wdi-method 0.6.18 → 0.6.24

package/kit-overlay/AGENTS.md

@@ -27,7 +27,7 @@ npx wdi-method update --yes
 ```
 
 BMad: https://github.com/bmad-code-org/BMAD-METHOD
-WDI Method: https://github.com/wiradigitalid/wdi-method
+WDI Method: https://github.com/wiradeltaid/wdi-method
 
 A method file MUST NOT be invented here. If a rule is wrong, fix it in the WDI
 Method package, then update.
@@ -66,6 +66,28 @@ under `.constitution/`. They are agent instructions, and they travel to every re
 **A corpus written before these settings existed MUST NOT be migrated for them.** The readers accept more
 than one language, so existing documents keep working and only new writing follows the setting.
 
+## Branches
+
+**Two branch settings live in `.control/registry/index.yaml` under `policy:`, both defaulting to `main`:**
+
+| Setting | Governs | Default |
+|---|---|---|
+| `primary_branch` | Production / release trunk | `main` |
+| `development_branch` | Active development branch for specs, worktrees, and PR targets | `main` |
+
+- **Immunity:** Agents MUST NOT delete, overwrite, force-push, or rename `primary_branch` or `development_branch`.
+- **Branch protection:** Agents MUST NOT commit application code directly to `primary_branch` or `development_branch`. Code changes MUST arrive via isolated task branches/worktrees and pull requests. In single-branch mode, direct commits to the shared branch are permitted strictly for Phase 1 & 2 planning documents in `.scratch/` and `.control/registry/specs.yaml`.
+- **Target branch:** All worktrees and PRs MUST target `development_branch`. Agents MUST verify the branch exists locally or on remote (`refs/heads/<branch>` or `refs/remotes/origin/<branch>`) and MUST NOT guess or silently fall back to `main`.
+- `.constitution/method/branch-guide.md` binds branch rules.
+
+## Delivery flow
+
+Applies to all feature specification, ticket creation, and code delivery in this repo:
+
+1. Turning notes, a task, or test results into a spec and tickets MUST go through `wdi-build`'s engines (`to-spec` / `to-tickets`, `mattpocock/skills`) — agents MUST NOT invent a bespoke spec or ticket format.
+2. Standing exception to `wdi-build`'s isolated worktree precondition: the spec authoring step (opening the spec, writing `SPEC.md` and ticket files in `.scratch/`, with no application code changes) happens directly on the active development branch (`policy.development_branch`, default `main`). The worktree requirement binds ticket implementation onward and `wdi-autopilot`.
+3. During or after spec and ticket authoring, an agent MUST NOT auto-continue into implementing code, committing, pushing, launching `wdi-autopilot`, merging a PR, cleaning up a worktree, or deploying without explicit confirmation from the maintainer. When explicitly commanded to build a ticket (`wdi-build`), committing and pushing to the task branch are permitted, but auto-merging PRs or auto-deploying remain strictly prohibited.
+
 ## The thing in your hand → its folder
 
 Read this instead of reasoning about what `.what/` and `.how/` mean.
@@ -157,6 +179,11 @@ verifies the result, and lands the memlog.
 - `CONTEXT.md`, `CONTEXT-MAP.md`, and `docs/adr/` MUST NOT be created. `docs/agents/domain.md` is the
   engines' config and says so too: the vocabulary is `.control/product-glossary.md`, domain knowledge is
   `.what/`, design is `.how/`, and a decision is a `DEC-` — never an ADR. Article 3 owns the rule.
+- `.control/registry/specs.yaml` MUST NOT be read in full (1000+ lines) into context to check project
+  status or open work — invoke skill `wdi-help` or read the generated status projection in
+  `.control/generated/` (`status.yaml`) instead.
+- `.scratch/` MUST NOT be searched with broad or recursive wildcard patterns (`*` or `**`) to discover
+  specs — inspect only the candidate spec's folder using `spec_folder:` from `status.yaml` or `specs.yaml`.
