toga-ai 1.0.1024 → 1.0.1026

package/CLAUDE.md

@@ -20,7 +20,7 @@ as `/skill-name` inside Claude Code.
 |-------|---------|-------------|
 | **start** | `/start TRUE-1234` | **Start of every session.** ClickUp ticket id only. Reads the ticket (apps, clients, task type, pseudocode), checks branches, then primes the framework architecture, coding standards, repo knowledge, and client context. Edits are blocked until it runs. |
 | **commit** | `/commit` | Commit only the files this session changed, with the session notes in the message, then pushes the ticket branch. |
-| **pseudocode** | `/pseudocode` | Major tickets only. Writes the agreed approach as plain text to the ticket's Pseudocode field, after approval. |
+| **pseudocode** | `/pseudocode` | Major tickets only. Writes the agreed approach as plain text to the ticket's Pseudocode field (no separate write approval). |
 | **finish** | `/finish` | **End of every session.** Records what was built or changed into the knowledge base, checks the ticket fields, and when the ticket is done pushes, opens the PRs, comments on the ticket, and sets it to development finished. |
 | **toga-loop** | `/toga-loop` | Orchestrate a bigger or iterative change (multi-file feature, refactor, migration, sweep, or "keep going until X") as an explore→implement→verify loop driven by subagents, with progress tracked on a state file so it survives compaction and can resume. Run after `/start`. |
 | **feature** | `/feature` | Build a feature end-to-end as a subagent-driven loop: restate goal + done-condition, get an independent second opinion on the approach before coding, plan, implement (worktree-isolated for parallel work), verify with reviewers, loop until done, hand off to `/finish`. Run after `/start`. |

package/knowledge/2.0/apps/_underscore/INDEX.md

@@ -14,6 +14,7 @@
 | [Calculated-column filter options (`<field>FilterOptions` model static → table meta)](features/calculated-column-filter-options.md) | Lets a calculated (`FIELD_SQL`) table column supply its own filter dropdown options via a `<field>FilterOptions` model static; open when adding a data-driven co |
 | [FIELD_SQL calculated fields — the underscore-prefix + same-name-method contract](features/calculated-sql-fields.md) | A `FIELD_SQL` (calculated) field on a `_Model` is bound by a **two-part contract that `_Model` enforces by throwing at model-construction time**, not by convent |
 | [Carrier Shipping Labels (UPS/FedEx) & NetSuite Item Fulfillment](features/carrier-shipping-labels.md) | Backend mechanics behind Fulfill & Ship: buying/persisting a carrier label (UPS/FedEx) and creating the NetSuite Item Fulfillment; open for label, reprint, retu |
+| [Case status is derived from stage/owner; stage changes pass a reason-note gate](features/case-status-and-stage-gate.md) | `_Model_Client_Case::_status` is DERIVED (never set) and stage writes via api2 are gated by a `case-set-stage` Surface rule; open before writing Cases from code |
 | [Running 2.0 code from a bare CLI script (bootstrap + transactions)](features/cli-script-bootstrap.md) | Minimum recipe + traps for running real 2.0 framework code (`_Model`/`_Query`/`_Database`) from a bare `php script.php`; open before writing a CLI harness/backf |
 | [Client Users require a contactId — the postPost backfill interceptor & every creation path](features/client-user-contactid-required.md) | Every `Client_<Tenant>.Users` row must have a non-null `contactId`; the shared `_Model_Client_User::postPost` interceptor guarantees it for api2-created users, |
 | [_Cloud credentials (WorkloadsRuntime) + S3 helpers (copy / get / delete / list)](features/cloud-s3-helpers.md) | `_Cloud` credentials (assumes `WorkloadsRuntime`, no IAM keys) and S3 helpers (copy/get/delete/list, per-bucket region, 5 GB single-PUT limit); open before any |

package/knowledge/2.0/apps/_underscore/features/case-status-and-stage-gate.md

@@ -0,0 +1,46 @@
+---
+title: "Case status is derived from stage/owner; stage changes pass a reason-note gate"
+framework: "2.0"
+repo: _underscore
+project: _Underscore
+client: shared
+type: feature
+status: active
+updated: 2026-10-15
+owners: [jcardinal]
+files:
+  - _underscore/Model/Client/Case.php
+  - _underscore/Model/Client/CaseNote.php
+  - _underscore/Model/Client/CaseStage.php
+  - _underscore/Model/Client/Ticket.php
+related:
+  - ../../api2/features/api-payload-interceptors.md
+  - ./note-record-authorship.md
+  - ../../../../clients/nycdoe/features/asn-sftp-ingestion-2-0.md
+---
+
+`_Model_Client_Case::_status` is DERIVED (never set) and stage writes via api2 are gated by a `case-set-stage` Surface rule; open before writing Cases from code, an integration, or the API.
+
+## Summary
+
+Stages are set; statuses are derived. A case's `_status` slug comes from its stage, else its owner. Moving a case to a blocker stage needs a stored reason note in the same request. Built for TOGa Desk Case Blocker (TRUE-82615, Desk ADR 0144). Shared core: applies to every 2.0 client. **On `_underscore` branch `TRUE-82615` (toga25 line) as of 2026-10-15 — not on `_production`.**
+
+## How it works
+
+- **`_status`** (plain `FIELD_SQL`, text slug): stage's linked `CaseStatuses.slug` if `caseStageId` set → else `ownerUserId` set → `in-progress` → else `open`. Same rule as `_Model_Client_Ticket::_status`. Never add `FIELDOPT_SQL_TYPE` (a cast zeroes the slug).
+- **Blocker stages** (`roadblocked`, `on-hold`, `awaiting-user`) are `CaseStages` rows keyed by the new `CaseStages.slug`. Resume = set `caseStageId` to NULL (status falls back to owner/open).
+- **`Client.CaseNotes` / `_Model_Client_CaseNote`**: write-once reason notes (`caseId`, `caseStageId`, `note`). `authorUserId` is stamped in `::save()` from `_Model::getRequestUserId()`, never from the payload. ACL: create + read only.
+- **Set-stage gate**: Case `prePut`/`prePatch` capture the before-stage; `postPut`/`postPatch`/`postPost` read the `case-set-stage` Surface `requiredRule` for the new stage slug and its status slug. If the rule needs a reason, a `CaseNotes` row for this case + stage must have been stored in this request (`CaseNote::countCreatedFor`) — else `_Exception_Validation` (400) and the whole request rolls back. Wired by 5 `Core.ApiPayloadInterceptors` rows on cases (recordId 222).
+- **`Ticket::createCase`** (`{"createCase":{}}` on PUT /tickets/{uuid}) now creates the case with **no stage** (it used to force the Open stage), so status derives.
+- Central ids: `Core.Records` 377 (case-notes); `Core.RecordFields` 2743-2750. SQL: dbchanges2 `Client/2026-10-14b`, `Client/2026-10-14c`, `Core/2026-10-14b`, `Client/2026-10-15a` (case-notes ACL), `Client/2026-10-15b` (cases-stages read ACL).
+
+## Gotchas
+
+- **Do not write `_status` or pick an "Open" stage to mean open.** Leave `caseStageId` NULL; status derives.
+- **Direct `_Model` writes skip the gate** (interceptors run only in api2). Nycdoe SFTP `Parse.php` creates cases this way; its cases now read `open` / `in-progress`.
+- **PUT/PATCH a case without a route uuid → 400** — the gate needs `$api->recordUuid`.
+- **Keep Cases FK child policies `MATCH`.** `MATCH_UPDATE` / `UPSERT` / `CREATE` write a case through a parent's FK object and bypass the gate.
+- **The reason must be a stored row, not payload text** — api2 can swallow a failed nested note and still return 200.
+
+## Change history
+- 2026-10-15 — Created: derived case status, blocker stages, CaseNotes, set-stage gate, createCase without stage (TRUE-82615). (jcardinal)

