qualia-framework 4.5.0 → 5.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (66) hide show
  1. package/AGENTS.md +24 -0
  2. package/CLAUDE.md +12 -75
  3. package/README.md +23 -16
  4. package/agents/builder.md +9 -21
  5. package/agents/planner.md +8 -0
  6. package/agents/verifier.md +8 -0
  7. package/agents/visual-evaluator.md +132 -0
  8. package/bin/cli.js +54 -18
  9. package/bin/install.js +369 -29
  10. package/bin/qualia-ui.js +208 -1
  11. package/bin/slop-detect.mjs +5 -0
  12. package/bin/state.js +34 -1
  13. package/docs/install-redesign-builder-prompt.md +290 -0
  14. package/docs/install-redesign-pilot.md +234 -0
  15. package/docs/playwright-loop-builder-prompt.md +185 -0
  16. package/docs/playwright-loop-design-notes.md +108 -0
  17. package/docs/playwright-loop-pilot-results.md +170 -0
  18. package/docs/playwright-loop-tester-prompt.md +213 -0
  19. package/docs/polish-loop-supervised-run.md +111 -0
  20. package/docs/reviews/matt-pocock-skills-analysis.md +300 -0
  21. package/guide.md +9 -5
  22. package/hooks/env-empty-guard.js +74 -0
  23. package/hooks/pre-compact.js +19 -9
  24. package/hooks/pre-deploy-gate.js +8 -2
  25. package/hooks/pre-push.js +26 -12
  26. package/hooks/supabase-destructive-guard.js +62 -0
  27. package/hooks/vercel-account-guard.js +91 -0
  28. package/package.json +2 -1
  29. package/rules/design-brand.md +4 -0
  30. package/rules/design-laws.md +4 -0
  31. package/rules/design-product.md +4 -0
  32. package/rules/design-rubric.md +4 -0
  33. package/rules/grounding.md +4 -0
  34. package/skills/qualia-build/SKILL.md +40 -46
  35. package/skills/qualia-discuss/SKILL.md +51 -68
  36. package/skills/qualia-handoff/SKILL.md +1 -0
  37. package/skills/qualia-hook-gen/SKILL.md +206 -0
  38. package/skills/qualia-issues/SKILL.md +151 -0
  39. package/skills/qualia-map/SKILL.md +78 -35
  40. package/skills/qualia-new/REFERENCE.md +139 -0
  41. package/skills/qualia-new/SKILL.md +45 -121
  42. package/skills/qualia-optimize/REFERENCE.md +265 -0
  43. package/skills/qualia-optimize/SKILL.md +92 -232
  44. package/skills/qualia-plan/SKILL.md +58 -65
  45. package/skills/qualia-polish-loop/REFERENCE.md +265 -0
  46. package/skills/qualia-polish-loop/SKILL.md +201 -0
  47. package/skills/qualia-polish-loop/fixtures/broken.html +117 -0
  48. package/skills/qualia-polish-loop/fixtures/clean.html +196 -0
  49. package/skills/qualia-polish-loop/scripts/loop.mjs +323 -0
  50. package/skills/qualia-polish-loop/scripts/playwright-capture.mjs +206 -0
  51. package/skills/qualia-polish-loop/scripts/score.mjs +176 -0
  52. package/skills/qualia-prd/SKILL.md +199 -0
  53. package/skills/qualia-report/SKILL.md +141 -200
  54. package/skills/qualia-research/SKILL.md +28 -33
  55. package/skills/qualia-road/SKILL.md +103 -0
  56. package/skills/qualia-ship/SKILL.md +1 -0
  57. package/skills/qualia-task/SKILL.md +1 -1
  58. package/skills/qualia-test/SKILL.md +50 -2
  59. package/skills/qualia-triage/SKILL.md +152 -0
  60. package/skills/qualia-verify/SKILL.md +63 -104
  61. package/skills/qualia-zoom/SKILL.md +51 -0
  62. package/skills/zoho-workflow/SKILL.md +1 -1
  63. package/templates/CONTEXT.md +36 -0
  64. package/templates/decisions/ADR-template.md +30 -0
  65. package/tests/bin.test.sh +598 -7
  66. package/tests/state.test.sh +58 -0
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: qualia-optimize
3
- description: "Deep optimization pass — reads .planning/ AND codebase to find performance, design, UI, backend, and frontend issues. Spawns parallel specialist agents. Use this skill whenever the user says 'optimize', 'optimization pass', 'find issues', 'qualia-optimize', 'deep optimize', 'performance audit', 'design alignment check', 'speed up', 'slow', 'bundle size', or wants a comprehensive quality sweep. Supports --perf, --ui, --backend, --alignment, --fix flags."
3
+ description: "Deep optimization pass — reads .planning/ AND codebase to find performance, design, UI, backend, frontend, AND architecture-deepening opportunities. Spawns parallel specialist agents. Use whenever the user says 'optimize', 'optimization pass', 'find issues', 'qualia-optimize', 'deep optimize', 'performance audit', 'design alignment check', 'speed up', 'slow', 'bundle size', 'refactor architecture', 'shallow modules', 'simplify', or wants a comprehensive quality sweep. Supports --perf, --ui, --backend, --alignment, --deepen, --fix flags."
4
4
  allowed-tools:
5
5
  - Bash
6
6
  - Read
@@ -13,30 +13,35 @@ allowed-tools:
13
13
 
