riskrails 3.2.2 → 4.0.1

package/skills/project-update/history/blobs/c644838866df2001a42501a988dd7b77aacf862bf09d22b465f3cd8a22c6b6eb

@@ -0,0 +1,33 @@
+# Workflow: feature
+
+New behaviour that someone asked for. The default workflow.
+
+> Who runs a stage is set by `pipeline_profile` in `policies/risk-tiers.json`.
+> The table names the agent for when a stage is delegated. In the default `solo`
+> profile T0–T2 run in direct mode — the session does every stage itself, in a
+> few lines, with cheap readers and one `sonnet` review at T2 — and T3+ run the
+> full pipeline with the delegations below.
+
+| Stage | Who | Notes |
+|---|---|---|
+| DISCOVERY | `ai-indexer` then `ai-discovery` | where the feature lands, what it will touch |
+| CONTEXT | `ai-context` | the structured summary everything downstream reads |
+| IMPACT ANALYSIS | `ai-discovery` (second pass) | callers, data, contracts, other environments |
+| RISK CLASSIFICATION | `ai-risk` | one tier, from `policies/risk-tiers.json` |
+| PLAN | none at T0/T1; the session at T2; `ai-planner` from T3 | steps with `allowed_files`; STRONG for T3/T4, `ai-expert` for T5 |
+| PLAN REVIEW | `ai-reviewer` | T3 and above |
+| IMPLEMENTATION | the session, one step at a time | scope-guarded |
+| TEST | the session (`ai-tester` in `team`) | once, after the last step, to the end; every failure fixed as one batch, then one more run |
+| ADVERSARIAL REVIEW | `ai-reviewer` | T2 and above |
+| SECURITY REVIEW | `ai-security` | T4, T5, and anything touching auth or personal data |
+| RELEASE REPORT | `ai-release` | full report from T2 up |
+| HUMAN APPROVAL | the human | the pipeline stops here |
+
+## Specific to this workflow
+
+- The plan states what stays the same, not only what changes. A feature that
+  quietly alters an existing behaviour is the most common source of regressions.
+- New code paths need their negative cases tested: not authorized, not found,
+  invalid input, external system down.
+- If the feature needs a new dependency, that is a decision worth its own line in
+  the plan.

package/skills/project-update/history/blobs/c980d74f76a4bdfb38c94b573ac10a54eb50b850b052e15fa6f2442889b36ccb

@@ -0,0 +1,32 @@
+# Workflow: investigation
+
+A question, not a change. "Why does this happen?", "where is this handled?",
+"can we do X?". The deliverable is an answer with evidence.
+
+> Who runs a stage is set by `pipeline_profile` in `policies/risk-tiers.json`.
+> The table names the agent for when a stage is delegated; in the default `solo`
+> profile the session does the stage inline up to the tier where the profile
+> delegates it.
+
+| Stage | Who | Notes |
+|---|---|---|
+| DISCOVERY | `ai-indexer`, then `ai-discovery` in parallel per area | read-only |
+| CONTEXT | `ai-context` | the structured summary is often the deliverable itself |
+| IMPACT ANALYSIS | `ai-discovery` | only if the question is "what would it take to…" |
+| RISK CLASSIFICATION | `ai-risk` | so the answer carries the tier a change would have |
+| REPORT | the session | written by the main session, not delegated |
+
+There is no implementation stage. If the investigation concludes that something
+should change, that is a **new task** with its own intent, plan and approval.
+
+## Rules
+
+- Nothing is edited. Not a comment, not a formatting fix.
+- Every claim in the answer is labelled and cited: KNOWN FACT with `file:line`,
+  INFERENCE with what it rests on, UNKNOWN with what would settle it.
+- Contradictions between documentation and code are reported as both, not
+  resolved by preference.
+- Findings worth acting on go into `project/known-risks.md` so the next task can
+  see them.
+- Say what you could not determine. An investigation that hides its gaps is worse
+  than one that admits them.

package/skills/project-update/history/blobs/ceed2f3bd937f862d0e6ca59ce1b1e3603e19a0d7f85d90d6dfeb7bf690153be

@@ -0,0 +1,29 @@
+# Workflow: bugfix
+
+Something behaves wrongly. The goal is the smallest change that fixes it without
+changing anything else.
+
+| Stage | Who | Notes |
+|---|---|---|
+| DISCOVERY | `ai-discovery` | reproduce first: find the exact path that produces the symptom |
+| CONTEXT | `ai-context` | include the *correct* behaviour and where it is defined |
+| IMPACT ANALYSIS | `ai-discovery` | who else depends on the current, wrong behaviour |
+| RISK CLASSIFICATION | `ai-risk` | a bug in a payment path is still T4 |
+| PLAN | `ai-planner` | failing test first, then the fix |
+| IMPLEMENTATION | the session | the failing test is its own step |
+| TEST | `ai-tester` | the new test fails before the fix and passes after |
+| ADVERSARIAL REVIEW | `ai-reviewer` | T2 and above |
+| SECURITY REVIEW | `ai-security` | if the bug was a security bug, always |
+| RELEASE REPORT | `ai-release` | |
+| HUMAN APPROVAL | the human | |
+
+## Specific to this workflow
+
+- **Write the failing test first.** A bugfix without a test that failed before it
+  is a bugfix nobody can prove.
+- Find out *why* the bug exists before fixing it. A bug that is deliberate
+  behaviour somebody depends on is not a bug; it is a requirements conflict, and
+  it goes back to the human.
+- Resist the urge to fix the surrounding code. Note it, fix the bug.
+- If the same bug exists in three places, fix the one that was reported and list
+  the other two in `project/known-risks.md`.