package/knowledge/2.0/apps/_underscore/features/note-record-authorship.md

@@ -6,8 +6,8 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
-owners: [apeterson]
+updated: 2026-10-15
+owners: [apeterson, jcardinal]
 files:
   - _underscore/Model/Client/SalesOrderNote.php
   - _underscore/Model/Client/PurchaseOrderNote.php
@@ -18,6 +18,7 @@ files:
   - _underscore/Model/Client/PartRequestNote.php
 related:
   - ../../toga-blox/features/add-notes-template.md
+  - ./case-status-and-stage-gate.md
   - ../../toga25-supply/features/transfer-orders-page.md
   - ../features/sales-order-denial-reason.md
   - ../../../clients/compass-usa/features/approval-decision-flow.md
@@ -62,8 +63,12 @@ Before building anything that shows or filters by note author:
 
 - **`contactId` on a `*Notes` model is an unwritten FK — treat it as always NULL.** Seven models, zero writers.
 - **A notes list UI has no author to show.** Design for it, or the field silently renders blank for every row.
+- **Exception — `CaseNotes` (2026-10-15) has a real author:** `authorUserId` stamped in `_Model_Client_CaseNote::save()` from `_Model::getRequestUserId()`. Copy that pattern for the real fix. See [Case status + stage gate](./case-status-and-stage-gate.md).
 - **`dtStamp` is `FIELD_DATETIME_CREATED`** — stamped by the ORM on insert, the only provenance a note actually carries.
 
+## Change history
+- 2026-10-15 — Noted CaseNotes as the first note model with a server-stamped author. (jcardinal)
+
 ## Related
 
 - [Add Notes template](../../toga-blox/features/add-notes-template.md)

package/knowledge/2.0/apps/worker2/features/clickup-github-autolink.md

@@ -6,8 +6,8 @@ project: Worker
 client: shared
 type: feature
 status: active
-updated: 2026-10-08
-owners: [dfranks]
+updated: 2026-10-15
+owners: [dfranks, jcardinal]
 files: []
 related:
   - ../../../../standalone/apps/claude/workflows/clickup-ticket-workflow.md
@@ -24,7 +24,7 @@ How ClickUp surfaces branches/PRs/commits in a ticket's GitHub tab and the branc
 
 - ClickUp's **native GitHub integration** auto-surfaces a branch, PR, or commit in a ticket's GitHub tab **whenever the ticket id appears in the branch name and/or the PR title/body**. Match is on the textual ticket id (e.g. `TRUE-79868`).
 - **No ClickUp API call creates this link.** Linking is purely a side effect of the ticket id appearing in Git metadata.
-- Durable rule for ticket work: name the **git branch as the BARE ticket id** (e.g. `TRUE-79868`), **one branch per repo**, PR title starts with the ticket id (`TRUE-79868 - <subject>`). PR base = the repo's default branch (usually `_production`, but it varies — resolve it with `gh repo view`). Confirmed working 2026-10-08.
+- Durable rule for ticket work: name the **git branch as the BARE ticket id** (e.g. `TRUE-79868`), **one branch per repo**, PR title starts with the ticket id (`TRUE-79868 - <subject>`). PR base is set by the ticket's project — see `rules/common/git-workflow.md` → *Base branch*. Confirmed working 2026-10-08.
 
 ## Gotchas
 
@@ -38,6 +38,7 @@ How ClickUp surfaces branches/PRs/commits in a ticket's GitHub tab and the branc
 
 ## Change history
 
+- 2026-10-15 — PR base now follows the ticket's project (Desk/IQ → `toga25`); links to git-workflow.md instead of restating. (jcardinal)
 - 2026-10-08 — Added reconnect fix, Development-space repo linking, and settings to leave alone. (jcardinal)
 - 2026-10-08 — `/work-ticket` and `/plan-ticket` retired; `/finish` opens the PRs. PR title = ticket id first; base = repo default branch; git-workflow now uses bare ticket-id branches. (jcardinal)
 

package/knowledge/INDEX.md

@@ -21,7 +21,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 
 ## 2.0 framework
 
