riskrails 3.0.1 → 3.2.1

package/skills/project-init/templates/constitution.md

@@ -7,7 +7,7 @@ C1. Production behaviour is the source of truth; what looks wrong may be load-be
 C2. A bugfix starts with the failing test; legacy behaviour gets a characterization test before it changes.
 C3. A refactoring changes no behaviour and is never mixed with a feature.
 C4. Every step names its files; scope grows only by amending the plan.
-C5. No agent merges or deploys; an agent commits, pushes or approves only by running, verbatim and once, a command a human picked in the dialog; otherwise a human runs it outside the agent.
+C5. No agent merges or deploys; an agent commits, pushes or approves only by running, verbatim and once, a command a human picked in the dialog, as the harness recorded; else a human runs it outside.
 C6. <!-- project principle — filled by /ai-init from the survey, confirmed by you -->
 C7. <!-- project principle -->
 C8. <!-- project principle -->

package/skills/project-init/templates/sdlc-README.md

@@ -1,24 +1,30 @@
 # SDLC artefacts
 
-Feature work in this repo follows the AI-Native SDLC flow: **intent → spec → plan → build**.
-Each stage has a skill that produces one file here, and the next stage reads it.
+Work that needs a written intent and design before any code follows
+**spec → plan → build**. Each stage has a skill that produces one file here,
+and the next stage reads it.
 
 ```
- /sdlc-intent <topic>        →  docs/sdlc/intent/<slug>.md   (problem, outcome, constraints)
+ /rr-spec <idea | intent/<slug>.md>  →  docs/sdlc/specs/<slug>.md    (## Intent, requirements, design, Flagged concerns)
+        │                               docs/sdlc/intent/<slug>.questions.md  (the brainstorm, recorded by state.py)
+ /rr-plan specs/<slug>.md            →  docs/sdlc/plans/<slug>.md    (files that change, order, risks, proof, rollback)
         │
- /sdlc-spec  intent/<slug>.md →  docs/sdlc/specs/<slug>.md    (requirements, design, flagged concerns)
-        │
- /sdlc-plan  specs/<slug>.md  →  docs/sdlc/plans/<slug>.md    (files, order, risks, proof)
-        │
-      build (main session, one plan step at a time; `ai-reviewer` before commit)
+ /rr-build  — one row at a time (each row is one task, weighed and started by /rr-plan)
+ /rr-build-all plans/<slug>.md — the whole plan as one task: parallel implementers, one review loop
 ```
 
 | Folder | Produced by | Contains |
 |---|---|---|
-| `intent/` | `/sdlc-intent` | one file per idea; what and why, not how |
-| `specs/` | `/sdlc-spec` | requirements + design; ends with **Flagged concerns** |
-| `plans/` | `/sdlc-plan` | ordered implementation steps with verification |
-| `adr/` | you / `architect` | Architecture Decision Records (MADR style) |
+| `intent/` | `/rr-spec`'s brainstorm (`state.py ask --topic`) | `<slug>.questions.md`, one question at a time with the answer on record; an `intent/<slug>.md` written by hand is accepted instead of the brainstorm |
+| `specs/` | `/rr-spec`, `architect` on STRONG | `## Intent` (problem, outcome, affected users and systems, constraints, decisions taken), requirements, design; ends with **Flagged concerns**, which a human resolves or accepts before planning |
+| `plans/` | `/rr-plan` | Files that change / Order of work / Risks / Proof (every requirement to a test or command) / Rollback; each row carries its files and its *Consumes* line |
+| `adr/` | you, or `architect` | Architecture Decision Records (MADR style) |
+| `constitution.md` | `/rr-setup`, then you | the principles the project does not negotiate, cited as `C<n>` in specs, plans and reviews; at most 15 lines |
 
-Each folder holds a `TEMPLATE.md`; the skills copy it and fill it in. Commit the artefacts with the
-code they describe so the reasoning survives the pull request.
+The skills fill in the plugin's templates
+(`$AI_HOME/skills/project-init/templates/{intent,spec,plan,adr}.md`, in the
+installed plugin); to override one, copy it to `docs/sdlc/<folder>/TEMPLATE.md`
+and edit it — the skills read that one first. Commit the artefacts with the code they describe, so the
+reasoning survives the pull request. A task's own record — weight, plan, questions, verify runs, review,
+verdict — is not here but in `.ai/reports/<task-id>/task.md`, written by
+`state.py`.

package/skills/project-update/adopt.py

@@ -32,6 +32,12 @@ def test_mode():
     return os.environ.get("RISKRAILS_TEST", os.environ.get("CLAUDE_AGENTIC_TEST")) == "1"
 
