wdi-method 0.6.1 → 0.6.2

package/kit/.constitution/method/document/templates/decision.md

@@ -22,7 +22,12 @@ created: '{YYYY-MM-DD}'
 
      Do not confuse this with AD-N in the architecture spine, which is a living rule edited in place.
 
-     Add `type:` to the frontmatter when it is useful — `risk-acceptance`, `course-correction`. -->
+     Add `type:` to the frontmatter when it is useful — `risk-acceptance`, `course-correction`. A `mandate`
+     is the one type with a fixed shape: `wdi-autopilot` opens it, its parameters live under `mandate:` on the
+     registry row only, and its `accepted_by` is a person and a date — never another DEC-.
+
+     `accepted_by:` — who raised this to `accepted`: a person and a date, or the `DEC-` of the mandate that
+     delegated it. Leave it out at `draft`. -->
 
 ## Decision
 

package/kit/.constitution/method/method-glossary.md

@@ -1,182 +1,183 @@
----
-status: Accepted
----
-
-# Method Glossary
-
-**Loaded when:** a method term is unclear, and before coining a new one.
-
-The words this method uses for **itself**. What the product is about belongs to
-`.control/product-glossary.md` instead. A term defined here MUST NOT be redefined there, and the
-reverse holds too. The test: would this term still apply on a different product? Yes → here.
-
-## Layers
-
-| Term | Means |
-|---|---|
-| **Corpus** | The four layers below. `_bmad-output/` is not part of it |
-| **`.constitution/`** | How we work. Rules. Rarely changes |
-| **`.control/`** | What currently holds and what has been decided. Facts. Changes often. Equals `{project_knowledge}` |
-| **`.what/`** | What was promised |
-| **`.how/`** | How it is built |
-| **Workspace** | `_bmad-output/` — work in progress, committed but not curated |
-| **Placement test** | Is this file still true after its spec has passed? Yes → corpus. No → workspace |
-
-## Units
-
-| Term | Means |
-|---|---|
-| **Product Component** (PC) | A domain slice — the box at C4 L3. Lives in `.what/<pc>/` and `.how/<pc>/`, and its `containers:` says where it runs |
-| **Logical Component** (LC) | One addressable unit of build. Registered in `components.yaml` with `type` · `container` · `owner` · `area` |
-| **Container** | Something that **runs its own code or stores its own data** and can be replaced without rebuilding another one. The C4 L2 term, and the value of an LC's `container` field. Two questions decide it and both MUST be yes — `architecture-guide.md` owns the test. Shipping two containers in one release does **not** merge them |
-| **`built`** | A container's one boolean. `true` when we write what is inside it, `false` when we deploy someone else's implementation. It decides whether the container gets an L3, an `LC`, and a heading in the codebase map — `container-built` checks all three |
-| **External system** | Something the product talks to whose **runtime we do not deploy**. It belongs at C4 L1, and MUST NOT be a container, an `LC`'s `container`, or a heading in the codebase map. What we lean on it for lives in `cross-cutting.md` or an integration contract |
-| **`_platform`** | **Not a component.** The home for what belongs to no Product Component: the spine, the C4 set, `cross-cutting.md`, the three inventories, and whatever it **owns**. A legitimate value in every position that asks which component owns something — `platform_owns`, an inventory row, an `LC`. Four kinds today: data · endpoint · job · screen. It carries no `mode`, no `risk_accepted`, and no G4 |
-| **Library** | An includable artifact — compiled into or imported by something else, never run on its own. Not a container |
-| **Slot** | A numbered sub-folder of a PC. `.what/<pc>/` 02–05 is reading order; `.how/<pc>/` 01–06 is ABCE classification. The two numberings do **not** mean the same thing |
-| **Kernel** | The `SRS-<pc>.md` or `SDD-<pc>.md` file itself. Content SHOULD stay in it until it grows past roughly 400 lines — a suggestion, not a threshold |
-
-A PC is not a container: a container runs, a PC is a domain. One container holds several PCs, and
-one PC may appear in more than one container. Because they cross, neither list implies the other, and
-the crossing MUST be written down rather than inferred — that is the PC × container matrix at C4 L2,
-rendered from each PC's `containers:`.
-
-## Flow
-
-There is no "stage". The five gates are the only flow vocabulary, and the word **area** is not used at all —
-there is only Product Component.
-
-| Term | Means |
-|---|---|
-| **Gate** | One of five decision points: G1 Problem · G2 Product · G3 Blueprint · G4 Component · G5 Release. Named after what is decided there, not after the work before it |
-| **`mode`** | The one knob for **document depth**, and nothing else. `catalog` · `outline` · `guarded` · `deep`, default `catalog`. Two scopes — global in `index.yaml`, per component in `components.yaml`, and the per-component one wins. **No third scope** |
-| **`risk_accepted`** | The one field for **review intensity**, and nothing else. `low` · `medium` · `high`. It MUST NOT be derived from `mode`, nor `mode` from it |
-| **Blueprint** | The whole-product portrait decided once at G3: one line per use case, table, endpoint, and screen, plus entities, actors, the spine, C4, and cross-component rules. It names a **gate and a skill**, never a document or a folder |