 
 ## Routing — load a guide when the task matches
 
@@ -171,7 +198,7 @@ verifies the result, and lands the memlog.
 | Unsure about a domain term | `.control/product-glossary.md` |
 | Looking for a non-technical fact — a domain, an account, a legal entity, a locked date | `.control/project-non-technical-log.md` |
 | Naming anything — a code identifier, a file, a database column | `.constitution/method/language-guide.md` |
-| Asking "which gate now, what next" | `.constitution/method/document/delivery-flow-guide.md` · skill `wdi-help` |
+| Asking "which gate now, what next", project status, or open/pending specs | skill `wdi-help` (MUST invoke `wdi-help` or read generated `status.yaml`) |
 | Having to decide something, and wanting the reading done first | skill `wdi-explain-to-me` — it briefs, and changes nothing |
 | Wanting every `FR` delivered without being asked in between | skill `wdi-autopilot` — preflight, one mandate, then the loop |
 | Setting or changing `mode` or `risk_accepted` | `.constitution/method/document/delivery-flow-guide.md` · skill `wdi-init` |
@@ -184,6 +211,8 @@ verifies the result, and lands the memlog.
 | Writing the spine, an `AD-N`, C4, or one of the three inventories | `.constitution/method/document/architecture-guide.md` |
 | Opening, accepting, or applying a `DEC-` | `.constitution/method/document/decision-guide.md` |
 | Writing or reading a structure map | `.constitution/method/structure-guide.md` |
+| Writing or changing a CI workflow, or deciding whether a push may start a cloud run | `.constitution/method/ci-guide.md` |
+| Branching rules, protected branches, or PR target policy | `.constitution/method/branch-guide.md` |
 | Looking for where code lives, or placing new code | `.control/structure-codebase.md` |
 | Looking for where a document lives | `.control/structure-document.md` |
 | Writing or reviewing code | `.constitution/project/codebase-stack-guide.md` · `.constitution/project/codebase-conventions-guide.md` · `.constitution/project/codebase-brownfield-guide.md` |
@@ -214,9 +243,13 @@ MUST anything in `.constitution/method/why/`; `status: Reference` forbids it. A
 
 - A skill MUST NOT be invoked automatically. Name the one that fits and wait for the owner's
   go-ahead — this holds even when the skill's own description says it must be used. Reading a
-  skill as reference is fine. The one exception is `wdi-autopilot` under a `DEC-` of `type: mandate`
+  skill as reference is fine. The exceptions are: (1) `wdi-autopilot` under a `DEC-` of `type: mandate`
   at `status: accepted` that has not expired: the mandate **is** the go-ahead, for every skill it
-  needs, until it lapses.
+  needs, until it lapses; (2) when the owner explicitly invokes an autonomous daily tier skill
+  (`/wdi-daily-*`), the owner's invocation authorizes the bounded orchestration steps specified in that skill;
+  (3) read-only status, open specs, and routing inquiries (`wdi-help`): the model MUST invoke
+  `wdi-help` (or read the generated status projection in `.control/generated/`) automatically to
+  inspect current gate progress, open work, or determine the next skill without modifying project state.
 - `.work/` is not production code. It MUST NOT be imported by the application, and MUST be
   excluded when searching for code.
 <!-- END:wdi-method -->

package/kit-overlay/README.md

@@ -43,6 +43,7 @@ Never a rule. When it disagrees with a guide, the guide wins and the disagreemen
 | [`language-guide.md`](language-guide.md) | Naming anything — a code identifier, a code file, a document file |
 | [`method-glossary.md`](method-glossary.md) | Unsure what a method term means — layer, wave, Product Component, ID code |
 | [`structure-guide.md`](structure-guide.md) | Writing or checking the two structure maps in `.control/` |
+| [`ci-guide.md`](ci-guide.md) | Writing or changing a CI workflow; when a push may start a cloud run, and what MUST NOT |
 
 ## `document/` — document rules
 

package/kit-overlay/constitution.md

@@ -26,6 +26,7 @@ The repo layout is governed by `corpus-guide.md` and mapped by
 | `.what-rendered/` · `.how-rendered/` | The two above, assembled for a human to read — one page per gate, at the mirror path. Regenerated by `validate.py`, never edited, never read by a skill |
 | `_bmad-output/` | Run workspace; MUST be in git, not curated |
 | `.scratch/` | One directory per effort: a spec's `SPEC.md` and its ticket files, and ad hoc work that has no `FR` yet. MUST be in git — the corpus cites into it by path |
+| `.archive/` | Archived records — closed specs and historical provenance moved from `.scratch/`. MUST be in git |
 | `.work/` | Scratch; MUST be in git, emptied when a task closes |
 | *(application roots)* | Application code — named and mapped in `.control/structure-codebase.md` |
 

package/lib/identity.mjs

@@ -1,117 +1,246 @@
-// index.yaml editing. Every regex here is anchored on `\n`, and a Windows checkout hands us `\r\n` —
-// so every function normalises before matching and restores the file's own ending before writing.