 
+def ai_unattended():
+    """AI_UNATTENDED is set when it is non-empty and not 0, false or no (case
+    and blanks ignored): one rule in every reader (risk 0587)."""
+    return os.environ.get("AI_UNATTENDED", "").strip().lower() not in ("", "0", "false", "no")
+
+
 def human_gate():
     """(passed, via, why) for --confirm-delete. A terminal outside any agent
     session is a human: via "terminal". Otherwise a launcher that declared the
@@ -44,7 +50,7 @@ def human_gate():
     markers = [name for name in AGENT_MARKERS if name in os.environ]
     if os.isatty(0) and not markers:
         return True, "terminal", ""
-    if os.environ.get("AI_UNATTENDED"):
+    if ai_unattended():
         return True, "unattended", ""
     if markers:
         return False, None, ("this run is inside an agent session (%s %s set); run it in a terminal "
@@ -175,7 +181,7 @@ def load_table(path=MAP_FILE):
     try:
         with open(path, encoding="utf-8") as fh:
             table = json.load(fh)
-    except (OSError, ValueError) as exc:
+    except (OSError, ValueError, RecursionError) as exc:
         raise TableError("%s: %s" % (path, exc)) from exc
     tools = table.get("tools")
     rows = table.get("rows")
@@ -455,7 +461,7 @@ def load_decisions(root):
     try:
         with open(os.path.join(root, where, "decisions.json"), encoding="utf-8") as fh:
             return json.load(fh)
-    except (OSError, ValueError) as exc:
+    except (OSError, ValueError, RecursionError) as exc:
         raise TableError("%s/decisions.json: %s" % (where, exc)) from exc
 
 
@@ -925,7 +931,7 @@ def state_line(root, shipped_block, skeleton_cap, table=None, instruction_files=
     try:
         return _state_line(root, shipped_block, skeleton_cap, table, instruction_files, shipped_files)
     except (TableError, OSError, ValueError, KeyError, TypeError, AttributeError) as exc:
-        return 1, "adopt state unreadable (%s) — run /project-update --adopt" % exc
+        return 1, "adopt state unreadable (%s) — run /rr-setup --adopt" % exc
 
 
 def _state_line(root, shipped_block, skeleton_cap, table, instruction_files, shipped_files):
@@ -943,11 +949,11 @@ def _state_line(root, shipped_block, skeleton_cap, table, instruction_files, shi
             return 0, "no foreign structure detected"
         bits = ["%s (%d file(s))" % (t, sum(g.values())) for t, g in adoption.detected.items()]
         bits += ["%s (split?)" % c.path for c, _ in adoption.candidates]
-        return 1, "foreign structure detected: %s — run /project-update --adopt" % ", ".join(bits)
+        return 1, "foreign structure detected: %s — run /rr-setup --adopt" % ", ".join(bits)
     try:
         with open(os.path.join(root, where, "adopt.json"), encoding="utf-8") as fh:
             record_data = json.load(fh)
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         return 0, "no foreign structure detected"
     date = where.rsplit("adopt-", 1)[-1]
     regenerated = []
@@ -968,13 +974,13 @@ def _state_line(root, shipped_block, skeleton_cap, table, instruction_files, shi
         if current != src.get("sha"):
             regenerated.append(src["path"])
     if regenerated:
-        return 1, ("foreign files regenerated since the adopt of %s: %s — run /project-update --adopt"
+        return 1, ("foreign files regenerated since the adopt of %s: %s — run /rr-setup --adopt"
                    % (date, ", ".join(sorted(regenerated))))
     checks = record_data.get("checks", {})
     failed = [name for name, c in checks.items() if c.get("status") not in ("pass", "not_applicable")]
     if failed or record_data.get("status") == "partial":
         what = failed[0].replace("_", "-") + " FAIL" if failed else "the apply was interrupted"
-        return 1, "adoption of %s incomplete: %s — run /project-update --adopt" % (date, what)
+        return 1, "adoption of %s incomplete: %s — run /rr-setup --adopt" % (date, what)
     tools = ", ".join(sorted(record_data.get("tools", {})))
     pending = sum(1 for s in record_data.get("sources", []) if s.get("cleanup") and safe_rel(s.get("path"))
                   and os.path.isfile(os.path.join(root, s["path"])))
@@ -1306,7 +1312,7 @@ def read_record(root, where):
     try:
         with open(os.path.join(root, where, "adopt.json"), encoding="utf-8") as fh:
             return json.load(fh)
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         return None
 