-- **_underscore** (_Underscore) _(framework core)_ — 95 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
+- **_underscore** (_Underscore) _(framework core)_ — 96 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
 - **worker2** (Worker) — 86 doc(s) → [2.0/apps/worker2/INDEX.md](2.0/apps/worker2/INDEX.md)
 - **api2** (API) — 26 doc(s) → [2.0/apps/api2/INDEX.md](2.0/apps/api2/INDEX.md)
 - **dbchanges2** (Database Changes) _(framework core)_ — 22 doc(s) → [2.0/apps/dbchanges2/INDEX.md](2.0/apps/dbchanges2/INDEX.md)

package/knowledge/clients/nycdoe/features/asn-sftp-ingestion-2-0.md

@@ -6,8 +6,8 @@ project: Worker
 client: nycdoe
 type: client-feature
 status: active
-updated: 2026-10-06
-owners: [mhammontree]
+updated: 2026-10-15
+owners: [mhammontree, jcardinal]
 files:
   - worker2/Worker/Sftp/Import.php
   - worker2/Worker/Sftp/Parse.php
@@ -23,6 +23,7 @@ related:
   - ../profile.md
   - ../../../2.0/apps/worker2/features/codeception-integration-tests.md
   - ../../../2.0/apps/_underscore/features/cli-script-bootstrap.md
+  - ../../../2.0/apps/_underscore/features/case-status-and-stage-gate.md
 ---
 
 2.0 rewrite of DOE's vendor-SFTP ASN intake (TRUE-80519 Phases 1–2): per-manufacturer fetch to `Files`, header-validated parse into one Case per customer PO + one ServiceRequest per line; open for any 2.0 DOE ASN/SFTP work.
@@ -112,8 +113,10 @@ PRs open 2026-10-06: library, worker2, dbchanges2, _underscore (worker optional
 - **`connect()` must not chain the phpseclib exception** — phpseclib `login()` frames carry the first 15 chars of the password, and worker2 stores job traces in `Core.WorkerJobs`. It rethrows a fresh exception with no `previous`.
 - **Locks and just-committed rows must read the writer** — see the read-host gotcha in [Per-Client Database Connections](../../../2.0/apps/_underscore/features/per-client-database-connections.md).
 - **Schema drift: `_Model_Client_Case` declares `longDescription` but `Client_Nycdoe.Cases` lacked the column** → any direct-model Case load/save 1054s. Fixed for DOE (Client_Nycdoe schema file). Other tenants' `Cases` may have the same gap — unchecked (ask Rohan).
+- **Parsed Cases get no stage; `_status` is derived** (`open`, or `in-progress` once an owner is set) since TRUE-82615. Direct model writes skip the api2 set-stage gate. Never set a stage to mean "open" — see [Case status + stage gate](../../../2.0/apps/_underscore/features/case-status-and-stage-gate.md).
 
 ## Change history
+- 2026-10-15 — Gotcha: parsed Cases now derive status (no stage) after the shared Case model change. (jcardinal)
 - 2026-10-06 — 9 dbchanges2 files merged into one Client_Nycdoe + one Core file; runbook Part A updated (mhammontree)
 - 2026-10-06 — Activation/deployment runbook (Part A inert, Part B shadow mode, rollback, failed-file release) (mhammontree)
 - 2026-10-06 — Gated delete built (RunForFile/DeleteSource, Parse claim + status-outside-transaction fix, retired names, `released` status); open cutover items (mhammontree)

package/knowledge/standalone/apps/claude/workflows/clickup-ticket-workflow.md

@@ -6,7 +6,7 @@ project: Claude Harness
 client: shared
 type: workflow
 status: active
-updated: 2026-10-13
+updated: 2026-10-15
 owners: ["jcardinal"]
 files:
   - claude/skills/start/SKILL.md
@@ -44,10 +44,11 @@ writes, and agents until the session has a ticket. These replaced `/kickoff`, `/
    exists (rework: same branch, same PR). If ClickUp can't be read, it stops — no offline mode.
 2. **`/commit`** — commits only this session's files, ticket from the session file, then the
    branch. Then pushes the ticket branch (`git push -u origin <TICKET>`, never force).
-3. **`/pseudocode`** — major tickets only. Writes the agreed approach to the Pseudocode field
-   after the developer approves. Touches no other field.
-4. **`/finish`** — always writes the team KB first. Then one approval list for ticket fields
-   (Application, Stakeholders, Task Type, title, Has UI Changes). Then it asks "Is this ticket finished?" — a yes is the permission (no extra asks): commit any
+3. **`/pseudocode`** — major tickets only. Writes the approach agreed with the developer to the
+   Pseudocode field — no separate write approval. Touches no other field.
+4. **`/finish`** — always writes the team KB first. Then Claude decides and writes the ticket
+   fields itself in one call (Application, Stakeholders, Task Type, title, Has UI Changes) and
+   reports before → after — no approval. Then it asks "Is this ticket finished?" — a yes is the permission (no extra asks): commit any
    uncommitted session files, push each
    repo with work, open or update a PR per repo, post a PM comment, set status
    `development finished`. The PM comment is plain bullets for a non-technical PM: "What
@@ -72,18 +73,18 @@ writes, and agents until the session has a ticket. These replaced `/kickoff`, `/
 ### Status flow
 
 `to do` -> `in progress` (`/start`, only from `to do`, never backward) -> `development finished`
-(`/finish`). The `start-gate` guard allows only those two status values.
+(`/finish`). Since 2026-10-15 the `start-gate` guard allows any status on the session ticket.
 
 ### Ticket-write rules
 
-- Writes go only to the session's own ticket — the `start-gate` hook blocks any other task id,
-  and blocks task creation, deletion, moves, tags, links, docs, chat, and time tracking.
-- The `start-gate` hook is the hard limit: session ticket only; fields Application,
-  Stakeholders, Task Type, Pseudocode, Has UI Changes, and the name; statuses `in progress` and
-  `development finished` only.
-- No permission prompt for `clickup_update_task` or `clickup_create_comment` (since 2026-10-09).
-  Field changes are written only after the developer's yes in chat; status changes and the PM
-  comment need no question. Only `Bash(git push *)` stays in `permissions.ask`. `npx toga-ai`
+- **No approval for ticket writes (team rule, 2026-10-15).** Claude updates the session
+  ticket's fields, name, status, description, tags, priority, assignees and comments itself,
+  then reports before → after.
+- The `start-gate` hook keeps two hard limits: writes go only to the session's own ticket (any
+  other task id is blocked), and never to Has Code Changes (worker2 owns it). It also blocks task
+  creation, deletion, moves, links, docs, chat, time tracking and `update_comment` (no task id
+  to check).
+- No permission prompt for `clickup_update_task` or `clickup_create_comment` (since 2026-10-09). Only `Bash(git push *)` stays in `permissions.ask`. `npx toga-ai`
   strips the old ClickUp rules from a dev's existing `permissions.ask` (see harness distribution).
 - Use only the `clickup` MCP server (`mcp__clickup__clickup_*`). The old read-only
   "claude.ai ClickUP for Dev" server (`mcp__claude_ai_ClickUP_for_Dev__*`) is blocked.
@@ -134,8 +135,9 @@ All tested 2026-10-08:
   .scss .less .html`, a React app's `src/`, blox components), else unchecks it.
 - **Branch = bare ticket id**, created by ClickUp or by `/start`'s `create-branch`. A branch
   named with the ticket id should link to the ticket through the GitHub integration — confirm on
-  the first real `create-branch` run. PR base = the repo's default branch (usually
-  `_production`, varies) — resolve with `gh repo view <owner/repo> --json defaultBranchRef`.
+  the first real `create-branch` run. Base branch is set by the ticket's project (TOGa Desk / TOGa IQ ticket → every repo from
+  `toga25`; else each repo's default branch) — rule lives in `rules/common/git-workflow.md`
+  → *Base branch*.
 - **The KB repo (`toga-tech`) works on `_main`.** No branch check and no PRs there; `/finish`
   still does the ticket check.
 - **Re-check the branch, never repeat it.** When the developer says they switched (or before
@@ -157,6 +159,10 @@ All tested 2026-10-08:
 
