23 → 1.1.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/bundled/VERSION.json CHANGED Viewed

@@ -1,5 +1,5 @@
 {
-  "frameworkVersion": "1.1.23",
-  "bundledAt": "2026-04-11T14:45:05.180Z",
-  "bundledFrom": "fbba566"
+  "frameworkVersion": "1.1.24",
+  "bundledAt": "2026-04-12T01:13:39.954Z",
+  "bundledFrom": "626fbf5"
 }

package/bundled/dev-pipeline/lib/heartbeat.sh CHANGED Viewed

@@ -6,9 +6,14 @@
 # structured progress from progress.json (written by
 # parse-stream-progress.py) and fall back to tail-based monitoring.
 #
+# When stale_kill_threshold is set (>0), the heartbeat monitor will
+# automatically kill the AI CLI process if it shows no progress for
+# the specified duration. This prevents sessions from hanging forever
+# when the AI CLI process doesn't exit after completing its work.
+#
 # Usage:
 #   source "$SCRIPT_DIR/lib/heartbeat.sh"
-#   start_heartbeat "$cli_pid" "$session_log" "$progress_json" "$interval"
+#   start_heartbeat "$cli_pid" "$session_log" "$progress_json" "$interval" ["$stale_kill_threshold"]
 #   # ... wait for CLI to finish ...
 #   stop_heartbeat "$_HEARTBEAT_PID"
 #
@@ -20,19 +25,23 @@
 # Sets _HEARTBEAT_PID to the background process PID.
 #
 # Arguments:
-#   $1 - cli_pid         PID of the AI CLI process to monitor
-#   $2 - session_log     Path to session.log
-#   $3 - progress_json   Path to progress.json (may not exist if stream-json disabled)
-#   $4 - interval        Heartbeat interval in seconds
+#   $1 - cli_pid              PID of the AI CLI process to monitor
+#   $2 - session_log          Path to session.log
+#   $3 - progress_json        Path to progress.json (may not exist if stream-json disabled)
+#   $4 - interval             Heartbeat interval in seconds
+#   $5 - stale_kill_threshold (optional) Seconds of no progress before auto-killing the process.
+#                              0 = disabled (default). Recommended: 900 (15 minutes).
 start_heartbeat() {
     local cli_pid="$1"
     local session_log="$2"
     local progress_json="$3"
     local heartbeat_interval="$4"
+    local stale_kill_threshold="${5:-0}"
     (
         local elapsed=0
         local prev_size=0
+        local stale_seconds=0
         while kill -0 "$cli_pid" 2>/dev/null; do
             sleep "$heartbeat_interval"
             elapsed=$((elapsed + heartbeat_interval))
@@ -48,6 +57,13 @@ start_heartbeat() {
             local growth=$((cur_size - prev_size))
             prev_size=$cur_size
+            # Track progress staleness (no log growth = stale)
+            if [[ $growth -eq 0 ]]; then
+                stale_seconds=$((stale_seconds + heartbeat_interval))
+            else
+                stale_seconds=0
+            fi
             local size_display
             if [[ $cur_size -gt 1048576 ]]; then
                 size_display="$((cur_size / 1048576))MB"
@@ -67,6 +83,33 @@ start_heartbeat() {
                 status_icon="${YELLOW}⏸${NC}"
             fi
+            # Stale-kill: auto-terminate process if no progress for too long
+            if [[ $stale_kill_threshold -gt 0 && $stale_seconds -ge $stale_kill_threshold ]]; then
+                local stale_mins=$((stale_seconds / 60))
+                echo -e "  ${RED}[HEARTBEAT]${NC} ${mins}m${secs}s | log: ${size_display} | ${RED}STALE-KILL: no progress for ${stale_mins}m (threshold: ${stale_kill_threshold}s)${NC}"
+                echo -e "  ${RED}[HEARTBEAT]${NC} Killing AI CLI process $cli_pid (stale session)..."
+                kill -TERM "$cli_pid" 2>/dev/null || true
+                # Give process 10s to exit gracefully, then force kill
+                sleep 10
+                if kill -0 "$cli_pid" 2>/dev/null; then
+                    echo -e "  ${RED}[HEARTBEAT]${NC} Process still alive after SIGTERM, sending SIGKILL..."
+                    kill -9 "$cli_pid" 2>/dev/null || true
+                fi
+                # Write stale-kill marker so spawn_and_wait_session knows this wasn't a crash
+                local _marker_dir
+                _marker_dir="$(dirname "$session_log")"
+                echo "{\"killed_at\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\", \"reason\": \"stale_session\", \"stale_seconds\": $stale_seconds, \"threshold\": $stale_kill_threshold}" > "$_marker_dir/stale-kill.json" 2>/dev/null || true
+                break
+            fi
+            # Build staleness hint for display
+            local stale_hint=""
+            if [[ $stale_kill_threshold -gt 0 && $stale_seconds -gt 0 ]]; then
+                local stale_mins=$((stale_seconds / 60))
+                local threshold_mins=$((stale_kill_threshold / 60))
+                stale_hint=" | stale: ${stale_mins}m/${threshold_mins}m"
+            fi
             # Try structured progress from progress.json
             if [[ -f "$progress_json" ]]; then
                 local phase tool msgs tools_total
@@ -86,7 +129,7 @@ try:
 except Exception:
     sys.exit(1)
 " "$progress_json" 2>/dev/null) && {
-                    echo -e "  ${status_icon} ${BLUE}[HEARTBEAT]${NC} ${mins}m${secs}s | log: ${size_display} | ${phase}"
+                    echo -e "  ${status_icon} ${BLUE}[HEARTBEAT]${NC} ${mins}m${secs}s | log: ${size_display} | ${phase}${stale_hint}"
                     continue
                 }
             fi
@@ -97,7 +140,7 @@ except Exception:
                 last_activity=$(tail -20 "$session_log" 2>/dev/null | grep -v '^$' | tail -1 | cut -c1-80 || echo "")
             fi
-            echo -e "  ${status_icon} ${BLUE}[HEARTBEAT]${NC} ${mins}m${secs}s elapsed | log: ${size_display} (+${growth}B) | ${last_activity}"
+            echo -e "  ${status_icon} ${BLUE}[HEARTBEAT]${NC} ${mins}m${secs}s elapsed | log: ${size_display} (+${growth}B) | ${last_activity}${stale_hint}"
         done
     ) &
     _HEARTBEAT_PID=$!