-//
-// Skipping that is not a cosmetic bug. It silently returns "" for a name that IS set, which makes
-// `identityIsPlaceholder` true, which makes `setProductIdentity` return early: the installer reports
-// nothing and writes nothing, on every CRLF repo. Found 2026-08-18 on the first real install into a
-// Windows product repo, where `policy.doc_language` printed empty while the file plainly said `id`.
-
-const PRODUCT_BLOCK = /(?:^|\n)product:\n(?:  .*\n)*/;
-const POLICY_BLOCK = /(?:^|\n)policy:\n(?:  .*\n)*/;
-
-// FREE TEXT, not an enum. The consumer is a model, and a model does not need a list: "English",
-// "Bahasa Indonesia", "id", "Indonesia" all read the same to it. Fencing this into two values would
-// force the owner to translate their intent into the installer's vocabulary first, and nothing is
-// bought with that.
-export const DEFAULT_DOC_LANGUAGE = "English";
-
-/** LF view of the text, plus how to put the original endings back. */
-function lf(text) {
-  const crlf = text.includes("\r\n");
-  return { body: crlf ? text.replaceAll("\r\n", "\n") : text, crlf };
-}
-
-function restore(body, crlf) {
-  return crlf ? body.replaceAll("\n", "\r\n") : body;
-}
-
-export function yamlQuote(value) {
-  return `"${String(value).replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
-}
-
-export function readProductIdentity(text) {
-  const { body } = lf(text);
-  const name = body.match(/product:\n(?:  .*\n)*?  name:\s*"([^"]*)"/);
-  const client = body.match(/product:\n(?:  .*\n)*?  client:\s*"([^"]*)"/);
-  return {
-    name: name ? name[1] : "",
-    client: client ? client[1] : "",
-  };
-}
-
-export function writeProductIdentity(text, { name, client }) {
-  const { body, crlf } = lf(text);
-  const block =
-    `product:\n  name: ${yamlQuote(name)}\n  client: ${yamlQuote(client ?? "")}\n`;
-  if (/^product:/m.test(body)) {
-    return restore(
-      body.replace(PRODUCT_BLOCK, (m) => (m.startsWith("\n") ? `\n${block}` : block)), crlf);
-  }
-  return restore(`${block}\n${body.replace(/^/, "")}`, crlf);
-}
-
-export function identityIsPlaceholder(name) {
-  return !name || name === "{product}";
-}
-
-// ---------------------------------------------------------------------- language policy
-//
-// Two settings, and only two. Everything else about language is NOT a choice: method terminology,
-// document code prefixes, machine-facing markers, and code identifiers are always English —
-// `language-guide.md` owns that, and a caller MUST NOT ask about them.
-//
-//   doc_language           the PROSE of working documents in .what/ .how/ .control/
-//   doc_filename_language  the SLUG part of a document filename
-//
-// A corpus written before these existed is NOT migrated for them: the readers in validate.py accept
-// more than one language, so an existing document keeps working and only new writing follows the value.
-
-function readPolicyValue(body, key) {
-  const quoted = body.match(new RegExp(`policy:\\n(?:  .*\\n)*?  ${key}:[ \\t]*"([^"]*)"`));
-  if (quoted) return quoted[1].trim();
-  // Bare scalars are accepted because early repos wrote `doc_language: id` unquoted. Stops at a
-  // comment so a trailing `# note` never becomes part of the value.
