wdi-method 0.6.18 → 0.6.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -1,530 +1,538 @@
1
- # WDI Method
2
-
3
- **The review layer BMad leaves thin — documents a human reads to check a decision before code gets written, sized to what the change actually deserves.**
4
-
5
- [BMad](https://github.com/bmad-code-org/BMAD-METHOD) decides *what* to build and *how* to build it well. WDI Method wraps it — it does not replace it — and adds the part between those two decisions and the code: inventories, a use case catalogue, a component design record, and a way to choose how much of that a given change actually needs.
6
-
7
- > This repository is **public and generic**. It MUST NOT carry a client name, a product name, or a
8
- > link to a private repository — product identity lives entirely in the repo that installs it.
9
-
10
- ---
11
-
12
- ## Prerequisites — two engines, and both are required
13
-
14
- | Engine | What it does here | Source |
15
- |---|---|---|
16
- | **BMad Method** | Writes the documents behind G1–G4 — brief, PRD, architecture, UX | [github.com/bmad-code-org/BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) |
17
- | **mattpocock/skills** | Cuts the work at G5 — `to-spec`, `to-tickets`; runs the Fast Path and every `wdi-autopilot` iteration — `implement` | [github.com/mattpocock/skills](https://github.com/mattpocock/skills) |
18
-
19
- **The installer refuses without either.** BMad has always been checked. The ticket engines are checked
20
- too, since 0.6.4: G1–G4 genuinely run without them, and every repo that relied on that learned they were
21
- missing inside `wdi-build` with a spec already open. `--skip-engines-check` is the escape for the two
22
- cases that earn it — CI, and a repo that will never reach G5.
23
-
24
- No engine skill is invoked on its own. Each has a wrapper (`wdi-*`) that checks where the project is,
25
- runs the engine, verifies what came back, and records it. The engine is the pen; the wrapper knows what
26
- page it is on.
27
-
28
- ---
29
-
30
- ## Install
31
-
32
- Three steps, in this order, and **step 3 refuses until steps 1 and 2 are done** — through the TUI and
33
- through `--yes` alike. BMad has always been checked; the engines are checked too, because every repo that
34
- learned they were missing learned it inside `wdi-build` with a spec already open. `--skip-engines-check`
35
- is the escape for the two cases that earn it: CI, and a repo that will never reach G5.
36
-
37
- **1. BMad Method** — in the product repo, picking the same agents you will give this installer:
38
-
39
- ```bash
40
- cd /path/to/your/product-repo
41
- npx bmad-method install
42
- ```
43
-
44
- **2. mattpocock/skills** — **into this repo**, on every agent:
45
-
46
- ```bash
47
- npx skills@latest add mattpocock/skills
48
- ```
49
-
50
- Take all six the method drives: `to-spec`, `to-tickets`, `implement`, `tdd`, `code-review`, and
51
- `domain-modeling`. Either install mode works — "copy" or "symlink".
52
-
53
- **The Claude Code plugin is not an alternative here, and the reason is mechanical.** `to-spec`,
54
- `to-tickets` and `implement` ship with `disable-model-invocation: true`, so no skill can invoke them;
55
- nothing outside the file lifts that flag, and a plugin's files are not this repo's to edit. WDI Method
56
- strips it from the copies the repo owns — which is what lets `wdi-build` invoke an engine and
57
- `wdi-autopilot` run an iteration with nobody watching — and re-applies that on every update, because
58
- `npx skills update` restores the author's file. The installer refuses without the six, and
59
- `--skip-engines-check` is the escape for CI and for a repo that will never reach G5.
60
-
61
- If you also have the plugin installed for your user, the repo's copies are what run; removing the
62
- plugin keeps `/to-spec` unambiguous.
63
-
64
- **You do not need to run `/setup-matt-pocock-skills` to get started.** Step 3 seeds `docs/agents/` with
65
- the two answers WDI Method actually has a requirement on, so the engines are aligned from the first
66
- install. Run the setup skill only to *change* something — to point at GitHub or Jira instead of local
67
- markdown — and keep the three invariants the seeded `issue-tracker.md` names.
68
-
69
- The seeding exists because the interview's own defaults are wrong here in one specific way: they send every
70
- engineering skill looking for a root `CONTEXT.md` and `docs/adr/`, and Article 3 says this method has no
71
- `docs/` layer for corpus or rules — `wdi-reconcile` reports both as findings. A repo that ran the setup
72
- before installing this package keeps its own file, and the installer names the contradiction rather than
73
- overwriting it.
74
-
75
- **3. WDI Method:**
76
-
77
- ```bash
78
- npx wdi-method
79
- ```
80
-
81
- This opens a TUI: it checks BMad, reports whether it found the ticket engines, detects install versus
82
- update, asks the product name and the document language, lets you pick agents, shows what it will
83
- write, and prints what to do next.
84
-
85
- **Every field arrives with an answer already in it, and Enter accepts it.** On an update that answer is
86
- what the repo already says; on a first install the product name is the folder name made readable —
87
- `acme-billing-portal` offers `Acme Billing Portal`. Nothing is validated as required: a prompt that
88
- refuses an empty submission while already holding a sensible default is asking you to retype something
89
- the installer knows.
90
-
91
- A value only changes when you actually answer. A run that does not mention language keeps the language the
92
- repo already chose, and says so.
93
-
94
- ```bash
95
- npx wdi-method@latest update # later, to take a newer method — @latest, or npx may reuse a cached one
96
- npx wdi-method verify # check the method files are all present
97
- ```
98
-
99
- **Upgrading from 0.5.x to 0.6** is two halves. `update` does the mechanical one — overwrites the kit,
100
- renames files whose content needs no judgment, seeds what is new — and then prints an `upgrade` line
101
- naming what is still in the old shape: a single `requirements.yaml`, a 14-section brief, a PRD carrying
102
- its FR text. The second half is a decision about content, so it belongs to a skill:
103
-
104
- ```bash
105
- npx wdi-method@latest update --yes # 1 — mechanical; read the `upgrade` line it prints
106
- # 2 — in your agent, run the wdi-upgrade skill: it moves every sentence into its new home, word for
107
- # word, invents nothing, reports what it could not place, and ends in one commit.
108
- ```
109
-
110
- Run the skill before any other skill. `wdi-help` and the validators read the new shape; a corpus half
111
- in the old one answers them wrongly.
112
-
113
- Non-interactive, for CI:
114
-
115
- ```bash
116
- npx wdi-method install --yes --agents claude,codex --product "Your Product" \
117
- --doc-language "Bahasa Indonesia"
118
- ```
119
-
120
- Then invoke the **`wdi-help`** skill and ask what to do next. It reads where the project actually is and
121
- answers with the gate you are at, not with a menu.
122
-
123
- ---
124
-
125
- ## What to do right after install, and right after update
126
-
127
- Two questions, and the honest answer to most of them is *nothing*. `wdi-help` answers them from the
128
- registry at any time; this table is the same answer written down.
129
-
130
- ### After `install`
131
-
132
- | | |
133
- |---|---|
134
- | Engines missing | You never get here — `install` refuses, and names both install paths. Install them, run it again |
135
- | `/setup-matt-pocock-skills`? | **No.** The installer seeded `docs/agents/` already answered for this method. Run that interview only to *change* tracker |
136
- | So what is first? | **`wdi-init` intent `setup`** — it sets the global `mode`, and nothing has started until it is |
137
- | Then? | `wdi-problem` for G1. Or ask `wdi-help`, which reads the registry rather than this table |
138
-
139
- ### After `update`
140
-
141
- | The summary said | Do |
142
- |---|---|
143
- | an **`upgrade`** line, naming content still in the old shape | **`wdi-upgrade`, before any other skill.** It moves every sentence into its new home, invents nothing, reports what it could not place, and ends in one commit. `wdi-help` and the validators read the new shape; a corpus half in the old one answers them wrongly |
144
- | **no** `upgrade` line | Nothing. The update was mechanical and complete — carry on from wherever the gates say you are |
145
- | `seeded docs/agents/` | Nothing. An older repo just received the engines' config, pre-answered. Read it if you like; do not run the setup interview to redo it |
146
- | a warning that `domain.md` still points at a root `CONTEXT.md` | Add the correction that warning names to the top of that file. It was written by the setup interview before this package was installed, and it sends every engineering skill at two paths Article 3 forbids |
147
- | a warning naming a **mandate** and `ad-n` | Only if you run `wdi-autopilot`. Decide whether that mandate should now park `AD-N` contradictions, and edit its `parked` list yourself — `update` never edits an authority you granted |
148
-
149
- **`wdi-upgrade` is only ever about corpus content** — a brief, a PRD, an SRS, registry rows in the old
150
- shape. It is not the answer to a missing engine, a missing tracker config, or anything under
151
- `.control/memlog/`; each of those is handled by the installer itself or by the skill that owns it.