 ## Change history
 
+- 2026-10-15 — Ticket writes need no approval: `/finish` writes fields itself, `/pseudocode`
+  writes once the plan is agreed; the gate allows any field/status/tag/comment on the session
+  ticket, except Has Code Changes. (jcardinal)
+- 2026-10-15 — Base branch now follows the ticket's project (Desk/IQ → `toga25`); points at git-workflow.md. (jcardinal)
 - 2026-10-08 — Created: ClickUp-tied sessions (`/start`, `/commit`, `/pseudocode`, `/finish`)
   replace `/kickoff`, `/capture`, `/plan-ticket`, `/work-ticket`, `/rework-ticket`. (jcardinal)
 - 2026-10-08 — Branch claims always re-checked fresh; `/finish` runs `/commit` on yes and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1024",
+  "version": "1.0.1026",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",

package/rules/common/communication.md

@@ -48,9 +48,28 @@ What you need to do:
 1. Run `2026-08-31a - AddColumn.sql` on the Core database (prod).
 2. Then run `2026-08-31b - Seed.sql` on the same database.
 3. Deploy worker2 to Elastic Beanstalk.
-4. Confirm the WorkerJobs table shows the new column.
+4. Tell me when done — I check the new column myself.
 ```
 
+### Database changes: give a SQL file, not a description (team rule, 2026-10-15)
+
+Applies to every repo. When a developer must change data or schema — ACL grant rows, seeds,
+data cleanup, anything — Claude delivers a **ready-to-run SQL file**, never a prose list of
+rows for the developer to write by hand.
+
+1. **Put the file in the right folder:** `dbchanges2` for 2.0, `dbchanges` for 1.0. Follow the
+   existing SQL file rules (file name with today's date, `ADD COLUMN ... AFTER`, random v4 uuids,
+   guarded re-runnable seeds, one database family per query — see the `dbchanges2`
+   architecture doc and `security.md`).
+2. **Add a "What you need to do" numbered run list** (format above): which file, which
+   database, in what order. For a `dbchanges2` `Client/` file the step always says
+   **"every client DB"**.
+3. **ACL grants stay the developer's call.** Claude proposes the roles in the file header
+   comment; the developer decides before running.
+4. **Put verify SELECTs at the end of the file.** After the developer runs it, Claude runs
+   those SELECTs itself (local DB, or `toga-db` read-only) and reports the result in plain
+   words. Never ask the developer to read verify output.
+
 ## Cut output tokens — the safe way
 
 Shorter answers are clearer AND cheaper to run. Both matter. But **clarity always wins** —

package/rules/common/git-workflow.md

@@ -16,11 +16,14 @@ the commit prefix, the PR title, and the ticket updates at `/finish`.
 2. **`/finish`** does the KB capture, then asks one question: **"Is this ticket finished?"**
    On yes it: commits any uncommitted session files, pushes, opens (or updates) one PR per
    repo, comments on the ticket, and sets the status. No extra "may I push?" or "may I open
-   the PR?" questions — that yes is the permission. Ticket field changes still use the one
-   approval list.
-3. **Branches.** Claude may create or switch to the ticket branch as part of normal work.
-4. `/ship`, `/land-and-deploy` — the commits, pushes, and PRs they describe.
-5. The KB repo (`~/toga-tech`) — `/finish` commits and pushes to `_main`.
+   the PR?" questions — that yes is the permission.
+3. **ClickUp ticket writes need no approval** (decided 2026-10-15, jcardinal). Claude updates
+   the session ticket's fields, title, status and comments itself, then reports before → after.
+   Only the session's own ticket, and never Has Code Changes (worker2 owns it) — the
+   `start-gate` hook enforces both.
+4. **Branches.** Claude may create or switch to the ticket branch as part of normal work.
+5. `/ship`, `/land-and-deploy` — the commits, pushes, and PRs they describe.
+6. The KB repo (`~/toga-tech`) — `/finish` commits and pushes to `_main`.
 
 Always, in every repo:
 
@@ -47,7 +50,7 @@ either (see *Claude never rewrites code because a branch changed*). Present diff
 let the developer commit, PR, and deploy.
 
 **One exception — `/start`'s `create-branch`.** At `/start`, after the developer says yes for
-that repo, Claude may run `start-helper.js create-branch` to create (from the default branch)
+that repo, Claude may run `start-helper.js create-branch` to create (from the ticket's base branch, see *Branch naming*)
 or check out the ticket branch `<TICKET>`. Nothing else: no worktree, no stash, never on a
 repo with uncommitted changes, never force-push. See *Branch naming*.
 
@@ -99,14 +102,23 @@ Never force-push to `_main` under any circumstances.
 The branch is the bare ClickUp ticket id — e.g. `TRUE-82600`. No prefix, no description.
 ClickUp may create it, or `/start` creates it. One branch per ticket per repo.
 
-**Base branch.** Only the new platform app repos (today `toga25-desk` and `toga25-iq`) branch from
-`toga25` and open their PR back to `toga25`. Every other repo (`_underscore`, `api2`, `worker2`,
-`dbchanges2`, …) uses its own default branch, even in the same session.
+**Base branch.** The ticket's project (its Application) decides the base — not the repo.
+
+- **New platform app ticket** (today TOGa Desk = `toga25-desk`, TOGa IQ = `toga25-iq`): every repo
+  touched for that ticket — the app and its dependencies (`toga25-blox`, `toga2-template`,
+  `_underscore`, `api2`, `dbchanges2`, `worker2`, …) — branches from `toga25`. Its PR goes back to
+  `toga25`. At `/start`, pass `--base toga25` to `create-branch`.
+- **Any other project** (e.g. TOGa Commerce, TOGa Supply, Worker): every repo branches from its own
+  default branch (e.g. `_production`). PRs go there — even when the ticket touches the same shared
+  repos (`_underscore`, `api2`, …).
+- Example: a `toga25-desk` ticket touching `_underscore` → `_underscore` branches from `toga25`. A
+  `toga2-commerce` ticket touching `_underscore` → from `_production`.
+- The KB repo `toga-tech` is unchanged: `_main`, no branch, no PR.
 
 `/start` checks that every repo on the ticket (from its Application values) is on the ticket
 branch. On a mismatch it asks once per repo: "Create/switch to `<TICKET>` in `<repo>` from
 `<base>`?" On yes it runs `start-helper.js create-branch` (checks out `origin/<TICKET>` or the
-local branch if one exists, else creates it from the default branch and pushes it with
+local branch if one exists, else creates it from the base branch above and pushes it with
 `git push -u`, never force). A repo with uncommitted changes is refused — Claude stops and
 says so. Claude may also create or switch to the ticket branch later in normal work, with the
 same limits.

package/rules/common/security.md