14
14
  # Qualia Optimize — Deep Codebase + Planning Optimization
15
15
 
16
- Comprehensive optimization that reads BOTH `.planning/` docs AND the actual codebase. Never analyze one without the other.
16
+ ## Reference templates
17
+
18
+ Detailed agent-prompt templates live in `REFERENCE.md` (in this same skill folder). When a step below says "see REFERENCE.md section X", read that section before generating the spawn.
19
+
20
+ ---
21
+
22
+ Reads `.planning/` docs AND codebase. Never analyze one without the other.
17
23
 
18
24
  ## Usage
19
25
 
20
- - `/qualia-optimize` — Full optimization (all 6 dimensions)
26
+ - `/qualia-optimize` — Full (all 7 dimensions + architecture deepening)
21
27
  - `/qualia-optimize --perf` — Performance only (queries, bundle, render, latency)
22
28
  - `/qualia-optimize --ui` — Frontend/design/UI only
23
- - `/qualia-optimize --backend` — Backend only (RLS, auth, queries, edge functions)
24
- - `/qualia-optimize --alignment` — Planning-code alignment check only
25
- - `/qualia-optimize --fix` — Auto-fix LOW/MEDIUM findings from existing OPTIMIZE.md
29
+ - `/qualia-optimize --backend` — Backend only (RLS, auth, queries, edge fns)
30
+ - `/qualia-optimize --alignment` — Planning-code alignment only
31
+ - `/qualia-optimize --deepen` — Architecture deepening only (Ousterhout: shallow modules, deeper interfaces)
32
+ - `/qualia-optimize --fix` — Auto-fix LOW/MEDIUM from existing OPTIMIZE.md
26
33
 
27
34
  ## Process
28
35
 
29
36
  ### Step 1: Parse Arguments
30
37
 
31
- Extract mode from $ARGUMENTS. Default to `full`.
38
+ Mode from $ARGUMENTS. Default: `full`.
39
+ Modes: `full`, `perf`, `ui`, `backend`, `alignment`, `deepen`, `fix`.
40
+ `--fix` skips to Step 9 (requires `.planning/OPTIMIZE.md`).
32
41
 
33
- Supported modes: `full`, `perf`, `ui`, `backend`, `alignment`, `fix`.
42
+ ### Step 2: Load Planning Context (MANDATORY)
34
43
 
35
- If `--fix`: skip to Step 9 (requires existing `.planning/OPTIMIZE.md`).
36
-
37
- ### Step 2: Load Planning Context (MANDATORY — never skip)
38
-
39
- Read ALL of these (skip silently if file doesn't exist, but always attempt):
44
+ Read all (skip silently if missing):
40
45
 
41
46
  ```bash
42
47
  cat .planning/PROJECT.md 2>/dev/null || echo "NO_PROJECT"
@@ -58,15 +63,23 @@ cat .planning/STATE.md 2>/dev/null || echo "NO_STATE"
58
63
  cat .planning/DESIGN.md 2>/dev/null || echo "NO_DESIGN"
59
64
  ```
60
65
 
61
- Also read the rules:
66
+ ```bash
67
+ cat .planning/CONTEXT.md 2>/dev/null || echo "NO_CONTEXT"
68
+ ```
69
+
70
+ ```bash
71
+ ls .planning/decisions/ 2>/dev/null && cat .planning/decisions/*.md 2>/dev/null || echo "NO_ADRS"
72
+ ```
73
+
74
+ Also read rules:
62
75
  ```bash
63
76
  cat ~/.claude/rules/frontend.md 2>/dev/null
64
77
  cat ~/.claude/rules/security.md 2>/dev/null
65
78
  ```
66
79
 
