qfai 1.9.0 → 1.9.2

package/assets/init/.qfai/assistant/agents/requirements-analyst.md

@@ -33,6 +33,12 @@ tools: [Read, Write, Edit, Glob, Grep, Bash]
 - Option set with recommendation and rejected rationale
 - Open questions with owner, decision point, and safe deferral notes
 - Mapping from requirements to impacted artifacts
+- For UI-bearing surfaces: every entry in the UI contract `screens[]` must
+  carry at least one `primary_task` (≥ 1 primary_task per screen). The
+  shipped `ui-contract.sample.yaml` template exposes a `primary_tasks: []`
+  placeholder slot; populate it before handing the contract to the
+  prototyping phase. Empty `primary_tasks` arrays cause the
+  QFAI-AUD-001 aligned validate lane to block `/qfai-prototyping`.
 
 ## Stop conditions
 

package/assets/init/.qfai/assistant/manifest/agent-catalog.yml

@@ -366,95 +366,62 @@ agents:
       - requirements-analyst
       - oq-harvester
       - option-explorer
-    developer_instructions: >-
+    developer_instructions: |-
       ## Mission
 
-
-      - Convert discussions into testable requirements, explicit open questions,
-      and option sets with acceptance signals.
-
+      - Convert discussions into testable requirements, explicit open questions, and option sets with acceptance signals.
 
       ## Domain Responsibilities
 
-
-      - Translate stakeholder intent into requirement statements and acceptance
-      signals.
-
+      - Translate stakeholder intent into requirement statements and acceptance signals.
       - Harvest undefined decisions and maintain the OQ backlog.
-
       - Produce multiple solution options with a recommendation.
-
       - Map requirements to impacted downstream artifacts.
 
-
       ## Inputs you must read
 
-
       - .qfai/assistant/constitution/\*\*
-
       - .qfai/assistant/{manifest,catalog}/\*\*
-
       - .qfai/specs/spec-\*/09_delta.md
-
       - .qfai/discussion/discussion-\*/04_Sources.md
-
       - .qfai/discussion/discussion-\*/06_REQ.md
-
       - .qfai/discussion/discussion-\*/11_OQ-Register.md
-
       - Discussion records under `.qfai/discussion/`
 
-
       ## Deliverables
 
-
       - Requirements list with acceptance signals
-
       - Option set with recommendation and rejected rationale
-
       - Open questions with owner, decision point, and safe deferral notes
-
       - Mapping from requirements to impacted artifacts
-
+      - For UI-bearing surfaces: every entry in the UI contract `screens[]` must
+        carry at least one `primary_task` (≥ 1 primary_task per screen). The
+        shipped `ui-contract.sample.yaml` template exposes a `primary_tasks: []`
+        placeholder slot; populate it before handing the contract to the
+        prototyping phase. Empty `primary_tasks` arrays cause the
+        QFAI-AUD-001 aligned validate lane to block `/qfai-prototyping`.
 
       ## Stop conditions
 
-
-      - Governing specs, routing rules, or required source artifacts are
-      missing.
-
-      - The requested output belongs to another specialist's ownership without
-      an explicit handoff.
-
+      - Governing specs, routing rules, or required source artifacts are missing.
+      - The requested output belongs to another specialist's ownership without an explicit handoff.
       - The task would bypass required validation or reviewer gates.
 
-
       ## Sign-off
 
-
       - [ ] Deliverables are complete
-
       - [ ] Ownership boundaries were respected
-
       - [ ] Required gates and follow-up evidence are recorded
 
-
       ## When to use
 
-
       - Use when `agent-routing.yml` assigns this domain to the current phase.
-
       - Use when the task needs this specialist's owned artifacts or decisions.
 