-| **Spec** | One unit of delivered work: the tickets that reach one outcome. Opens at G4 or G5, closes at G5, recorded in `specs.yaml`. Its document is `SPEC.md`, **optional at size `S`** — one term, one entry, and the document is named after the unit the way a `DEC-` file is named after its decision |
-| **Release** | What a PRD promises. One release MAY span several specs; the relation is data, never inferred from numbering |
-| **Spec size** | `S` ≤3 tickets no new FR · `M` 4–12 · `L` >12 or a new container. MAY be raised mid-flight, MUST NOT be lowered. It does **not** choose which gates are active — that is `mode`. It decides two things: whether G4 and G5 merge into one session (`S`), and whether `SPEC.md` is written at all (`M` and up) |
-| **Fast Path** | A fix that skips all gates: ≤1 ticket, no FR/UC/`AD-N`/domain-model change, no money, personal data, or third-party integration |
-| **Step** | One of the five points inside `wdi-build`'s ship pipeline — plan · build · panel · publish · CI. It is **not** a gate and not a stage, and the word MUST NOT be used for anything at gate altitude |
-
-## Artifacts
-
-| Term | Means |
-|---|---|
-| **Brief** | One problem, one user, one measure. Singleton, spans releases |
-| **PRD** | What is promised for **one initiative**, across every release it touches. FR and NFR numbered from the registry |
-| **SRS** | Per PC: what the system must do. `.what/` — slices space, while the PRD slices initiative. It **exists at every `mode`**, carrying the actor list and the use case catalogue |
-| **SDD** | Per PC: how it is built. `.how/`. At `mode: catalog` it is a skeleton, and that is a finished state |
-| **Inventory** | One of three living registers at product level — tables, endpoints, screens. Written as a plan when there is no code, **derived** from code once there is |
-| **Architecture spine** | `ARCHITECTURE-SPINE.md` — invariants as `AD-N`, each carrying Binds · Prevents · Rule. It constrains; it does not describe |
-| **C4** | L1 system context · L2 containers · L3 components, one file per container. L1+L2 together are what other methods call the HLD |
-| **`DESIGN.md`** | UX per PC, in `.how/<pc>/01-ux/` |
-| **`EXPERIENCE.md`** | The user-facing journey, in `.what/<pc>/04-usecases/` |
-| **`DEC-`** | One decision worth remembering, numbered globally. Lives in `.control/decisions/`. Recording is **not mandatory**; it freezes at `applied`, not at `accepted` |
-| **SPEC** | The document of **one spec**: a projection of `.what/` + `.how/` that MUST NOT contain anything new. Not read by humans, and **not written at size `S`** — there the tickets are the contract |
-| **Ticket** | One unit of build: a tracer-bullet vertical slice, complete through every layer, verifiable on its own, sized to one fresh context window. Carries the tickets that **block** it. Status is read from the ticket itself, never copied elsewhere |
-| **Structure map** | `.control/structure-codebase.md` and `structure-document.md` — where things actually are today |
-| **Memlog** | The record of *why* while an artifact was written. Never copied into a document; a source when writing a `DEC-`. It is a **run log**, and it MUST NOT be searched as an index of decisions — `.control/generated/decisions.md` is that |
-
-## Identifiers
-
-| Code | For |
-|---|---|
-| `BG-` · `FR-` · `NFR-` · `UJ-` | Business goal · functional requirement · non-functional requirement · user journey |
-| `UC-` | Use case |
-| `AD-` | An invariant in the architecture spine |
-| `DEC-` | A decision |
-| `LC-` | A Logical Component |
-| `OQ-` | An open question |
-| `RTR-` | **Retired.** It was an archived retrospective in `.control/reports/`; the retrospective step and `V19` went together. A frozen `RTR-` file stays where it is |
-| `CAP-` | A capability — the planning unit |
-| `NT-` | A non-technical fact |
-| `BUG-` · `HOT-` | A defect · a hotfix |
-| `goal-has-fr`–`container-built` | Validators. `V10` fell and its number is not reused |
-
-IDs are allocated **globally** and never restart per document, per component, or per release. The chain
-that must hold end to end: `BG → FR → UC → ticket → test`.
-
-`ADR-` is **retired**. It was renamed to `DEC-` on 2026-08-18 with the numbers unchanged, so `ADR-004`
-inside a document frozen before that date is an alias for `DEC-004`, and those documents MUST NOT be
-rewritten for the prefix.
-
-## Registry and generated
-
-| Term | Means |
-|---|---|
-| **Registry** | `.control/registry/` — the source of truth for IDs and plans. Written through `wdi-*` skills |
-| **Generated** | `.control/generated/` — derived from the registry. Written by the generator only, by hand **never** |
-| **RTM** | Requirements traceability matrix. Generated, never hand-maintained |
-| **Validator** | A script that answers what can be counted. It does not replace a gate checklist, which answers what must be judged |
-
-## BMad terms
-
-BMad terms live in a WDI glossary because WDI runs on BMad. Each is defined **as WDI uses it**;
-where BMad's own meaning is wider, the narrower one here wins.
-
-| Term | Means |
-|---|---|