67
- Store all content — you will inline it into agent prompts.
80
+ Store all; inline into agent prompts.
68
81
 
69
- **If NO planning docs exist at all**: warn the user but proceed. The optimization still works on raw codebase — it just can't check alignment.
82
+ **No planning docs:** warn, proceed. Can optimize raw codebase; can't check alignment.
70
83
 
71
84
  ### Step 3: Discover Codebase
72
85
 
@@ -87,224 +100,74 @@ git diff --stat HEAD~10..HEAD 2>/dev/null | tail -5
87
100
  ls -d app/ src/ pages/ components/ lib/ actions/ hooks/ supabase/ types/ 2>/dev/null
88
101
  ```
89
102
 
90
- Classify project type: `web` | `voice` | `mobile` | `agent` | `edge-functions` | `unknown`
103
+ Classify: `web` | `voice` | `mobile` | `agent` | `edge-functions` | `unknown`
91
104
 
92
105
  ### Step 4: Spawn Wave 1 Agents (parallel)
93
106
 
94
- Based on mode, spawn agents in a **single message** with multiple Agent() calls.
107
+ Spawn in **single message** with multiple Agent() calls per mode:
95
108
 
96
109
  | Mode | Agents |
97
110
  |------|--------|
98
- | `full` | frontend-agent + backend-agent + performance-oracle (3 parallel) |
99
- | `perf` | performance-oracle only |
100
- | `ui` | frontend-agent only |
101
- | `backend` | backend-agent only |
102
- | `alignment` | general-purpose with alignment prompt |
111
+ | `full` | frontend + backend + perf-oracle (3 parallel), then arch-strategist (Wave 2) |
112
+ | `perf` | perf-oracle only |
113
+ | `ui` | frontend only |
114
+ | `backend` | backend only |
115
+ | `alignment` | alignment prompt only |
116
+ | `deepen` | arch-strategist only (skip Wave 1) |
103
117
 
104
- **CRITICAL**: Inline ALL planning context into each agent prompt. `@` references don't work across Agent() boundaries.
118
+ **CRITICAL**: Inline ALL planning context into each prompt. `@` refs don't work across Agent() boundaries.
105
119
 
106
- #### Frontend Agent Prompt
120
+ Spawn parallel: **frontend** (@REFERENCE.md "Frontend agent prompt"), **backend** (@REFERENCE.md "Backend agent prompt"), **perf oracle** (@REFERENCE.md "Performance oracle prompt").
107
121
 
108
- ```
109
- Agent(
110
- prompt="You are optimizing a project's frontend. Read the planning docs and codebase rules below, then analyze the actual code.
111
-
112
- <planning>
113
- {PROJECT.md content}
114
- {REQUIREMENTS.md content}
115
- {DESIGN.md content}
116
- </planning>
117
-
118
- <rules>
119
- {rules/frontend.md content}
120
- </rules>
121
-
122
- <task>
123
- Analyze the frontend codebase for issues in these categories:
124
-
125
- 1. **UI Quality**
126
- - Loading states: every async operation should show a loading indicator
127
- - Error states: every data-fetching component should handle errors gracefully
128
- - Empty states: lists/tables should handle zero items with helpful messaging
129
- - Responsive: check for fixed pixel widths on containers, missing breakpoint handling
130
- - Accessibility: alt text on images, ARIA labels on interactive elements, keyboard navigation
131
-
132
- 2. **Design Alignment**
133
- - Compare actual components against DESIGN.md decisions (colors, typography, spacing)
134
- - Check rules/frontend.md compliance: distinctive fonts? sharp accents? transitions? No card grids or blue-purple gradients?
135
- - Consistency: are the same patterns used throughout? (button styles, spacing, color usage)
136
-
137
- 3. **Frontend Performance**
138
- - Bundle: large library imports that could be tree-shaken or dynamically imported
139
- - Images: using next/image? width/height set? lazy loading below fold?
140
- - Fonts: using next/font? No render-blocking font loads?
141
- - CSS: unused Tailwind classes? conflicting styles?
142
- - Rendering: unnecessary re-renders, missing React.memo on list items, heavy computations in render
143
-
144
- For EVERY finding, output in this exact format:
145
- - **What**: [description]
146
- - **Where**: [file:line]
147
- - **Why**: [impact on users/performance]
148