152
-
153
- ---
154
-
155
- ## How to use it — the walk
156
-
157
- A gate is a moment where a human reads **one page** and decides. Between gates the AI works in a
158
- pointer-heavy working set it does not need you to read. So the walk is: run a skill, read the page it
159
- renders, decide — advance or refine.
160
-
161
- | # | You run | You read | You decide |
162
- |---|---|---|---|
163
- | 0 | `wdi-init` intent `setup` | — | the global `mode`: how deep this product goes by default |
164
- | 1 | `wdi-problem` | `.what-rendered/_product-brief/brief.md` | **G1** — is this the problem, whose is it, and does it earn the work? |
165
- | 2 | `wdi-product` intent `prd` — `wdi-ux` first when the interface *is* the promise | `.what-rendered/_prd/<slug>/prd.md` | **G2** — is this what we build, and how does it feel? |
166
- | 3 | `wdi-init` intent `component` | the rows it adds to `components.yaml` | each component's `mode` and `risk_accepted` |
167
- | 4 | `wdi-blueprint` — `catalog`, then `platform` | `.how-rendered/blueprint.md` | **G3** — does the whole hold together? **Once per product** |
168
- | 5 | `wdi-component` — one component | `.how-rendered/<pc>/SDD-<pc>.md` | **G4** — is this how we build it? **Skipped at `mode: catalog`** |
169
- | 6 | `wdi-report` intent `estimate` | `.control/generated/estimate.md` | which candidate row becomes the next spec |
170
- | 7 | `wdi-build` — for that row | nothing: tickets are machine contracts. You answer `to-tickets`' quiz on granularity and blocking edges | **G5** — is it done and proven? Once per spec |
171
- | 8 | `wdi-report` intent `progress` | the report it writes | what has moved, what is late, what is proven |
172
- | 9 | `wdi-autopilot` — when you would rather review the result than walk steps 6–8 yourself | its preflight page, then its final report and ledger | one **mandate**: scope, what stays parked for you, smoke test by the agent or by you, loop interval, expiry |
173
-
174
- **Unattended, on request.** `wdi-autopilot` moves owner time from the gates to two points: the mandate before,
175
- the review after. From the gate you name it runs the same skills, answers what they would have asked, records
176
- every answer in `.control/memlog/autopilot-<mandate-id>.md`, and returns at one of three stops — done,
177
- at capacity, or blocked. It finishes when every `FR` in scope is closed, when nothing left is runnable, or
178
- when the mandate expires. It needs three things from the session: permission prompts bypassed (one prompt halts the
179
- loop), a loop to fire it — `/loop 5m /wdi-autopilot` in Claude Code — and a way past the ticket engines'
180
- `disable-model-invocation`, which the preflight names: a builder that reads and follows the engine's `SKILL.md`,
181
- or a copy of the engines inside the repo. The validator `mandate-accept` keeps the one thing the method never
182
- gives up: a person, dated, at the root of every delegated acceptance.
183
-
184
- **Refine, do not advance.** When a page does not convince you, run the same skill again and say what is
185
- wrong it updates the document it owns. Nothing downstream exists yet, so nothing breaks. Advancing past a
186
- page you did not believe is how every later page inherits the doubt.
187
-
188
- **After the first pass**, steps 0–4 never run again for that product. The next component enters at step 5
189
- (or 6, at `catalog`); a new initiative enters at step 2; a small fix touching no `FR`, `UC`, `AD-N`, or
190
- domain model skips every gate and runs `/implement` directly — and **stops to become a spec `S`** the
191
- moment it touches an `FR`. `wdi-help` tells you which of these you are in; it reads the registry, not you.
192
-
193
- ---
194
-
195
- ## Why the steps are in this order
196
-
197
- - **One question per gate.** The brief answers *why*, the PRD *what*, the blueprint *the whole*, the SDD
198
- *how one part*, the spec *is it done*. Every document that grew unreadable did so by answering a
199
- neighbour's question too. A gate that asks one question can be passed in ten minutes.
200
- - **The page you read is rendered; the page the AI edits points.** A goal lives once, in
201
- `goals.yaml`; the working brief says `Goals — see goals.yaml`; the rendered brief shows the goals in
202
- full. So the human gets a complete document and the corpus has no copies — and the validators check
203
- **drift against the code**, never whether two copies agree, because there are none to compare.
204
- - **Cost follows the unit of change.** G3 is once per product because the portrait is one thing. G4 is per
205
- component because that is what changes when you build. G5 is per spec because that is what ships.
206
- Repeating the blueprint per component was the single largest waste the earlier shape carried.
207
- - **Two knobs that never merge.** `mode` decides which gates *exist* for a component (`catalog` skips G4
208
- outright); `risk_accepted` decides how much *proof* a gate demands. Merged into one "rigor" dial, a
209
- low-risk component either drowns in ceremony or a high-risk one escapes it.
210
- - **Estimate before build.** Step 6 derives the candidate tasks from the promises already made
211
- `CAP` and `FR` so nobody invents a backlog. One candidate row becomes one spec, three neighbours
212
- may merge into one, and the estimate page says so about itself: it is forward-looking, never a record.
213
- - **The engine cuts; the wrapper frames.** `to-spec` and `to-tickets` are the best ticket-cutting
214
- engine we found: vertical tracer-bullet slices, blocking edges, a quiz with the owner. What a cutter
215
- cannot know, `wdi-build` supplies: that every component the spec touches passed G4; that every ticket
216
- names the `UC` it `satisfies`, so `FR UC ticket test` stays one chain; that a spec restates
217
- promises and never makes new ones; that code is judged by the test suite going red then green, from a
218
- fresh context per step, never by a builder's report; and that a closed spec leaves the registry caught
219
- up and the inventories re-derived from code.
220
- - **Documents follow the code.** At spec close the inventories are regenerated from what was built and
221
- the difference is *reported*, never patched into agreement. A record that contradicts the code is
222
- corrected; code is never changed to match a record.
223
-
224
- ---
225
-
226
- ## The file tree, and why
227
-
228
- ```
229
- .constitution/
230
- method/ the method overwritten by every update; never edit here
231
- project/ your own rules and readers — kept by every update
232
- .control/
233
- registry/ SSOT for every ROW: goals.yaml · requirements-<slug>.yaml · components.yaml
234
- usecases.yaml · specs.yaml · risks.yaml · defects.yaml · index.yaml
235
- questions/ open questions, assumptions, external prerequisites — one row each
236
- decisions/ DEC-N files; frozen once applied
237
- generated/ machine tables: rtm · dag · status · estimate · timeline — regenerated, never edited
238
- .what/ what is PROMISED the AI's working set, pointer-heavy, few files
239
- _product-brief/brief.md
240
- _prd/<slug>/prd.md · addendum.md
241
- <pc>/SRS-<pc>.md + 02-rules · 03-domain · 04-usecases · 05-scenarios
242
- .how/ how it is BUILT same discipline
243
- _platform/ ARCHITECTURE-SPINE.md · c4-l2-containers.md · inventories
244
- <pc>/SDD-<pc>.md + 01-ux · 02-contracts · 04-components · 05-model · 06-flows
245
- .what-rendered/ the human's tree: brief · _prd/<slug>/prd.md · <pc>/SRS-<pc>.mdone complete page each
246
- .how-rendered/ blueprint.md (rootit spans every component) · <pc>/SDD-<pc>.md
247
- _bmad-output/ a skill run's working output; empties as its spec closes
248
- .work/ scratch; empties when the task closes
249
- <spec_folder>/issues/ one file per ticket the tracker's payload, not yours to read
250
- ```
251
-
252
- Three layers, and the rule that keeps them honest:
253
-
254
- | Layer | Holds | Who writes | Who reads |
255
- |---|---|---|---|
256
- | **Registry** | every row — a goal, a requirement, a component, a ticket index | the skill that owns the gate | validators, renderers, every other skill |
257
- | **Working documents** (`.what/`, `.how/`) | the prose that reasons — why, boundaries, what makes it different — and **pointers** at the rows | the owning skill | the AI |
258
- | **Rendered pages** (`*-rendered/`) | one complete page per gate, rows filled in from their homes | `validate.py --generate`, never a hand | the human, and the client |
259
-
260
- Why split the human's tree from the AI's: a document that is both the AI's working surface and the
261
- human's deliverable ends up serving neither — too long to point, too gappy to hand over. Why the
262
- registry is per initiative (`requirements-<slug>.yaml`) but goals are per product: a capability is
263
- declared by one feature in one PRD; a goal belongs to the product before any PRD exists. Why
264
- `blueprint.md` sits at the root of `.how-rendered/` and not under `_platform/`: `_platform` means
265
- "belongs to no component"; the blueprint spans all of them. Why rendered pages are never a skill's
266
- input: a skill that read a projection would be reading a copy, and the copy would start to drift the
267
- day someone edited it. A test in this package fails if any `SKILL.md` lists a `-rendered` path as an
268
- Input.