package/bundled/dev-pipeline/run-bugfix.sh CHANGED Viewed

@@ -21,6 +21,7 @@ set -euo pipefail
 #   PRIZMKIT_PLATFORM     Force platform: 'codebuddy' or 'claude' (auto-detected)
 #   VERBOSE               Set to 1 to enable --verbose on AI CLI
 #   HEARTBEAT_INTERVAL    Heartbeat log interval in seconds (default: 30)
+#   STALE_KILL_THRESHOLD   Auto-kill session after N seconds of no progress (default: 900)
 #   HEARTBEAT_STALE_THRESHOLD  Heartbeat stale threshold in seconds (default: 600)
 #   LOG_CLEANUP_ENABLED   Run periodic log cleanup (default: 1)
 #   LOG_RETENTION_DAYS    Delete logs older than N days (default: 14)
@@ -39,6 +40,7 @@ MAX_RETRIES=${MAX_RETRIES:-3}
 SESSION_TIMEOUT=${SESSION_TIMEOUT:-0}
 HEARTBEAT_STALE_THRESHOLD=${HEARTBEAT_STALE_THRESHOLD:-600}
 HEARTBEAT_INTERVAL=${HEARTBEAT_INTERVAL:-30}
+STALE_KILL_THRESHOLD=${STALE_KILL_THRESHOLD:-900}
 LOG_CLEANUP_ENABLED=${LOG_CLEANUP_ENABLED:-1}
 LOG_RETENTION_DAYS=${LOG_RETENTION_DAYS:-14}
 LOG_MAX_TOTAL_MB=${LOG_MAX_TOTAL_MB:-1024}
@@ -146,8 +148,8 @@ spawn_and_wait_session() {
         watcher_pid=$!
     fi
-    # Heartbeat monitor
-    start_heartbeat "$cli_pid" "$session_log" "$progress_json" "$HEARTBEAT_INTERVAL"
+    # Heartbeat monitor (with stale-kill protection)
+    start_heartbeat "$cli_pid" "$session_log" "$progress_json" "$HEARTBEAT_INTERVAL" "$STALE_KILL_THRESHOLD"
     local heartbeat_pid="${_HEARTBEAT_PID:-}"
     # Wait for AI CLI to finish
@@ -166,6 +168,14 @@ spawn_and_wait_session() {
     [[ $exit_code -eq 143 ]] && exit_code=124
+    # Check for stale-kill marker (heartbeat killed the process due to no progress)
+    local stale_kill_marker="$session_dir/logs/stale-kill.json"
+    local was_stale_killed=false
+    if [[ -f "$stale_kill_marker" ]]; then
+        was_stale_killed=true
+        log_warn "Session was stale-killed by heartbeat monitor (no progress for too long)"
+    fi
     # Session summary
     if [[ -f "$session_log" ]]; then
         local final_size=$(wc -c < "$session_log" 2>/dev/null | tr -d ' ')
@@ -183,6 +193,33 @@ spawn_and_wait_session() {
     if [[ $exit_code -eq 124 ]]; then
         log_warn "Session timed out after ${SESSION_TIMEOUT}s"
         session_status="timed_out"
+    elif [[ "$was_stale_killed" == true ]]; then
+        log_warn "Session stale-killed (no progress for ${STALE_KILL_THRESHOLD}s)"
+        local has_commits=""
+        if git -C "$project_root" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+            has_commits=$(git -C "$project_root" log "${default_branch}..HEAD" --oneline 2>/dev/null | head -1)
+        fi
+        if [[ -n "$has_commits" ]]; then
+            log_info "Stale-killed session has commits — treating as success"
+            session_status="success"
+        else
+            local uncommitted=""
+            uncommitted=$(git -C "$project_root" status --porcelain 2>/dev/null | head -1 || true)
+            if [[ -n "$uncommitted" ]]; then
+                log_warn "Stale-killed session has uncommitted changes — auto-committing..."
+                git -C "$project_root" add -A 2>/dev/null || true
+                if git -C "$project_root" commit --no-verify -m "chore($bug_id): auto-commit session work (stale-killed)" 2>/dev/null; then
+                    log_info "Auto-commit succeeded"
+                    session_status="success"
+                else
+                    log_warn "Auto-commit failed — no changes to commit"
+                    session_status="crashed"
+                fi
+            else
+                log_warn "Stale-killed session produced no commits and no changes"
+                session_status="crashed"
+            fi
+        fi
     elif [[ $exit_code -ne 0 ]]; then
         log_warn "Session exited with code $exit_code"
         session_status="crashed"
@@ -1091,6 +1128,7 @@ show_help() {
     echo "  AI_CLI                AI CLI command name (auto-detected: cbc or claude)"
     echo "  VERBOSE               Set to 1 for verbose AI CLI output"
     echo "  HEARTBEAT_INTERVAL    Heartbeat log interval in seconds (default: 30)"
+    echo "  STALE_KILL_THRESHOLD  Auto-kill session after N seconds of no progress (default: 900)"
     echo "  LOG_CLEANUP_ENABLED   Run log cleanup before execution (default: 1)"
     echo "  LOG_RETENTION_DAYS    Delete logs older than N days (default: 14)"
     echo "  LOG_MAX_TOTAL_MB      Keep total logs under N MB (default: 1024)"