-
       ## When not to use
 
-
-      - Do not use when the task is primarily review-only and needs a reviewer
-      instead.
-
-      - Do not use when another specialist owns the main artifact or decision
-      surface.
+      - Do not use when the task is primarily review-only and needs a reviewer instead.
+      - Do not use when another specialist owns the main artifact or decision surface.
   - id: solution-architect
     kind: worker
     domain: architecture

package/assets/init/.qfai/assistant/skills/qfai-atdd/SKILL.md

@@ -374,6 +374,27 @@ When this skill is complete, provide a final user-facing completion message and
 - Acceptance tests need fixes: rerun `/qfai-atdd`.
   Action: close uncovered `US` / `TC` / `CON-API` obligations and rerun validation.
 
+## Default Autopilot Policy
+
+The skill collapses avoidable per-session prompts to 0-1 by classifying every decision into one of three named buckets:
+
+- auto-decide:
+  - output formatting
+  - ID / sequence numbering
+  - append-vs-create on subject overlap
+  - equivalent-option pick
+- ask-user:
+  - CREATE / DELETE / SPLIT / MERGE / SUPERSEDE / UPDATE:REMOVE triage operations (each with a prompt template that names the target and rationale)
+  - destructive operations (rm / overwrite / force-push)
+  - version-pin changes (`package.json#version`, branch pin)
+  - scope expansions outside the active envelope
+- hard-required:
+  - `companyName`
+  - brand intent
+  - `primarySpecId` (when absent from inputs)
+
+A skill MAY narrow the auto-decide bucket (drop entries) but MUST NOT widen it. Widening triggers a Reviewer-Gate finding.
+
 project_memory:
 
 - Coverage obligations stay layer-pinned: tests/e2e/** must cover all required US; tests/integration/** all required TC; tests/api/\*\* all required CON-API.

package/assets/init/.qfai/assistant/skills/qfai-configure/SKILL.md

@@ -444,6 +444,27 @@ When this skill is complete, provide a final user-facing completion message and
 - Configuration needs refinement: rerun `/qfai-configure`.
   Action: provide additional include/exclude evidence and update `qfai.config.yaml`.
 
+## Default Autopilot Policy
+
+The skill collapses avoidable per-session prompts to 0-1 by classifying every decision into one of three named buckets:
+
+- auto-decide:
+  - output formatting
+  - ID / sequence numbering
+  - append-vs-create on subject overlap
+  - equivalent-option pick
+- ask-user:
+  - CREATE / DELETE / SPLIT / MERGE / SUPERSEDE / UPDATE:REMOVE triage operations (each with a prompt template that names the target and rationale)
+  - destructive operations (rm / overwrite / force-push)
+  - version-pin changes (`package.json#version`, branch pin)
+  - scope expansions outside the active envelope
+- hard-required:
+  - `companyName`
+  - brand intent
+  - `primarySpecId` (when absent from inputs)
+
+A skill MAY narrow the auto-decide bucket (drop entries) but MUST NOT widen it. Widening triggers a Reviewer-Gate finding.
+
 project_memory:
 
 - qfai-configure is the user-facing entrypoint for editing `qfai.config.yaml` and the `.qfai/assistant/manifest/` declarative manifests; edits to those files MUST go through this skill so the agent-catalog / agent-routing / review-profiles SSOTs stay consistent.

package/assets/init/.qfai/assistant/skills/qfai-discussion/SKILL.md

@@ -36,6 +36,7 @@ Produce a unified 15-file discussion pack plus exploration-first UI sidecars so
 - UI-bearing discussion packs may include `prototyping.yaml` as an optional recommendation artifact; non-ui discussion packs typically omit it.
 - Completion requires `Disposition: open` count to be zero in `11_OQ-Register.md`.
 - If UI requirements exist, behavior obligations are primary and HTML+CSS mock is optional fallback only.
+- When an HTML+CSS mock includes links, author them in anchor-form (`<a href="#name">`); external `http(s)://` links are also allowed. Do NOT use same-origin absolute paths (`/orders/`) — a static mock cannot serve them and the validator rejects them (QFAI-MOCK-010).
 - Discussion is planner-first: do not select a single visual winner and do not finalize the design system here.
 - Use artifact files, not conversational summaries, as the downstream handoff.
 