269
-
270
- ---
271
-
272
- ## Why WDI Method?
273
-
274
- - **Depth separate from scrutiny.** `mode` sets how much gets written; `risk_accepted` sets how hard it
275
- gets reviewed. Neither is derived from the other, so a component MAY be thin on purpose and reviewed the
276
- hardest.
277
- - **Ground truth over plan.** Once code exists, the tables, endpoints, and screens are **derived from it**
278
- — the gap between plan and reality is a finding to resolve, not an argument to have.
279
- - **Containers that match what actually ships.** C4's containers follow deployability, not folders, and a
280
- component view is drawn for every container that carries more than one Product Component.
281
- - **A gate that can be skipped honestly.** `mode: catalog` skips the component gate entirely — a fast
282
- default is fast because the work is genuinely gone, not nominally trimmed.
283
- - **Decisions that don't rot.** A `DEC-` is recorded only when the reason would not survive reading the
284
- code, and it freezes the moment it is applied — a change of mind writes a new one rather than editing
285
- the old.
286
- - **Wraps BMad, never forks it.** Every `wdi-*` skill is a wrapper around a BMad skill. Upgrading BMad
287
- does not strand you, and no BMad skill is meant to be invoked directly.
288
-
289
- ---
290
-
291
- ## The gap this fills
292
-
293
- A gate is only as good as the artifact it reads. Between *"the architecture is decided"* and *"the code
294
- is written"* there is a set of questions that decide whether a build goes straight or crooked, and they
295
- are all **list-shaped**:
296
-
297
- - Which use cases exist, and which of them touch money, personal data, or something irreversible?
298
- - Which tables exist, and which component is allowed to **write** each one?
299
- - Which endpoints exist, on which host, and which promise does each serve?
300
- - Which screens exist, in which application?
301
- - When a boundary fails halfway the other side slow, absent, or lying what does the user see?
302
-
303
- Those questions have answers inside an architecture document and a build spec. What they usually do not
304
- have is a **place where a person can read all of one kind at once** and notice the row that is missing,
305
- the table with two owners, or the endpoint nobody promised.
306
-
307
- WDI Method's whole contribution is that place, plus the discipline that keeps it honest:
308
-
309
- | | |
310
- |---|---|
311
- | **Inventories** | Tables, endpoints, and screens as three flat lists **derived from the code**, not hand-written, so the difference between plan and reality is a finding rather than an argument |
312
- | **Use case catalogue** | One line per use case with its actor, the requirement it satisfies, and whether it is `critical` |
313
- | **SRS / SDD** | What a component promises, and how it is built — one pair per component, in human language |
314
- | **C4** | Context, containers, and one component view per container that carries more than one domain slice |
315
- | **Robustness** | For the deepest mode: boundary, control, and entity objects per critical use case, before code |
316
- | **Invariants** | A spine of `AD-N` rules that constrain every component, separate from the decisions that produced them |
317
-
318
- ---
319
-
320
- ## Two knobs, never merged
321
-
322
- The reason a method like this usually fails is that it asks for the same depth everywhere, so people
323
- either drown in it or abandon it. WDI splits depth from scrutiny into **two independent fields**:
324
-
325
- | Field | Controls | Values |
326
- |---|---|---|
327
- | `mode` | **Document depth**, and nothing else | `catalog` · `outline` · `guarded` · `deep` |
328
- | `risk_accepted` | **Review intensity**, and nothing else | `low` · `medium` · `high` |
329
-
330
- | `mode` | What is written per component | G4 |
331
- |---|---|---|
332
- | `catalog` | Nothing. Code is written from the use case catalogue, the three inventories, and C4 | **skipped** |
333
- | `outline` | + a decision summary and the component list in the SDD, full flows for at most 3 use cases, local rules | 20 min |
334
- | `guarded` | + **failure behaviour for every boundary**, inherited invariants quoted verbatim, integration documents | 20 min |
335
- | `deep` | + robustness analysis, a contract per endpoint, data dictionary, flow diagrams, state machines | 30 min |
336
-
337
- Neither field is derived from the other, and that is the point: **a component MAY be thin on purpose and
338
- reviewed the hardest.** A component at `catalog` skips the component gate entirely which is what makes
339
- a shallow default genuinely fast rather than nominally fast.
340
-
341
- Depth is a preference and needs no defence. Accepting risk on something that touches money, personal
342
- data, or an irreversible action is **not** free: it requires a recorded decision, and a validator checks
343
- that the decision exists.
344
-
345
- All twelve combinations are legal. The installed kit carries
346
- `.constitution/method/why/mode-risk-map.md`, which puts them side by side what each cell costs at G4,
347
- which review lenses run, and which review traces a validator will demand.
348
-
349
- ---
350
-
351
- ## Five gates, eighteen skills
352
-
353
- | Gate | Decides | Skill |
354
- |---|---|---|
355
- | **G1 Problem** | What the problem is, whose it is, why it earns work | `wdi-problem` |
356
- | **G2 Product** | What is built, and how it feels to use | `wdi-product` · optional `wdi-ux` |
357
- | **G3 Blueprint** | The whole portrait, once per product | `wdi-blueprint` |
358
- | **G4 Component** | How one component is built — **skipped at `catalog`** | `wdi-component` |
359
- | **G5 Release** | Whether it is done and proven | `wdi-build` |
360
-
361
- Around them: `wdi-init` (scaffold, component birth, depth and risk settings, structure maps),
362
- `wdi-decision`, `wdi-question`, `wdi-log`, `wdi-help`, `wdi-explain-to-me`, `wdi-autopilot`, `wdi-reconcile`, `wdi-review`, `wdi-report`,
363
- `wdi-systematic-debugging`, and `wdi-upgrade` (moves a corpus written under an older kit into the current
364
- shape content moves, nothing is invented).
365
-
366
- **No BMad skill is invoked directly.** Each has a wrapper, and the wrapper is what checks position,
367
- verifies the result, and records what happened.
368
-
369
- ### Decisions, not ADRs
370
-
371
- A decision is a `DEC-`, and **recording one is not mandatory.** The test is one sentence: *if somebody
372
- asks in three months why it is like this, is the answer readable from the code?* If yes, it MUST NOT be
373
- recorded — a register nobody trusts is worse than no register. One case is mandatory: contradicting an
374
- invariant on the spine.
375
-
376
- A `DEC-` freezes when it is applied. A change of mind produces a new one; it never edits the old.
377
-
378
- ---
379
-
380
- ## The mechanical half
381
-
382
- `validate.py` runs twenty-nine named validators — `goal-has-fr`, `cites-resolve`, `no-cycles`,
383
- `id-allocated-once`, and the rest, each named for the thing it checks — over the registries and the
384
- corpus, and `inventory.py` derives the three inventories from code and reports the difference against the
385
- plan without patching either side. There is no validator that compares two copies of one fact, because
386
- the corpus keeps no copies.
387
-
388
- **The corpus is what git tracks.** A vendored dependency tree inside a gitignored folder is not this
389
- product's writing, and since 0.6.17 the walk skips what the repo ignores. The other half of that rule is
390
- `corpus-in-git`: a folder the method commits MUST NOT be ignored, so `.gitignore` cannot be used to quiet
391
- a finding about a file that really is yours.
392
-
393
- The validators exist because prose that nothing checks is prose that gets contradicted by the first
394
- person in a hurry. Every one of them also states **the state in which it does not apply** — a rule that
395
- demands a trace before the trace can exist is a rule that gets switched off, and a validator nobody
396
- reads guards nothing.
397
-
398
- ---
399
-
400
- ## What is generic, and where your own rules live
401
-
402
- `.constitution/` holds **exactly two folders**, and the folder is the whole answer to who owns a file:
403
-
404
- | Folder | Owner | `update` | `promote` |
405
- |---|---|---|---|
406
- | `.constitution/method/` | the method | **overwritten** in full | carries it into the package |
407
- | **`.constitution/project/`** | you | **never touched** — seeded once when absent | never carries it, so your rules cannot be published |
408
-
409
- Everything in the room is yours: `project/constitution.md` (Articles 1, 2, 5 — scope, repo checklist,
410
- method ownership), `project/codebase-*-guide.md` (stack, conventions, brownfield, protected at **any**
411
- `status:` — `Draft` is when they actually get written), and any rule file you add.
412
-
413
- **The seam is a folder, never a marked region inside a generic file.** Prose has no merge algebra: you
414
- cannot "merge" your paragraph with the method's, so only a path can say unambiguously whose a file is.
415
- `AGENTS.md` is the one exception, and only because it is a single file with nowhere else to go.