package/skills/project-update/history/blobs/d51ea2e893482a20c5882056cf8043327ca1dc1c957927f6746929a47ee8368e

@@ -0,0 +1,45 @@
+# Manager
+
+The manager is the main session, not a subagent. It orchestrates; it does not
+collect facts itself, and it keeps its own context small so it can stay in the
+task until the end.
+
+The role is the same whichever runtime the session is: Claude Code or Codex. The
+agents it delegates to carry the same names in both, and the tier each runs at is
+the same; only the model behind that tier differs.
+
+## Responsibilities
+
+- Understand the request and restate it in one sentence the human can correct.
+- Classify the task: which workflow, which risk tier.
+- Establish scope, and defend it.
+- Choose the stages the tier requires, and the agent for each.
+- Do inline what the pipeline profile leaves inline — in a few lines, recorded
+  in the state file — and delegate the rest. In the `solo` profile the
+  developer's request and `grep -n` are the context for anything up to T2; a
+  subagent is spawned only for what the tier makes mandatory, or on a trigger
+  from `policies/risk-tiers.json`. Never read logs, test output or large files
+  into its own context.
+- Split the work into steps small enough that each one names the files it touches.
+- Track state through `state.py` after every stage. The state file, not the
+  conversation, is what survives.
+- Decide when to escalate a model tier, one task at a time, against the triggers
+  in `policies/risk-tiers.json`, and name the trigger when it does.
+- Record, in every artifact, the tier **and the model that actually ran** — see
+  `policies/model-routing.md`. A gate may have moved an agent down a tier, and a
+  Codex agent file may override the model asked for at spawn time.
+- Write the final summary the human reads.
+
+## What the manager must not do
+
+- Skip a stage because the task looks easy. Make it lightweight instead, and
+  record that it happened.
+- Expand scope. A discovered problem goes into `project/known-risks.md`.
+- Delegate the conclusion. The synthesis a human reads is written by the session.
+- Commit, push, merge or deploy. The pipeline ends at human approval.
+
+## Implementation
+
+The manager implements approved steps itself, under this policy and under
+`ai-scope-guard`. `ai-implementer` exists for mechanical, pattern-copying steps
+and for when the human asks for it — not as the default.

package/skills/project-update/history/blobs/d78f5e0bb1380259fce2cce009785a9a11f6de8b87a160080b9872c059f95060

@@ -0,0 +1,34 @@
+# Workflow: investigation
+
+A question, not a change. "Why does this happen?", "where is this handled?",
+"can we do X?". The deliverable is an answer with evidence.
+
+> Who runs a stage is set by `pipeline_profile` in `policies/risk-tiers.json`.
+> The table names the agent for when a stage is delegated. In the default `solo`
+> profile T0–T3 run in direct mode — the session does every stage itself, in a
+> few lines, with cheap readers and one review (BALANCED at T2; STRONG at T3,
+> whose plan the human approves in plan mode) — and T4+ run the full pipeline
+> with the delegations below.
+
+| Stage | Who | Notes |
+|---|---|---|
+| DISCOVERY | `ai-indexer`, then `ai-discovery` in parallel per area | read-only |
+| CONTEXT | `ai-context` | the structured summary is often the deliverable itself |
+| IMPACT ANALYSIS | `ai-discovery` | only if the question is "what would it take to…" |
+| RISK CLASSIFICATION | `ai-risk` | so the answer carries the tier a change would have |
+| REPORT | the session | written by the main session, not delegated |
+
+There is no implementation stage. If the investigation concludes that something
+should change, that is a **new task** with its own intent, plan and approval.
+
+## Rules
+
+- Nothing is edited. Not a comment, not a formatting fix.
+- Every claim in the answer is labelled and cited: KNOWN FACT with `file:line`,
+  INFERENCE with what it rests on, UNKNOWN with what would settle it.
+- Contradictions between documentation and code are reported as both, not
+  resolved by preference.
+- Findings worth acting on go into `project/known-risks.md` so the next task can
+  see them.
+- Say what you could not determine. An investigation that hides its gaps is worse
+  than one that admits them.

package/skills/project-update/history/blobs/d97f46a2cca020406252b1f7baa4184617fa71faca3885e2379c44ae4e1d9327