 
@@ -1331,7 +1337,7 @@ def task_in_flight(root):
     try:
         with open(path, encoding="utf-8") as fh:
             state = json.load(fh)
-    except (OSError, ValueError):
+    except (OSError, ValueError, RecursionError):
         return None
     stage = state.get("current_stage")
     return None if stage in (None, "done") else "%s at stage %s" % (state.get("task_id", "a task"), stage)
@@ -1340,13 +1346,13 @@ def task_in_flight(root):
 def gates(root, u, planned_writes):
     """R5, in the order a human fixes them. Returns a refusal (reason, how) or None."""
     if not os.path.isdir(os.path.join(root, ".ai")):
-        return "the project has no .ai/", "run /ai-init first, then /project-update --adopt"
+        return "the project has no .ai/", "run /rr-setup first, then /rr-setup --adopt"
     dirty = clean_tree(root)
     if dirty is None:
         return "the project is not a git work tree", "run `git init` and commit, so the adopt can be undone"
     running = task_in_flight(root)
     if running:
-        return "a task is in flight (%s)" % running, "finish or abandon it with /ai-task first"
+        return "a task is in flight (%s)" % running, "finish or abandon it with /rr-build first"
     outside = [p for p in dirty if not p.startswith(ALLOWED_DIRT) and p not in planned_writes]
     if outside:
         more = " and %d more" % (len(outside) - 3) if len(outside) > 3 else ""
@@ -1356,7 +1362,7 @@ def gates(root, u, planned_writes):
                     "commit it or remove it")
         return ("the tree has uncommitted changes: %s%s" % (", ".join(outside[:3]), more), how)
     if u.plain_pending(root, ignore=planned_writes):
-        return "the project is behind the installed plugin", "run /project-update --apply first, then adopt"
+        return "the project is behind the installed plugin", "run /rr-setup --update --apply first, then adopt"
     return None
 
 
@@ -1403,7 +1409,8 @@ def write_json(u, root, rel, data):
 
 def apply_run(plan, args, u, skeleton_cap, instruction_files=frozenset(), shipped_files=None):
     """`update.py --adopt --apply`: gates, originals, phased writes, the checks
-    on disk, the record. Exit 0, 3 (aborted), 4 (incomplete) or 5 (refused)."""
+    on disk, the record. Exit 0, 2 (the routing table or a migration could not be
+    read), 3 (aborted), 4 (incomplete) or 5 (refused)."""
     root = plan.root
     try:
         table = load_table()
@@ -1413,7 +1420,11 @@ def apply_run(plan, args, u, skeleton_cap, instruction_files=frozenset(), shippe
     tools = [t.strip() for t in args.tool.split(",")] if args.tool else None
     resume_dir, resume = partial_record(root)
     planned_writes = set(resume.get("planned_writes", [])) if resume else set()
-    refusal = gates(root, u, planned_writes)
+    try:
+        refusal = gates(root, u, planned_writes)
+    except u.SchemaError as exc:  # plain_pending builds the plan: a migration's error is exit 2, as in update.py
+        print("project-update: %s" % exc, file=sys.stderr)
+        return 2
     if refusal:
         return refuse(*refusal)
     plan.report_dir = plan.adopt_report_dir = resume_dir or ".ai/reports/adopt-%s" % today()
@@ -1577,7 +1588,9 @@ def report_md(plan, adoption, record):
 # ---------------------------------------------------------------------------
 
 CLEANUP_HEADING = "## Cleanup"
-REVIEW_LINE = "Run `/project-update --adopt --cleanup` to review; a human confirms the deletion."
+REVIEW_LINE = "Run `/rr-setup --adopt --cleanup` to review; a human confirms the deletion."
+# Reports written by v2.0.2-v3.1.0 carry this text; cleanup still replaces it.
+LEGACY_REVIEW_LINE = "Run `/project-update --adopt --cleanup` to review; a human confirms the deletion."
 