416
-
417
- Two more things are yours, outside `.constitution/`:
418
-
419
- | Yours | Because |
420
- |---|---|
421
- | `.control/registry/index.yaml` `product:` | The product and client name live in exactly one place |
422
- | `_bmad/custom/*.user.toml` | Your BMad overrides — TOML, so these genuinely merge: a string replaces, a list appends, a table merges per key |
423
-
424
- `.control/` `.what/` `.how/` are never touched by an update at all — they are your state, your promises,
425
- and your design.
426
-
427
- The custom room takes whole files, not marked blocks inside generic ones: `AGENTS.md` can use a marked
428
- block because it is *one* file, while `.constitution/` has fifty-odd, and blocks inside them would make
429
- an update perform surgery in every file. A file there declares `scope: project` and a one-line
430
- `purpose:`; to **contradict** a generic rule it must name that rule and carry the decision that allowed
431
- it. **An empty room is a valid state** — filling it so that it gets used is the failure the rule prevents.
432
-
433
- ### Language
434
-
435
- Two settings, both free text, both defaulting to English:
436
-
437
- ```yaml
438
- policy:
439
- doc_language: "English" # prose of working documents
440
- doc_filename_language: "English" # the slug part of a document filename
441
- ```
442
-
443
- Write whatever names the language `English`, `Bahasa Indonesia`, `id`. What reads the value is a model,
444
- and a model does not need a lookup table.
445
-
446
- Always English, and never asked: method terminology, document code prefixes (`UC-`, `DEC-`), machine
447
- markers (`[NEEDS CONFIRMATION]`, `[MISSING]`), and code identifiers. `.constitution/` itself is always
448
- English, whatever the settings say it travels to every repo through this package.
449
-
450
- ---
451
-
452
- ## What update does
453
-
454
- | | |
455
- |---|---|
456
- | Overwrites | everything in `.constitution/method/` · the eighteen wrappers · `_bmad/custom/*.toml` · the marked block in `AGENTS.md` |
457
- | Renames | a file whose content needs no judgment to move — `waves.yaml` → `specs.yaml`, the pre-0.5 registry names, and a pre-0.6.2 autopilot ledger to `autopilot-<mandate-id>.md`. Content is never rewritten |
458
- | Seeds | `docs/agents/` — the ticket engines' own config, already answered for this method, so `/setup-matt-pocock-skills` is not part of getting started. Seeded once; a file you already wrote is never touched |
459
- | Removes | Wrappers the method has retired — a `wdi-*` folder with a `SKILL.md` that is no longer one of the eighteen. Each removal is printed |
460
- | Reports | what is still in the OLD shape, as an `upgrade` line — and names `wdi-upgrade` as the next step. The installer does not move content; that is a decision, and the skill's |
461
- | Keeps | All of `.constitution/project/`, plus your initiative slug and your language choice. A setting somebody already chose is not the installer's to change behind their back |
462
- | Never resurrects | A folder you retired. On update, absence is treated as a decision |
463
- | Warns, never edits | An open `wdi-autopilot` mandate written before `ad-n` was parked by default, and a `docs/agents/domain.md` still pointing at a root `CONTEXT.md`. Both are values you chose; the installer names them and leaves them alone |
464
-
465
- It prints the version it replaced, what it wrote, what it kept, and what to do next.
466
-
467
- ### Moving a repo from 0.6.7 or earlier to 0.6.8
468
-
469
- Four things change for a repo already running the method. The first is the only one that can stop an
470
- update, and all four are mechanical.
471
-
472
- | What changed | What it means for your repo |
473
- |---|---|
474
- | **The engines must be in the repo** | `install` and `update` refuse until `to-spec`, `to-tickets`, `implement`, `tdd`, `code-review` and `domain-modeling` are here — `npx skills@latest add mattpocock/skills`. The Claude Code plugin no longer counts: three of the six ship locked against skill invocation, nothing outside the file unlocks them, and a plugin's files are not yours to edit. `--skip-engines-check` still installs without them |
475
- | **The engines are invoked, not handed to you** | `wdi-build` calls `to-spec`, `to-tickets`, `implement`, `tdd` and `code-review` itself, so `wdi-autopilot` can finish a spec with nobody watching. Every `update` re-unlocks the repo's copies, because `npx skills update` puts the author's lock back — and `engines-invocable` in `validate.py` goes red when it has |
476
- | **Thirteen BMad skills are retired at G5, and now enforced** | `bmad-spec`, `bmad-build`, `bmad-build-auto`, `bmad-code-review`, `bmad-retrospective`, `bmad-agent-dev`, `bmad-create-epics-and-stories`, `bmad-create-story`, `bmad-dev-story`, `bmad-dev-auto`, `bmad-quick-dev`, `bmad-sprint-planning`, `bmad-sprint-status`. Each is locked out of model invocation and denied in `.claude/settings.json`; typing the slash command yourself still works. `bmad-skill-register.md` carries the list and the criterion — retired only where this method has a named replacement, which is why `bmad-qa-generate-e2e-tests` and `bmad-checkpoint-preview` are not on it |
477
- | **A spec has one predefined home** | `.scratch/<spec-id>-<slug>/`, with `SPEC.md` and `issues/<NN>-<slug>.md` inside it. Left free, that folder name gets written a different way in every repo and traces back to nothing. A row in `specs.yaml` is now what makes an effort a spec rather than ad hoc work — the path no longer says |
478
-
479
- Run the `wdi-upgrade` skill after updating: it names what is still in the old shape, including a
480
- `docs/agents/issue-tracker.md` that still carries `/setup-matt-pocock-skills`' own answer, and the spec
481
- folders that need moving. `npx wdi-method engines` reports the engine state on its own, and
482
- `npx wdi-method engines --fix` repairs what can be repaired without touching anything you wrote — the
483
- previous config is kept as `.bak`.
484
-
485
- ---
486
-
487
- ## Changing the method
488
-
489
- **This repository is where a method change is authored** a guide, a template, a skill wrapper, a
490
- validator. It is proven here before publishing, against a fixture corpus the three registry scripts
491
- actually run against:
492
-
493
- ```bash
494
- npm test # includes validate.py, timeline.py and inventory.py over tests/fixture/
495
- ```
496
-
497
- The fixture is small but complete, and kept **green**, so a new finding is a regression rather than
498
- noise. One test plants a defect in a copy and requires the matching validator to name it — a green
499
- baseline is worthless if it is green because every check is broken.
500
-
501
- A consuming repo then takes the change with `npx wdi-method update`, and that is where the judgement
502
- half gets tested: whether a guide actually helps a person at G3 is only provable in use.
503
-
504
- `promote` — pulling the method back out of a consumer — is a **rescue tool**, not the workflow. It
505
- overwrites the whole kit from one copy, so it refuses to run without `--rescue`.
506
- [`CONTRIBUTING.md`](CONTRIBUTING.md) records why the direction was reversed and what it cost.
507
-
508
- **Patch releases are routine; minor and major are the maintainer's call.** This package overwrites files
509
- in repos that already hold months of work, and the version is the only signal a reader has for how
510
- carefully to read the diff. [`CONTRIBUTING.md`](CONTRIBUTING.md) has the detail, and
511
- [`AGENTS.md`](AGENTS.md) states it for agents working on the package.
512
-
513
- ---
514
-
515
- ## Support and Contributing
516
-
517
- Open an [issue](https://github.com/wiradigitalid/wdi-method/issues) for a bug or a proposal. Read
518
- [`CONTRIBUTING.md`](CONTRIBUTING.md) before sending a pull request — it explains where a change belongs,
519
- how versioning works here, and what to check before publishing.
520
-
521
- [`CHANGELOG.md`](CHANGELOG.md) is what changed in each version, and what each change means for a repo
522
- that already has the method installed. Read it before an `update` that crosses more than a patch.
523
-
524
- ## License
525
-
526
- MIT — see [LICENSE](LICENSE). Requires Node 20+ and [uv](https://docs.astral.sh/uv/) for the Python
527
- scripts.
528
-
529
- [![Version](https://img.shields.io/npm/v/wdi-method?color=blue&label=version)](https://www.npmjs.com/package/wdi-method)
530
- [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
1
+ # WDI Method
2
+
3
+ **The review layer BMad leaves thin — documents a human reads to check a decision before code gets written, sized to what the change actually deserves.**
4
+
5
+ [BMad](https://github.com/bmad-code-org/BMAD-METHOD) decides *what* to build and *how* to build it well. WDI Method wraps it — it does not replace it — and adds the part between those two decisions and the code: inventories, a use case catalogue, a component design record, and a way to choose how much of that a given change actually needs.
6
+
7
+ > This repository is **public and generic**. It MUST NOT carry a client name, a product name, or a
8
+ > link to a private repository — product identity lives entirely in the repo that installs it.