@@ -0,0 +1,67 @@
+# Task state
+
+`state.json` is the machine-readable record of the task in flight. It is
+written by `skills/ai-task/state.py` (atomically), read by `/rr-status`, and
+enforced by `ai-scope-guard`, which derives the files the current step may touch
+from it.
+
+Two other writers exist, and only these two. A schema migration in
+`/rr-setup --update` may change the state through `ctx.patch_state()`, with the
+same atomic write and a `schema_migrated` history entry — that is how a task in
+flight survives a change to the shape of this file. And `hooks/context-guard.py`
+writes `session.json`, the sidecar beside this file, and nothing else: it never
+touches `state.json`. Nothing else writes any of it — an agent never edits
+them by hand, and the path guard refuses when one tries.
+
+It is **not committed**: it describes a session, not the repository. The
+`.gitignore` entry added by `/rr-setup` keeps it out of git.
+
+When a task closes, `state.py close` writes the final state to
+`.ai/state/logs/<task-id>/state.json`, beside the task's verify logs — local,
+**not** committed. What is committed is `.ai/reports/<task-id>/events.jsonl`
+and `task.md`, and in packages mode the task's compact record under
+`.ai/memory/` — that is the audit trail: which stages ran, in what order, who
+approved what, and when (the plugin's `docs/local-memory.md`).
+
+It holds facts, never transcripts:
+
+```
+task_id, goal, workflow, risk_tier, current_stage, affected_modules,
+context_summary_ref, approved_plan { ref, current_step_id, steps[] },
+completed_steps, test_status, e2e_status, review_status, security_status, open_risks,
+next_action, owner_runtime, resume_point { stage, step_id, next_action, at, runtime },
+questions { file, pending[] }, handoff { file, written_at, reason },
+human_approval { required, granted, granted_by, granted_at,
+                 requested_at, gate_id, requested_session, rejected_at, via, unattended },
+created_at, updated_at, history[]
+```
+
+`state.py` applies the schema-2 keys in memory as it loads, so a project that has
+not run `/rr-setup --update` yet still answers every command; `save()` then writes
+them. A reader that opens this file directly sees what is on disk, not those
+defaults.
+
+## The other files beside it
+
+| File | Written by | Committed |
+|---|---|---|
+| `state.json` | `state.py` | no |
+| `session.json` | `context-guard.py`, on SessionStart and each prompt | no |
+| `handoff.md` | `state.py handoff` — never a model | no |
+| `../reports/<task-id>/task.md` §Questions | `state.py ask/answer/questions` | yes |
+| `../reports/<task-id>/events.jsonl` | `state.py` (`emit`), append-only | yes |
+
+`handoff.md` is the ≤ 30-line frame a session that lost its context reads first:
+the goal, the next action and its resume point, the pending questions, the latest
+decisions, rejected options and failed attempts, and the user's last instruction
+verbatim. It is rendered from the four sources above, so deleting it loses
+nothing — the next stage-moving command writes it again.
+
+`events.jsonl` is the journal: one line per state change, `history[]`'s facts
+with types beside them. It is best effort by contract — a line that cannot be
+written never fails the command that emitted it — so nothing depends on it being
+complete, and readers skip a line they cannot parse.
+
+If this file is corrupt, `state.py` refuses to read it rather than replacing it.
+Inspect it by hand: the scope guard's boundaries come from here, and a silently
+regenerated state file means an unbounded implementer.

package/skills/project-update/history/blobs/da3ecd4c4c414c93d04488685931df39a56bf959bfeb9c45cb1aea2c13bd991b

@@ -0,0 +1,38 @@
+# Manager
+
+The manager is the main session, not a subagent. It orchestrates; it does not
+collect facts itself, and it keeps its own context small so it can stay in the
+task until the end.
+
+## Responsibilities
+
+- Understand the request and restate it in one sentence the human can correct.
+- Classify the task: which workflow, which risk tier.
+- Establish scope, and defend it.
+- Choose the stages the tier requires, and the agent for each.
+- Do inline what the pipeline profile leaves inline — in a few lines, recorded
+  in the state file — and delegate the rest. In the `solo` profile the
+  developer's request and `grep -n` are the context for anything up to T2; a
+  subagent is spawned only for what the tier makes mandatory, or on a trigger
+  from `policies/risk-tiers.json`. Never read logs, test output or large files
+  into its own context.
+- Split the work into steps small enough that each one names the files it touches.
+- Track state through `state.py` after every stage. The state file, not the
+  conversation, is what survives.
+- Decide when to escalate a model tier, one task at a time, against the triggers
+  in `policies/risk-tiers.json`.
+- Write the final summary the human reads.
+
+## What the manager must not do
+
+- Skip a stage because the task looks easy. Make it lightweight instead, and
+  record that it happened.
+- Expand scope. A discovered problem goes into `project/known-risks.md`.
+- Delegate the conclusion. The synthesis a human reads is written by the session.
+- Commit, push, merge or deploy. The pipeline ends at human approval.
+
+## Implementation
+
+The manager implements approved steps itself, under this policy and under
+`ai-scope-guard`. `ai-implementer` exists for mechanical, pattern-copying steps
+and for when the human asks for it — not as the default.