package/bundled/dev-pipeline/run-feature.sh CHANGED Viewed

@@ -23,6 +23,7 @@ set -euo pipefail
 #   MODEL                 AI model to use (e.g. claude-opus-4.6, claude-sonnet-4.6, claude-haiku-4.5)
 #   VERBOSE               Set to 1 to enable --verbose on AI CLI (shows subagent output)
 #   HEARTBEAT_INTERVAL    Heartbeat log interval in seconds (default: 30)
+#   STALE_KILL_THRESHOLD   Auto-kill session after N seconds of no progress (default: 900)
 #   HEARTBEAT_STALE_THRESHOLD  Heartbeat stale threshold in seconds (default: 600)
 #   LOG_CLEANUP_ENABLED   Run periodic log cleanup (default: 1)
 #   LOG_RETENTION_DAYS    Delete logs older than N days (default: 14)
@@ -42,6 +43,7 @@ MAX_RETRIES=${MAX_RETRIES:-3}
 SESSION_TIMEOUT=${SESSION_TIMEOUT:-0}
 HEARTBEAT_STALE_THRESHOLD=${HEARTBEAT_STALE_THRESHOLD:-600}
 HEARTBEAT_INTERVAL=${HEARTBEAT_INTERVAL:-30}
+STALE_KILL_THRESHOLD=${STALE_KILL_THRESHOLD:-900}
 LOG_CLEANUP_ENABLED=${LOG_CLEANUP_ENABLED:-1}
 LOG_RETENTION_DAYS=${LOG_RETENTION_DAYS:-14}
 LOG_MAX_TOTAL_MB=${LOG_MAX_TOTAL_MB:-1024}
@@ -157,7 +159,8 @@ spawn_and_wait_session() {
     fi
     # Heartbeat monitor (reads progress.json when available, falls back to tail)
-    start_heartbeat "$cbc_pid" "$session_log" "$progress_json" "$HEARTBEAT_INTERVAL"
+    # Also monitors for stale sessions and auto-kills if no progress for STALE_KILL_THRESHOLD seconds
+    start_heartbeat "$cbc_pid" "$session_log" "$progress_json" "$HEARTBEAT_INTERVAL" "$STALE_KILL_THRESHOLD"
     local heartbeat_pid="${_HEARTBEAT_PID:-}"
     # Wait for AI CLI to finish
@@ -179,6 +182,14 @@ spawn_and_wait_session() {
         exit_code=124
     fi
+    # Check for stale-kill marker (heartbeat killed the process due to no progress)
+    local stale_kill_marker="$session_dir/logs/stale-kill.json"
+    local was_stale_killed=false
+    if [[ -f "$stale_kill_marker" ]]; then
+        was_stale_killed=true
+        log_warn "Session was stale-killed by heartbeat monitor (no progress for too long)"
+    fi
     # Show final session summary
     if [[ -f "$session_log" ]]; then
         local final_size=$(wc -c < "$session_log" 2>/dev/null | tr -d ' ')
@@ -198,6 +209,34 @@ spawn_and_wait_session() {
     if [[ $exit_code -eq 124 ]]; then
         log_warn "Session timed out after ${SESSION_TIMEOUT}s"
         session_status="timed_out"
+    elif [[ "$was_stale_killed" == true ]]; then
+        log_warn "Session stale-killed (no progress for ${STALE_KILL_THRESHOLD}s)"
+        # Treat stale-killed as potentially successful — check for commits
+        local has_commits=""
+        if git -C "$project_root" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+            has_commits=$(git -C "$project_root" log "${default_branch}..HEAD" --oneline 2>/dev/null | head -1)
+        fi
+        if [[ -n "$has_commits" ]]; then
+            log_info "Stale-killed session has commits — treating as success"
+            session_status="success"
+        else
+            local uncommitted=""
+            uncommitted=$(git -C "$project_root" status --porcelain 2>/dev/null | head -1 || true)
+            if [[ -n "$uncommitted" ]]; then
+                log_warn "Stale-killed session has uncommitted changes — auto-committing..."
+                git -C "$project_root" add -A 2>/dev/null || true
+                if git -C "$project_root" commit --no-verify -m "chore($feature_id): auto-commit session work (stale-killed)" 2>/dev/null; then
+                    log_info "Auto-commit succeeded"
+                    session_status="success"
+                else
+                    log_warn "Auto-commit failed — no changes to commit"
+                    session_status="crashed"
+                fi
+            else
+                log_warn "Stale-killed session produced no commits and no changes"
+                session_status="crashed"
+            fi
+        fi
     elif [[ $exit_code -ne 0 ]]; then
         log_warn "Session exited with code $exit_code"
         session_status="crashed"
@@ -1318,6 +1357,7 @@ show_help() {
     echo "  AI_CLI                AI CLI command name (auto-detected: cbc or claude)"
     echo "  MODEL                 AI model ID (e.g. claude-opus-4.6, claude-sonnet-4.6, claude-haiku-4.5)"
     echo "  HEARTBEAT_INTERVAL    Heartbeat log interval in seconds (default: 30)"
+    echo "  STALE_KILL_THRESHOLD  Auto-kill session after N seconds of no progress (default: 900)"
     echo "  HEARTBEAT_STALE_THRESHOLD  Heartbeat stale threshold in seconds (default: 600)"
     echo "  LOG_CLEANUP_ENABLED   Run log cleanup before execution (default: 1)"
     echo "  LOG_RETENTION_DAYS    Delete logs older than N days (default: 14)"