9
+
10
+ ---
11
+
12
+ ## Prerequisites — two engines, and both are required
13
+
14
+ | Engine | What it does here | Source |
15
+ |---|---|---|
16
+ | **BMad Method** | Writes the documents behind G1–G4 — brief, PRD, architecture, UX | [github.com/bmad-code-org/BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) |
17
+ | **mattpocock/skills** | Cuts the work at G5 — `to-spec`, `to-tickets`; runs the Fast Path and every `wdi-autopilot` iteration — `implement` | [github.com/mattpocock/skills](https://github.com/mattpocock/skills) |
18
+
19
+ **The installer refuses without either.** BMad has always been checked. The ticket engines are checked
20
+ too, since 0.6.4: G1–G4 genuinely run without them, and every repo that relied on that learned they were
21
+ missing inside `wdi-build` with a spec already open. `--skip-engines-check` is the escape for the two
22
+ cases that earn it — CI, and a repo that will never reach G5.
23
+
24
+ No engine skill is invoked on its own. Each has a wrapper (`wdi-*`) that checks where the project is,
25
+ runs the engine, verifies what came back, and records it. The engine is the pen; the wrapper knows what
26
+ page it is on.
27
+
28
+ ---
29
+
30
+ ## Install
31
+
32
+ Three steps, in this order, and **step 3 refuses until steps 1 and 2 are done** — through the TUI and
33
+ through `--yes` alike. BMad has always been checked; the engines are checked too, because every repo that
34
+ learned they were missing learned it inside `wdi-build` with a spec already open. `--skip-engines-check`
35
+ is the escape for the two cases that earn it: CI, and a repo that will never reach G5.
36
+
37
+ **1. BMad Method** — in the product repo, picking the same agents you will give this installer:
38
+
39
+ ```bash
40
+ cd /path/to/your/product-repo
41
+ npx bmad-method install
42
+ ```
43
+
44
+ **2. mattpocock/skills** — **into this repo**, on every agent:
45
+
46
+ ```bash
47
+ npx skills@latest add mattpocock/skills
48
+ ```
49
+
50
+ Take all six the method drives: `to-spec`, `to-tickets`, `implement`, `tdd`, `code-review`, and
51
+ `domain-modeling`. Either install mode works — "copy" or "symlink".
52
+
53
+ **The Claude Code plugin is not an alternative here, and the reason is mechanical.** `to-spec`,
54
+ `to-tickets` and `implement` ship with `disable-model-invocation: true`, so no skill can invoke them;
55
+ nothing outside the file lifts that flag, and a plugin's files are not this repo's to edit. WDI Method
56
+ strips it from the copies the repo owns — which is what lets `wdi-build` invoke an engine and
57
+ `wdi-autopilot` run an iteration with nobody watching — and re-applies that on every update, because
58
+ `npx skills update` restores the author's file. The installer refuses without the six, and
59
+ `--skip-engines-check` is the escape for CI and for a repo that will never reach G5.
60
+
61
+ If you also have the plugin installed for your user, the repo's copies are what run; removing the
62
+ plugin keeps `/to-spec` unambiguous.
63
+
64
+ **You do not need to run `/setup-matt-pocock-skills` to get started.** Step 3 seeds `docs/agents/` with
65
+ the two answers WDI Method actually has a requirement on, so the engines are aligned from the first
66
+ install. Run the setup skill only to *change* something — to point at GitHub or Jira instead of local
67
+ markdown — and keep the three invariants the seeded `issue-tracker.md` names.
68
+
69
+ The seeding exists because the interview's own defaults are wrong here in one specific way: they send every
70
+ engineering skill looking for a root `CONTEXT.md` and `docs/adr/`, and Article 3 says this method has no
71
+ `docs/` layer for corpus or rules — `wdi-reconcile` reports both as findings. A repo that ran the setup
72
+ before installing this package keeps its own file, and the installer names the contradiction rather than
73
+ overwriting it.
74
+
75
+ **3. WDI Method:**
76
+
77
+ ```bash
78
+ npx wdi-method
79
+ ```
80
+
81
+ This opens a TUI: it checks BMad, reports whether it found the ticket engines, detects install versus
82
+ update, asks the product name and the document language, lets you pick agents, shows what it will
83
+ write, and prints what to do next.
84
+
85
+ **Every field arrives with an answer already in it, and Enter accepts it.** On an update that answer is
86
+ what the repo already says; on a first install the product name is the folder name made readable —
87
+ `acme-billing-portal` offers `Acme Billing Portal`. Nothing is validated as required: a prompt that
88
+ refuses an empty submission while already holding a sensible default is asking you to retype something
89
+ the installer knows.
90
+
91
+ A value only changes when you actually answer. A run that does not mention language keeps the language the
92
+ repo already chose, and says so.
93
+
94
+ ```bash
95
+ npx wdi-method@latest update # later, to take a newer method — @latest, or npx may reuse a cached one
96
+ npx wdi-method verify # check the method files are all present
97
+ ```
98
+
99
+ **Upgrading from 0.5.x to 0.6** is two halves. `update` does the mechanical one — overwrites the kit,
100
+ renames files whose content needs no judgment, seeds what is new — and then prints an `upgrade` line
101
+ naming what is still in the old shape: a single `requirements.yaml`, a 14-section brief, a PRD carrying
102
+ its FR text. The second half is a decision about content, so it belongs to a skill:
103
+
104
+ ```bash
105
+ npx wdi-method@latest update --yes # 1 — mechanical; read the `upgrade` line it prints
106
+ # 2 — in your agent, run the wdi-upgrade skill: it moves every sentence into its new home, word for
107
+ # word, invents nothing, reports what it could not place, and ends in one commit.
108
+ ```
109
+
110
+ Run the skill before any other skill. `wdi-help` and the validators read the new shape; a corpus half
111
+ in the old one answers them wrongly.
112
+
113
+ Non-interactive, for CI:
114
+
115
+ ```bash
116
+ npx wdi-method install --yes --agents claude,codex --product "Your Product" \
117
+ --doc-language "Bahasa Indonesia"
118
+ ```
119
+
120
+ Then invoke the **`wdi-help`** skill and ask what to do next. It reads where the project actually is and
121
+ answers with the gate you are at, not with a menu.
122
+
123
+ ---
124
+
125
+ ## What to do right after install, and right after update
126
+
127
+ Two questions, and the honest answer to most of them is *nothing*. `wdi-help` answers them from the
128
+ registry at any time; this table is the same answer written down.
129
+
130
+ ### After `install`
131
+
132
+ | | |
133
+ |---|---|
134
+ | Engines missing | You never get here — `install` refuses, and names both install paths. Install them, run it again |
135
+ | `/setup-matt-pocock-skills`? | **No.** The installer seeded `docs/agents/` already answered for this method. Run that interview only to *change* tracker |
136
+ | So what is first? | **`wdi-init` intent `setup`** — it sets the global `mode`, and nothing has started until it is |
137
+ | Then? | `wdi-problem` for G1. Or ask `wdi-help`, which reads the registry rather than this table |
138
+
139
+ ### After `update`
140
+
141
+ | The summary said | Do |
142
+ |---|---|
143
+ | an **`upgrade`** line, naming content still in the old shape | **`wdi-upgrade`, before any other skill.** It moves every sentence into its new home, invents nothing, reports what it could not place, and ends in one commit. `wdi-help` and the validators read the new shape; a corpus half in the old one answers them wrongly |
144
+ | **no** `upgrade` line | Nothing. The update was mechanical and complete — carry on from wherever the gates say you are |
145
+ | `seeded docs/agents/` | Nothing. An older repo just received the engines' config, pre-answered. Read it if you like; do not run the setup interview to redo it |
146
+ | a warning that `domain.md` still points at a root `CONTEXT.md` | Add the correction that warning names to the top of that file. It was written by the setup interview before this package was installed, and it sends every engineering skill at two paths Article 3 forbids |
147
+ | a warning naming a **mandate** and `ad-n` | Only if you run `wdi-autopilot`. Decide whether that mandate should now park `AD-N` contradictions, and edit its `parked` list yourself — `update` never edits an authority you granted |
148
+
149
+ **`wdi-upgrade` is only ever about corpus content** — a brief, a PRD, an SRS, registry rows in the old
150
+ shape. It is not the answer to a missing engine, a missing tracker config, or anything under
151
+ `.control/memlog/`; each of those is handled by the installer itself or by the skill that owns it.
152
+
153
+ ---
154
+
155
+ ## How to use it — the walk
156
+
157
+ A gate is a moment where a human reads **one page** and decides. Between gates the AI works in a
158
+ pointer-heavy working set it does not need you to read. So the walk is: run a skill, read the page it
159
+ renders, decide — advance or refine.