@@ -121,6 +122,27 @@ You MUST end the user-facing output with a handoff sentence to `/qfai-sdd` in th
 - Japanese output (use this exact sentence):
   ディスカッションが完了しました。他に要望などがあればご提示ください。問題なければ『/qfai-sdd』と入力してください。
 
+## Default Autopilot Policy
+
+The skill collapses avoidable per-session prompts to 0-1 by classifying every decision into one of three named buckets:
+
+- auto-decide:
+  - output formatting
+  - ID / sequence numbering
+  - append-vs-create on subject overlap
+  - equivalent-option pick
+- ask-user:
+  - CREATE / DELETE / SPLIT / MERGE / SUPERSEDE / UPDATE:REMOVE triage operations (each with a prompt template that names the target and rationale)
+  - destructive operations (rm / overwrite / force-push)
+  - version-pin changes (`package.json#version`, branch pin)
+  - scope expansions outside the active envelope
+- hard-required:
+  - `companyName`
+  - brand intent
+  - `primarySpecId` (when absent from inputs)
+
+A skill MAY narrow the auto-decide bucket (drop entries) but MUST NOT widen it. Widening triggers a Reviewer-Gate finding.
+
 project_memory:
 
 - 15-file mandatory output set is fixed; the UI-bearing sidecar family (40_screen_contracts.md + 50_review_input_bundle.md + root DESIGN.md) is required only when the target is UI-bearing.

package/assets/init/.qfai/assistant/skills/qfai-discussion/templates/03_Story-Workshop.md

@@ -75,12 +75,15 @@ Screen-level contract details are finalized in `uiux/40_screen_contracts.md`. Pr
 <!-- Optional fallback only — do not use as the primary UI definition artifact.
      Include only when it materially clarifies the selected anchor.
      Behavior Obligations and sidecar artifacts (uiux/) are the primary UI definitions.
-     The required state SSOT is uiux/40_screen_contracts.md (`default/loading/empty/error`). -->
+     The required state SSOT is uiux/40_screen_contracts.md (`default/loading/empty/error`).
+     Links MUST be anchor-form (`<a href="#name">`) — never same-origin absolute
+     paths (`/orders/`), which a static mock cannot serve and which the validator rejects. -->
 
 ```html
 <section class="screen-mock">
   <h1>Screen Title</h1>
   <p>Primary information shown to the user.</p>
+  <a href="#orders">View Orders</a>
   <button type="button">Primary Action</button>
 </section>
 ```

package/assets/init/.qfai/assistant/skills/qfai-implement/SKILL.md

@@ -349,6 +349,27 @@ When this skill is complete, provide a final user-facing completion message and
 - Acceptance tests: `/qfai-atdd`.
   Action: ensure acceptance test coverage aligns with implementation.
 
+## Default Autopilot Policy
+
+The skill collapses avoidable per-session prompts to 0-1 by classifying every decision into one of three named buckets:
+
+- auto-decide:
+  - output formatting
+  - ID / sequence numbering
+  - append-vs-create on subject overlap
+  - equivalent-option pick
+- ask-user:
+  - CREATE / DELETE / SPLIT / MERGE / SUPERSEDE / UPDATE:REMOVE triage operations (each with a prompt template that names the target and rationale)
+  - destructive operations (rm / overwrite / force-push)
+  - version-pin changes (`package.json#version`, branch pin)
+  - scope expansions outside the active envelope
+- hard-required:
+  - `companyName`
+  - brand intent
+  - `primarySpecId` (when absent from inputs)
+
+A skill MAY narrow the auto-decide bucket (drop entries) but MUST NOT widen it. Widening triggers a Reviewer-Gate finding.
+
 project_memory:
 
 - One TDD item at a time from test-list.md; status lifecycle is forward-only (todo → red → green → refactor → done); exception requires DR-ID.