 
 def plan_cleanup(plan, args, u, table, skeleton_cap, instruction_files, shipped_files):
@@ -1589,21 +1602,21 @@ def plan_cleanup(plan, args, u, table, skeleton_cap, instruction_files, shipped_
     def no(reason, how, adoption=None):
         return (reason, how), None, None, None, adoption
     if not os.path.isdir(os.path.join(root, ".ai")):
-        return no("the project has no .ai/", "run /ai-init first")
+        return no("the project has no .ai/", "run /rr-setup first")
     where = latest_with(root, "adopt.json")
     record = read_record(root, where) if where else None
     if record is None:
-        return no("no adopt record to clean up", "run /project-update --adopt --apply first")
+        return no("no adopt record to clean up", "run /rr-setup --adopt --apply first")
     if args.mode == "coexist" or record.get("mode") == "coexist":
         return no("coexist keeps the foreign files",
-                  "to move them, run /project-update --adopt --apply (mode migrate), then --cleanup")
+                  "to move them, run /rr-setup --adopt --apply (mode migrate), then --cleanup")
     checks = record.get("checks", {})
     if record.get("status") != "applied" or any(c.get("status") != "pass" for c in checks.values()):
         return no("the adopt of %s is not complete (R12)" % where.rsplit("adopt-", 1)[-1],
-                  "run /project-update --adopt --apply until both checks pass")
+                  "run /rr-setup --adopt --apply until both checks pass")
     running = task_in_flight(root)
     if running:
-        return no("a task is in flight (%s)" % running, "finish or abandon it with /ai-task first")
+        return no("a task is in flight (%s)" % running, "finish or abandon it with /rr-build first")
     dirty = clean_tree(root)
     if dirty is None:
         return no("the project is not a git work tree", "cleanup deletes only what git can restore")
@@ -1642,7 +1655,7 @@ def plan_cleanup(plan, args, u, table, skeleton_cap, instruction_files, shipped_
         what.append("%d unmapped, %d split(s) waiting" % (len(adoption.unmapped), len(adoption.split)))
     if what:
         return no("the adopt no longer holds on the current tree: %s" % "; ".join(what),
-                  "run /project-update --adopt to see why, settle it, then --cleanup", adoption)
+                  "run /rr-setup --adopt to see why, settle it, then --cleanup", adoption)
     # Only what the adopt finds again as a cleanup source, and only what git
     # can restore: an ignored file skipped from original/ would be gone for good.
     found = {path for path, _t, _tr, _n, cleanup in adoption.sources if cleanup}
@@ -1773,7 +1786,8 @@ def cleanup_report_md(u, root, where, record):
     except OSError:
         text = ""
     text = text.split("\n" + CLEANUP_HEADING + "\n", 1)[0].rstrip("\n") + "\n"
-    text = text.replace(REVIEW_LINE, "The deletion is recorded under Cleanup below.")
+    for line in (REVIEW_LINE, LEGACY_REVIEW_LINE):
+        text = text.replace(line, "The deletion is recorded under Cleanup below.")
     c = record["cleanup"]
     runs = list(c.get("history") or []) + [c]
 
@@ -1900,7 +1914,7 @@ def find_proposal(root, cand, stale=False):
             try:
                 with open(os.path.join(base, d, name), encoding="utf-8") as fh:
                     data = json.load(fh)
-            except (OSError, ValueError):
+            except (OSError, ValueError, RecursionError):
                 continue
             if isinstance(data, dict) and data.get("source") == cand.path and (stale or data.get("source_sha") == cand.sha):
                 return ".ai/reports/%s/%s" % (d, name), data

package/skills/project-update/history/blobs/00289f98434fed230eebe768dfb3425f83d737866a3aebc97aa95167c4fa0c6e