-| **Stories mode** | **Retired.** It was BMad's route — `SPEC.md` + `stories.yaml` produced by `bmad-spec`. The engine layer below G5 no longer runs it; `bmad-guide.md` says what replaced it |
-| **Skill class** | `A` living document, straight to the corpus · `B` living but wrongly granular, lands neutral then is placed · `C` spent after its work · `D` no artifact |
-| **Companion** | A side file a BMad skill produces next to its main output. The lasting ones are promoted by the distillation table |
-| **Distillation** | Promoting what is durable out of `_bmad-output/` before a spec closes. What is not promoted dies with the folder |
-| **`persistent_facts`** | Files a skill always reads. Routing alone does not achieve this |
-| **`doc_standards`** | Rule files a skill checks its output against. Facts MUST NOT be installed here, and neither MUST anything at `status: Reference` |
-| **`{project_knowledge}`** | The config variable pointing at `.control/` |
-| **`_bmad/custom/`** | Where every BMad override lives. `.claude/skills/bmad-*/customize.toml` MUST NOT be edited — it is overwritten on update |
-
-## Retired — MUST NOT be used as current
-
-| Retired | Instead |
-|---|---|
-| `ADR-` | `DEC-` — same numbers, new prefix |
-| `ANX-`, and the annex concept | Nothing. Zero annexes were ever born |
-| `SCP-` | A `DEC-` of `type: course-correction` |
-| `layer:` on a decision | `touches:`, filled from what actually changed |
-| "Stage 1"…"Stage 5" as flow vocabulary | The five gates |
-| `epics.md` · `sprint-status.yaml` · `bmad-sprint-planning` · `bmad-create-epics-and-stories` · `stories.yaml` | Tickets, each carrying its own status and its blocking edges |
-| Validator `V10` | Nothing. Its number is not reused |
-| `bmad-help` as the answer to "where am I" | `wdi-help` |
-| The skills `wdi-analysis` · `wdi-architecture` · `wdi-design` · `wdi-glossary` · `wdi-structure` · `wdi-apply` · `wdi-correct-course` · `wdi-wave` · `wdi-ship-story` · `wdi-product-brief` · `wdi-meeting` · `wdi-project-log` | The seventeen in `why/README.md`. `why/rationale.md` says which absorbed which, and why |
-| An Indonesian synonym for a `mode` value — *ringkas*, *terjaga*, *katalog* as prose | The English value, used as written: `catalog` · `outline` · `guarded` · `deep` |
-
-## Synonyms that MUST NOT be coined
-
-A synonym for a term that already has an entry is drift, and `wdi-reconcile` hunts for it.
-
-| Do not say | Say | Because |
-|---|---|---|
-| application · app · service, for a deployable | **container** | The term is already defined at C4 L2 and carried by every LC |
-| infrastructure · third-party · dependency, for something inside the boundary | **container** with `built: false` | Calling it something else is how a container ends up with no row, no owner, and no NFR |
-| container, for something whose runtime we do not deploy | **external system** | It has no `built`, no L3, and no heading. Registering it as a container promises a section of the codebase map that will never exist |
-| module · package, for a unit of build | **Logical Component** | `components.yaml` names it, and `lc-registered` resolves against that name |
-| epic · sprint, for a batch of work | **spec** | Both belong to the sprint route this method dropped |
-| **wave**, for a unit of delivered work | **spec** | Retired when the engine layer below G5 changed. See the retired-alias rule below |
-| **story**, for a unit of build | **ticket** | Same retirement. A ticket is a vertical slice that blocks and is blocked; a story was a row in a file BMad owned |
-| area, for a domain slice | **Product Component** | The word "area" is not used anywhere in this method |
-| platform, for a Product Component | **`_platform`**, and only for what is not one | Registering `_platform` as a PC gives it a `mode`, an SRS, and a G4 it has no use for |
-| profile · tier · level, for document depth | **`mode`** | One knob, four values, and no matrix behind it |
-| feature, for a domain slice | **Product Component** | A feature is a promise; a PC is a folder pair with an owner |
-| requirements document | **PRD** or **SRS** | They cut different axes — time versus space — and merging the names merges the documents |
-
-## Retired terms keep their frozen documents
-
-`wave` and `story` are **retired aliases** of `spec` and `ticket`. A `wave` or a `story` appearing in a
-document frozen before the change — a closed `DEC-`, an `RTR-`, minutes, `why/rationale.md`'s record of what
-happened — reads as its replacement, and those documents **MUST NOT be rewritten for the term.** This is the
-same rule Article 6 already applies to `ADR-NNN` → `DEC-NNN`, and for the same reason: a frozen record that
-cites a name is evidence, and rewriting evidence to tidy a vocabulary destroys the thing that made it useful.
-
-What MUST use the new term: every `Accepted` guide, every skill, every registry, and anything written from
-here on.
-
-## Rules
-
-- A new method term MUST be added here in the same pass it first appears, not defined where it is
-  used. Adding one is a change to the **method itself** — `wdi-blueprint` MAY propose it and MUST NOT
-  write it, because a method term binds every project the method is installed in.
-- One term MUST NOT have two entries. Two meanings mean two terms.