package/skills/project-update/history/blobs/e129bf71a5a922e24b2c1bc8daa8a5d2b5589b0069770e17ce17e7db5ed4e7a4

@@ -0,0 +1,27 @@
+# Workflow: feature
+
+New behaviour that someone asked for. The default workflow.
+
+| Stage | Who | Notes |
+|---|---|---|
+| DISCOVERY | `ai-indexer` then `ai-discovery` | where the feature lands, what it will touch |
+| CONTEXT | `ai-context` | the structured summary everything downstream reads |
+| IMPACT ANALYSIS | `ai-discovery` (second pass) | callers, data, contracts, other environments |
+| RISK CLASSIFICATION | `ai-risk` | one tier, from `policies/risk-tiers.json` |
+| PLAN | `ai-planner` | steps with `allowed_files`; STRONG for T3/T4, `ai-expert` for T5 |
+| PLAN REVIEW | `ai-reviewer` | T3 and above |
+| IMPLEMENTATION | the session, one step at a time | scope-guarded |
+| TEST | `ai-tester` | after every step, not only at the end |
+| ADVERSARIAL REVIEW | `ai-reviewer` | T2 and above |
+| SECURITY REVIEW | `ai-security` | T4, T5, and anything touching auth or personal data |
+| RELEASE REPORT | `ai-release` | full report from T2 up |
+| HUMAN APPROVAL | the human | the pipeline stops here |
+
+## Specific to this workflow
+
+- The plan states what stays the same, not only what changes. A feature that
+  quietly alters an existing behaviour is the most common source of regressions.
+- New code paths need their negative cases tested: not authorized, not found,
+  invalid input, external system down.
+- If the feature needs a new dependency, that is a decision worth its own line in
+  the plan.

package/skills/project-update/history/blobs/e504529519a371892838725f8b89b5d32e3300e345bcbf2643a3a1a48434b3dd

@@ -0,0 +1,24 @@
+# Directory rules
+
+One file per slug, `<slug>.md`, holding the rules that apply to a part of this
+repository and nowhere else. `/rr-setup --update` renders each of them into a
+managed block in the instruction file of every directory it names, so an agent
+working there reads them without anything being loaded for a task that never
+goes near that code.
+
+```markdown
+---
+dirs: [src/Payment, tests/Payment]      # required: where the rules apply
+paths: ["src/Payment/**"]               # optional: also a path-scoped rules file
+---
+# Payment rules
+- Amounts are integer minor units; never a float.
+- A refund never writes to the order; it emits an event.
+```
+
+- `dirs:` is the list of directories whose `CLAUDE.md` / `AGENTS.md` receive the
+  block `<!-- riskrails:rule:<slug>:start -->` … `:end`, created if absent.
+  Text outside the markers is yours and is never touched.
+- The body is what an agent reads: rules, not rationale. Keep it under a screen.
+- This file is the format, not a rule: no rule ships with the plugin. Delete a
+  `<slug>.md` and the next `/rr-setup --update` offers to remove what it rendered.

package/skills/project-update/history/blobs/e9e62d03ca70b3dffccef8dceeb214173352cfef005145e519f0e037993f1c03

@@ -0,0 +1,36 @@
+# Workflow: bugfix
+
+Something behaves wrongly. The goal is the smallest change that fixes it without
+changing anything else.
+
+> Who runs a stage is set by `pipeline_profile` in `policies/risk-tiers.json`.
+> The table names the agent for when a stage is delegated. In the default `solo`
+> profile T0–T3 run in direct mode — the session does every stage itself, in a
+> few lines, with cheap readers and one review (BALANCED at T2; STRONG at T3,
+> whose plan the human approves in plan mode) — and T4+ run the full pipeline
+> with the delegations below.
+
+| Stage | Who | Notes |
+|---|---|---|
+| DISCOVERY | `ai-discovery` | reproduce first: find the exact path that produces the symptom |
+| CONTEXT | `ai-context` | include the *correct* behaviour and where it is defined |
+| IMPACT ANALYSIS | `ai-discovery` | who else depends on the current, wrong behaviour |
+| RISK CLASSIFICATION | `ai-risk` | a bug in a payment path is still T4 |
+| PLAN | `ai-planner` | failing test first, then the fix |
+| IMPLEMENTATION | the session | the failing test is its own step |
+| TEST | the session (`ai-tester` in `team`) | the new test is shown failing before the fix; each step runs only its own scoped tests; the full verification command runs once after the last step, to the end, then the e2e suite once; every failure fixed as one batch |
+| ADVERSARIAL REVIEW | `ai-reviewer` | T2 and above |
+| SECURITY REVIEW | `ai-security` | if the bug was a security bug, always |
+| RELEASE REPORT | `ai-release` | |
+| HUMAN APPROVAL | the human | |
+
+## Specific to this workflow
+
+- **Write the failing test first.** A bugfix without a test that failed before it
+  is a bugfix nobody can prove.
+- Find out *why* the bug exists before fixing it. A bug that is deliberate
+  behaviour somebody depends on is not a bug; it is a requirements conflict, and
+  it goes back to the human.
+- Resist the urge to fix the surrounding code. Note it, fix the bug.
+- If the same bug exists in three places, fix the one that was reported and list
+  the other two in `project/known-risks.md`.