package/bundled/dev-pipeline/run-refactor.sh CHANGED Viewed

@@ -21,6 +21,7 @@ set -euo pipefail
 #   PRIZMKIT_PLATFORM     Force platform: 'codebuddy' or 'claude' (auto-detected)
 #   VERBOSE               Set to 1 to enable --verbose on AI CLI
 #   HEARTBEAT_INTERVAL    Heartbeat log interval in seconds (default: 30)
+#   STALE_KILL_THRESHOLD   Auto-kill session after N seconds of no progress (default: 900)
 #   HEARTBEAT_STALE_THRESHOLD  Heartbeat stale threshold in seconds (default: 600)
 #   LOG_CLEANUP_ENABLED   Run periodic log cleanup (default: 1)
 #   LOG_RETENTION_DAYS    Delete logs older than N days (default: 14)
@@ -40,6 +41,7 @@ MAX_RETRIES=${MAX_RETRIES:-3}
 SESSION_TIMEOUT=${SESSION_TIMEOUT:-0}
 HEARTBEAT_STALE_THRESHOLD=${HEARTBEAT_STALE_THRESHOLD:-600}
 HEARTBEAT_INTERVAL=${HEARTBEAT_INTERVAL:-30}
+STALE_KILL_THRESHOLD=${STALE_KILL_THRESHOLD:-900}
 LOG_CLEANUP_ENABLED=${LOG_CLEANUP_ENABLED:-1}
 LOG_RETENTION_DAYS=${LOG_RETENTION_DAYS:-14}
 LOG_MAX_TOTAL_MB=${LOG_MAX_TOTAL_MB:-1024}
@@ -148,8 +150,8 @@ spawn_and_wait_session() {
         watcher_pid=$!
     fi
-    # Heartbeat monitor
-    start_heartbeat "$cli_pid" "$session_log" "$progress_json" "$HEARTBEAT_INTERVAL"
+    # Heartbeat monitor (with stale-kill protection)
+    start_heartbeat "$cli_pid" "$session_log" "$progress_json" "$HEARTBEAT_INTERVAL" "$STALE_KILL_THRESHOLD"
     local heartbeat_pid="${_HEARTBEAT_PID:-}"
     # Wait for AI CLI to finish
@@ -168,6 +170,14 @@ spawn_and_wait_session() {
     [[ $exit_code -eq 143 ]] && exit_code=124
+    # Check for stale-kill marker (heartbeat killed the process due to no progress)
+    local stale_kill_marker="$session_dir/logs/stale-kill.json"
+    local was_stale_killed=false
+    if [[ -f "$stale_kill_marker" ]]; then
+        was_stale_killed=true
+        log_warn "Session was stale-killed by heartbeat monitor (no progress for too long)"
+    fi
     # Session summary
     if [[ -f "$session_log" ]]; then
         local final_size=$(wc -c < "$session_log" 2>/dev/null | tr -d ' ')
@@ -185,6 +195,33 @@ spawn_and_wait_session() {
     if [[ $exit_code -eq 124 ]]; then
         log_warn "Session timed out after ${SESSION_TIMEOUT}s"
         session_status="timed_out"
+    elif [[ "$was_stale_killed" == true ]]; then
+        log_warn "Session stale-killed (no progress for ${STALE_KILL_THRESHOLD}s)"
+        local has_commits=""
+        if git -C "$project_root" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+            has_commits=$(git -C "$project_root" log "${default_branch}..HEAD" --oneline 2>/dev/null | head -1)
+        fi
+        if [[ -n "$has_commits" ]]; then
+            log_info "Stale-killed session has commits — treating as success"
+            session_status="success"
+        else
+            local uncommitted=""
+            uncommitted=$(git -C "$project_root" status --porcelain 2>/dev/null | head -1 || true)
+            if [[ -n "$uncommitted" ]]; then
+                log_warn "Stale-killed session has uncommitted changes — auto-committing..."
+                git -C "$project_root" add -A 2>/dev/null || true
+                if git -C "$project_root" commit --no-verify -m "chore($refactor_id): auto-commit session work (stale-killed)" 2>/dev/null; then
+                    log_info "Auto-commit succeeded"
+                    session_status="success"
+                else
+                    log_warn "Auto-commit failed — no changes to commit"
+                    session_status="crashed"
+                fi
+            else
+                log_warn "Stale-killed session produced no commits and no changes"
+                session_status="crashed"
+            fi
+        fi
     elif [[ $exit_code -ne 0 ]]; then
         log_warn "Session exited with code $exit_code"
         session_status="crashed"
@@ -1129,6 +1166,7 @@ show_help() {
     echo "  VERBOSE                  Set to 1 for verbose AI CLI output"
     echo "  STRICT_BEHAVIOR_CHECK    Force full test suite after each refactor (default: 1)"
     echo "  HEARTBEAT_INTERVAL       Heartbeat log interval in seconds (default: 30)"
+    echo "  STALE_KILL_THRESHOLD     Auto-kill session after N seconds of no progress (default: 900)"
     echo "  LOG_CLEANUP_ENABLED      Run log cleanup before execution (default: 1)"
     echo "  LOG_RETENTION_DAYS       Delete logs older than N days (default: 14)"
     echo "  LOG_MAX_TOTAL_MB         Keep total logs under N MB (default: 1024)"

package/bundled/dev-pipeline/templates/bootstrap-tier1.md CHANGED Viewed

@@ -189,6 +189,49 @@ Round 5: 3 failures [test_b, test_d, test_e]          ← plateau 3/3 → STOP
 You MUST execute this phase. Do NOT skip it. Do NOT mark it as completed without actually running playwright-cli.
+**CRITICAL CONSTRAINT — playwright-cli ONLY, NO Playwright MCP**:
+- You MUST use `playwright-cli` (the CLI tool) for ALL browser interactions in this phase
+- **NEVER** use Playwright MCP server, Playwright MCP tools, or any MCP-based browser automation
+- If you have Playwright MCP configured, IGNORE it entirely — use the CLI command `playwright-cli` exclusively
+- All browser actions go through `playwright-cli <command>` in the Bash tool, not through any MCP tool call
+**Step 0 — Playwright CLI Readiness Check (BLOCKING — must pass before any browser action)**:
+0a. Check if `playwright-cli` is installed:
+```bash
+which playwright-cli 2>/dev/null && playwright-cli --version 2>/dev/null || echo "NOT_INSTALLED"
+```
+If output is `NOT_INSTALLED`, install it:
+```bash
+npm install -g @playwright/cli@latest
+```
+Then verify installation succeeded: `playwright-cli --version`. If installation fails, log `## Browser Verification: SKIPPED — playwright-cli installation failed` in context-snapshot.md and proceed to the next phase.
+0b. Learn playwright-cli usage (run once per session):
+```bash
+playwright-cli --help
+```
+0c. Check if playwright-cli skill is installed for the current AI platform:
+```bash
+CURRENT_PLATFORM=""
+if which claude >/dev/null 2>&1; then
+  CURRENT_PLATFORM="claude"; SKILL_DIR="$HOME/.claude/skills"
+elif which cbc >/dev/null 2>&1; then
+  CURRENT_PLATFORM="codebuddy"; SKILL_DIR="$HOME/.cbc/skills"
+else
+  CURRENT_PLATFORM="unknown"
+fi
+if [ -d "$SKILL_DIR/playwright-cli" ] || ls "$SKILL_DIR"/playwright* 2>/dev/null | grep -q .; then
+  echo "SKILL_EXISTS"
+else
+  echo "SKILL_MISSING"
+fi
+```
+If `SKILL_MISSING`: run `playwright-cli install --skills`. If current platform is NOT claude, copy installed skill from `$HOME/.claude/skills/playwright-cli` to `$SKILL_DIR/playwright-cli`.
+0d. Read the installed playwright-cli skill (SKILL.md) for workflow guidance. Use its recommended patterns to construct your verification flow.
 **Step 1 — Start Dev Server**:
 You know this project's tech stack. Detect and start the dev server yourself:
@@ -196,9 +239,7 @@ You know this project's tech stack. Detect and start the dev server yourself:
 1. Identify the dev server start command from project config (`package.json` scripts, `Makefile`, `docker-compose.yml`, etc.)
 2. **Detect the dev server port** — use the pre-detected port from pipeline if available, otherwise extract from project config. Do NOT hardcode or guess the port:
    ```bash
-   # Use pipeline-injected port if available, otherwise extract from package.json
    DEV_PORT={{DEV_PORT}}
-   # If DEV_PORT is still a placeholder, detect at runtime:
    if [ "$DEV_PORT" = "{{DEV_PORT}}" ]; then
      DEV_PORT=$(node -e "const s=require('./package.json').scripts.dev; const m=s.match(/-p\s+(\d+)/); console.log(m?m[1]:'')")
      if [ -z "$DEV_PORT" ]; then
@@ -225,14 +266,14 @@ You know this project's tech stack. Detect and start the dev server yourself:
 Use `playwright-cli snapshot` on the running app to discover actual element refs, then verify these goals:
    {{BROWSER_VERIFY_STEPS}}
-   Decide the concrete playwright-cli actions (click, fill, assert, etc.) yourself based on the snapshot output and your knowledge of the implemented code. The goals above describe WHAT to verify — you determine HOW.
-Take a final screenshot for evidence.
+Construct your verification workflow based on: (1) the playwright-cli skill documentation, (2) the `--help` output, (3) the current task's acceptance criteria. Decide the concrete playwright-cli actions yourself. Take a final screenshot: `playwright-cli screenshot`.
 **Step 3 — Cleanup (REQUIRED — you started it, you stop it)**:
-1. Kill the dev server process: `kill $DEV_SERVER_PID 2>/dev/null || true`
-2. Verify port is released: `lsof -ti:$DEV_PORT | xargs kill -9 2>/dev/null || true`
+1. Close the playwright-cli browser: `playwright-cli close`
+2. Kill the dev server process: `kill $DEV_SERVER_PID 2>/dev/null || true`
+3. Verify port is released: `lsof -ti:$DEV_PORT | xargs kill -9 2>/dev/null || true`
 **Step 4 — Reporting**:
@@ -241,10 +282,12 @@ Append results to `context-snapshot.md`:
    ## Browser Verification
    URL: http://localhost:$DEV_PORT
    Dev Server Command: <actual command used>
-   Steps executed: [list]
+   playwright-cli version: <version>
+   Steps executed: [list of playwright-cli commands used]
    Screenshot: [path]
    Result: PASS / FAIL (reason)
    Server cleanup: confirmed
+   Browser cleanup: confirmed
    ```
 If verification fails, log the failure details but continue to commit. Failures do NOT block the commit, but you MUST attempt verification and MUST clean up the dev server.