- - **Fix**: [concrete fix suggestion]
149
- - **Severity**: CRITICAL | HIGH | MEDIUM | LOW
150
- </task>",
151
- subagent_type="general-purpose",
152
- description="Frontend optimization analysis"
153
- )
154
- ```
122
+ ### Step 5: Wave 2 -- Architecture Strategist
155
123
 
156
- #### Backend Agent Prompt
124
+ `full`: after Wave 1 (synthesizes + deepens). `deepen`: sole agent (no Wave 1).
157
125
 
158
- ```
159
- Agent(
160
- prompt="You are optimizing a project's backend. Read the planning docs and security rules below, then analyze the actual code.
161
-
162
- <planning>
163
- {PROJECT.md content}
164
- {REQUIREMENTS.md content}
165
- </planning>
166
-
167
- <rules>
168
- {rules/security.md content}
169
- </rules>
170
-
171
- <task>
172
- Analyze the backend codebase for issues:
173
-
174
- 1. **Security**
175
- - RLS: every Supabase table must have ROW LEVEL SECURITY enabled with policies
176
- - Service role: grep for service_role key usage in client-side code (app/, components/, src/) — should be ZERO
177
- - Auth: all mutations use server-side auth check (supabase.auth.getUser())
178
- - Validation: input validated with Zod before database operations
179
- - No dangerouslySetInnerHTML or eval()
180
-
181
- 2. **Data Access Patterns**
182
- - Server actions vs client mutations: data writes should use 'use server' actions, not direct Supabase client calls
183
- - Proper error handling: try/catch with meaningful error messages
184
- - Revalidation: revalidatePath/revalidateTag after mutations
185
-
186
- 3. **Edge Functions** (if supabase/functions/ exists)
187
- - Cold start optimization: bundle size, dependency count
188
- - Error handling and logging
189
- - CORS configuration
190
- - Timeout protection (maxDuration)
191
-
192
- 4. **API Quality**
193
- - Rate limiting on public endpoints
194
- - Proper HTTP status codes
195
- - Consistent error response format
196
-
197
- For EVERY finding, output:
198
- - **What**: [description]
199
- - **Where**: [file:line]
200
- - **Why**: [impact]
201
- - **Fix**: [concrete suggestion]
202
- - **Severity**: CRITICAL | HIGH | MEDIUM | LOW
203
- </task>",
204
- subagent_type="general-purpose",
205
- description="Backend optimization analysis"
206
- )
207
- ```
126
+ Spawn **arch strategist** (@REFERENCE.md "Architecture strategist prompt (deepening lens)").
208
127
 
209
- #### Performance Oracle Prompt
128
+ **Skip Wave 2 for single-mode** (`--perf`, `--ui`, `--backend`, `--alignment`). Run for `full` and `deepen`.
210
129
 
211
- ```
212
- Agent(
213
- prompt="You are analyzing cross-cutting performance issues. Read the project context, then analyze the codebase.
214
-
215
- <planning>
216
- {PROJECT.md content}
217
- </planning>
218
-
219
- <task>
220
- Analyze for performance issues across the full stack:
221
-
222
- 1. **Database Queries**
223
- - N+1 queries: Supabase .from() calls inside loops or .map()
224
- - Missing indexes: .eq()/.filter()/.order() columns without corresponding indexes in migrations
225
- - Sequential queries that could be parallel (Promise.all)
226
- - Over-fetching: SELECT * when only specific columns needed
227
-
228
- 2. **API Latency**
229
- - Sequential API calls from client that could be batched
230
- - Missing caching (SWR/React Query stale times, HTTP cache headers)
231
- - Large payloads without pagination
232
-
233
- 3. **Bundle Size**
234
- - Barrel exports (index.ts re-exporting everything) preventing tree-shaking
235
- - Large libraries imported for single functions (lodash, moment)
236
- - Missing dynamic imports for heavy components (charts, editors, maps)
237
-
238
- 4. **Render Performance**
239
- - Expensive computations in render path without useMemo
240
- - Event handlers recreated on every render without useCallback
241
- - Large lists without virtualization
242
- - Context providers causing unnecessary re-renders
243
-
244
- For EVERY finding, output:
245
- - **What**: [description]
246
- - **Where**: [file:line]
247
- - **Why**: [performance impact, quantified if possible]