package/skills/project-update/history/blobs/effefbaaf4beb8f1ba55081d6b7e74bf25ebb91045dd10613418f17b95fa7182

@@ -0,0 +1,33 @@
+# Workflow: investigation
+
+A question, not a change. "Why does this happen?", "where is this handled?",
+"can we do X?". The deliverable is an answer with evidence.
+
+> Who runs a stage is set by `pipeline_profile` in `policies/risk-tiers.json`.
+> The table names the agent for when a stage is delegated. In the default `solo`
+> profile T0–T2 run in direct mode — the session does every stage itself, in a
+> few lines, with cheap readers and one `sonnet` review at T2 — and T3+ run the
+> full pipeline with the delegations below.
+
+| Stage | Who | Notes |
+|---|---|---|
+| DISCOVERY | `ai-indexer`, then `ai-discovery` in parallel per area | read-only |
+| CONTEXT | `ai-context` | the structured summary is often the deliverable itself |
+| IMPACT ANALYSIS | `ai-discovery` | only if the question is "what would it take to…" |
+| RISK CLASSIFICATION | `ai-risk` | so the answer carries the tier a change would have |
+| REPORT | the session | written by the main session, not delegated |
+
+There is no implementation stage. If the investigation concludes that something
+should change, that is a **new task** with its own intent, plan and approval.
+
+## Rules
+
+- Nothing is edited. Not a comment, not a formatting fix.
+- Every claim in the answer is labelled and cited: KNOWN FACT with `file:line`,
+  INFERENCE with what it rests on, UNKNOWN with what would settle it.
+- Contradictions between documentation and code are reported as both, not
+  resolved by preference.
+- Findings worth acting on go into `project/known-risks.md` so the next task can
+  see them.
+- Say what you could not determine. An investigation that hides its gaps is worse
+  than one that admits them.

package/skills/project-update/history/blobs/f6af4581bafbf62b257d57e06c3ae2c5998aeca608ee7df037fcc3c3e4b563a9

@@ -0,0 +1,34 @@
+# Workflow: bugfix
+
+Something behaves wrongly. The goal is the smallest change that fixes it without
+changing anything else.
+
+> Who runs a stage is set by `pipeline_profile` in `policies/risk-tiers.json`.
+> The table names the agent for when a stage is delegated; in the default `solo`
+> profile the session does the stage inline up to the tier where the profile
+> delegates it.
+
+| Stage | Who | Notes |
+|---|---|---|
+| DISCOVERY | `ai-discovery` | reproduce first: find the exact path that produces the symptom |
+| CONTEXT | `ai-context` | include the *correct* behaviour and where it is defined |
+| IMPACT ANALYSIS | `ai-discovery` | who else depends on the current, wrong behaviour |
+| RISK CLASSIFICATION | `ai-risk` | a bug in a payment path is still T4 |
+| PLAN | `ai-planner` | failing test first, then the fix |
+| IMPLEMENTATION | the session | the failing test is its own step |
+| TEST | the session (`ai-tester` in `team`) | the new test is shown failing before the fix; the full verification command runs once at the end |
+| ADVERSARIAL REVIEW | `ai-reviewer` | T2 and above |
+| SECURITY REVIEW | `ai-security` | if the bug was a security bug, always |
+| RELEASE REPORT | `ai-release` | |
+| HUMAN APPROVAL | the human | |
+
+## Specific to this workflow
+
+- **Write the failing test first.** A bugfix without a test that failed before it
+  is a bugfix nobody can prove.
+- Find out *why* the bug exists before fixing it. A bug that is deliberate
+  behaviour somebody depends on is not a bug; it is a requirements conflict, and
+  it goes back to the human.
+- Resist the urge to fix the surrounding code. Note it, fix the bug.
+- If the same bug exists in three places, fix the one that was reported and list
+  the other two in `project/known-risks.md`.

package/skills/project-update/history/blobs/fc35045777d29630303430752a651b3e553580a581036a02cc103eb96a46f4b0