package/bundled/dev-pipeline/templates/bootstrap-tier2.md CHANGED Viewed

@@ -287,6 +287,49 @@ If GATE:MISSING — send message to Reviewer (re-spawn if needed): "Write review
 You MUST execute this phase. Do NOT skip it. Do NOT mark it as completed without actually running playwright-cli.
+**CRITICAL CONSTRAINT — playwright-cli ONLY, NO Playwright MCP**:
+- You MUST use `playwright-cli` (the CLI tool) for ALL browser interactions in this phase
+- **NEVER** use Playwright MCP server, Playwright MCP tools, or any MCP-based browser automation
+- If you have Playwright MCP configured, IGNORE it entirely — use the CLI command `playwright-cli` exclusively
+- All browser actions go through `playwright-cli <command>` in the Bash tool, not through any MCP tool call
+**Step 0 — Playwright CLI Readiness Check (BLOCKING — must pass before any browser action)**:
+0a. Check if `playwright-cli` is installed:
+```bash
+which playwright-cli 2>/dev/null && playwright-cli --version 2>/dev/null || echo "NOT_INSTALLED"
+```
+If output is `NOT_INSTALLED`, install it:
+```bash
+npm install -g @playwright/cli@latest
+```
+Then verify installation succeeded: `playwright-cli --version`. If installation fails, log `## Browser Verification: SKIPPED — playwright-cli installation failed` in context-snapshot.md and proceed to the next phase.
+0b. Learn playwright-cli usage (run once per session):
+```bash
+playwright-cli --help
+```
+0c. Check if playwright-cli skill is installed for the current AI platform:
+```bash
+CURRENT_PLATFORM=""
+if which claude >/dev/null 2>&1; then
+  CURRENT_PLATFORM="claude"; SKILL_DIR="$HOME/.claude/skills"
+elif which cbc >/dev/null 2>&1; then
+  CURRENT_PLATFORM="codebuddy"; SKILL_DIR="$HOME/.cbc/skills"
+else
+  CURRENT_PLATFORM="unknown"
+fi
+if [ -d "$SKILL_DIR/playwright-cli" ] || ls "$SKILL_DIR"/playwright* 2>/dev/null | grep -q .; then
+  echo "SKILL_EXISTS"
+else
+  echo "SKILL_MISSING"
+fi
+```
+If `SKILL_MISSING`: run `playwright-cli install --skills`. If current platform is NOT claude, copy installed skill from `$HOME/.claude/skills/playwright-cli` to `$SKILL_DIR/playwright-cli`.
+0d. Read the installed playwright-cli skill (SKILL.md) for workflow guidance. Use its recommended patterns to construct your verification flow.
 **Step 1 — Start Dev Server**:
 You know this project's tech stack. Detect and start the dev server yourself:
@@ -294,9 +337,7 @@ You know this project's tech stack. Detect and start the dev server yourself:
 1. Identify the dev server start command from project config (`package.json` scripts, `Makefile`, `docker-compose.yml`, etc.)
 2. **Detect the dev server port** — use the pre-detected port from pipeline if available, otherwise extract from project config. Do NOT hardcode or guess the port:
    ```bash
-   # Use pipeline-injected port if available, otherwise extract from package.json
    DEV_PORT={{DEV_PORT}}
-   # If DEV_PORT is still a placeholder, detect at runtime:
    if [ "$DEV_PORT" = "{{DEV_PORT}}" ]; then
      DEV_PORT=$(node -e "const s=require('./package.json').scripts.dev; const m=s.match(/-p\s+(\d+)/); console.log(m?m[1]:'')")
      if [ -z "$DEV_PORT" ]; then
@@ -323,14 +364,14 @@ You know this project's tech stack. Detect and start the dev server yourself:
 Use `playwright-cli snapshot` on the running app to discover actual element refs, then verify these goals:
    {{BROWSER_VERIFY_STEPS}}
-   Decide the concrete playwright-cli actions (click, fill, assert, etc.) yourself based on the snapshot output and your knowledge of the implemented code. The goals above describe WHAT to verify — you determine HOW.
-Take a final screenshot for evidence.
+Construct your verification workflow based on: (1) the playwright-cli skill documentation, (2) the `--help` output, (3) the current task's acceptance criteria. Decide the concrete playwright-cli actions yourself. Take a final screenshot: `playwright-cli screenshot`.
 **Step 3 — Cleanup (REQUIRED — you started it, you stop it)**:
-1. Kill the dev server process: `kill $DEV_SERVER_PID 2>/dev/null || true`
-2. Verify port is released: `lsof -ti:$DEV_PORT | xargs kill -9 2>/dev/null || true`
+1. Close the playwright-cli browser: `playwright-cli close`
+2. Kill the dev server process: `kill $DEV_SERVER_PID 2>/dev/null || true`
+3. Verify port is released: `lsof -ti:$DEV_PORT | xargs kill -9 2>/dev/null || true`
 **Step 4 — Reporting**:
@@ -339,10 +380,12 @@ Append results to `context-snapshot.md`:
    ## Browser Verification
    URL: http://localhost:$DEV_PORT
    Dev Server Command: <actual command used>
-   Steps executed: [list]
+   playwright-cli version: <version>
+   Steps executed: [list of playwright-cli commands used]
    Screenshot: [path]
    Result: PASS / FAIL (reason)
    Server cleanup: confirmed
+   Browser cleanup: confirmed
    ```
 If verification fails, log the failure details but continue to commit. Failures do NOT block the commit, but you MUST attempt verification and MUST clean up the dev server.