@@ -75,6 +75,9 @@ escaping, and it will corrupt data you meant to store intact.
 
 ## Never query across database clusters (2.0)
 
+(Handing a DB change to a developer? Give a SQL file — see `communication.md` § *Database
+changes: give a SQL file, not a description*.)
+
 In 2.0 the database families live on **separate production clusters**: `Core` / `Forecast` /
 `Team` (prod-core), `Client_<Tenant>` (prod-client), `Archive_<Tenant>` (prod-archive), and
 `Logs` / `Logs_<Tenant>` (prod-logs). A single SQL statement that joins or sub-selects across

package/scripts/hooks/start-gate.js

@@ -33,11 +33,18 @@
  * the team repo.
  *
  * ClickUp guard (any stage, any tool name containing "clickup"): an ALLOWLIST. Reads pass.
- * Writes pass only for `mcp__clickup__clickup_update_task` (allowed keys and fields only; status
- * only "in progress" or "development finished") and
- * `mcp__clickup__clickup_create_comment` (entity_type "task"), on the session ticket. Everything
- * else is blocked, including every tool of the old "ClickUP for Dev" server. This branch FAILS
- * CLOSED on an internal error; the rest of the gate fails open.
+ * Team rule 2026-10-15 (jcardinal): Claude may update the SESSION ticket's fields, name, status,
+ * description, tags, priority, assignees and comments without asking. So on the session ticket
+ * these writes pass: `update_task` (keys in UPDATE_TASK_KEYS, any status, any custom field),
+ * `add_tag_to_task` / `remove_tag_from_task`, and `create_comment` (entity_type "task") /
+ * `create_task_comment`. Two guards stay:
+ *   1. Session ticket only — never another task. A wrong id would silently change someone
+ *      else's ticket, and the task id is the only thing tying a write to this session.
+ *   2. Never Has Code Changes — worker2 sets it from the PRs; a Claude write would fight it.
+ * Everything else is blocked (create/delete/move tasks, links, docs, chat, time tracking,
+ * `update_comment` — it carries no task id, so the ticket cannot be checked), including every
+ * tool of the old "ClickUP for Dev" server. This branch FAILS CLOSED on an internal error; the
+ * rest of the gate fails open.
  *
  * Subagents: hook input carries `agent_id` (only inside a subagent) and `agent_type`. The
  * ticket-reader subagent may run Bash only as `node <pinned>/ticket-parse.js ...`.
@@ -101,17 +108,15 @@ const MAX_UNWRAP_DEPTH = 6;
 const OLD_CLICKUP_SERVER_RE = /^claude_ai_ClickUP_for_Dev$/i;
 /* get_* covers get_operators and get_schema. download_* is a read but is not needed — blocked. */
 const CLICKUP_READ_RE = /^(get_.+|search|search_.+|filter_.+|list_.+|find_.+|resolve_assignees)$/;
-const UPDATE_TASK_KEYS = new Set(['task_id', 'workspace_id', 'status', 'name', 'custom_fields']);
-const CUSTOM_FIELD_ITEM_KEYS = new Set(['id', 'value']);
-/* /start sets "in progress" (only from "to do"); /finish sets "development finished". */
-const ALLOWED_STATUSES = new Set(['in progress', 'development finished']);
-const WRITABLE_FIELDS = new Map([
-  ['32e9fcd3-6f59-448a-a06e-de52afc87587', 'Application'],
-  ['ec15edfd-5920-4c12-a1dc-94ede4a62438', 'Stakeholders'],
-  ['093170c3-abdc-4815-9f1f-f51841799590', 'Task Type'],
-  ['ad0e4fc8-ff03-4e5f-a187-7d2cd6d0bc65', 'Pseudocode'],
-  ['576ff7b7-a2bf-4e78-bd55-85661d1a98ef', 'Has UI Changes'],
+/* Any field of the session ticket (team rule 2026-10-15). Not `task_type`: Task Type is a custom field here. */
+const UPDATE_TASK_KEYS = new Set([
+  'task_id', 'workspace_id', 'status', 'name', 'custom_fields', 'markdown_description', 'priority',
+  'assignees', 'due_date', 'start_date', 'time_estimate',
 ]);
+const CUSTOM_FIELD_ITEM_KEYS = new Set(['id', 'value']);
+/* Writes on the session ticket keyed by task_id. */
+const TASK_ID_WRITE_OPS = new Set(['update_task', 'add_tag_to_task', 'remove_tag_from_task', 'create_task_comment']);
+/* worker2 owns it (sets it from the ticket's PRs) — Claude never writes it. */
 const HAS_CODE_CHANGES_FIELD = 'af9eaba8-d3d3-4769-b8bc-28de78b04570';
 
 /* ---------------- shell allowlist data ---------------- */
@@ -186,10 +191,10 @@ const MSG = {
   noSessionTicket: 'ClickUp write blocked: this session has no ticket. Run /start TRUE-1234 first.',
   alwaysBlocked: (op) => 'ClickUp call blocked: `' + op + '` is not allowed from Claude. Ask the developer to do it in ClickUp.',
   commentEntity: 'ClickUp write blocked: comments may only go on the session ticket (entity_type "task").',
-  badKey: (k) => 'ClickUp write blocked: update_task may not set `' + k + '`. Allowed: status, name, custom_fields (Application, Stakeholders, Task Type, Pseudocode, Has UI Changes).',
-  badStatus: 'ClickUp write blocked: the only statuses Claude may set are "in progress" (/start) and "development finished" (/finish).',
+  badKey: (k) => 'ClickUp write blocked: update_task may not set `' + k + '`. Allowed: ' + [...UPDATE_TASK_KEYS].filter((x) => x !== 'task_id' && x !== 'workspace_id').join(', ') + '.',
+  badStatus: 'ClickUp write blocked: status must be a non-empty string.',
   hasCodeChanges: 'ClickUp write blocked: never write Has Code Changes — worker2 owns it.',
-  badField: (id) => 'ClickUp write blocked: custom field `' + id + '` is not one Claude may write.',
+  badField: (id) => 'ClickUp write blocked: custom field item `' + id + '` must be {id, value}.',
   guardError: 'ClickUp call blocked: the start gate could not check it (internal error). Try again; if it repeats, tell the developer.',
 };
 
@@ -762,8 +767,8 @@ function checkCustomFields(value) {
   for (const item of list) {
     if (!item || typeof item !== 'object' || Array.isArray(item)) return MSG.badField(JSON.stringify(item));
     const id = String(item.id || '');
-    if (id === HAS_CODE_CHANGES_FIELD) return MSG.hasCodeChanges;
-    if (!WRITABLE_FIELDS.has(id)) return MSG.badField(id || 'no id');
+    if (id.trim().toLowerCase() === HAS_CODE_CHANGES_FIELD) return MSG.hasCodeChanges;
+    if (!id) return MSG.badField('no id');
     const extra = Object.keys(item).find((k) => !CUSTOM_FIELD_ITEM_KEYS.has(k));
     if (extra) return MSG.badKey('custom_fields[].' + extra);
   }
@@ -772,7 +777,7 @@ function checkCustomFields(value) {
 
 function checkUpdateTask(ti) {
   for (const k of Object.keys(ti)) if (!UPDATE_TASK_KEYS.has(k)) return MSG.badKey(k);
-  if ('status' in ti && (typeof ti.status !== 'string' || !ALLOWED_STATUSES.has(ti.status.trim().toLowerCase()))) return MSG.badStatus;
+  if ('status' in ti && (typeof ti.status !== 'string' || !ti.status.trim())) return MSG.badStatus;
   if ('name' in ti && typeof ti.name !== 'string') return MSG.badKey('name');
   if ('custom_fields' in ti) return checkCustomFields(ti.custom_fields);
   return null;