160
+
161
+ | # | You run | You read | You decide |
162
+ |---|---|---|---|
163
+ | 0 | `wdi-init` intent `setup` | — | the global `mode`: how deep this product goes by default |
164
+ | 1 | `wdi-problem` | `.what-rendered/_product-brief/brief.md` | **G1** — is this the problem, whose is it, and does it earn the work? |
165
+ | 2 | `wdi-product` intent `prd` — `wdi-ux` first when the interface *is* the promise | `.what-rendered/_prd/<slug>/prd.md` | **G2** — is this what we build, and how does it feel? |
166
+ | 3 | `wdi-init` intent `component` | the rows it adds to `components.yaml` | each component's `mode` and `risk_accepted` |
167
+ | 4 | `wdi-blueprint` — `catalog`, then `platform` | `.how-rendered/blueprint.md` | **G3** — does the whole hold together? **Once per product** |
168
+ | 5 | `wdi-component` — one component | `.how-rendered/<pc>/SDD-<pc>.md` | **G4** — is this how we build it? **Skipped at `mode: catalog`** |
169
+ | 6 | `wdi-report` intent `estimate` | `.control/generated/estimate.md` | which candidate row becomes the next spec |
170
+ | 7 | `wdi-build` — for that row | nothing: tickets are machine contracts. You answer `to-tickets`' quiz on granularity and blocking edges | **G5** — is it done and proven? Once per spec |
171
+ | 8 | `wdi-report` intent `progress` | the report it writes | what has moved, what is late, what is proven |
172
+ | 9 | `wdi-autopilot` — when you would rather review the result than walk steps 6–8 yourself | its preflight page, then its final report and ledger | one **mandate**: scope, what stays parked for you, smoke test by the agent or by you, loop interval, expiry |
173
+
174
+ **Unattended, on request.** `wdi-autopilot` moves owner time from the gates to two points: the mandate before,
175
+ the review after. From the gate you name it runs the same skills, answers what they would have asked, records
176
+ every answer in `.control/memlog/autopilot-<mandate-id>.md`, and returns at one of three stops — done,
177
+ at capacity, or blocked. It finishes when every `FR` in scope is closed, when nothing left is runnable, or
178
+ when the mandate expires. It needs three things from the session: permission prompts bypassed (one prompt halts the
179
+ loop), a loop to fire it — `/loop 5m /wdi-autopilot` in Claude Code — and a way past the ticket engines'
180
+ `disable-model-invocation`, which the preflight names: a builder that reads and follows the engine's `SKILL.md`,
181
+ or a copy of the engines inside the repo. The validator `mandate-accept` keeps the one thing the method never
182
+ gives up: a person, dated, at the root of every delegated acceptance.
183
+
184
+ **One run, one cloud run.** Commits stay granular one per ticket and the run branch is pushed as often
185
+ as the work needs, but none of those pushes starts a GitHub Actions run: the workflow fires **once**, at
186
+ the end of the cycle, when the PR is marked ready for review. Until then the evidence is the local suite,
187
+ which is free. That is what stops one unattended run over fifteen tickets from spending most of a month's
188
+ Actions allowance in two days a Windows runner bills at 2x the minutes and macOS at 10x, and on a private
189
+ repository every one of those comes out of the allowance. `.constitution/method/ci-guide.md` carries the
190
+ trigger shape and two workflow templates, `ci.yml` and `korpus.yml`.
191
+
192
+ **Refine, do not advance.** When a page does not convince you, run the same skill again and say what is
193
+ wrong — it updates the document it owns. Nothing downstream exists yet, so nothing breaks. Advancing past a
194
+ page you did not believe is how every later page inherits the doubt.
195
+
196
+ **After the first pass**, steps 0–4 never run again for that product. The next component enters at step 5
197
+ (or 6, at `catalog`); a new initiative enters at step 2; a small fix touching no `FR`, `UC`, `AD-N`, or
198
+ domain model skips every gate and runs `/implement` directly and **stops to become a spec `S`** the
199
+ moment it touches an `FR`. `wdi-help` tells you which of these you are in; it reads the registry, not you.
200
+
201
+ ---
202
+
203
+ ## Why the steps are in this order
204
+
205
+ - **One question per gate.** The brief answers *why*, the PRD *what*, the blueprint *the whole*, the SDD
206
+ *how one part*, the spec *is it done*. Every document that grew unreadable did so by answering a
207
+ neighbour's question too. A gate that asks one question can be passed in ten minutes.
208
+ - **The page you read is rendered; the page the AI edits points.** A goal lives once, in
209
+ `goals.yaml`; the working brief says `Goals see goals.yaml`; the rendered brief shows the goals in
210
+ full. So the human gets a complete document and the corpus has no copies and the validators check
211
+ **drift against the code**, never whether two copies agree, because there are none to compare.
212
+ - **Cost follows the unit of change.** G3 is once per product because the portrait is one thing. G4 is per
213
+ component because that is what changes when you build. G5 is per spec because that is what ships.
214
+ Repeating the blueprint per component was the single largest waste the earlier shape carried.
215
+ - **Two knobs that never merge.** `mode` decides which gates *exist* for a component (`catalog` skips G4
216
+ outright); `risk_accepted` decides how much *proof* a gate demands. Merged into one "rigor" dial, a
217
+ low-risk component either drowns in ceremony or a high-risk one escapes it.
218
+ - **Estimate before build.** Step 6 derives the candidate tasks from the promises already made
219
+ `CAP` and `FR` so nobody invents a backlog. One candidate row becomes one spec, three neighbours
220
+ may merge into one, and the estimate page says so about itself: it is forward-looking, never a record.
221
+ - **The engine cuts; the wrapper frames.** `to-spec` and `to-tickets` are the best ticket-cutting
222
+ engine we found: vertical tracer-bullet slices, blocking edges, a quiz with the owner. What a cutter
223
+ cannot know, `wdi-build` supplies: that every component the spec touches passed G4; that every ticket
224
+ names the `UC` it `satisfies`, so `FR → UC → ticket → test` stays one chain; that a spec restates
225
+ promises and never makes new ones; that code is judged by the test suite going red then green, from a
226
+ fresh context per step, never by a builder's report; and that a closed spec leaves the registry caught
227
+ up and the inventories re-derived from code.
228
+ - **Documents follow the code.** At spec close the inventories are regenerated from what was built and
229
+ the difference is *reported*, never patched into agreement. A record that contradicts the code is
230
+ corrected; code is never changed to match a record.
231
+
232
+ ---
233
+
234
+ ## The file tree, and why
235
+
236
+ ```
237
+ .constitution/
238
+ method/ the methodoverwritten by every update; never edit here
239
+ project/ your own rules and readers — kept by every update
240
+ .control/
241
+ registry/ SSOT for every ROW: goals.yaml · requirements-<slug>.yaml · components.yaml
242
+ usecases.yaml · specs.yaml · risks.yaml · defects.yaml · index.yaml
243
+ questions/ open questions, assumptions, external prerequisites — one row each
244
+ decisions/ DEC-N files; frozen once applied
245
+ generated/ machine tables: rtm · dag · status · estimate · timeline regenerated, never edited
246
+ .what/ what is PROMISED the AI's working set, pointer-heavy, few files
247
+ _product-brief/brief.md
248
+ _prd/<slug>/prd.md · addendum.md
249
+ <pc>/SRS-<pc>.md + 02-rules · 03-domain · 04-usecases · 05-scenarios
250
+ .how/ how it is BUILT — same discipline
251
+ _platform/ ARCHITECTURE-SPINE.md · c4-l2-containers.md · inventories
252
+ <pc>/SDD-<pc>.md + 01-ux · 02-contracts · 04-components · 05-model · 06-flows
253
+ .what-rendered/ the human's tree: brief · _prd/<slug>/prd.md · <pc>/SRS-<pc>.md — one complete page each
254
+ .how-rendered/ blueprint.md (root it spans every component) · <pc>/SDD-<pc>.md
255
+ _bmad-output/ a skill run's working output; empties as its spec closes
256
+ .work/ scratch; empties when the task closes
257
+ <spec_folder>/issues/ one file per ticket the tracker's payload, not yours to read
258
+ ```
259
+
260
+ Three layers, and the rule that keeps them honest:
261
+
262
+ | Layer | Holds | Who writes | Who reads |
263
+ |---|---|---|---|
264
+ | **Registry** | every row — a goal, a requirement, a component, a ticket index | the skill that owns the gate | validators, renderers, every other skill |
265
+ | **Working documents** (`.what/`, `.how/`) | the prose that reasons why, boundaries, what makes it different and **pointers** at the rows | the owning skill | the AI |
266
+ | **Rendered pages** (`*-rendered/`) | one complete page per gate, rows filled in from their homes | `validate.py --generate`, never a hand | the human, and the client |
267
+
268
+ Why split the human's tree from the AI's: a document that is both the AI's working surface and the
269
+ human's deliverable ends up serving neither — too long to point, too gappy to hand over. Why the
270
+ registry is per initiative (`requirements-<slug>.yaml`) but goals are per product: a capability is
271
+ declared by one feature in one PRD; a goal belongs to the product before any PRD exists. Why
272
+ `blueprint.md` sits at the root of `.how-rendered/` and not under `_platform/`: `_platform` means
273
+ "belongs to no component"; the blueprint spans all of them. Why rendered pages are never a skill's
274
+ input: a skill that read a projection would be reading a copy, and the copy would start to drift the
275
+ day someone edited it. A test in this package fails if any `SKILL.md` lists a `-rendered` path as an
276
+ Input.
