qfai 1.9.2 → 1.10.0

package/assets/init/.qfai/assistant/skills/web-research/SKILL.md

@@ -20,6 +20,10 @@ QFAI Skill Body (SSOT)
 
 ## Sub-agent Delegation (MANDATORY)
 
+Follow `.qfai/assistant/constitution/shared-skill-delegation-baseline.md`.
+The sections below add only pipeline-specific detail; where they and the
+baseline overlap, the baseline governs.
+
 ### Orchestrator Protocol (MUST)
 
 - Orchestrator may only create work orders, delegate tasks, integrate outputs, and present results.
@@ -38,19 +42,33 @@ QFAI Skill Body (SSOT)
 
 ## Work Orders Summary
 
-Every major research artifact SHOULD include a `## Work Orders Summary` table:
+Every major research artifact MUST include a `## Work Orders Summary` table.
+Use the shared schema from `shared-skill-delegation-baseline.md` — including the
+`Agent instance` column, without which an author-reviewed-their-own-work
+collision cannot be detected from the evidence afterwards. Typical pipeline
+steps:
 
-| Step | Role (sub-agent) | Task title                 | Input (refs)          | Output (refs)     | Status (PASS/REVISE) |
-| ---- | ---------------- | -------------------------- | --------------------- | ----------------- | -------------------- |
-| 1    | Researcher       | Discover candidate sources | User request + config | Candidate list    | PASS/REVISE          |
-| 2    | Analyst          | Prepare research notes     | Candidate URLs        | Research notes    | PASS/REVISE          |
-| 3    | Reviewer         | Review evidence and claims | Notes + sources       | Approval decision | PASS/REVISE          |
+| Step | Role (sub-agent) | Agent instance  | Task title                 | Input (refs)          | Output (refs)     | Status (PASS/REVISE/PENDING) |
+| ---- | ---------------- | --------------- | -------------------------- | --------------------- | ----------------- | ---------------------------- |
+| 1    | Researcher       | `<instance id>` | Discover candidate sources | User request + config | Candidate list    | PASS/REVISE                  |
+| 2    | Analyst          | `<instance id>` | Prepare research notes     | Candidate URLs        | Research notes    | PASS/REVISE                  |
+| 3    | Reviewer         | `<instance id>` | Review evidence and claims | Notes + sources       | Approval decision | PASS/REVISE                  |
 
 ### Reviewer Gate (MUST)
 
-- Final completion gate MUST be performed by an independent Reviewer.
+- Final completion gate MUST be performed by an independent reviewer, as defined
+  normatively in `shared-skill-delegation-baseline.md#definition-independent-reviewer-normative`.
+  Being routed as `Reviewer` does not by itself make an agent independent: an agent
+  that drafted or edited any artifact under review is disqualified for the whole run,
+  and MUST hand the same evidence set to a non-participating reviewer instead of
+  returning `PASS`.
+- Reviewer responses use the response template in
+  `shared-skill-delegation-baseline.md#reviewer-response-template`, including the
+  REQUIRED `Authored/edited under review:` line. A response omitting that line is
+  not a valid verdict; anything other than `none` cannot be a `PASS`.
 - Reviewer checks the Drift Protocol, verifies alignment with `test-layers.md`, and treats ratios as signals, not gates.
 - Reviewer returns only `PASS` or `REVISE` with a concrete fix proposal when returning `REVISE`.
+- A gate that could not be run at all is recorded as `PENDING` in the Work Orders Summary. `PENDING` never counts as `PASS`.
 
 ## CRITICAL CONSTRAINTS (Read First)
 

package/assets/init/.qfai/waivers.yml

@@ -1,13 +1,19 @@
 version: 1
 waivers: []
-# Example:
+# Write `rule:` exactly as the finding's `code` appears in
+# `.qfai/report/validate.json` and in the CLI output — `QFAI-ATDD-112`,
+# `TDDLIST_UNKNOWN_LEVEL`, `E_TC_ORPHAN`. Do not strip the `QFAI-` prefix; the
+# stripped form is kept working only for older waiver files.
+#
+# Waivers apply to `warning` and `info` findings only. A waiver aimed at an
+# `error` is a configuration error and fails the run.
+#
+# Example — a project that deliberately ships its own `Level` vocabulary:
 # - id: WVR-20260207-01
-#   rule: COMPAT-003
+#   rule: TDDLIST_UNKNOWN_LEVEL
 #   scope:
 #     paths: [".qfai/specs/spec-0001/**"]
-#   match:
-#     dl_ids: ["DL-20260207-01"]
-#   reason: "Legacy acceptance tests are being migrated; suppress until migration completes."
+#   reason: "Level vocabulary is owned by this project; migration tracked in DL-20260207-01."
 #   expires: "2026-03-01"
 #   evidence: "delta.md#DL-20260207-01"
 #   owner: "team-foo"

package/assets/init/root/DESIGN.md

@@ -52,6 +52,12 @@ accessibility:
   motion: "respect-reduced-motion"
 ---
 
+<!-- QFAI-SAMPLE-DESIGN-MD: this is the qfai sample brand, NOT your product's brand.
+     Replace the front-matter and the body below with this product's own brand SSOT
+     (`/qfai-discussion` emits the draft), then DELETE this comment. While this comment
+     is present `qfai validate` reports QFAI-DCON-034 and /qfai-sdd Phase 0 refuses to
+     freeze the file's sha256 as the project's brand contract. -->
+
 # Brand Philosophy
 
 Acme Ledger is a calm, confident financial comparison surface. The interface

package/assets/init/root/qfai.config.yaml

@@ -18,17 +18,20 @@ validation:
   traceability:
     brMustHaveSc: true
     scMustHaveTest: true
-    testFileGlobs:
-      - tests/**/*.test.ts
-      - tests/**/*.spec.ts
-      - packages/*/tests/**/*.test.ts
-      - packages/*/tests/**/*.spec.ts
-      - src/**/*.test.ts
-      - src/**/*.spec.ts
-      - packages/*/src/**/*.test.ts
-      - packages/*/src/**/*.spec.ts
-      - features/**/*.feature
-      - packages/*/features/**/*.feature
+    # Intentionally empty: this matches the in-code default and must be set to the
+    # repository's real test layout before the SC traceability gate means anything.
+    # Seeding a language-specific list here makes the gate silently pass on every
+    # other stack. Run /qfai-configure to populate it; `qfai validate` reports
+    # QFAI-TRACE-124 while this is unset or matches zero files.
+    #
+    # Examples:
+    #   TypeScript: tests/**/*.test.ts, src/**/*.spec.ts
+    #   Python:     tests/**/test_*.py, tests/**/*_test.py
+    #   Go:         **/*_test.go
+    #   Java/Kotlin: src/test/**/*.java, src/test/**/*.kt
+    #   Rust:       tests/**/*.rs
+    #   Cucumber:   features/**/*.feature
+    testFileGlobs: []
     testFileExcludeGlobs: []
     scNoTestSeverity: error
     orphanContractsPolicy: error
@@ -40,4 +43,4 @@ prototyping:
     packPath: .qfai/evidence/calibration.yaml
   execution:
     targetUrl: null
-    browserTool: playwright-cli
+    browserTool: playwright