-- A domain term MUST go to `.control/product-glossary.md` instead. If it is unclear which, ask whether the
-  term would survive being applied to a different product: yes → here, no → there.
-- Common technical terms stay in English when the industry name is the one that matches the code,
-  the error message, or the reader's expectation.
+---
+status: Accepted
+---
+
+# Method Glossary
+
+**Loaded when:** a method term is unclear, and before coining a new one.
+
+The words this method uses for **itself**. What the product is about belongs to
+`.control/product-glossary.md` instead. A term defined here MUST NOT be redefined there, and the
+reverse holds too. The test: would this term still apply on a different product? Yes → here.
+
+## Layers
+
+| Term | Means |
+|---|---|
+| **Corpus** | The four layers below. `_bmad-output/` is not part of it |
+| **`.constitution/`** | How we work. Rules. Rarely changes |
+| **`.control/`** | What currently holds and what has been decided. Facts. Changes often. Equals `{project_knowledge}` |
+| **`.what/`** | What was promised |
+| **`.how/`** | How it is built |
+| **Workspace** | `_bmad-output/` — work in progress, committed but not curated |
+| **Placement test** | Is this file still true after its spec has passed? Yes → corpus. No → workspace |
+
+## Units
+
+| Term | Means |
+|---|---|
+| **Product Component** (PC) | A domain slice — the box at C4 L3. Lives in `.what/<pc>/` and `.how/<pc>/`, and its `containers:` says where it runs |
+| **Logical Component** (LC) | One addressable unit of build. Registered in `components.yaml` with `type` · `container` · `owner` · `area` |
+| **Container** | Something that **runs its own code or stores its own data** and can be replaced without rebuilding another one. The C4 L2 term, and the value of an LC's `container` field. Two questions decide it and both MUST be yes — `architecture-guide.md` owns the test. Shipping two containers in one release does **not** merge them |
+| **`built`** | A container's one boolean. `true` when we write what is inside it, `false` when we deploy someone else's implementation. It decides whether the container gets an L3, an `LC`, and a heading in the codebase map — `container-built` checks all three |
+| **External system** | Something the product talks to whose **runtime we do not deploy**. It belongs at C4 L1, and MUST NOT be a container, an `LC`'s `container`, or a heading in the codebase map. What we lean on it for lives in `cross-cutting.md` or an integration contract |
+| **`_platform`** | **Not a component.** The home for what belongs to no Product Component: the spine, the C4 set, `cross-cutting.md`, the three inventories, and whatever it **owns**. A legitimate value in every position that asks which component owns something — `platform_owns`, an inventory row, an `LC`. Four kinds today: data · endpoint · job · screen. It carries no `mode`, no `risk_accepted`, and no G4 |
+| **Library** | An includable artifact — compiled into or imported by something else, never run on its own. Not a container |
+| **Slot** | A numbered sub-folder of a PC. `.what/<pc>/` 02–05 is reading order; `.how/<pc>/` 01–06 is ABCE classification. The two numberings do **not** mean the same thing |
+| **Kernel** | The `SRS-<pc>.md` or `SDD-<pc>.md` file itself. Content SHOULD stay in it until it grows past roughly 400 lines — a suggestion, not a threshold |
+
+A PC is not a container: a container runs, a PC is a domain. One container holds several PCs, and
+one PC may appear in more than one container. Because they cross, neither list implies the other, and
+the crossing MUST be written down rather than inferred — that is the PC × container matrix at C4 L2,
+rendered from each PC's `containers:`.
+
+## Flow
+
+There is no "stage". The five gates are the only flow vocabulary, and the word **area** is not used at all —
+there is only Product Component.
+
+| Term | Means |
+|---|---|
+| **Gate** | One of five decision points: G1 Problem · G2 Product · G3 Blueprint · G4 Component · G5 Release. Named after what is decided there, not after the work before it |
+| **`mode`** | The one knob for **document depth**, and nothing else. `catalog` · `outline` · `guarded` · `deep`, default `catalog`. Two scopes — global in `index.yaml`, per component in `components.yaml`, and the per-component one wins. **No third scope** |
+| **`risk_accepted`** | The one field for **review intensity**, and nothing else. `low` · `medium` · `high`. It MUST NOT be derived from `mode`, nor `mode` from it |
+| **Blueprint** | The whole-product portrait decided once at G3: one line per use case, table, endpoint, and screen, plus entities, actors, the spine, C4, and cross-component rules. It names a **gate and a skill**, never a document or a folder |
+| **Spec** | One unit of delivered work: the tickets that reach one outcome. Opens at G4 or G5, closes at G5, recorded in `specs.yaml`. Its document is `SPEC.md`, **optional at size `S`** — one term, one entry, and the document is named after the unit the way a `DEC-` file is named after its decision |
+| **Release** | What a PRD promises. One release MAY span several specs; the relation is data, never inferred from numbering |