@@ -0,0 +1,131 @@
+# Testing policy
+
+Tests describe behaviour. Coverage percentage is a side effect, not a goal.
+
+## Characterization first
+
+Before changing behaviour that is not covered by a test — which is most legacy
+behaviour — write a test that passes against the code **as it is today**. That
+test is the definition of what must not break. Only then change the code.
+
+```
+characterization test → refactor → verify identical behaviour → feature change
+```
+
+Never do those in one step, and never in one commit.
+
+## What to consider, by kind of change
+
+| Change touches | Also test |
+|---|---|
+| a shared service | the existing callers, not only the new one |
+| money, tax, fiscal | rounding, currency, negative and zero amounts, refunds |
+| a state machine | every transition that is now reachable, and the ones that must stay unreachable |
+| an async consumer | retry, double delivery, out-of-order delivery, poison message |
+| an external integration | timeout, 500, malformed response, partial write |
+| a write path | idempotency, concurrency, transaction boundaries |
+| authorization | the negative case, for every role |
+| a public API or event | the old shape still works |
+
+## Three scopes, three moments
+
+A task runs tests three times at most, and each run has its own scope. Nothing
+else runs in between.
+
+| When | What runs | Command |
+|---|---|---|
+| after each implementation step, before `step-done` | **only the tests the plan named for that step** — the files it touched, their direct callers' tests | `step_test_command` |
+| once, after the **last** step | the full fast suite — unit and integration, no e2e | `verify_command` |
+| once, at the **end of the task**, after the full suite is green | the end-to-end suite | `e2e_command` |
+
+- A step never runs the full suite, and **never** runs e2e. If the plan named
+  no test for a step, nothing runs for it.
+- A step's tests are scoped by path or filter, not by `--stop-on-failure`: the
+  scoped run still goes to the end, and its failures are fixed inside that step.
+- The e2e suite runs **once per task**, at the very end, never per step. Skip it
+  at T0/T1, and when the change cannot reach a flow the e2e suite covers — say
+  which, in one line; silence is not a verdict.
+- A failure in a step's own tests is fixed in that step, before `step-done`;
+  the batch rule below is for the two end-of-task runs.
+- After a green suite, a documents-only edit runs `doc_tests` (step scope), not the suite.
+
+## Reading a failure
+
+**Run to the end, then fix as one batch.** The verification command runs with
+no fail-fast flag and is never interrupted at the first failure. Collect every
+failure, classify each one, fix all the new regressions in one batch
+(`state.py start --amend` widens the task when a fix needs more files), and run the
+command once more. One failure never
+sends the task back to the start: the plan, the tier and the finished steps
+stand. At most two remediation rounds; a third means the human decides.
+
+Classify before fixing. The four answers are:
+
+- **EXISTING TEST FAILURE** — it failed before this change too. Say so, do not
+  fix it inside this task.
+- **NEW REGRESSION** — this change broke it. Fix the code, not the test.
+- **TEST ENVIRONMENT FAILURE** — database, fixtures, network, container. Say what
+  is missing.
+- **UNKNOWN** — you could not tell. Say what you tried.
+
+A review's MEDIUM and LOW findings are recorded with `state.py memory risk add`, not
+fixed in the task; only a BLOCKER, a HIGH or a regression buys an `--after-fix` run.
+
+**Never edit a test to make it pass when production behaviour changed
+unexpectedly.** A test that suddenly disagrees with the code is evidence, and
+deleting evidence is the worst available option.
+
+## Verification
+
+Three commands, one per scope. `verify_command` proves the project is healthy;
+`step_test_command` proves one step is; `e2e_command` proves the whole flow
+still works. Keep each to one command — chain the pieces in a Makefile or
+composer script if there are several — and make sure none of them stops at the
+first failure (`--stop-on-failure`, `-x`, `--bail`, `failfast` are off).
+
+`verify_command` must **exclude** the e2e suite: it is the fast loop run after
+the last step and again after a remediation batch. `e2e_command` runs once, at
+the end of the task. A bugfix still shows its new failing test first — that one
+test only, through `single_test`.
+
+```
+verify_command:      # the full fast suite, e2e excluded — e.g. make test   |   composer qa && vendor/bin/phpunit --exclude-group e2e
+step_test_command:   # the same runner, scoped to a path or filter — e.g. vendor/bin/phpunit {files} | pytest {files}
+e2e_command:         # the end-to-end suite, run once at the end of a task — e.g. make e2e | vendor/bin/behat | npx playwright test
+lint_command:        # e.g. vendor/bin/php-cs-fixer fix --dry-run | ruff check . | npm run lint — write `none` if the project has none
+doc_tests:           # the suites a documents-only edit runs after a green suite — e.g. tests/test_docs.py; `none` if the project has none
+typecheck_command:   # e.g. vendor/bin/phpstan analyse --no-progress | mypy . | npx tsc --noEmit — `none` if the project has none
+healthy_output:      # two or three lines of what a green run ends with
+runtime:             # roughly, for each command, so a hang is recognisable
+single_test:         # how to run one test, for the failing-test-first step of a bugfix
+```
+
+`step_test_command` may contain `{files}`, which is replaced by the paths the
+step names; without it the paths are appended. The placeholder is what lets
+`sensors.py` run a step's own tests for the "test must bite" check, so a runner
+that only takes a `--filter` gets `bite: unavailable` rather than a wrong answer.
+
+`bite_codes` (optional) lists the exit codes that mean "a test failed" when a
+test is shown failing before its fix; the default is `1`. Runners that exit
+differently say so here — `bite_codes: 1,2` for pytest (2 is a collection
+error, such as a missing import), `1,2` for phpunit, `101` for cargo. Any other
+code is the runner's own usage error and does not count as a bite.
+
+`lint_command` and `typecheck_command` are read by the deterministic sensors,
+never by a model. They decide, together with the test run, whether a light-mode change
+can skip its model review (`state.py close` measures them). A **missing** line is
+`unavailable` and keeps the review; only the literal `none`, written by a human,
+says the project has no such tool. Read the exact line from the project's
+config files (`package.json`, `composer.json`, `pyproject.toml`, `Makefile`), and
+never run a command just to find it out.
+
+If the project has no e2e suite, write `e2e_command: none` and say so — an
+empty line is read as "not written down yet" and the next task will go looking
+for it. Say which group, tag or directory marks the e2e tests and how
+`verify_command` excludes them, so a step's scoped run and the fast suite stay
+free of them.
+
+## Project specifics
+
+<!-- The real commands: how to run unit tests, integration tests, a single test.
+     Where fixtures live. What the CI runs. Cite the config. -->