248
- - **Fix**: [concrete suggestion]
249
- - **Severity**: CRITICAL | HIGH | MEDIUM | LOW
250
- </task>",
251
- subagent_type="general-purpose",
252
- description="Performance optimization analysis"
253
- )
254
- ```
130
+ ### Step 5b: Wave 3 -- Parallel Interface Design (`--deepen` only, after candidate selection)
255
131
 
256
- ### Step 5: Spawn Wave 2 Agent (after Wave 1 completes)
132
+ After the strategist returns deepening candidates, present a numbered list to the user. User picks ONE candidate (or `--auto` mode picks the highest-severity).
257
133
 
258
- After all Wave 1 agents return, spawn the architecture strategist with their combined findings:
134
+ For the chosen candidate, spawn **3 fan-out agents in parallel, in the same response turn**, each producing a *radically different* interface design for the proposed deep module. From Matt Pocock's improve-codebase-architecture skill: "spawn three sub-agents in parallel, each must produce a radically different interface for the deepened module."
259
135
 
260
- ```
261
- Agent(
262
- prompt="You are synthesizing optimization findings from 3 specialist agents. Look for cross-cutting architectural issues.
263
-
264
- <wave1_findings>
265
- {All findings from frontend-agent, backend-agent, performance-oracle}
266
- </wave1_findings>
267
-
268
- <planning>
269
- {PROJECT.md content}
270
- {REQUIREMENTS.md content}
271
- </planning>
272
-
273
- <task>
274
- 1. Identify patterns across findings — recurring issues that point to a structural problem
275
- 2. Find coupling issues between frontend and backend
276
- 3. Check for inconsistent patterns (e.g., some routes use server actions, others use API routes)
277
- 4. Identify missing abstractions (same pattern repeated 3+ times)
278
- 5. Check for dead code and unused exports
279
-
280
- Output:
281
- - **Structural findings** (architectural issues, not covered by Wave 1)
282
- - **Pattern consolidation** (where Wave 1 findings share a root cause)
283
- - Each finding in the same format: What/Where/Why/Fix/Severity
284
- </task>",
285
- subagent_type="general-purpose",
286
- description="Architecture synthesis"
287
- )
288
- ```
136
+ Spawn 3 (@REFERENCE.md "Parallel interface design prompt"). Each receives:
137
+ - The candidate's files, problem, and current shallow signature
138
+ - CONTEXT.md domain glossary (use shared terms)
139
+ - A *different* design constraint (functional / OOP / event-driven / minimal-surface / hexagonal — assigned per agent so the variants differ in shape, not just naming)
140
+
141
+ Collect all 3 proposals. Present to the user as a side-by-side table:
289
142
 
290
- **Skip Wave 2 for single-mode runs** (`--perf`, `--ui`, `--backend`). Only run for `full` mode.
143
+ | # | Interface shape | Locality gain | Testability | Migration cost |
144
+ |---|---|---|---|---|
145
+ | 1 | {sketch} | {what concentrates} | {seams} | {N callers updated} |
146
+ | 2 | ... | ... | ... | ... |
147
+ | 3 | ... | ... | ... | ... |
291
148
 
292
- ### Step 6: Alignment Check (always runs in `full` and `alignment` modes)
149
+ User picks `1`, `2`, `3`, or `hybrid` (with notes on which elements from which proposals to combine). The synthesizer then writes a "Refactor RFC" to `.planning/REFACTOR-{slug}.md` and optionally opens a GH issue (mirrors `/qualia-prd` flow).
293
150
 
294
- For `alignment` mode, this is the sole analysis. For `full` mode, run alongside Wave 1.
151
+ **Why parallel + radically different**: a single deepening proposal anchors on the first idea the LLM has. Three parallel proposals with diverse design constraints surface trade-offs the user can see at a glance — and the human's "taste" dominates the choice rather than the agent's first instinct. Empirically (Matt Pocock + Qualia internal testing) this produces dramatically better refactor RFCs than a single-pass proposal.
295
152
 
296
- Read REQUIREMENTS.md and ROADMAP.md. For each requirement marked "Complete" or mapped to a completed phase:
153
+ **Skip Wave 3 for `full` mode** (too many candidates to fan out per-candidate). Run for `--deepen` only when a candidate is selected.
154
+
155
+ ### Step 6: Alignment Check (`full` and `alignment` modes)
156
+
157
+ `alignment`: sole analysis. `full`: alongside Wave 1.
158
+
159
+ Read REQUIREMENTS.md + ROADMAP.md. Per req marked "Complete" or mapped to completed phase:
297
160
 
298
161
  ```bash
299
162
  # Find completed requirements
300
163
  grep -E "Complete|✓" .planning/REQUIREMENTS.md 2>/dev/null
301
164
  ```
302
165
 
303
- For each completed requirement:
304
- - Grep the codebase for evidence it actually exists (routes, components, API endpoints)
305
- - If not found: flag as "Claimed complete but not implemented"
166
+ Per completed req:
167
+ - Grep for evidence (routes, components, endpoints)
168
+ - Not found: flag "Claimed complete but not implemented"
306
169
 
307
- Then scan for orphan features:
170
+ Orphan scan:
308
171
  ```bash
309
172
  # Find all routes/pages
310
173
  find app -name "page.tsx" -o -name "route.ts" 2>/dev/null
@@ -312,16 +175,15 @@ find app -name "page.tsx" -o -name "route.ts" 2>/dev/null
312
175
  find app/api -name "route.ts" 2>/dev/null
313
176
  ```
314
177
 
315
- Cross-reference with REQUIREMENTS.md — any route/feature NOT in requirements is flagged as "Undocumented feature".
178
+ Cross-ref with REQUIREMENTS.md; route NOT in reqs: "Undocumented feature".
316
179
 
317
- ### Step 7: Collect and Score Findings
180
+ ### Step 7: Collect and Score
318
181
 
319
- After all agents return:
320
- 1. Deduplicate (same file:line from multiple agents → keep the most detailed one)
321
- 2. Sort by severity: CRITICAL first
322
- 3. Group by dimension: Performance, Design Alignment, UI Quality, Backend, Frontend, Planning-Code Alignment, Architecture
323
-
324
- Count totals per severity.
182
+ All agents done:
183
+ 1. Deduplicate (same file:line, keep most detailed)
184
+ 2. Sort: CRITICAL first
185
+ 3. Group by dimension: Perf, Design, UI, Backend, Frontend, Alignment, Architecture
186
+ 4. Count per severity.
325
187
 
326
188
  ### Step 8: Write OPTIMIZE.md and Present Results
327
189
 
@@ -399,27 +261,25 @@ Run /qualia-optimize --fix to auto-fix LOW/MEDIUM findings.
399
261
 
400
262
  ### Step 9: --fix Mode
401
263
 
402
- When `--fix` is provided:
403
-
404
- 1. Read existing `.planning/OPTIMIZE.md` — if not found, error: "Run /qualia-optimize first"
405
- 2. Filter to LOW and MEDIUM findings only
406
- 3. For each finding with a clear, safe fix:
407
- - Read the target file
408
- - Apply the fix
409
- - Verify it doesn't break (npx tsc --noEmit if TypeScript)
410
- 4. Update OPTIMIZE.md: mark fixed findings, recount severities
411
- 5. Commit changes
412
- 6. Report what was fixed and what remains
264
+ `--fix` mode:
413
265
 
414
- **Never auto-fix CRITICAL or HIGH** those require human judgment.
266
+ 1. Read `.planning/OPTIMIZE.md`; missing: "Run /qualia-optimize first"
267
+ 2. Filter to LOW + MEDIUM only
268
+ 3. Per finding with clear, safe fix:
269
+ - Read target file
270
+ - Apply fix
271
+ - Verify (npx tsc --noEmit if TS)
272
+ 4. Update OPTIMIZE.md: mark fixed, recount severities
273
+ 5. Commit
274
+ 6. Report fixed vs remaining
415
275
 
416
- ### Step 10: Gap Phase Creation (if user selects option 1 from Step 8)
276
+ **Never auto-fix CRITICAL/HIGH.** Require human judgment.
417
277
 
418
- If user wants a fix phase for critical issues:
278
+ ### Step 10: Gap Phase Creation (user picks option 1)
419
279
 
420
- 1. Read ROADMAP.md, find current phase number
421
- 2. Insert a decimal phase: `Phase {N}.1: Optimization Fixes (INSERTED)`
422
- 3. Map CRITICAL and HIGH findings as success criteria
280
+ 1. Read ROADMAP.md, find current phase
281
+ 2. Insert `Phase {N}.1: Optimization Fixes (INSERTED)`
282
+ 3. Map CRITICAL + HIGH findings as success criteria
423
283
  4. Update STATE.md
424
284
  5. Commit
425
285
  6. Suggest: "Fix phase created. Run `/qualia-plan {N}.1`"