@@ -786,7 +791,7 @@ function clickupVerdict(tool, toolInput, sid) {
   const op = m[2].replace(/^clickup_/i, '').toLowerCase();
   if (OLD_CLICKUP_SERVER_RE.test(server)) return MSG.oldClickup;
   if (CLICKUP_READ_RE.test(op)) return null;
-  if (op !== 'update_task' && op !== 'create_comment') return MSG.alwaysBlocked(m[2]);
+  if (op !== 'create_comment' && !TASK_ID_WRITE_OPS.has(op)) return MSG.alwaysBlocked(m[2]);
   if (server !== CLICKUP_SERVER) return MSG.otherServer(server);
   const ti = toolInput && typeof toolInput === 'object' && !Array.isArray(toolInput) ? toolInput : {};
   const session = sid ? readSession(sid) : null;
@@ -796,7 +801,7 @@ function clickupVerdict(tool, toolInput, sid) {
     return sameTicket(ti.entity_id || '', session) ? null : MSG.otherTicket(String(ti.entity_id || 'no task id'));
   }
   if (!sameTicket(ti.task_id || '', session)) return MSG.otherTicket(String(ti.task_id || 'no task id'));
-  return checkUpdateTask(ti);
+  return op === 'update_task' ? checkUpdateTask(ti) : null;
 }
 
 function clickupGuard(tool, toolInput, sid) {

package/skills/finish/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: finish
-description: End-of-session closer for TOGA Technology work tied to a ClickUp ticket (replaces /capture). Always records the session's durable knowledge into the team `claude` knowledge base first (search, classify CREATE/UPDATE/DEPRECATE/NO-OP, write, publish to `_main`). Then checks the session ticket's fields (Application, Stakeholders, Task Type, title, Has UI Changes) in ONE approval list, asks "Is this ticket finished?", and if yes pushes the ticket branch in every repo with work, opens or updates one PR per repo (with the full review summary in the description), posts a short PM comment, and sets status `development finished`. Run at the END of EVERY session, finished or not. Trigger on "/finish", "finish", "wrap up", "capture", "save my work to the knowledge base", "I'm done", or when the developer ends a session.
+description: End-of-session closer for TOGA Technology work tied to a ClickUp ticket (replaces /capture). Always records the session's durable knowledge into the team `claude` knowledge base first (search, classify CREATE/UPDATE/DEPRECATE/NO-OP, write, publish to `_main`). Then checks the session ticket's fields (Application, Stakeholders, Task Type, title, Has UI Changes) and updates them itself in one call (no approval needed), asks "Is this ticket finished?", and if yes pushes the ticket branch in every repo with work, opens or updates one PR per repo (with the full review summary in the description), posts a short PM comment, and sets status `development finished`. Run at the END of EVERY session, finished or not. Trigger on "/finish", "finish", "wrap up", "capture", "save my work to the knowledge base", "I'm done", or when the developer ends a session.
 ---
 
 # /finish — save the knowledge, check the ticket, ship the ticket
@@ -12,8 +12,9 @@ Keep the main thread lean: the KB write pipeline runs in the `session-capture` s
 ClickUp reads run in the `ticket-reader` subagent. The main thread distills and asks only for real decisions.
 
 Claude writes and posts all summary text itself — PM comment, PR subject and body, commit
-notes, KB capture summary. Never ask the developer to approve that wording. Approvals are only
-for real decisions: ticket field changes (one list), ELEVATED KB docs, and "Is this ticket finished?". A yes to
+notes, KB capture summary. Never ask the developer to approve that wording. Claude also
+updates the session ticket's fields, status and comments itself — no approval (team rule,
+2026-10-15). Approvals are only for real decisions: ELEVATED KB docs and "Is this ticket finished?". A yes to
 that question is the permission to commit, push, and open the PRs — no extra asks.
 
 ## Step 0 — Rules, helpers, session ticket
@@ -27,18 +28,18 @@ exactly these, nothing else):
    origin _main` (never force, no PR) — the KB repo exception in `rules/common/git-workflow.md`.
 4. `gh pr create` for those repos, or `gh pr edit <n> --body-file <file>` to rebuild the body of an open PR.
 5. ClickUp writes **on the session ticket only**, with exactly two tools:
-   - `mcp__clickup__clickup_update_task` — only these: `name`, `status` = `development
-     finished`, and the custom fields Application, Stakeholders, Task Type, Pseudocode,
-     Has UI Changes.
+   - `mcp__clickup__clickup_update_task` — any field, name, status, description, tags,
+     priority or assignees of the session ticket. /finish uses `name`, `status` = `development
+     finished`, and the custom fields Application, Stakeholders, Task Type, Has UI Changes.
    - `mcp__clickup__clickup_create_comment` — one PM comment, `entity_type: "task"`.
 
 Never: force-push, push any other branch, commit source code (that is `/commit`), write the
 **Has Code Changes** field (`af9eaba8-d3d3-4769-b8bc-28de78b04570` — worker2 owns it), write
 "Pseudocode Review" / "Pseudocode Required", touch any other ticket, or use the old read-only
 `mcp__claude_ai_ClickUP_for_Dev__*` tools. The `start-gate` hook blocks every other ClickUp
-write (other tools, other fields, other tickets). Claude Code asks before `clickup_update_task`
-(field changes) — that prompt is expected. The PM comment posts without a prompt. `git push` may also ask for
-permission — that is expected too.
+write (other tools, other tickets, Has Code Changes). Field changes, status and the PM comment
+need no approval — write them, then report them. `git push` may ask for permission — that is
+expected.
 
 **Helpers** (both print JSON):
 
@@ -241,7 +242,7 @@ validate → index → mirror → rebase-push command. The `PostToolUse` hook st
 
 ---
 
-# Part 2 — Ticket field check (ONE list, ONE approval)
+# Part 2 — Ticket field check (Claude decides and writes — no approval)
 
 Skip Part 2 and Part 3 if the session has no verified ticket (Step 0).
 
@@ -274,34 +275,34 @@ Compare the ticket (Step 0 read) with what the session actually did:
 6. Never touch Has Code Changes.
 
 **Labels REPLACE the whole set.** For Application and Stakeholders, the new value is
-`current set ∪ additions − removals` — never just the additions. Only remove a value the
-developer agrees is wrong.
+`current set ∪ additions − removals` — never just the additions. Remove a value only when the
+work clearly shows it is wrong, and give the reason in the report.
 
-## Step 9 — Show ONE numbered approval list
+## Step 9 — Decide the changes (no approval)
 
-Show only fields that change. Example:
+Claude decides the changes itself. Do not ask the developer to approve them (team rule,
+2026-10-15). Keep a list of only the fields that change, each with the reason. Example:
 