+| **Spec size** | `S` ≤3 tickets no new FR · `M` 4–12 · `L` >12 or a new container. MAY be raised mid-flight, MUST NOT be lowered. It does **not** choose which gates are active — that is `mode`. It decides two things: whether G4 and G5 merge into one session (`S`), and whether `SPEC.md` is written at all (`M` and up) |
+| **Fast Path** | A fix that skips all gates: ≤1 ticket, no FR/UC/`AD-N`/domain-model change, no money, personal data, or third-party integration |
+| **Step** | One of the five points inside `wdi-build`'s ship pipeline — plan · build · panel · publish · CI. It is **not** a gate and not a stage, and the word MUST NOT be used for anything at gate altitude |
+
+## Artifacts
+
+| Term | Means |
+|---|---|
+| **Brief** | One problem, one user, one measure. Singleton, spans releases |
+| **PRD** | What is promised for **one initiative**, across every release it touches. FR and NFR numbered from the registry |
+| **SRS** | Per PC: what the system must do. `.what/` — slices space, while the PRD slices initiative. It **exists at every `mode`**, carrying the actor list and the use case catalogue |
+| **SDD** | Per PC: how it is built. `.how/`. At `mode: catalog` it is a skeleton, and that is a finished state |
+| **Inventory** | One of three living registers at product level — tables, endpoints, screens. Written as a plan when there is no code, **derived** from code once there is |
+| **Architecture spine** | `ARCHITECTURE-SPINE.md` — invariants as `AD-N`, each carrying Binds · Prevents · Rule. It constrains; it does not describe |
+| **C4** | L1 system context · L2 containers · L3 components, one file per container. L1+L2 together are what other methods call the HLD |
+| **`DESIGN.md`** | UX per PC, in `.how/<pc>/01-ux/` |
+| **`EXPERIENCE.md`** | The user-facing journey, in `.what/<pc>/04-usecases/` |
+| **`DEC-`** | One decision worth remembering, numbered globally. Lives in `.control/decisions/`. Recording is **not mandatory**; it freezes at `applied`, not at `accepted` |
+| **SPEC** | The document of **one spec**: a projection of `.what/` + `.how/` that MUST NOT contain anything new. Not read by humans, and **not written at size `S`** — there the tickets are the contract |
+| **Ticket** | One unit of build: a tracer-bullet vertical slice, complete through every layer, verifiable on its own, sized to one fresh context window. Carries the tickets that **block** it. Status is read from the ticket itself, never copied elsewhere |
+| **Structure map** | `.control/structure-codebase.md` and `structure-document.md` — where things actually are today |
+| **Mandate** | A `DEC-` of `type: mandate`: the owner's one dated, expiring delegation that lets `wdi-autopilot` decide what the skills would otherwise have asked. Its parameters live on its registry row only; every decision taken under it is a row in the ledger, `.control/memlog/autopilot-<date>.md` |
+| **Memlog** | The record of *why* while an artifact was written. Never copied into a document; a source when writing a `DEC-`. It is a **run log**, and it MUST NOT be searched as an index of decisions — `.control/generated/decisions.md` is that |
+
+## Identifiers
+
+| Code | For |
+|---|---|
+| `BG-` · `FR-` · `NFR-` · `UJ-` | Business goal · functional requirement · non-functional requirement · user journey |
+| `UC-` | Use case |
+| `AD-` | An invariant in the architecture spine |
+| `DEC-` | A decision |
+| `LC-` | A Logical Component |
+| `OQ-` | An open question |
+| `RTR-` | **Retired.** It was an archived retrospective in `.control/reports/`; the retrospective step and `V19` went together. A frozen `RTR-` file stays where it is |
+| `CAP-` | A capability — the planning unit |
+| `NT-` | A non-technical fact |
+| `BUG-` · `HOT-` | A defect · a hotfix |
+| `goal-has-fr`–`container-built` | Validators. `V10` fell and its number is not reused |
+
+IDs are allocated **globally** and never restart per document, per component, or per release. The chain
+that must hold end to end: `BG → FR → UC → ticket → test`.
+
+`ADR-` is **retired**. It was renamed to `DEC-` on 2026-08-18 with the numbers unchanged, so `ADR-004`
+inside a document frozen before that date is an alias for `DEC-004`, and those documents MUST NOT be
+rewritten for the prefix.
+
+## Registry and generated
+
+| Term | Means |
+|---|---|
+| **Registry** | `.control/registry/` — the source of truth for IDs and plans. Written through `wdi-*` skills |
+| **Generated** | `.control/generated/` — derived from the registry. Written by the generator only, by hand **never** |
+| **RTM** | Requirements traceability matrix. Generated, never hand-maintained |
+| **Validator** | A script that answers what can be counted. It does not replace a gate checklist, which answers what must be judged |
+
+## BMad terms
+
+BMad terms live in a WDI glossary because WDI runs on BMad. Each is defined **as WDI uses it**;
+where BMad's own meaning is wider, the narrower one here wins.
+
+| Term | Means |
+|---|---|
+| **Stories mode** | **Retired.** It was BMad's route — `SPEC.md` + `stories.yaml` produced by `bmad-spec`. The engine layer below G5 no longer runs it; `bmad-guide.md` says what replaced it |
+| **Skill class** | `A` living document, straight to the corpus · `B` living but wrongly granular, lands neutral then is placed · `C` spent after its work · `D` no artifact |