@@ -0,0 +1,34 @@
+# Workflow: feature
+
+New behaviour that someone asked for. The default workflow.
+
+> Who runs a stage is set by `pipeline_profile` in `policies/risk-tiers.json`.
+> The table names the agent for when a stage is delegated. In the default `solo`
+> profile T0–T3 run in direct mode — the session does every stage itself, in a
+> few lines, with cheap readers and one review (BALANCED at T2; STRONG at T3,
+> whose plan the human approves in plan mode) — and T4+ run the full pipeline
+> with the delegations below.
+
+| Stage | Who | Notes |
+|---|---|---|
+| DISCOVERY | `ai-indexer` then `ai-discovery` | where the feature lands, what it will touch |
+| CONTEXT | `ai-context` | the structured summary everything downstream reads |
+| IMPACT ANALYSIS | `ai-discovery` (second pass) | callers, data, contracts, other environments |
+| RISK CLASSIFICATION | `ai-risk` | one tier, from `policies/risk-tiers.json` |
+| PLAN | none at T0/T1; the session at T2, in plan mode at T3; `ai-planner` from T4 | steps with `allowed_files`; STRONG for T4, `ai-expert` for T5 |
+| PLAN REVIEW | the human at T3 (plan mode); `ai-reviewer` from T4 | |
+| IMPLEMENTATION | the session, one step at a time | scope-guarded |
+| TEST | the session (`ai-tester` in `team`) | per step, only that step's tests; the full suite once after the last step, to the end, then the e2e suite once at the end of the task; every failure fixed as one batch, then one more run |
+| ADVERSARIAL REVIEW | `ai-reviewer` | T2 and above |
+| SECURITY REVIEW | `ai-security` | T4, T5, and anything touching auth or personal data |
+| RELEASE REPORT | `ai-release` | full report from T2 up |
+| HUMAN APPROVAL | the human | the pipeline stops here |
+
+## Specific to this workflow
+
+- The plan states what stays the same, not only what changes. A feature that
+  quietly alters an existing behaviour is the most common source of regressions.
+- New code paths need their negative cases tested: not authorized, not found,
+  invalid input, external system down.
+- If the feature needs a new dependency, that is a decision worth its own line in
+  the plan.

package/skills/project-update/history/blobs/fdc21345c77f92a42d244aa104f393f439a0ff9981a9fd462bd837e8a47931bb

@@ -0,0 +1,48 @@
+# Manager
+
+The manager is the main session, not a subagent. It orchestrates; it does not
+collect facts itself, and it keeps its own context small so it can stay in the
+task until the end.
+
+The role is the same whichever runtime the session is: Claude Code or Codex. The
+agents it delegates to carry the same names in both, and the tier each runs at is
+the same; only the model behind that tier differs.
+
+## Responsibilities
+
+- Understand the request and restate it in one sentence the human can correct.
+- Classify the task: which workflow, which risk tier.
+- Establish scope, and defend it.
+- Choose the stages the tier requires, and the agent for each.
+- Do inline what the pipeline profile leaves inline — in a few lines — and
+  delegate the rest. In the `solo` profile T0–T2 are direct mode: the
+  developer's request and `grep -n` are the context, the plan is a few lines in
+  the conversation, and a subagent is spawned only as a cheap reader, for the
+  one `sonnet` review at T2, or on a trigger from `policies/risk-tiers.json`.
+  From T3 the full pipeline runs, stage by stage. Never read logs, test output
+  or large files into its own context.
+- Run the tests once, to the end, and fix every failure as one batch in a
+  `state.py remediate` step. One failure never restarts the task.
+- Split the work into steps small enough that each one names the files it touches.
+- Track state through `state.py` after every stage. The state file, not the
+  conversation, is what survives.
+- Decide when to escalate a model tier, one task at a time, against the triggers
+  in `policies/risk-tiers.json`, and name the trigger when it does.
+- Record, in every artifact, the tier **and the model that actually ran** — see
+  `policies/model-routing.md`. A gate may have moved an agent down a tier, and a
+  Codex agent file may override the model asked for at spawn time.
+- Write the final summary the human reads.
+
+## What the manager must not do
+
+- Skip a stage because the task looks easy. Make it lightweight instead, and
+  record that it happened.
+- Expand scope. A discovered problem goes into `project/known-risks.md`.
+- Delegate the conclusion. The synthesis a human reads is written by the session.
+- Commit, push, merge or deploy. The pipeline ends at human approval.
+
+## Implementation
+
+The manager implements approved steps itself, under this policy and under
+`ai-scope-guard`. `ai-implementer` exists for mechanical, pattern-copying steps
+and for when the human asks for it — not as the default.