 ```
-Ticket TRUE-82600 — proposed changes:
-1. Application: add "TOGa Desk"  (now: "api2")  → api2, TOGa Desk
-2. Stakeholders: add "Compass Group"  (now: none)
-3. Task Type: "Bug" → "Enhancement"
+Ticket TRUE-82600 — changes:
+1. Application: add "TOGa Desk"  (was: api2) → api2, TOGa Desk — work also changed the Desk app
+2. Stakeholders: add "Compass Group"  (was: none) — fix is for Compass
+3. Task Type: "Bug" → "Enhancement" — new behavior, not a fix
 4. Title: "Fix thing" → "Compass - Fix order-for dropdown on Desk [Claude modified]"
-5. Has UI Changes: true → false  (no UI files changed)
-Approve all, some (give numbers), or none?
+5. Has UI Changes: true → false — no UI files changed
 ```
 
 No changes → say "Ticket fields look right — no changes." and go to Part 3.
 
-## Step 10 — Write the approved changes (one call), read back, show the difference
+## Step 10 — Write the changes (one call), read back, report before → after
 
-One `mcp__clickup__clickup_update_task` call with only the approved items. Do **not** use the
+One `mcp__clickup__clickup_update_task` call with all the changes from Step 9. Do **not** use the
 tool's `task_type` parameter — Task Type here is a custom field.
 