package/skills/project-update/history/blobs/079a91f976ad69b5cf49ccb9a28849576e4735ddd9485fc26599e528a69fd2f4

@@ -0,0 +1,30 @@
+# SDLC artefacts
+
+Work that needs a written intent and design before any code follows
+**spec → plan → build**. Each stage has a skill that produces one file here,
+and the next stage reads it.
+
+```
+ /rr-spec <idea | intent/<slug>.md>  →  docs/sdlc/specs/<slug>.md    (## Intent, requirements, design, Flagged concerns)
+        │                               docs/sdlc/intent/<slug>.questions.md  (the brainstorm, recorded by state.py)
+ /rr-plan specs/<slug>.md            →  docs/sdlc/plans/<slug>.md    (files that change, order, risks, proof, rollback)
+        │
+ /rr-build  — one row at a time (each row is one task, weighed and started by /rr-plan)
+ /rr-build-all plans/<slug>.md — the whole plan as one task: parallel implementers, one review loop
+```
+
+| Folder | Produced by | Contains |
+|---|---|---|
+| `intent/` | `/rr-spec`'s brainstorm (`state.py ask --topic`) | `<slug>.questions.md`, one question at a time with the answer on record; an `intent/<slug>.md` written by hand is accepted instead of the brainstorm |
+| `specs/` | `/rr-spec`, `architect` on STRONG | `## Intent` (problem, outcome, affected users and systems, constraints, decisions taken), requirements, design; ends with **Flagged concerns**, which a human resolves or accepts before planning |
+| `plans/` | `/rr-plan` | Files that change / Order of work / Risks / Proof (every requirement to a test or command) / Rollback; each row carries its files and its *Consumes* line |
+| `adr/` | you, or `architect` | Architecture Decision Records (MADR style) |
+| `constitution.md` | `/rr-setup`, then you | the principles the project does not negotiate, cited as `C<n>` in specs, plans and reviews; at most 15 lines |
+
+The skills fill in the plugin's templates
+(`skills/project-init/templates/{spec,plan,adr}.md`); a folder holds a
+`TEMPLATE.md` only when this project overrides the plugin's, and the skills read
+that one first. Commit the artefacts with the code they describe, so the
+reasoning survives the pull request. A task's own record — weight, plan, questions, verify runs, review,
+verdict — is not here but in `.ai/reports/<task-id>/task.md`, written by
+`state.py`.

package/skills/project-update/history/blobs/07ff7fa6f93d471ff533f553b4e523e4105ccde1f3dab70132c5237728f68422

@@ -0,0 +1,13 @@
+<!-- riskrails:start -->
+## AI agent workflow
+
+This repository runs an agentic pipeline under `.ai/`. Read `.ai/AGENTS.md` first: it routes to the policies, workflows and rules, which load on demand; `.ai/policies/` is binding.
+
+- Production behaviour is the source of truth: document problems outside the task, do not fix them.
+
+- A change runs through `/rr-build <request>`; `/rr-status` shows where it stands. Each step names the files it may touch — an edit outside them is refused: answer `SCOPE_CHANGE_REQUIRED`.
+
+- Verify before reporting done: `verify_command` from `.ai/policies/testing.md` once, to the end, then `e2e_command` once; every failure fixed as one batch; show the output.
+- No agent merges or deploys; commit, push, approval only as the dialog picks and the harness records, else a human. When a review flags a mistake twice, the fix goes in this file.
+- Files, not chat, carry decisions: `.ai/reports/<task-id>/task.md` (answer by filling `[Answer]:`), `.ai/state/handoff.md` (read first when resuming), `docs/sdlc/constitution.md` (this project's principles).
+<!-- riskrails:end -->

package/skills/project-update/history/blobs/0ef4a360c76da290173dea0f8073949cb0f8113710a38df95acae5d96bdd1286