package/skills/project-update/history/index.json

@@ -11,7 +11,8 @@
   "54eefe3d8cd6cd1ed56764e7bd412a4c919a28fc64b56b69dcafeecd7a921678",
   "fe513647c66e8883b326ea884a7e9cb045ce54c49b03d2e75a0b73c4756c423e",
   "8b3ef9586491a426767c01da5d01bdd6b0655c576c68c4cc6dfb093367817dc0",
-  "774b1e3a04ef0d49d33c44a2cfecd92eb6f6b738a12b6a681103ba7fc13e7b86"
+  "774b1e3a04ef0d49d33c44a2cfecd92eb6f6b738a12b6a681103ba7fc13e7b86",
+  "7bae90789625d6fb9071ecb412d14a8d1eb0bc5659d8d284c4eaf213e1b5de56"
  ],
  "ai-init/.ai/VERSION": [
   "4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865",
@@ -23,7 +24,8 @@
   "10159baf262b43a92d95db59dae1f72c645127301661e0a3ce4e38b295a97c58",
   "aa67a169b0bba217aa0aa88a65346920c84c42447c36ba5f7ea65f422c1fe5d8",
   "917df3320d778ddbaa5c5c7742bc4046bf803c36ed2b050f30844ed206783469",
-  "25d4f2a86deb5e2574bb3210b67bb24fcc4afb19f93a7b65a057daa874a9d18e"
+  "25d4f2a86deb5e2574bb3210b67bb24fcc4afb19f93a7b65a057daa874a9d18e",
+  "a1fb50e6c86fae1679ef3351296fd6713411a08cf8dd1790a4fd05fae8688164"
  ],
  "ai-init/.ai/agents/context.md": [
   "a213099429aff491b00e885c8d556465be2405072efbb9a3a297890a15a5b4ca",
@@ -177,7 +179,8 @@
   "4e67b352e2d7a29a83c4fa9f80a0d3ed9272da0f976a084c344b55e349f741b2",
   "1fdc406be22d9ea39f41e738c6bbd36a31ef4adc84ece06cfceebddaa86c9798",
   "1a8995e5f7e51b5be74fca82551e5d9e4d970c546d9fd6eecb6809a7f6af8821",
-  "6a3be0e624e5ad91e44d08857b7183ee53b7903e1e8d56ff196dbc9dde271e4a"
+  "6a3be0e624e5ad91e44d08857b7183ee53b7903e1e8d56ff196dbc9dde271e4a",
+  "7224ede803ea81e65a456e21b6028a0e848e8a880456c6503eebe7534ca4f6aa"
  ],
  "ai-init/.ai/policies/testing.md": [
   "930ccfac4ba1306341e32279278410b451246a52223c42e0597b5ee83706ff00",
@@ -187,21 +190,31 @@
   "3a492555cac3198136e239539466fb768cf672d5a972f5afd7d57c038d3cfed6",
   "8ad13d2ca4504cfd8e4ab7fe3a49129b228d9979461f0f758a71daeec78b6ae1",
   "0ef4a360c76da290173dea0f8073949cb0f8113710a38df95acae5d96bdd1286",
-  "00289f98434fed230eebe768dfb3425f83d737866a3aebc97aa95167c4fa0c6e"
+  "00289f98434fed230eebe768dfb3425f83d737866a3aebc97aa95167c4fa0c6e",
+  "4c45aee9b9fc5f6b4e1d9739e434c4094975a5a8dec6b9703fb25f3080680c77"
  ],
  "ai-init/.ai/policies/tooling.md": [
   "2c6afb3518714d35eaf0119bf2ae2154782bbece632dfdbd68988351abde61f5"
  ],
+ "ai-init/.ai/policies/verification.md": [
+  "3918b4ee011d9477b9d2779e2893ab599749c406d4b09439a9748b64fbff58f3"
+ ],
  "ai-init/.ai/policies/weight.json": [
   "7f3859c34035fe32abf937eebdd7240ac72ab32d254286cff7d939cf0cf6eaef",
-  "5353ca529c46f2443e12947ec205a6887fb594a4de1f87f0eb1c0e6c0f826133"
+  "5353ca529c46f2443e12947ec205a6887fb594a4de1f87f0eb1c0e6c0f826133",
+  "6d6dee8634abf9ac057bb206828b83a893a2afcf4f86bbe69e839a3b47d0adde"
  ],
  "ai-init/.ai/policies/weight.md": [
   "e639e99d3f59015dc21472de081ca7766231135399ac3a6f439e841e458251f4",
-  "5f65bc7ab3fc3c4e75ae05d49eaf4331fafc398c661abe33c69f7380a720344c"
+  "5f65bc7ab3fc3c4e75ae05d49eaf4331fafc398c661abe33c69f7380a720344c",
+  "c4dbeb180292a6199ad73a3be861ece07c1f8bf6bf0cc7ca204412bc8e1bb1d8"
+ ],
+ "ai-init/.ai/policies/weight.project.json": [
+  "7f834103e9d97aea44e76717bcdcbbe349c560e5b81a42ce85a1cec341041281"
  ],
  "ai-init/.ai/project/architecture.md": [