 ```
 mcp__clickup__clickup_update_task
   task_id: "<TICKET>"                       (custom id, e.g. "TRUE-82600")
-  name: "<new title>"                       (only if item approved)
+  name: "<new title>"                       (only if the title changes)
   custom_fields: [
     {"id": "32e9fcd3-6f59-448a-a06e-de52afc87587", "value": "[\"<app uuid>\",\"<app uuid>\"]"},
     {"id": "ec15edfd-5920-4c12-a1dc-94ede4a62438", "value": "[\"<client uuid>\"]"},
@@ -313,9 +314,9 @@ mcp__clickup__clickup_update_task
 Value formats (all strings): labels = JSON array string of option UUIDs (the FULL set);
 drop_down = one option UUID; checkbox = `"true"` / `"false"`.
 
-Then spawn `ticket-reader` (`mode: ticket`) again and show the before → after for each changed
-field. If a value did not stick, say so plainly. Keep the list of changed fields for the PM
-comment.
+Then spawn `ticket-reader` (`mode: ticket`) again and check each value stuck. If a value did
+not stick, say so plainly. Keep the before → after list with reasons: it goes in the Step 17
+report (and the "is this finished?" no-path report) and in the PM comment.
 
 ---
 
@@ -557,7 +558,7 @@ developer the list name and leave the status alone.
 Short list:
 
 1. KB: publish status (Step 5).
-2. Ticket fields changed (or "none").
+2. Ticket fields changed: before → after with the reason, one line each (or "none").
 3. PRs: one url per repo, and which were created vs. updated.
 4. PM comment: posted (yes/no), with the posted text.
 5. Status: `development finished` (or why not).

package/skills/pseudocode/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pseudocode
-description: Write the agreed approach for a MAJOR ClickUp ticket into the ticket's Pseudocode field, as clean plain text, after the developer approves it. Writes the session ticket only, and only that one field. Trigger on "/pseudocode", "write the pseudocode", "put the plan on the ticket".
+description: Write the agreed approach for a MAJOR ClickUp ticket into the ticket's Pseudocode field, as clean plain text, once the plan is agreed with the developer (no separate approval for the write). Writes the session ticket only, and only that one field. Trigger on "/pseudocode", "write the pseudocode", "put the plan on the ticket".
 ---
 
 # /pseudocode — put the agreed approach on the ticket
@@ -15,9 +15,9 @@ insists.
   (`ad0e4fc8-ff03-4e5f-a187-7d2cd6d0bc65`). Never "Pseudocode Review", "Pseudocode Required",
   or any other field.
 - The only write is `mcp__clickup__clickup_update_task` with that one custom field. Never
-  `mcp__claude_ai_ClickUP_for_Dev__*`. The `start-gate` hook blocks any other ClickUp write,
-  field, or ticket.
-- Claude Code asks the developer before the write. That prompt is expected.
+  `mcp__claude_ai_ClickUP_for_Dev__*`. The `start-gate` hook blocks writes to any other ticket.
+- The plan itself must be agreed with the developer. The write needs no extra approval (team
+  rule, 2026-10-15) — once the plan is agreed, write it and report.
 
 ## Step 1 — Session ticket
 
@@ -67,19 +67,20 @@ OUT OF SCOPE
 1. Email notices.
 ```
 
-## Step 4 — Show it and get approval
+## Step 4 — Check the plan is agreed
 
-Show the text in a code block. If the field already has text, show **old** and **new** one
-after the other and ask: "Replace the current Pseudocode with this?" Edit until the developer
-approves. No approval → do not write.
+The text must match the approach agreed with the developer in this session. If no approach was
+agreed yet, agree it first (that is a real decision — ask). Once agreed, do not ask again
+before writing. If the field already has text, keep what is still true and replace the rest;
+show **old** and **new** in the Step 5 report.
 
 ## Step 5 — Write, then read back
 
 ```
 mcp__clickup__clickup_update_task
   task_id: "<TICKET>"
-  custom_fields: [{"id": "ad0e4fc8-ff03-4e5f-a187-7d2cd6d0bc65", "value": "<approved plain text>"}]
+  custom_fields: [{"id": "ad0e4fc8-ff03-4e5f-a187-7d2cd6d0bc65", "value": "<agreed plain text>"}]
 ```
 
 Spawn `ticket-reader` (`mode: ticket`) again and confirm its `pseudocode` matches. Report: "Pseudocode
-written to <TICKET>." or what did not stick.
+written to <TICKET>." (with old → new if it replaced text) or what did not stick.

package/skills/start/SKILL.md

@@ -24,11 +24,11 @@ The hook already checked the id, wrote the session ticket file
    main session. Repo code reads, edits and every agent stay blocked until you run
    `node "<TEAM_REPO>/knowledge.js" kickoff-primed`.
 3. **open** — normal work. ClickUp writes still only go to this ticket, only with
-   `mcp__clickup__clickup_update_task` (fields: Application, Stakeholders, Task Type,
-   Pseudocode, Has UI Changes, `name`, status `in progress` / `development finished`) and
-   `mcp__clickup__clickup_create_comment`. The hook blocks every other ClickUp write. Field
-   changes are written only after the developer says yes in chat; status changes need no
-   question. /start writes only the status `to do` -> `in progress` (Step 6b).
+   `mcp__clickup__clickup_update_task` (any field, name, status, description, tags, priority,
+   assignees — never Has Code Changes) and `mcp__clickup__clickup_create_comment`. The hook
+   blocks other tickets and every other ClickUp write. Field, status and comment writes need
+   no approval (team rule, 2026-10-15): write them, then tell the developer before → after.
+   /start writes only the status `to do` -> `in progress` (Step 6b).
 
 Trailing text is never permission to skip steps. If a block message appears, do the step it
 names. Do not fight the gate. (Harness work only: `TOGA_START_GATE_DISABLED=1`.)
@@ -140,10 +140,13 @@ developer has not named the session.
    — ask for the local path.
 
 3. **For each repo in `mismatches`, ask once:** "Create/switch to `<T>` in `<repo>` from
-   `<base>`?" Resolve `<base>` with
+   `<base>`?" The base comes from the
+   TICKET's project, not the repo. New platform app ticket (TOGa Desk / TOGa IQ): `<base>` =
+   `toga25` for EVERY repo on the ticket (app + dependencies). Any other project: the repo's own
+   default branch — resolve with
    `gh repo view <owner/repo> --json defaultBranchRef -q .defaultBranchRef.name` when gh works
    (owner/repo from `git -C <repo> remote get-url origin`); else leave `--base` off (origin's
-   default is used). If `changes` > 0, do not offer — STOP and say: "`<repo>` has uncommitted
+   default is used). See `rules/common/git-workflow.md` § Branch naming. If `changes` > 0, do not offer — STOP and say: "`<repo>` has uncommitted
    changes on `<branch>`. Commit or move them, then tell me." Never stash.
 
 4. **On yes:**
@@ -264,12 +267,14 @@ KB loaded:  <doc titles>; gaps: <none | list>
 
 State the permission policy in one line: "File reads and local edits run automatically;
 anything that executes, deploys, hits a remote/production environment, or leaves this machine,
-I'll confirm with you first. Ticket writes always ask you first."
+I'll confirm with you first. I update this ticket's fields, status and comments myself and
+tell you what changed."
 
 ## During the session
 
 - If you notice another app or client is affected, or the title is far off, note it for
-  `/finish`. Do not write to the ticket now.
+  `/finish` (it writes all field changes in one call). You may also update the ticket now
+  without asking — then tell the developer before → after in one line.
 - Commit with `/commit`. `/finish` pushes, opens PRs, and updates the ticket.
 - `/pseudocode` writes the agreed plan to the ticket (major tickets only).