277
+
278
+ ---
279
+
280
+ ## Why WDI Method?
281
+
282
+ - **Depth separate from scrutiny.** `mode` sets how much gets written; `risk_accepted` sets how hard it
283
+ gets reviewed. Neither is derived from the other, so a component MAY be thin on purpose and reviewed the
284
+ hardest.
285
+ - **Ground truth over plan.** Once code exists, the tables, endpoints, and screens are **derived from it**
286
+ the gap between plan and reality is a finding to resolve, not an argument to have.
287
+ - **Containers that match what actually ships.** C4's containers follow deployability, not folders, and a
288
+ component view is drawn for every container that carries more than one Product Component.
289
+ - **A gate that can be skipped honestly.** `mode: catalog` skips the component gate entirely — a fast
290
+ default is fast because the work is genuinely gone, not nominally trimmed.
291
+ - **Decisions that don't rot.** A `DEC-` is recorded only when the reason would not survive reading the
292
+ code, and it freezes the moment it is applied — a change of mind writes a new one rather than editing
293
+ the old.
294
+ - **Wraps BMad, never forks it.** Every `wdi-*` skill is a wrapper around a BMad skill. Upgrading BMad
295
+ does not strand you, and no BMad skill is meant to be invoked directly.
296
+
297
+ ---
298
+
299
+ ## The gap this fills
300
+
301
+ A gate is only as good as the artifact it reads. Between *"the architecture is decided"* and *"the code
302
+ is written"* there is a set of questions that decide whether a build goes straight or crooked, and they
303
+ are all **list-shaped**:
304
+
305
+ - Which use cases exist, and which of them touch money, personal data, or something irreversible?
306
+ - Which tables exist, and which component is allowed to **write** each one?
307
+ - Which endpoints exist, on which host, and which promise does each serve?
308
+ - Which screens exist, in which application?
309
+ - When a boundary fails halfway — the other side slow, absent, or lying — what does the user see?
310
+
311
+ Those questions have answers inside an architecture document and a build spec. What they usually do not
312
+ have is a **place where a person can read all of one kind at once** and notice the row that is missing,
313
+ the table with two owners, or the endpoint nobody promised.
314
+
315
+ WDI Method's whole contribution is that place, plus the discipline that keeps it honest:
316
+
317
+ | | |
318
+ |---|---|
319
+ | **Inventories** | Tables, endpoints, and screens as three flat lists — **derived from the code**, not hand-written, so the difference between plan and reality is a finding rather than an argument |
320
+ | **Use case catalogue** | One line per use case with its actor, the requirement it satisfies, and whether it is `critical` |
321
+ | **SRS / SDD** | What a component promises, and how it is built — one pair per component, in human language |
322
+ | **C4** | Context, containers, and one component view per container that carries more than one domain slice |
323
+ | **Robustness** | For the deepest mode: boundary, control, and entity objects per critical use case, before code |
324
+ | **Invariants** | A spine of `AD-N` rules that constrain every component, separate from the decisions that produced them |
325
+
326
+ ---
327
+
328
+ ## Two knobs, never merged
329
+
330
+ The reason a method like this usually fails is that it asks for the same depth everywhere, so people
331
+ either drown in it or abandon it. WDI splits depth from scrutiny into **two independent fields**:
332
+
333
+ | Field | Controls | Values |
334
+ |---|---|---|
335
+ | `mode` | **Document depth**, and nothing else | `catalog` · `outline` · `guarded` · `deep` |
336
+ | `risk_accepted` | **Review intensity**, and nothing else | `low` · `medium` · `high` |
337
+
338
+ | `mode` | What is written per component | G4 |
339
+ |---|---|---|
340
+ | `catalog` | Nothing. Code is written from the use case catalogue, the three inventories, and C4 | **skipped** |
341
+ | `outline` | + a decision summary and the component list in the SDD, full flows for at most 3 use cases, local rules | 20 min |
342
+ | `guarded` | + **failure behaviour for every boundary**, inherited invariants quoted verbatim, integration documents | 20 min |
343
+ | `deep` | + robustness analysis, a contract per endpoint, data dictionary, flow diagrams, state machines | 30 min |
344
+
345
+ Neither field is derived from the other, and that is the point: **a component MAY be thin on purpose and
346
+ reviewed the hardest.** A component at `catalog` skips the component gate entirely which is what makes
347
+ a shallow default genuinely fast rather than nominally fast.
348
+
349
+ Depth is a preference and needs no defence. Accepting risk on something that touches money, personal
350
+ data, or an irreversible action is **not** free: it requires a recorded decision, and a validator checks
351
+ that the decision exists.
352
+
353
+ All twelve combinations are legal. The installed kit carries
354
+ `.constitution/method/why/mode-risk-map.md`, which puts them side by side — what each cell costs at G4,
355
+ which review lenses run, and which review traces a validator will demand.
356
+
357
+ ---
358
+
359
+ ## Five gates, eighteen skills
360
+
361
+ | Gate | Decides | Skill |
362
+ |---|---|---|
363
+ | **G1 Problem** | What the problem is, whose it is, why it earns work | `wdi-problem` |
364
+ | **G2 Product** | What is built, and how it feels to use | `wdi-product` · optional `wdi-ux` |
365
+ | **G3 Blueprint** | The whole portrait, once per product | `wdi-blueprint` |
366
+ | **G4 Component** | How one component is built **skipped at `catalog`** | `wdi-component` |
367
+ | **G5 Release** | Whether it is done and proven | `wdi-build` |
368
+
369
+ Around them: `wdi-init` (scaffold, component birth, depth and risk settings, structure maps),
370
+ `wdi-decision`, `wdi-question`, `wdi-log`, `wdi-help`, `wdi-explain-to-me`, `wdi-autopilot`, `wdi-reconcile`, `wdi-review`, `wdi-report`,
371
+ `wdi-systematic-debugging`, and `wdi-upgrade` (moves a corpus written under an older kit into the current
372
+ shape content moves, nothing is invented).
373
+
374
+ **No BMad skill is invoked directly.** Each has a wrapper, and the wrapper is what checks position,
375
+ verifies the result, and records what happened.
376
+
377
+ ### Decisions, not ADRs
378
+
379
+ A decision is a `DEC-`, and **recording one is not mandatory.** The test is one sentence: *if somebody
380
+ asks in three months why it is like this, is the answer readable from the code?* If yes, it MUST NOT be
381
+ recorded — a register nobody trusts is worse than no register. One case is mandatory: contradicting an
382
+ invariant on the spine.
383
+
384
+ A `DEC-` freezes when it is applied. A change of mind produces a new one; it never edits the old.
385
+
386
+ ---
387
+
388
+ ## The mechanical half
389
+
390
+ `validate.py` runs twenty-nine named validators `goal-has-fr`, `cites-resolve`, `no-cycles`,
391
+ `id-allocated-once`, and the rest, each named for the thing it checks — over the registries and the
392
+ corpus, and `inventory.py` derives the three inventories from code and reports the difference against the
393
+ plan without patching either side. There is no validator that compares two copies of one fact, because
394
+ the corpus keeps no copies.
395
+
396
+ **The corpus is what git tracks.** A vendored dependency tree inside a gitignored folder is not this
397
+ product's writing, and since 0.6.17 the walk skips what the repo ignores. The other half of that rule is
398
+ `corpus-in-git`: a folder the method commits MUST NOT be ignored, so `.gitignore` cannot be used to quiet
399
+ a finding about a file that really is yours.
400
+
401
+ The validators exist because prose that nothing checks is prose that gets contradicted by the first
402
+ person in a hurry. Every one of them also states **the state in which it does not apply** — a rule that
403
+ demands a trace before the trace can exist is a rule that gets switched off, and a validator nobody
404
+ reads guards nothing.
405
+
406
+ ---
407
+
408
+ ## What is generic, and where your own rules live
409
+
410
+ `.constitution/` holds **exactly two folders**, and the folder is the whole answer to who owns a file:
411
+
412
+ | Folder | Owner | `update` | `promote` |
413
+ |---|---|---|---|
414
+ | `.constitution/method/` | the method | **overwritten** in full | carries it into the package |
415
+ | **`.constitution/project/`** | you | **never touched** seeded once when absent | never carries it, so your rules cannot be published |
416
+
417
+ Everything in the room is yours: `project/constitution.md` (Articles 1, 2, 5 — scope, repo checklist,
418
+ method ownership), `project/codebase-*-guide.md` (stack, conventions, brownfield, protected at **any**
419
+ `status:` `Draft` is when they actually get written), and any rule file you add.