package/bundled/dev-pipeline/templates/bootstrap-tier3.md CHANGED Viewed

@@ -359,6 +359,49 @@ If GATE:MISSING — send message to Reviewer (re-spawn if needed): "Write review
 You MUST execute this phase. Do NOT skip it. Do NOT mark it as completed without actually running playwright-cli.
+**CRITICAL CONSTRAINT — playwright-cli ONLY, NO Playwright MCP**:
+- You MUST use `playwright-cli` (the CLI tool) for ALL browser interactions in this phase
+- **NEVER** use Playwright MCP server, Playwright MCP tools, or any MCP-based browser automation
+- If you have Playwright MCP configured, IGNORE it entirely — use the CLI command `playwright-cli` exclusively
+- All browser actions go through `playwright-cli <command>` in the Bash tool, not through any MCP tool call
+**Step 0 — Playwright CLI Readiness Check (BLOCKING — must pass before any browser action)**:
+0a. Check if `playwright-cli` is installed:
+```bash
+which playwright-cli 2>/dev/null && playwright-cli --version 2>/dev/null || echo "NOT_INSTALLED"
+```
+If output is `NOT_INSTALLED`, install it:
+```bash
+npm install -g @playwright/cli@latest
+```
+Then verify installation succeeded: `playwright-cli --version`. If installation fails, log `## Browser Verification: SKIPPED — playwright-cli installation failed` in context-snapshot.md and proceed to the next phase.
+0b. Learn playwright-cli usage (run once per session):
+```bash
+playwright-cli --help
+```
+0c. Check if playwright-cli skill is installed for the current AI platform:
+```bash
+CURRENT_PLATFORM=""
+if which claude >/dev/null 2>&1; then
+  CURRENT_PLATFORM="claude"; SKILL_DIR="$HOME/.claude/skills"
+elif which cbc >/dev/null 2>&1; then
+  CURRENT_PLATFORM="codebuddy"; SKILL_DIR="$HOME/.cbc/skills"
+else
+  CURRENT_PLATFORM="unknown"
+fi
+if [ -d "$SKILL_DIR/playwright-cli" ] || ls "$SKILL_DIR"/playwright* 2>/dev/null | grep -q .; then
+  echo "SKILL_EXISTS"
+else
+  echo "SKILL_MISSING"
+fi
+```
+If `SKILL_MISSING`: run `playwright-cli install --skills`. If current platform is NOT claude, copy installed skill from `$HOME/.claude/skills/playwright-cli` to `$SKILL_DIR/playwright-cli`.
+0d. Read the installed playwright-cli skill (SKILL.md) for workflow guidance. Use its recommended patterns to construct your verification flow.
 **Step 1 — Start Dev Server**:
 You know this project's tech stack. Detect and start the dev server yourself:
@@ -366,9 +409,7 @@ You know this project's tech stack. Detect and start the dev server yourself:
 1. Identify the dev server start command from project config (`package.json` scripts, `Makefile`, `docker-compose.yml`, etc.)
 2. **Detect the dev server port** — use the pre-detected port from pipeline if available, otherwise extract from project config. Do NOT hardcode or guess the port:
    ```bash
-   # Use pipeline-injected port if available, otherwise extract from package.json
    DEV_PORT={{DEV_PORT}}
-   # If DEV_PORT is still a placeholder, detect at runtime:
    if [ "$DEV_PORT" = "{{DEV_PORT}}" ]; then
      DEV_PORT=$(node -e "const s=require('./package.json').scripts.dev; const m=s.match(/-p\s+(\d+)/); console.log(m?m[1]:'')")
      if [ -z "$DEV_PORT" ]; then
@@ -395,14 +436,14 @@ You know this project's tech stack. Detect and start the dev server yourself:
 Use `playwright-cli snapshot` on the running app to discover actual element refs, then verify these goals:
    {{BROWSER_VERIFY_STEPS}}
-   Decide the concrete playwright-cli actions (click, fill, assert, etc.) yourself based on the snapshot output and your knowledge of the implemented code. The goals above describe WHAT to verify — you determine HOW.
-Take a final screenshot for evidence.
+Construct your verification workflow based on: (1) the playwright-cli skill documentation, (2) the `--help` output, (3) the current task's acceptance criteria. Decide the concrete playwright-cli actions yourself. Take a final screenshot: `playwright-cli screenshot`.
 **Step 3 — Cleanup (REQUIRED — you started it, you stop it)**:
-1. Kill the dev server process: `kill $DEV_SERVER_PID 2>/dev/null || true`
-2. Verify port is released: `lsof -ti:$DEV_PORT | xargs kill -9 2>/dev/null || true`
+1. Close the playwright-cli browser: `playwright-cli close`
+2. Kill the dev server process: `kill $DEV_SERVER_PID 2>/dev/null || true`
+3. Verify port is released: `lsof -ti:$DEV_PORT | xargs kill -9 2>/dev/null || true`
 **Step 4 — Reporting**:
@@ -411,10 +452,12 @@ Append results to `context-snapshot.md`:
    ## Browser Verification
    URL: http://localhost:$DEV_PORT
    Dev Server Command: <actual command used>
-   Steps executed: [list]
+   playwright-cli version: <version>
+   Steps executed: [list of playwright-cli commands used]
    Screenshot: [path]
    Result: PASS / FAIL (reason)
    Server cleanup: confirmed
+   Browser cleanup: confirmed
    ```
 If verification fails, log the failure details but continue to commit. Failures do NOT block the commit, but you MUST attempt verification and MUST clean up the dev server.

package/bundled/dev-pipeline/templates/sections/context-budget-rules.md CHANGED Viewed