+| **Companion** | A side file a BMad skill produces next to its main output. The lasting ones are promoted by the distillation table |
+| **Distillation** | Promoting what is durable out of `_bmad-output/` before a spec closes. What is not promoted dies with the folder |
+| **`persistent_facts`** | Files a skill always reads. Routing alone does not achieve this |
+| **`doc_standards`** | Rule files a skill checks its output against. Facts MUST NOT be installed here, and neither MUST anything at `status: Reference` |
+| **`{project_knowledge}`** | The config variable pointing at `.control/` |
+| **`_bmad/custom/`** | Where every BMad override lives. `.claude/skills/bmad-*/customize.toml` MUST NOT be edited — it is overwritten on update |
+
+## Retired — MUST NOT be used as current
+
+| Retired | Instead |
+|---|---|
+| `ADR-` | `DEC-` — same numbers, new prefix |
+| `ANX-`, and the annex concept | Nothing. Zero annexes were ever born |
+| `SCP-` | A `DEC-` of `type: course-correction` |
+| `layer:` on a decision | `touches:`, filled from what actually changed |
+| "Stage 1"…"Stage 5" as flow vocabulary | The five gates |
+| `epics.md` · `sprint-status.yaml` · `bmad-sprint-planning` · `bmad-create-epics-and-stories` · `stories.yaml` | Tickets, each carrying its own status and its blocking edges |
+| Validator `V10` | Nothing. Its number is not reused |
+| `bmad-help` as the answer to "where am I" | `wdi-help` |
+| The skills `wdi-analysis` · `wdi-architecture` · `wdi-design` · `wdi-glossary` · `wdi-structure` · `wdi-apply` · `wdi-correct-course` · `wdi-wave` · `wdi-ship-story` · `wdi-product-brief` · `wdi-meeting` · `wdi-project-log` | The eighteen in `why/README.md`. `why/rationale.md` says which absorbed which, and why |
+| An Indonesian synonym for a `mode` value — *ringkas*, *terjaga*, *katalog* as prose | The English value, used as written: `catalog` · `outline` · `guarded` · `deep` |
+
+## Synonyms that MUST NOT be coined
+
+A synonym for a term that already has an entry is drift, and `wdi-reconcile` hunts for it.
+
+| Do not say | Say | Because |
+|---|---|---|
+| application · app · service, for a deployable | **container** | The term is already defined at C4 L2 and carried by every LC |
+| infrastructure · third-party · dependency, for something inside the boundary | **container** with `built: false` | Calling it something else is how a container ends up with no row, no owner, and no NFR |
+| container, for something whose runtime we do not deploy | **external system** | It has no `built`, no L3, and no heading. Registering it as a container promises a section of the codebase map that will never exist |
+| module · package, for a unit of build | **Logical Component** | `components.yaml` names it, and `lc-registered` resolves against that name |
+| epic · sprint, for a batch of work | **spec** | Both belong to the sprint route this method dropped |
+| **wave**, for a unit of delivered work | **spec** | Retired when the engine layer below G5 changed. See the retired-alias rule below |
+| **story**, for a unit of build | **ticket** | Same retirement. A ticket is a vertical slice that blocks and is blocked; a story was a row in a file BMad owned |
+| area, for a domain slice | **Product Component** | The word "area" is not used anywhere in this method |
+| platform, for a Product Component | **`_platform`**, and only for what is not one | Registering `_platform` as a PC gives it a `mode`, an SRS, and a G4 it has no use for |
+| profile · tier · level, for document depth | **`mode`** | One knob, four values, and no matrix behind it |
+| feature, for a domain slice | **Product Component** | A feature is a promise; a PC is a folder pair with an owner |
+| requirements document | **PRD** or **SRS** | They cut different axes — time versus space — and merging the names merges the documents |
+
+## Retired terms keep their frozen documents
+
+`wave` and `story` are **retired aliases** of `spec` and `ticket`. A `wave` or a `story` appearing in a
+document frozen before the change — a closed `DEC-`, an `RTR-`, minutes, `why/rationale.md`'s record of what
+happened — reads as its replacement, and those documents **MUST NOT be rewritten for the term.** This is the
+same rule Article 6 already applies to `ADR-NNN` → `DEC-NNN`, and for the same reason: a frozen record that
+cites a name is evidence, and rewriting evidence to tidy a vocabulary destroys the thing that made it useful.
+
+What MUST use the new term: every `Accepted` guide, every skill, every registry, and anything written from
+here on.
+
+## Rules
+
+- A new method term MUST be added here in the same pass it first appears, not defined where it is
+  used. Adding one is a change to the **method itself** — `wdi-blueprint` MAY propose it and MUST NOT
+  write it, because a method term binds every project the method is installed in.
+- One term MUST NOT have two entries. Two meanings mean two terms.
+- A domain term MUST go to `.control/product-glossary.md` instead. If it is unclear which, ask whether the
+  term would survive being applied to a different product: yes → here, no → there.
+- Common technical terms stay in English when the industry name is the one that matches the code,
+  the error message, or the reader's expectation.