-  "5cbaaabe2c8d0e24582877aab05eeaaf4d53cb5e9515e81cd18368d13d2fe79e"
+  "5cbaaabe2c8d0e24582877aab05eeaaf4d53cb5e9515e81cd18368d13d2fe79e",
+  "449273200dfec2a56885c881ff34d40e8ecc00da53c24c2d09b7fbeb1004d255"
  ],
  "ai-init/.ai/project/business-rules.md": [
   "ab13c708e91c1de2adbc9ccdb1caec5c320197708bcaaa6d5cfd30c18a7dac34"
@@ -213,7 +226,8 @@
   "d9abea96dbe584fd77c27d5ed0523eb20d048f2d146e4909d16b2a7948db38c5"
  ],
  "ai-init/.ai/project/initial-assessment.md": [
-  "6af1b12f814384e517e8f09131b0524930ac1c849350db765d8a77c7a59905b9"
+  "6af1b12f814384e517e8f09131b0524930ac1c849350db765d8a77c7a59905b9",
+  "ba14a457e83f9dde65e4190fdfab83b912f7398c1442a2a1cb3d89bfac741cf3"
  ],
  "ai-init/.ai/project/integrations.md": [
   "1c2c3e5bbb132a152163ebeb678d57f0f7162a56ea92b84acc43cd2dedd4a935"
@@ -228,14 +242,16 @@
   "ab0ce5062b41aaff12b0525d56b42de6b9dee9ce9e1de2938f72675435013c6a"
  ],
  "ai-init/.ai/project/overview.md": [
-  "53376d1fca268d8fdb59a5a0d0e0a4fe2d3bc2a7689a79c00a227f41bd5a2165"
+  "53376d1fca268d8fdb59a5a0d0e0a4fe2d3bc2a7689a79c00a227f41bd5a2165",
+  "6221b7c14cc04634e485e562d464c6860d45666a7f63e293c06bb2944ff556cc"
  ],
  "ai-init/.ai/reports/.gitkeep": [
   "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  ],
  "ai-init/.ai/rules/README.md": [
   "a1ed0b4f3b73b1a29adfdf0d4d495553ba48707aa5a676496ebc28f993a57dcb",
-  "ae49c96abe45e56e88ae5e28e046212f7114d6413785cbe998f692d2914792be"
+  "ae49c96abe45e56e88ae5e28e046212f7114d6413785cbe998f692d2914792be",
+  "e504529519a371892838725f8b89b5d32e3300e345bcbf2643a3a1a48434b3dd"
  ],
  "ai-init/.ai/state/README.md": [
   "30b6dcbdcfbb8e9223af11edacc387b1102868261bbe7051c2d85ad1a18384e5",
@@ -245,7 +261,8 @@
   "19b1a6390e96136619d23bc2ef9afed8f15e62107de7c1052bc5ea23e5bb5692",
   "23a42febbacaa7b52a802d428033a99c0694391c81d51fe3b6e1dff608a641d5",
   "7ee99edafe7cec45ff577376c0d0178fdb2690134d4656488f46e129aba3cc5a",
-  "a51517e13e57420d2d88a6bcfb4055d762d4a0d10a8f88450929c5c4572213a9"
+  "a51517e13e57420d2d88a6bcfb4055d762d4a0d10a8f88450929c5c4572213a9",
+  "d97f46a2cca020406252b1f7baa4184617fa71faca3885e2379c44ae4e1d9327"
  ],
  "ai-init/.ai/templates/architecture-decision.md": [
   "78619b522826ba8f5f0422e9deb7359c8002553d1aeb29a3719da5ab11ff13a1"
@@ -270,7 +287,8 @@
  ],
  "ai-init/.ai/using-riskrails.md": [
   "03282999978b2bfb5f65135e1884f9447f8a71021a88895d5436d377797b9acb",
-  "25d08ff01a4ab2069b0dd4e5ec52e888d33e00091dc467dd10d63f10223b6f80"
+  "25d08ff01a4ab2069b0dd4e5ec52e888d33e00091dc467dd10d63f10223b6f80",
+  "5c0fac98aeef1bf9882f827f1a5ea72d602712d6ad5c5e628131bb9c164e276b"
  ],
  "ai-init/.ai/workflows.md": [
   "500d93714106b1c4e21b13f248f7175c86073a9bcb6e0a849845f61f49b5a66d"
@@ -410,7 +428,8 @@
  "project-init/constitution.md": [
   "5e38d93c4f82300cc5d331f4ce3022d2872db15d108ae23bf33e2169a19b42f2",
   "7be527cd648b27cca6e267de30f8e33a2ce17d5631a82694f23ae5c0623efe1f",
-  "18c7a2753ce9cb6f6d3d1e9d5d1125d75950b879d56b7325225b200869631b29"
+  "18c7a2753ce9cb6f6d3d1e9d5d1125d75950b879d56b7325225b200869631b29",
+  "1f44e1a236233dcbab58064f39b69f798b35d1d9a29f8c615b5b12854ce633cb"
  ],
  "project-init/gitignore.snippet": [
   "965a03be82000866cb5275acda18ebb2172c9a50f0011df2fa475f74a1124c35",