@@ -0,0 +1,123 @@
+# Testing policy
+
+Tests describe behaviour. Coverage percentage is a side effect, not a goal.
+
+## Characterization first
+
+Before changing behaviour that is not covered by a test — which is most legacy
+behaviour — write a test that passes against the code **as it is today**. That
+test is the definition of what must not break. Only then change the code.
+
+```
+characterization test → refactor → verify identical behaviour → feature change
+```
+
+Never do those in one step, and never in one commit.
+
+## What to consider, by kind of change
+
+| Change touches | Also test |
+|---|---|
+| a shared service | the existing callers, not only the new one |
+| money, tax, fiscal | rounding, currency, negative and zero amounts, refunds |
+| a state machine | every transition that is now reachable, and the ones that must stay unreachable |
+| an async consumer | retry, double delivery, out-of-order delivery, poison message |
+| an external integration | timeout, 500, malformed response, partial write |
+| a write path | idempotency, concurrency, transaction boundaries |
+| authorization | the negative case, for every role |
+| a public API or event | the old shape still works |
+
+## Three scopes, three moments
+
+A task runs tests three times at most, and each run has its own scope. Nothing
+else runs in between.
+
+| When | What runs | Command |
+|---|---|---|
+| after each implementation step, before `step-done` | **only the tests the plan named for that step** — the files it touched, their direct callers' tests | `step_test_command` |
+| once, after the **last** step | the full fast suite — unit and integration, no e2e | `verify_command` |
+| once, at the **end of the task**, after the full suite is green | the end-to-end suite | `e2e_command` |
+
+- A step never runs the full suite, and **never** runs e2e. If the plan named
+  no test for a step, nothing runs for it.
+- A step's tests are scoped by path or filter, not by `--stop-on-failure`: the
+  scoped run still goes to the end, and its failures are fixed inside that step.
+- The e2e suite runs **once per task**, at the very end, never per step. Skip it
+  at T0/T1, and when the change cannot reach a flow the e2e suite covers — say
+  which, in one line; silence is not a verdict.
+- A failure in a step's own tests is fixed in that step, before `step-done`;
+  the batch rule below is for the two end-of-task runs.
+- After a green suite, a documents-only edit runs `doc_tests` (step scope), not the suite.
+
+## Reading a failure
+
+**Run to the end, then fix as one batch.** The verification command runs with
+no fail-fast flag and is never interrupted at the first failure. Collect every
+failure, classify each one, fix all the new regressions in a single remediation
+step (`state.py remediate`), and run the command once more. One failure never
+sends the task back to the start: the plan, the tier and the finished steps
+stand. At most two remediation rounds; a third means the human decides.
+
+Classify before fixing. The four answers are:
+
+- **EXISTING TEST FAILURE** — it failed before this change too. Say so, do not
+  fix it inside this task.
+- **NEW REGRESSION** — this change broke it. Fix the code, not the test.
+- **TEST ENVIRONMENT FAILURE** — database, fixtures, network, container. Say what
+  is missing.
+- **UNKNOWN** — you could not tell. Say what you tried.
+
+A review's MEDIUM and LOW findings are recorded with `state.py memory risk add`, not
+fixed in the task; only a BLOCKER, a HIGH or a regression buys an `--after-fix` run.
+
+**Never edit a test to make it pass when production behaviour changed
+unexpectedly.** A test that suddenly disagrees with the code is evidence, and
+deleting evidence is the worst available option.
+
+## Verification
+
+Three commands, one per scope. `verify_command` proves the project is healthy;
+`step_test_command` proves one step is; `e2e_command` proves the whole flow
+still works. Keep each to one command — chain the pieces in a Makefile or
+composer script if there are several — and make sure none of them stops at the
+first failure (`--stop-on-failure`, `-x`, `--bail`, `failfast` are off).
+
+`verify_command` must **exclude** the e2e suite: it is the fast loop run after
+the last step and again after a remediation batch. `e2e_command` runs once, at
+the end of the task. A bugfix still shows its new failing test first — that one
+test only, through `single_test`.
+
+```
+verify_command:      # the full fast suite, e2e excluded — e.g. make test   |   composer qa && vendor/bin/phpunit --exclude-group e2e
+step_test_command:   # the same runner, scoped to a path or filter — e.g. vendor/bin/phpunit {files} | pytest {files}
+e2e_command:         # the end-to-end suite, run once at the end of a task — e.g. make e2e | vendor/bin/behat | npx playwright test
+lint_command:        # e.g. vendor/bin/php-cs-fixer fix --dry-run | ruff check . | npm run lint — write `none` if the project has none
+doc_tests:           # the suites a documents-only edit runs after a green suite — e.g. tests/test_docs.py; `none` if the project has none
+typecheck_command:   # e.g. vendor/bin/phpstan analyse --no-progress | mypy . | npx tsc --noEmit — `none` if the project has none
+healthy_output:      # two or three lines of what a green run ends with
+runtime:             # roughly, for each command, so a hang is recognisable
+single_test:         # how to run one test, for the failing-test-first step of a bugfix
+```
+
+`step_test_command` may contain `{files}`, which is replaced by the paths the
+step names; without it the paths are appended. The placeholder is what lets
+`sensors.py` run a step's own tests for the "test must bite" check, so a runner
+that only takes a `--filter` gets `bite: unavailable` rather than a wrong answer.
+
+`lint_command` and `typecheck_command` are read by the deterministic sensors,
+never by a model. They decide, together with the test run, whether a T2 change
+can skip its model review (`risk-tiers.json`, `sensors`). A **missing** line is
+`unavailable` and keeps the review; only the literal `none`, written by a human,
+says the project has no such tool. `sensors.py detect` proposes the exact line
+from the config files it finds, and never runs what it detected.
+
+If the project has no e2e suite, write `e2e_command: none` and say so — an
+empty line is read as "not written down yet" and the next task will go looking
+for it. Say which group, tag or directory marks the e2e tests and how
+`verify_command` excludes them, so a step's scoped run and the fast suite stay
+free of them.
+
+## Project specifics
+
+<!-- The real commands: how to run unit tests, integration tests, a single test.
+     Where fixtures live. What the CI runs. Cite the config. -->