package/assets/init/.qfai/assistant/skills/qfai-prototyping/SKILL.md

@@ -15,14 +15,11 @@ mode: execution-focused
 
 This skill is static-first and file-based by default: it runs every
 UI-bearing spec resolved at cycle 0 through up to 10 iterations against
-a frozen brand SSOT (`DESIGN.md`) and a frozen spec set, with one
-prototype lineage per `spec × screen` pair, no parallel candidates
-within a pair, no mode, and a fixed 10-cycle budget. Visual identity
-is fixed for the whole run; every cycle improves information
-architecture, navigation flow, usability, and functionality. Supported
-UI prototyping surfaces are: web, mobile, desktop, mixed. cli is not a
-prototyping execution target and is rejected. ui_bearing: false specs
-are not prototyping execution targets and are excluded.
+a frozen brand SSOT (`DESIGN.md`) and a frozen spec set, one lineage per
+`spec × screen` pair, no parallel candidates, no mode, fixed 10-cycle
+budget. Supported surfaces: web, mobile, desktop, mixed. cli surface is
+rejected and `ui_bearing: false` specs are excluded from prototyping
+execution.
 
 ## Goal
 
@@ -58,23 +55,13 @@ current `DESIGN.md` hash does not match the lock.
 
 ### Step 2-A — Verify Contract Preconditions
 
-- The skill resolves **every UI-bearing spec in the consumer project in
-  one invocation** via `resolveSurfaceUnion()`
-  (`core/prototyping/specResolution.ts`) — the same resolver the
-  cycle ≥ 1 drift gate and `show-spec`'s live scope consume, so the
-  scope you read here is apples-to-apples with what iterate enforces
-  downstream. `resolveSurfaceUnion()` internally composes
-  `resolveAllUiBearingSpecs()` (the strict `surface_type: ui-bearing`
-  frontmatter signal + the matching `.qfai/contracts/ui/<spec-id>*.yaml`
-  contract fallback) and folds in the legacy `# … prototyping …`
-  title-marker fallback and the operator-pinned spec id from the
-  `qfai.config.yaml` `prototyping` section (run
-  `qfai doctor --profile prototyping` to surface the resolved value).
-  Operators authoring CHG-002-shaped projects can rely on the strict
-  frontmatter alone; the broader composition covers legacy /
-  config-pinned consumers.
-  The operator is never prompted to pick a single spec; zero
-  UI-bearing specs at cycle 0 is a deterministic no-op exit `0`.
+- The skill resolves **every UI-bearing spec in one invocation** via
+  `resolveAllUiBearingSpecs()` (`core/prototyping/specResolution.ts`):
+  strict `surface_type: ui-bearing` frontmatter + matching
+  `.qfai/contracts/ui/<spec-id>*.yaml`, with legacy title-marker and
+  `qfai.config.yaml` `prototyping` pinning folded in. Run
+  `qfai doctor --profile prototyping` to surface the resolved value.
+  Zero UI-bearing specs at cycle 0 is a deterministic no-op exit `0`.
   Confirm each resolved spec has a supported `surface`.
 - Confirm root `DESIGN.md` and `.qfai/contracts/design/DESIGN.md.lock.yaml`
   both exist; confirm `.qfai/contracts/ui/*.yaml` exists.
@@ -85,8 +72,29 @@ current `DESIGN.md` hash does not match the lock.
 ### Step 2-B — Verify Environment Preconditions
 