package/kit/.constitution/method/scripts/validate.py

@@ -55,6 +55,7 @@ CHECK_ORDER = (
     "entity-one-writer",
     "spec-after-g4",
     "high-risk-named",
+    "mandate-accept",
     "cites-resolve",
     "container-built",
     "custom-room-declared",
@@ -969,7 +970,8 @@ def high_risk_named(c: Corpus, r: Result) -> None:  # was V23
     to resolve: a repo pointing at a decision is making a checkable claim, and a pointer to a decision
     that does not exist is worse than no pointer.
     """
-    known = {str(x.get("id")) for x in c.decs}
+    by_id = {str(x.get("id")): x for x in c.decs}
+    known = set(by_id)
     for pc in c.pcs:
         pid = str(pc.get("id"))
         if str(pc.get("risk_accepted") or "").strip() != "high":
@@ -985,6 +987,104 @@ def high_risk_named(c: Corpus, r: Result) -> None:  # was V23
                    f"`risk_accepted_by` names nobody — a person and a date is enough")
         elif ref.startswith("DEC-") and ref not in known:
             r.fail("high-risk-named", pid, f"`risk_accepted_by: {ref}` does not exist in decisions.yaml")
+        elif str(by_id.get(ref, {}).get("type") or "") == "mandate":
+            # A mandate delegates the decisions the owner would have taken. Accepting a HIGH risk on a
+            # component that touches money or personal data is not one of them: the whole point of this
+            # check is that a PERSON is named, and pointing at the delegation names nobody. Left legal, an
+            # unattended run could raise the risk itself and switch off the code panel wdi-build requires.
+            r.fail("high-risk-named", pid, f"`risk_accepted_by: {ref}` is a `type: mandate` — a run MUST NOT "
+                                           f"accept a sensitive risk for the owner; name a person and a date")
+
+
+def _dec_date(c: Corpus, dec: dict) -> dt.date | None:
+    """The day a decision was taken: `date` on its row, else `date`/`created` in its file's frontmatter."""
+    def as_date(v: object) -> dt.date | None:
+        if isinstance(v, dt.datetime):
+            return v.date()
+        if isinstance(v, dt.date):
+            return v
+        try:
+            return dt.date.fromisoformat(str(v).strip()) if v else None
+        except ValueError:
+            return None
+    got = as_date(dec.get("date"))
+    if got:
+        return got
+    did = str(dec.get("id") or "")
+    for path in sorted(c.root.glob(f".control/decisions/{did}-*.md")):
+        fm = frontmatter(path) or {}
+        got = as_date(fm.get("date")) or as_date(fm.get("created"))
+        if got:
+            return got
+    return None
+
+
+def mandate_accept(c: Corpus, r: Result) -> None:
+    """A decision accepted BY DELEGATION points at a real mandate that had not lapsed when it was taken.
+
+    `wdi-autopilot` lets the agent accept decisions the owner would have accepted, and that is legal
+    only because the owner accepted the MANDATE in person. So three things hold: a mandate is never
+    itself accepted by another decision — the chain of authority has a person at its root; an accepted
+    mandate names the day it ends, or it is standing permission; and a decision whose `accepted_by` is
+    a `DEC-` names one that is `type: mandate`, accepted, and unexpired on the decision's own date.
+
+    It says nothing about WHAT was decided — that is the ledger's job and the owner's review.
+    """
+    by_id = {str(d.get("id")): d for d in c.decs}
+    for dec in c.decs:
+        did = str(dec.get("id"))
+        ref = str(dec.get("accepted_by") or "").strip()
+        status = str(dec.get("status") or "")
+        if str(dec.get("type") or "") == "mandate":
+            if ref.startswith("DEC-"):
+                r.fail("mandate-accept", did,
+                       f"is a mandate accepted by delegation (`accepted_by: {ref}`) — the mandate is the one "
+                       f"decision the owner accepts in person")
+            if status in ("accepted", "applied"):
+                if not ref:
+                    r.fail("mandate-accept", did, "is an accepted mandate and `accepted_by` names nobody — "
+                                                  "a person and a date is enough")
+                params = dec.get("mandate") if isinstance(dec.get("mandate"), dict) else {}
+                raw = str(params.get("expires") or "").strip()
+                if not raw:
+                    r.fail("mandate-accept", did, "has no `mandate.expires` — a mandate with no end is standing "
+                                                  "permission, and the loop it drives expires anyway")
+                ledger = c.root / ".control/memlog" / f"autopilot-{did}.md"
+                if not ledger.exists():
+                    # Every claim the mandate rests on — every decision recorded, nothing decided that was
+                    # parked — is checkable only against this file. Absent, the run holds the owner's
+                    # authority with no account of what it did with it.
+                    r.fail("mandate-accept", did, f"has no ledger at `.control/memlog/autopilot-{did}.md` — "
+                                                  f"the record is what the delegation was granted against")
+                if raw and _dec_date(c, {"date": params.get("expires")}) is None:
+                    # An unparseable expiry is WORSE than a missing one: it passes a presence check and then
+                    # silently disables the lapse comparison for every decision taken under this mandate.
+                    r.fail("mandate-accept", did, f"`mandate.expires: {raw}` is not a date — write `YYYY-MM-DD`. "
+                                                  f"An expiry nothing can read stops nothing")
+            continue
+        if not ref.startswith("DEC-"):
+            continue
+        target = by_id.get(ref)
+        if target is None:
+            r.fail("mandate-accept", did, f"`accepted_by: {ref}` does not exist in decisions.yaml")
+            continue
+        if str(target.get("type") or "") != "mandate":
+            r.fail("mandate-accept", did, f"`accepted_by: {ref}` is not a `type: mandate` decision — only a mandate "
+                                          f"delegates acceptance")
+            continue
+        if str(target.get("status") or "") not in ("accepted", "applied"):
+            r.fail("mandate-accept", did, f"`accepted_by: {ref}` is `{target.get('status')}`, not accepted — "
+                                          f"nothing was delegated yet")
+            continue
+        params = target.get("mandate") if isinstance(target.get("mandate"), dict) else {}
+        expires = _dec_date(c, {"date": params.get("expires")})
+        when = _dec_date(c, dec)
+        if when is None:
+            r.fail("mandate-accept", did, f"is accepted under `{ref}` but no date says when — `date:` in its "
+                                          f"frontmatter is what the expiry is checked against")
+        elif expires and when > expires:
+            r.fail("mandate-accept", did, f"was taken on {when.isoformat()}, after `{ref}` expired on "
+                                          f"{expires.isoformat()} — the delegation had lapsed")
 