@@ -11,3 +11,23 @@ You are running in **headless non-interactive mode** with a FINITE context windo
 5. **Minimize tool output** — Never load full command output into context. First capture to a temp file (`cmd 2>&1 | tee /tmp/out.txt | tail -20`), then scan the head/tail to identify relevant fields, and use targeted filtering (`grep`, `sed`, `awk`) to extract only the information needed for the current task. Only read the filtered result — never the raw full output.
 6. **No intermediate commits** — Do NOT run `git add`/`git commit` during implementation phases. All changes are committed once at the end via `/prizmkit-committer`.
 7. **Capture test output once** — When running test suites, always use `$TEST_CMD 2>&1 | tee /tmp/test-out.txt | tail -20`. Then grep `/tmp/test-out.txt` for details. Never re-run the suite just to apply a different filter.
+8. **Scaffold / generated file awareness (CRITICAL)** — When you run a scaffolding tool or package manager init command (`npm init`, `npx create-*`, `vite create`, `cargo init`, `go mod init`, `rails new`, `django-admin startproject`, `npx shadcn-ui init`, etc.), the output files are **generated boilerplate**. You MUST:
+   - Identify and mentally tag all files created by the tool as "scaffold files"
+   - Record the list of scaffold-generated files in context-snapshot.md under a `### Scaffold Files (do not re-read)` section
+   - **NEVER re-read scaffold files** after initial creation. Their content is standard boilerplate — you already know what they contain from the tool that generated them
+   - If you need to modify a scaffold file, make the edit directly without reading it first (you know the standard template content)
+   - This applies equally to `node_modules/`, `package-lock.json`, generated config files (`tsconfig.json`, `vite.config.ts`, `tailwind.config.js`, `.eslintrc`, etc.) produced by init commands
+   - When passing context to subagents, explicitly tell them which files are scaffold-generated so they skip reading them too
+9. **Package version verification (HARD CONSTRAINT — BLOCKING)** — Before writing ANY dependency version in `package.json`, `requirements.txt`, `Cargo.toml`, `go.mod`, `Gemfile`, `pyproject.toml`, or any other dependency manifest:
+   - You MUST verify the real version exists by querying the package registry first:
+     - npm/Node.js: `npm view <package> dist-tags.latest 2>/dev/null`
+     - Python/pip: `pip index versions <package> 2>/dev/null | head -1`
+     - Go: `go list -m -versions <module>@latest 2>/dev/null`
+     - Rust: `cargo search <crate> --limit 1 2>/dev/null`
+   - **NEVER guess or hallucinate version numbers**. If you cannot verify a version, use `"latest"` or `"*"` as a placeholder, or omit the version constraint entirely and let the package manager resolve it
+   - If the registry query fails (network issue, package not found), you MUST either:
+     (a) Use a known-safe version you have high confidence in, OR
+     (b) Skip that dependency and document it as a manual step, OR
+     (c) Use no version constraint (e.g., `"express": "*"`)
+   - **This is a BLOCKING gate**: do NOT run `npm install` / `pip install` / `cargo build` / `go mod tidy` until ALL versions in the manifest have been verified or use open constraints
+   - Batch version lookups: query multiple packages in parallel to save time (e.g., run multiple `npm view` commands concurrently)

package/bundled/dev-pipeline/templates/sections/phase-browser-verification.md CHANGED Viewed