 - Confirm a capture route exists for each declared screen.
-- Use `npx --no-install playwright-cli` or
-  `node_modules/.bin/playwright-cli` when PATH reachability is uncertain.
+- Canonical launcher: `npx --no-install playwright` or
+  `node_modules/.bin/playwright` when PATH reachability is uncertain.
+- Legacy fallback (deprecation window only, emits
+  `D-DEPRECATED-PROBE` and will be removed in a future minor release):
+  `npx --no-install playwright-cli` or `node_modules/.bin/playwright-cli`.
+
+### Step 2-B.1 — Opt-in iterate flags
+
+Three flags extend `qfai prototyping iterate`; all default OFF so the
+prior invocation pattern is byte-equivalent when no flag is passed:
+
+- `--capture` — enable PNG / HTML capture per screen each cycle via
+  the default Playwright runner (dynamic `import("playwright")`;
+  Playwright is `optionalDependencies`). Use for durable pixel / DOM
+  evidence; skip for fast prose-only cycles.
+- `--auto-serve` — start an in-process `node:http` server rooted at
+  the prototype tree for the cycle. SIGINT teardown <= 2 s;
+  EADDRINUSE on a foreign owner exits 2 (no foreign-process kill).
+  Use when no external dev server is running.
+- `--check-convergence` — read-only peek of `prototyping.json`.
+  Exits `0` when converged (`stopReason === "axes-exceptional"` with
+  `acceptedIterationIndex` set), exits `2` otherwise. No writes,
+  no Playwright launches. Use at cycle 9 before recovery.
 
 ### Step 2-C — Run the Loop
 
@@ -113,41 +121,38 @@ covers `frozenSurfaceUnion` / `frozenLicenseCatalog` drift on cycle ≥ 1).
 `prototyping.json` violates the cycle-0 frozen license catalog. The
 verifier rejects five distinct error codes:
 
-- `license-not-allowlisted` — `source` is not in
-  `frozenLicenseCatalog.allowedSources`
-- `license-tier-unknown` — `license` is not in
-  `frozenLicenseCatalog.licenseTiers[source]`
+- `license-not-allowlisted` — `source` not in `allowedSources`
+- `license-tier-unknown` — `license` not in `licenseTiers[source]`
 - `license-non-https-url` — `url` is not HTTPS
-- `license-host-mismatch` — the URL host is not in
-  `frozenLicenseCatalog.sourceHosts[source]`
-- `license-missing-attribution` — `attribution` is undefined / empty /
-  whitespace-only
+- `license-host-mismatch` — URL host not in `sourceHosts[source]`
+- `license-missing-attribution` — `attribution` empty / whitespace
 
 Recovery path (no in-loop retry — the verifier is fail-closed):
 
-1. Inspect `prototyping.json#frozenLicenseCatalog` to see the frozen
+1. Inspect `prototyping.json#frozenLicenseCatalog` for the frozen
    `allowedSources` / `licenseTiers` / `sourceHosts`.
 2. Edit the offending `imageSources[]` entry to use an allowlisted
-   source / known license tier / HTTPS URL / matching host / non-empty
-   attribution. **Do not** edit `frozenLicenseCatalog` mid-loop — that
-   triggers a separate exit-2 lock-drift class.
-3. If the legitimate fix requires a different allowlist (e.g. adding a
-   new source), the only path is to refreeze the catalog by restarting
-   from cycle 0 (`qfai prototyping iterate --cycle 0 --target-url <url>`)
-   with the updated stock-photo configuration.
+   source / known tier / HTTPS URL / matching host / non-empty
+   attribution. **Do not** edit `frozenLicenseCatalog` mid-loop
+   (separate exit-2 lock-drift class).
+3. To change the allowlist, refreeze the catalog by restarting from
+   cycle 0 with the updated stock-photo configuration.
 