package/skills/project-update/history/blobs/18c7a2753ce9cb6f6d3d1e9d5d1125d75950b879d56b7325225b200869631b29

@@ -0,0 +1,15 @@
+# Constitution — {{PROJECT}}
+
+<!-- The 10–15 principles this project does not negotiate, one line each, numbered C1…;
+     /sdlc-spec and the planner cite them. Under 15: what is not here lives in .ai/policies/. -->
+
+C1. Production behaviour is the source of truth; what looks wrong may be load-bearing.
+C2. A bugfix starts with the failing test; legacy behaviour gets a characterization test before it changes.
+C3. A refactoring changes no behaviour and is never mixed with a feature.
+C4. Every step names its files; scope grows only by amending the plan.
+C5. No agent merges or deploys; an agent commits, pushes or approves only by running, verbatim and once, a command a human picked in the dialog, as the harness recorded; else a human runs it outside.
+C6. <!-- project principle — filled by /ai-init from the survey, confirmed by you -->
+C7. <!-- project principle -->
+C8. <!-- project principle -->
+C9. <!-- project principle -->
+C10. <!-- project principle -->

package/skills/project-update/history/blobs/25d4f2a86deb5e2574bb3210b67bb24fcc4afb19f93a7b65a057daa874a9d18e

@@ -0,0 +1 @@
+11

package/skills/project-update/history/blobs/48d9950f16e31d55475f566a80dc95f64b35f1c804d2f51729e313a4f29bac8d

@@ -0,0 +1,13 @@
+<!-- riskrails:start -->
+## AI agent workflow
+
+This repository runs an agentic pipeline under `.ai/`. Read `.ai/AGENTS.md` first: it routes to the policies, workflows and rules, which load on demand; `.ai/policies/` is binding.
+
+- Production behaviour is the source of truth: document problems outside the task, do not fix them.
+
+- A change runs through `/rr-build <request>`; `/rr-status` shows where it stands. Each step names the files it may touch — an edit outside them is refused: answer `SCOPE_CHANGE_REQUIRED`. One `apply_patch` is checked file by file: a patch that reaches outside the step is refused whole.
+
+- Verify before reporting done: `verify_command` from `.ai/policies/testing.md` once, to the end, then `e2e_command` once; every failure fixed as one batch; show the output.
+- No agent merges or deploys; commit, push, approval only as the dialog picks and the harness records, else a human outside. When a review flags the same mistake twice, the correction goes into this file.
+- Files, not chat, carry decisions: `.ai/reports/<task-id>/task.md` (answer by filling `[Answer]:`), `.ai/state/handoff.md` (read first when resuming), `docs/sdlc/constitution.md`.
+<!-- riskrails:end -->

package/skills/project-update/history/blobs/5a93f78b4ed4d416c171139b2ce610a117f9c1dd46fbb56ca86729cb4c53d10c

@@ -0,0 +1,6 @@
+# claude-agentic (.ai)
+.ai/state/*.json
+.ai/state/handoff.md
+.ai/state/*.tmp
+.ai/state/*.jsonl
+.ai/local/