420
+
421
+ **The seam is a folder, never a marked region inside a generic file.** Prose has no merge algebra: you
422
+ cannot "merge" your paragraph with the method's, so only a path can say unambiguously whose a file is.
423
+ `AGENTS.md` is the one exception, and only because it is a single file with nowhere else to go.
424
+
425
+ Two more things are yours, outside `.constitution/`:
426
+
427
+ | Yours | Because |
428
+ |---|---|
429
+ | `.control/registry/index.yaml` `product:` | The product and client name live in exactly one place |
430
+ | `_bmad/custom/*.user.toml` | Your BMad overrides TOML, so these genuinely merge: a string replaces, a list appends, a table merges per key |
431
+
432
+ `.control/` `.what/` `.how/` are never touched by an update at all — they are your state, your promises,
433
+ and your design.
434
+
435
+ The custom room takes whole files, not marked blocks inside generic ones: `AGENTS.md` can use a marked
436
+ block because it is *one* file, while `.constitution/` has fifty-odd, and blocks inside them would make
437
+ an update perform surgery in every file. A file there declares `scope: project` and a one-line
438
+ `purpose:`; to **contradict** a generic rule it must name that rule and carry the decision that allowed
439
+ it. **An empty room is a valid state** — filling it so that it gets used is the failure the rule prevents.
440
+
441
+ ### Language
442
+
443
+ Two settings, both free text, both defaulting to English:
444
+
445
+ ```yaml
446
+ policy:
447
+ doc_language: "English" # prose of working documents
448
+ doc_filename_language: "English" # the slug part of a document filename
449
+ ```
450
+
451
+ Write whatever names the language — `English`, `Bahasa Indonesia`, `id`. What reads the value is a model,
452
+ and a model does not need a lookup table.
453
+
454
+ Always English, and never asked: method terminology, document code prefixes (`UC-`, `DEC-`), machine
455
+ markers (`[NEEDS CONFIRMATION]`, `[MISSING]`), and code identifiers. `.constitution/` itself is always
456
+ English, whatever the settings say it travels to every repo through this package.
457
+
458
+ ---
459
+
460
+ ## What update does
461
+
462
+ | | |
463
+ |---|---|
464
+ | Overwrites | everything in `.constitution/method/` · the eighteen wrappers · `_bmad/custom/*.toml` · the marked block in `AGENTS.md` |
465
+ | Renames | a file whose content needs no judgment to move — `waves.yaml` → `specs.yaml`, the pre-0.5 registry names, and a pre-0.6.2 autopilot ledger to `autopilot-<mandate-id>.md`. Content is never rewritten |
466
+ | Seeds | `docs/agents/` — the ticket engines' own config, already answered for this method, so `/setup-matt-pocock-skills` is not part of getting started. Seeded once; a file you already wrote is never touched |
467
+ | Removes | Wrappers the method has retired — a `wdi-*` folder with a `SKILL.md` that is no longer one of the eighteen. Each removal is printed |
468
+ | Reports | what is still in the OLD shape, as an `upgrade` line — and names `wdi-upgrade` as the next step. The installer does not move content; that is a decision, and the skill's |
469
+ | Keeps | All of `.constitution/project/`, plus your initiative slug and your language choice. A setting somebody already chose is not the installer's to change behind their back |
470
+ | Never resurrects | A folder you retired. On update, absence is treated as a decision |
471
+ | Warns, never edits | An open `wdi-autopilot` mandate written before `ad-n` was parked by default, and a `docs/agents/domain.md` still pointing at a root `CONTEXT.md`. Both are values you chose; the installer names them and leaves them alone |
472
+
473
+ It prints the version it replaced, what it wrote, what it kept, and what to do next.
474
+
475
+ ### Moving a repo from 0.6.7 or earlier to 0.6.8
476
+
477
+ Four things change for a repo already running the method. The first is the only one that can stop an
478
+ update, and all four are mechanical.
479
+
480
+ | What changed | What it means for your repo |
481
+ |---|---|
482
+ | **The engines must be in the repo** | `install` and `update` refuse until `to-spec`, `to-tickets`, `implement`, `tdd`, `code-review` and `domain-modeling` are here `npx skills@latest add mattpocock/skills`. The Claude Code plugin no longer counts: three of the six ship locked against skill invocation, nothing outside the file unlocks them, and a plugin's files are not yours to edit. `--skip-engines-check` still installs without them |
483
+ | **The engines are invoked, not handed to you** | `wdi-build` calls `to-spec`, `to-tickets`, `implement`, `tdd` and `code-review` itself, so `wdi-autopilot` can finish a spec with nobody watching. Every `update` re-unlocks the repo's copies, because `npx skills update` puts the author's lock back — and `engines-invocable` in `validate.py` goes red when it has |
484
+ | **Thirteen BMad skills are retired at G5, and now enforced** | `bmad-spec`, `bmad-build`, `bmad-build-auto`, `bmad-code-review`, `bmad-retrospective`, `bmad-agent-dev`, `bmad-create-epics-and-stories`, `bmad-create-story`, `bmad-dev-story`, `bmad-dev-auto`, `bmad-quick-dev`, `bmad-sprint-planning`, `bmad-sprint-status`. Each is locked out of model invocation and denied in `.claude/settings.json`; typing the slash command yourself still works. `bmad-skill-register.md` carries the list and the criterion — retired only where this method has a named replacement, which is why `bmad-qa-generate-e2e-tests` and `bmad-checkpoint-preview` are not on it |
485
+ | **A spec has one predefined home** | `.scratch/<spec-id>-<slug>/`, with `SPEC.md` and `issues/<NN>-<slug>.md` inside it. Left free, that folder name gets written a different way in every repo and traces back to nothing. A row in `specs.yaml` is now what makes an effort a spec rather than ad hoc work — the path no longer says |
486
+
487
+ Run the `wdi-upgrade` skill after updating: it names what is still in the old shape, including a
488
+ `docs/agents/issue-tracker.md` that still carries `/setup-matt-pocock-skills`' own answer, and the spec
489
+ folders that need moving. `npx wdi-method engines` reports the engine state on its own, and
490
+ `npx wdi-method engines --fix` repairs what can be repaired without touching anything you wrote — the
491
+ previous config is kept as `.bak`.
492
+
493
+ ---
494
+
495
+ ## Changing the method
496
+
497
+ **This repository is where a method change is authored** a guide, a template, a skill wrapper, a
498
+ validator. It is proven here before publishing, against a fixture corpus the three registry scripts
499
+ actually run against:
500
+
501
+ ```bash
502
+ npm test # includes validate.py, timeline.py and inventory.py over tests/fixture/
503
+ ```
504
+
505
+ The fixture is small but complete, and kept **green**, so a new finding is a regression rather than
506
+ noise. One test plants a defect in a copy and requires the matching validator to name it — a green
507
+ baseline is worthless if it is green because every check is broken.
508
+
509
+ A consuming repo then takes the change with `npx wdi-method update`, and that is where the judgement
510
+ half gets tested: whether a guide actually helps a person at G3 is only provable in use.
511
+
512
+ `promote` — pulling the method back out of a consumer — is a **rescue tool**, not the workflow. It
513
+ overwrites the whole kit from one copy, so it refuses to run without `--rescue`.
514
+ [`CONTRIBUTING.md`](CONTRIBUTING.md) records why the direction was reversed and what it cost.
515
+
516
+ **Patch releases are routine; minor and major are the maintainer's call.** This package overwrites files
517
+ in repos that already hold months of work, and the version is the only signal a reader has for how
518
+ carefully to read the diff. [`CONTRIBUTING.md`](CONTRIBUTING.md) has the detail, and
519
+ [`AGENTS.md`](AGENTS.md) states it for agents working on the package.
520
+
521
+ ---
522
+
523
+ ## Support and Contributing
524
+
525
+ Open an [issue](https://github.com/wiradigitalid/wdi-method/issues) for a bug or a proposal. Read
526
+ [`CONTRIBUTING.md`](CONTRIBUTING.md) before sending a pull request it explains where a change belongs,
527
+ how versioning works here, and what to check before publishing.
528
+
529
+ [`CHANGELOG.md`](CHANGELOG.md) is what changed in each version, and what each change means for a repo
530
+ that already has the method installed. Read it before an `update` that crosses more than a patch.
531
+
532
+ ## License
533
+
534
+ MIT — see [LICENSE](LICENSE). Requires Node 20+ and [uv](https://docs.astral.sh/uv/) for the Python
535
+ scripts.
536
+
537
+ [![Version](https://img.shields.io/npm/v/wdi-method?color=blue&label=version)](https://www.npmjs.com/package/wdi-method)
538
+ [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)