 ### Cycle 9 budget exhaustion
 
-If convergence is not reached at iter-09, the certify gate will reject
-the run — H handoff artifacts (final mirror, `design-system.yaml`,
-`prototype-handoff.yaml`) and the `validate` / `/qfai-verify` gates can
-still be written / executed for inspection, but
-`qfai prototyping certify --check` will exit non-zero and prevent DONE.
-The recovery path is to restart from cycle 0: review `DESIGN.md`, the
-pivot strategy in `references/reviewer-prompt.md`, and the latest
-`review.json` findings, then re-run `qfai prototyping iterate
---cycle 0 --target-url <url>` to refreeze the loop. Do not seal a
-completion certificate against an unconverged iter-09.
+If convergence is not reached at iter-09, certify rejects the run; H
+handoff artifacts and `validate` / `/qfai-verify` can still execute for
+inspection, but `qfai prototyping certify --check` will exit non-zero
+and prevent DONE.
+
+Use `qfai prototyping iterate --cycle 9 --check-convergence` for a
+read-only peek of `prototyping.json` before refreezing: exit `0`
+confirms convergence (no recovery needed), exit `2` confirms the run
+did not converge. Recovery: review `DESIGN.md`, the pivot strategy
+in `references/reviewer-prompt.md`, and the latest `review.json`
+findings, then re-run `qfai prototyping iterate --cycle 0
+--target-url <url>` to refreeze. Do not seal a certificate against
+an unconverged iter-09.
 
 ## Evaluator Inputs (Mandatory)
 
@@ -163,8 +168,8 @@ completion certificate against an unconverged iter-09.
   latest iter is always accepted.
 - `DESIGN.md` is frozen for the run; to change it, edit + rerun
   `/qfai-sdd` to refreeze + start cycle 0.
-- Token-only colors / fonts / radii / shadows — non-DESIGN.md hex / rgb /
-  rgba / hsl / font / radius / shadow values are recorded in
+- Token-only colors / fonts / radii / shadows — non-DESIGN.md hex /
+  rgb / rgba / hsl / font / radius / shadow values land in
   `designMdViolations[]` and block exit 64.
 - DONE only when `qfai prototyping certify --check` returns 0.
 - No `mode / round / polish / branch / concept-fit` artifacts.
@@ -196,6 +201,27 @@ Follow `.qfai/assistant/constitution/shared-skill-operating-baseline.md#gate-fai
 
 - `/qfai-atdd` / `/qfai-implement` / `/qfai-verify`
 
+## Default Autopilot Policy
+
+The skill collapses avoidable per-session prompts to 0-1 by classifying every decision into one of three named buckets:
+
+- auto-decide:
+  - output formatting
+  - ID / sequence numbering
+  - append-vs-create on subject overlap
+  - equivalent-option pick
+- ask-user:
+  - CREATE / DELETE / SPLIT / MERGE / SUPERSEDE / UPDATE:REMOVE triage operations (each with a prompt template that names the target and rationale)
+  - destructive operations (rm / overwrite / force-push)
+  - version-pin changes (`package.json#version`, branch pin)
+  - scope expansions outside the active envelope
+- hard-required:
+  - `companyName`
+  - brand intent
+  - `primarySpecId` (when absent from inputs)
+
+A skill MAY narrow the auto-decide bucket (drop entries) but MUST NOT widen it. Widening triggers a Reviewer-Gate finding.
+
 project_memory:
 
 - Iteration count cap is 10; --cycle is 0-indexed; reaching cycle 9 on a non-converged iteration set exits 65 directly (no cycle-mismatch path).

package/assets/init/.qfai/assistant/skills/qfai-prototyping/references/evidence-requirements.md