 
 def defect_root_cause(c: Corpus, r: Result) -> None:  # was V20
@@ -1357,7 +1457,7 @@ def run_checks(c: Corpus, asof: dt.date) -> Result:
     # no two copies left to compare.
     # V19 is REPEALED. It checked one line item — an `RTR-` file in .control/reports/ — and the
     # retrospective it archived was the only thing spec size `L` ever decided. Both went together.
-    for fn in (goal_has_fr, fr_has_uc, uc_scheduled, ticket_has_test, nfr_has_enforcer, refs_resolve, no_cycles, applied_dec_touches, locked_gate_passed, parallel_tickets_blocked, lc_registered, review_trace, chain_links, memlog_home, spec_names_release_prd, ticket_status_one_home, defect_root_cause, entity_one_writer, spec_after_g4, high_risk_named, cites_resolve, container_built, custom_room_declared, id_allocated_once):
+    for fn in (goal_has_fr, fr_has_uc, uc_scheduled, ticket_has_test, nfr_has_enforcer, refs_resolve, no_cycles, applied_dec_touches, locked_gate_passed, parallel_tickets_blocked, lc_registered, review_trace, chain_links, memlog_home, spec_names_release_prd, ticket_status_one_home, defect_root_cause, entity_one_writer, spec_after_g4, high_risk_named, mandate_accept, cites_resolve, container_built, custom_room_declared, id_allocated_once):
         fn(c, r)
     plan_dates(c, r, asof)
     return r

package/kit/.constitution/method/why/README.md

@@ -101,7 +101,7 @@ and the Fast Path do not.
 | `wdi-method update` printed an `upgrade` line | `wdi-upgrade`, before any other skill — it moves content into the new shape, never invents it, one commit |
 | You do not know where you are | `wdi-help` |
 
-## Seventeen skills
+## Eighteen skills
 
 Named for the **gate they serve**, so *"which skill do I run"* is answered by *"which gate am I at"*.
 
@@ -126,6 +126,7 @@ Named for the **gate they serve**, so *"which skill do I run"* is answered by *"
 | `wdi-log` | A meeting finished, or a non-technical fact now binds |
 | `wdi-help` | "Where am I, what next" |
 | `wdi-explain-to-me` | "Brief me so I can decide this" — an open question, a defect, a design fork. Reads everything, writes nothing; the decision then goes to `wdi-decision` or `wdi-question` |
+| `wdi-autopilot` | "Deliver every `FR` and do not ask me in between." A preflight the owner confirms becomes one `DEC-` of `type: mandate`; a loop then fires the skill, and it runs every other skill, decides what they would have asked, and writes each decision to one ledger the owner reviews in parallel |
 | `wdi-upgrade` | `wdi-method update` just moved the method version, and the summary listed content still in the old shape. Moves it, never invents it; one commit |
 | `wdi-reconcile` | Any time. Read-only — it reports, it never edits |
 | `wdi-review` | Over any document, any time |