@@ -2,6 +2,77 @@
 You MUST execute this phase. Do NOT skip it. Do NOT mark it as completed without actually running playwright-cli.
+**CRITICAL CONSTRAINT — playwright-cli ONLY, NO Playwright MCP**:
+- You MUST use `playwright-cli` (the CLI tool) for ALL browser interactions in this phase
+- **NEVER** use Playwright MCP server, Playwright MCP tools, or any MCP-based browser automation
+- If you have Playwright MCP configured, IGNORE it entirely — use the CLI command `playwright-cli` exclusively
+- All browser actions go through `playwright-cli <command>` in the Bash tool, not through any MCP tool call
+**Step 0 — Playwright CLI Readiness Check (BLOCKING — must pass before any browser action)**:
+0a. Check if `playwright-cli` is installed:
+```bash
+which playwright-cli 2>/dev/null && playwright-cli --version 2>/dev/null || echo "NOT_INSTALLED"
+```
+If output is `NOT_INSTALLED`, install it:
+```bash
+npm install -g @playwright/cli@latest
+```
+Then verify installation succeeded:
+```bash
+playwright-cli --version
+```
+If installation fails, log the error in context-snapshot.md under `## Browser Verification: SKIPPED — playwright-cli installation failed` and proceed to the next phase. Do NOT attempt browser verification without playwright-cli.
+0b. Learn playwright-cli usage (run once per session to understand available commands):
+```bash
+playwright-cli --help
+```
+Use this output to determine the correct commands for your verification steps. Do NOT guess command syntax — refer to the help output.
+0c. Check if playwright-cli skill is installed for the current AI platform:
+```bash
+# Detect AI CLI platform
+CURRENT_PLATFORM=""
+if which claude >/dev/null 2>&1; then
+  CURRENT_PLATFORM="claude"
+  SKILL_DIR="$HOME/.claude/skills"
+elif which cbc >/dev/null 2>&1; then
+  CURRENT_PLATFORM="codebuddy"
+  SKILL_DIR="$HOME/.cbc/skills"
+else
+  # Try to detect from environment or config
+  CURRENT_PLATFORM="unknown"
+fi
+# Check if playwright-cli skill exists
+if [ -d "$SKILL_DIR/playwright-cli" ] || ls "$SKILL_DIR"/playwright* 2>/dev/null | grep -q .; then
+  echo "SKILL_EXISTS"
+else
+  echo "SKILL_MISSING"
+fi
+```
+If `SKILL_MISSING`:
+```bash
+# Install playwright-cli skills (defaults to claude platform)
+playwright-cli install --skills
+```
+If the current platform is NOT claude, move the installed skill files to the correct location:
+```bash
+# Skills are installed to claude's default location — move to current platform's skill dir
+if [ "$CURRENT_PLATFORM" != "claude" ] && [ "$CURRENT_PLATFORM" != "unknown" ]; then
+  CLAUDE_SKILL_DIR="$HOME/.claude/skills"
+  if [ -d "$CLAUDE_SKILL_DIR/playwright-cli" ]; then
+    mkdir -p "$SKILL_DIR"
+    cp -r "$CLAUDE_SKILL_DIR/playwright-cli" "$SKILL_DIR/"
+    echo "Moved playwright-cli skill from claude to $CURRENT_PLATFORM"
+  fi
+fi
+```
+0d. Read the installed playwright-cli skill for workflow guidance:
+After skill installation, read the skill's SKILL.md to understand recommended workflows and patterns. Use these patterns to construct your verification flow — do NOT invent your own patterns if the skill provides them.
 **Step 1 — Start Dev Server**:
 You know this project's tech stack. Detect and start the dev server yourself:
@@ -39,14 +110,20 @@ You know this project's tech stack. Detect and start the dev server yourself:
 Use `playwright-cli snapshot` on the running app to discover actual element refs, then verify these goals:
 {{BROWSER_VERIFY_STEPS}}
-Decide the concrete playwright-cli actions (click, fill, assert, etc.) yourself based on the snapshot output and your knowledge of the implemented code. The goals above describe WHAT to verify — you determine HOW.
+Construct your verification workflow based on:
+1. The playwright-cli skill documentation (read in Step 0d)
+2. The `playwright-cli --help` output (captured in Step 0b)
+3. The current task's acceptance criteria and implemented features
+Decide the concrete playwright-cli actions (click, fill, snapshot, screenshot, etc.) yourself based on the snapshot output and your knowledge of the implemented code. The goals above describe WHAT to verify — you determine HOW using playwright-cli commands.
-Take a final screenshot for evidence.
+Take a final screenshot for evidence: `playwright-cli screenshot`
 **Step 3 — Cleanup (REQUIRED — you started it, you stop it)**:
-1. Kill the dev server process: `kill $DEV_SERVER_PID 2>/dev/null || true`
-2. Verify port is released: `lsof -ti:$DEV_PORT | xargs kill -9 2>/dev/null || true`
+1. Close the playwright-cli browser: `playwright-cli close`
+2. Kill the dev server process: `kill $DEV_SERVER_PID 2>/dev/null || true`
+3. Verify port is released: `lsof -ti:$DEV_PORT | xargs kill -9 2>/dev/null || true`
 **Step 4 — Reporting**:
@@ -55,10 +132,12 @@ Append results to `context-snapshot.md`:
 ## Browser Verification
 URL: http://localhost:$DEV_PORT
 Dev Server Command: <actual command used>
-Steps executed: [list]
+playwright-cli version: <version>
+Steps executed: [list of playwright-cli commands used]
 Screenshot: [path]
 Result: PASS / FAIL (reason)
 Server cleanup: confirmed
+Browser cleanup: confirmed
 ```
 If verification fails, log the failure details but continue to commit. Failures do NOT block the commit, but you MUST attempt verification and MUST clean up the dev server.

package/bundled/dev-pipeline/templates/sections/phase-implement-agent.md CHANGED Viewed

@@ -2,6 +2,13 @@
 **Build artifacts rule** (passed to Dev): After any build/compile command (`go build`, `npm run build`, `tsc`, etc.), ensure the output binary or build directory is in `.gitignore`. Never commit compiled binaries, build output, or generated artifacts.
+**Dependency version gate (BLOCKING — pass to Dev agent)**: Before running ANY package install command (`npm install`, `pip install`, `cargo build`, `go mod tidy`, `bundle install`, etc.):
+1. Every version number in the dependency manifest MUST be verified against the real registry (see Context Budget Rules §9)
+2. If a scaffold tool generated a `package.json` / `requirements.txt` / etc., verify the versions it wrote too — scaffold tools can emit outdated versions
+3. Do NOT proceed with install until all versions are confirmed real. Violation = wasted timeout cycles that can crash the session
+**Scaffold file rule (pass to Dev agent)**: After running any init/scaffold command, record generated files in context-snapshot.md under `### Scaffold Files (do not re-read)`. Never re-read these files — their content is standard boilerplate (see Context Budget Rules §8). When spawning subagents, explicitly list scaffold files so they skip reading them.
 **Spawn Agent**:
 | Parameter | Value |
 |-----------|-------|

package/bundled/dev-pipeline/templates/sections/phase-implement-full.md CHANGED Viewed

@@ -2,6 +2,13 @@
 **Build artifacts rule** (passed to Dev): After any build/compile command (`go build`, `npm run build`, `tsc`, etc.), ensure the output binary or build directory is in `.gitignore`. Never commit compiled binaries, build output, or generated artifacts.
+**Dependency version gate (BLOCKING — pass to Dev agent)**: Before running ANY package install command (`npm install`, `pip install`, `cargo build`, `go mod tidy`, `bundle install`, etc.):
+1. Every version number in the dependency manifest MUST be verified against the real registry (see Context Budget Rules §9)
+2. If a scaffold tool generated a `package.json` / `requirements.txt` / etc., verify the versions it wrote too — scaffold tools can emit outdated versions
+3. Do NOT proceed with install until all versions are confirmed real. Violation = wasted timeout cycles that can crash the session
+**Scaffold file rule (pass to Dev agent)**: After running any init/scaffold command, record generated files in context-snapshot.md under `### Scaffold Files (do not re-read)`. Never re-read these files — their content is standard boilerplate (see Context Budget Rules §8). When spawning subagents, explicitly list scaffold files so they skip reading them.
 Before spawning Dev, check plan.md Tasks section:
 ```bash
 grep -c '^\- \[ \]' .prizmkit/specs/{{FEATURE_SLUG}}/plan.md 2>/dev/null || true

package/bundled/dev-pipeline/templates/sections/phase-implement-lite.md CHANGED Viewed

@@ -7,6 +7,13 @@ grep -q '^/binary-name$' .gitignore || echo '/binary-name' >> .gitignore
 ```
 Never commit compiled binaries, build output, or generated artifacts.
+**Dependency version gate (BLOCKING)**: Before running ANY package install command (`npm install`, `pip install`, `cargo build`, `go mod tidy`, `bundle install`, etc.):
+1. Every version number in your dependency manifest MUST be verified against the real registry (see Context Budget Rules §9)
+2. If you used a scaffold tool that generated a `package.json` / `requirements.txt` / etc., verify the versions it wrote too — scaffold tools can emit outdated versions
+3. Do NOT proceed with install until all versions are confirmed real. Violation = wasted timeout cycles
+**Scaffold file rule**: After running any init/scaffold command, record generated files in context-snapshot.md under `### Scaffold Files (do not re-read)`. Never re-read these files — their content is standard boilerplate (see Context Budget Rules §8).
 **3a.** Detect test commands and record baseline:
 You know this project's tech stack. Identify ALL test commands that apply (e.g., `go test ./...`, `npm test`, `cargo test`, `pytest`, `make test`, etc.). Record them as `TEST_CMDS`. Then record baseline:

package/bundled/skills/_metadata.json CHANGED Viewed

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.23",
+  "version": "1.1.24",
   "skills": {
     "prizm-kit": {
       "description": "Full-lifecycle dev toolkit. Covers spec-driven development, Prizm context docs, code quality, debugging, deployment, and knowledge management.",

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "prizmkit",
-  "version": "1.1.23",
+  "version": "1.1.24",
   "description": "Create a new PrizmKit-powered project with clean initialization — no framework dev files, just what you need.",
   "type": "module",
   "bin": {