@@ -0,0 +1,46 @@
+# Evidence Requirements: `taskFidelity` section
+
+Prototyping evidence files MUST include a `taskFidelity` section so the
+`QFAI-CRIT-009` gate passes. Below is the required keyword set and
+the canonical markdown shape consumed by the validator and the
+`qfai prototyping iterate --capture` template emitter.
+
+## Required keywords
+
+Every evidence file that records a critique iteration MUST surface
+these `taskFidelity` keys with concrete values:
+
+- `cta_visibility` — does the primary call-to-action stay on-screen and
+  visually distinct at both desktop (>= 1024px) and mobile (<= 480px)
+  viewports?
+- `four_state_check` — has the interactive flow been checked in all
+  four reachable states (default / hover / focused / disabled), with a
+  pass/fail observation per state?
+
+The SSOT for this list lives at
+`packages/qfai/src/core/validators/taskFidelityKeywords.ts`
+(`TASK_FIDELITY_REQUIRED_KEYWORDS`). The validator (`QFAI-CRIT-009`),
+the `--capture` template emitter, and this document all read from
+that constant so the keyword set cannot silently drift between the
+three surfaces.
+
+## Canonical markdown structure
+
+The validator detects the section via the literal heading
+`## taskFidelity`. The minimal accepted shape is:
+
+```markdown
+## taskFidelity
+
+- step_count: 3
+- max_primary_steps: 5
+- cta_visibility: PASS — primary CTA stays anchored at the viewport bottom on
+  desktop (1440px) and remains tappable on mobile (375px).
+- four_state_check: PASS — default / hover / focused / disabled states each
+  render the expected variant; disabled is non-interactive.
+```
+
+Authors may add free-form prose between the bullets so long as each
+required keyword appears at least once. The `--capture` template emits
+a stub with TODO placeholders for every required keyword so the
+operator never silently forgets one.

package/assets/init/.qfai/assistant/skills/qfai-prototyping/references/generator-prompt.md

@@ -50,12 +50,102 @@ tokens (e.g. `bg-primary`, `text-text`, `rounded-md`, `shadow-lg`,
 
 ## Hard constraints (enforced by the compliance gate)
 
-- No `#hex`, `rgb(...)`, `rgba(...)`, `hsl(...)`, `hsla(...)` value
-  outside `DESIGN.md.visual.colors`.
-- No `font-family:` whose first token is outside
-  `DESIGN.md.visual.typography.family_*`.
-- No `border-radius:` outside `DESIGN.md.visual.radius`.
-- No `box-shadow:` outside `DESIGN.md.visual.shadow`.
+The compliance gate scans rendered HTML — `<style>` blocks, inline
+`style="..."` attributes, AND Tailwind `class="..."` attributes — for
+four categories of forbidden literals. Findings are **advisory-failing**:
+the gate blocks convergence by default, but a Reviewer can override
+when a finding is a known false positive.
+
+### 1. color literal ban
+
+No raw color literals outside `DESIGN.md.visual.colors`. The scanner
+catches every authoring path:
+
+- `#hex` (3 / 4 / 6 / 8 nibbles): e.g. `color: #ff0000`,
+  `bg-[#ff0000]`.
+- `rgb(...)` / `rgba(...)`: e.g. `background: rgb(255 0 0)`,
+  `bg-[rgb(255_0_0)]`.
+- `hsl(...)` / `hsla(...)`: e.g. `color: hsl(0 100% 50%)`.
+- CSS named-color keywords (`red`, `white`, `blue`, …) when placed
+  on a color-bearing property (`color`, `background`, `border`,
+  `outline`, `fill`, `stroke`, `caret-color`, `text-decoration`,
+  `column-rule`, and their `-color` longhands / shorthand variants).
+- Tailwind palette utilities (`bg-blue-500`, `text-slate-900`,
+  `border-red-400`, etc.) — the CDN cannot read `DESIGN.md`, so
+  every palette class is by definition drift.
+
+### 2. font-family literal ban
+
+No `font-family:` whose first family token is outside
+`DESIGN.md.visual.typography.family_sans` / `family_display` /
+`family_mono`. Authored forms caught:
+
+- Inline `font-family: Inter, sans-serif` (quoted or unquoted).
+- Tailwind arbitrary `font-[Inter]`. Numeric / named font-weight
+  arbitraries (`font-[600]`, `font-[medium]`) are weight tokens —
+  not font-family drift — and pass through.
+
+### 3. border-radius literal ban
+
+No `border-radius:` value outside `DESIGN.md.visual.radius`. Authored
+forms caught:
+
+- Inline `border-radius: 12px` / `border-radius: 0.5rem`.
+- Tailwind arbitrary `rounded-[13px]`, `rounded-[0.5rem]`.
+- Tailwind scale aliases (`rounded`, `rounded-sm`, `rounded-md`,
+  `rounded-lg`, `rounded-xl`, `rounded-2xl`, `rounded-3xl`,
+  `rounded-full`, `rounded-none`) — all resolve to Tailwind defaults,
+  not `DESIGN.md` tokens.
+
+### 4. box-shadow literal ban (including rgba color slot)
+
+No `box-shadow:` declaration outside `DESIGN.md.visual.shadow`. The
+shadow value's embedded `rgba(...)` color slot is also covered.
+Authored forms caught:
+
+- Inline `box-shadow: 0 1px 2px rgba(15,23,42,0.05)`.
+- Tailwind arbitrary `shadow-[0_4px_6px_rgba(0,0,0,0.1)]`.
+- Tailwind scale aliases (`shadow`, `shadow-sm`, `shadow-md`,
+  `shadow-lg`, `shadow-xl`, `shadow-2xl`, `shadow-inner`,
+  `shadow-none`, `drop-shadow-*`).
+
+### Safelisted CSS-wide keywords
+
+The following values are **not** treated as drift by any of the four
+scanners above — they are CSS inheritance / system keywords with no
+visual identity:
+
+- `inherit`
+- `initial`
+- `unset`
+- `revert`
+- `currentColor` (case-insensitive)
+- `transparent`
+- `none`
+- `0` (dimensionless)
+
+Authoring `font-family: inherit`, `border-radius: 0`, or
+`box-shadow: none` passes the gate even when not present in
+`DESIGN.md`.
+
+### Allowed expression forms
+
+The generator MUST express every styled surface as one of:
+
+- A Tailwind utility class whose token resolves through the
+  `tailwind.config.theme.extend.*` injection above (e.g. `bg-primary`,
+  `text-text`, `rounded-md`, `shadow-lg`, `font-display`). These
+  utilities reference `DESIGN.md` tokens by name and never carry a
+  literal in the rendered DOM.
+- A CSS custom-property reference via `var(--token-name)` where the
+  `--token-name` is declared in a `:root { ... }` block inside the
+  iter's `<style>` head. The scanner resolves the `var()` against
+  the `:root` map and re-validates the resolved value against
+  `DESIGN.md`.
+- A `theme(...)` reference to the injected Tailwind theme.
+
+### Other envelope constraints
+
 - No component library beyond Tailwind + Lucide. No external CSS, no
   design-system imports.
 - One self-contained HTML file; embedded CSS / JS minimal.

package/assets/init/.qfai/assistant/skills/qfai-sdd/SKILL.md

@@ -272,6 +272,27 @@ When this skill completes, provide a final user-facing message enumerating next
 - Spec pack needs correction: rerun `/qfai-sdd` and regenerate evidence.
 - Confirm contracts referenced by `_policies/05_Contracts.md` exist under `.qfai/contracts/**`.
 
+## Default Autopilot Policy
+
+The skill collapses avoidable per-session prompts to 0-1 by classifying every decision into one of three named buckets:
+
+- auto-decide:
+  - output formatting
+  - ID / sequence numbering
+  - append-vs-create on subject overlap
+  - equivalent-option pick
+- ask-user:
+  - CREATE / DELETE / SPLIT / MERGE / SUPERSEDE / UPDATE:REMOVE triage operations (each with a prompt template that names the target and rationale)
+  - destructive operations (rm / overwrite / force-push)
+  - version-pin changes (`package.json#version`, branch pin)
+  - scope expansions outside the active envelope
+- hard-required:
+  - `companyName`
+  - brand intent
+  - `primarySpecId` (when absent from inputs)
+
+A skill MAY narrow the auto-decide bucket (drop entries) but MUST NOT widen it. Widening triggers a Reviewer-Gate finding.
+
 project_memory:
 
 - Phase order is fixed: Stage 0 Preflight → Stage 1 Triage → Phase 0 Contracts-first → Phase 1 Outline → Phase 2 Slice → Phase 3 Plan finalize → Phase 4 Delta update; do not reorder.