-  const bare = body.match(new RegExp(`policy:\\n(?:  .*\\n)*?  ${key}:[ \\t]*([^\\n#]*)`));
-  return bare ? bare[1].trim() : "";
-}
-
-export function readLanguagePolicy(text) {
-  const { body } = lf(text);
-  return {
-    docLanguage: readPolicyValue(body, "doc_language"),
-    docFilenameLanguage: readPolicyValue(body, "doc_filename_language"),
-  };
-}
-
-export function writeLanguagePolicy(text, { docLanguage, docFilenameLanguage }) {
-  const { body, crlf } = lf(text);
-  // Always quoted: free text MAY carry a space or a colon, and a bare YAML scalar breaks on both.
-  const block =
-    `policy:\n  doc_language: ${yamlQuote(docLanguage)}\n` +
-    `  doc_filename_language: ${yamlQuote(docFilenameLanguage)}\n`;
-  if (/^policy:/m.test(body)) {
-    return restore(
-      body.replace(POLICY_BLOCK, (m) => (m.startsWith("\n") ? `\n${block}` : block)), crlf);
-  }
-  // Sits right after `product:` when that block exists — the two answer the same kind of question,
-  // so a reader who finds one finds the other.
-  if (/^product:/m.test(body)) {
-    return restore(body.replace(/^product:\n(?:  .*\n)*/m, (m) => `${m}\n${block}`), crlf);
-  }
-  return restore(`${block}\n${body.replace(/^/, "")}`, crlf);
-}
-
-// A first install has nowhere to read a product name from, so the folder is the best guess available —
-// and a guess the owner can accept with Enter beats a field they must type. `worship-presenter-web`
-// becomes `Worship Presenter Web`; camelCase splits too. It is a SUGGESTION: G1 confirms the real name.
-export function humaniseFolderName(name) {
-  return String(name || "")
-    .replace(/[._-]+/g, " ")
-    .replace(/([a-z\d])([A-Z])/g, "$1 $2")
-    .replace(/\s+/g, " ")
-    .trim()
-    .split(" ")
-    .filter(Boolean)
-    .map((w) => (w === w.toUpperCase() && w.length <= 4 ? w : w[0].toUpperCase() + w.slice(1)))
-    .join(" ");
-}
+// index.yaml editing. Every regex here is anchored on `\n`, and a Windows checkout hands us `\r\n` —
+// so every function normalises before matching and restores the file's own ending before writing.
+//
+// Skipping that is not a cosmetic bug. It silently returns "" for a name that IS set, which makes
+// `identityIsPlaceholder` true, which makes `setProductIdentity` return early: the installer reports
+// nothing and writes nothing, on every CRLF repo. Found 2026-08-18 on the first real install into a
+// Windows product repo, where `policy.doc_language` printed empty while the file plainly said `id`.
+
+// FREE TEXT, not an enum. The consumer is a model, and a model does not need a list: "English",
+// "Bahasa Indonesia", "id", "Indonesia" all read the same to it. Fencing this into two values would
+// force the owner to translate their intent into the installer's vocabulary first, and nothing is
+// bought with that.
+export const DEFAULT_DOC_LANGUAGE = "English";
+
+/** LF view of the text, plus how to put the original endings back. */
+function lf(text) {
+  const crlf = text.includes("\r\n");
+  return { body: crlf ? text.replaceAll("\r\n", "\n") : text, crlf };
+}
+
+function restore(body, crlf) {
+  return crlf ? body.replaceAll("\n", "\r\n") : body;
+}
+
+export function yamlQuote(value) {
+  return `"${String(value).replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+
+/**
+ * Generic block-level key upsert that preserves comments, indentations, and existing sibling keys.
+ */
+export function upsertBlockKeys(body, blockName, pairs) {
+  const entries = Array.isArray(pairs) ? pairs : Object.entries(pairs);
+  const validEntries = entries.filter(([_, v]) => v !== undefined);
+  if (validEntries.length === 0) {
+    return body;
+  }
+
+  const lines = body.split("\n");
+  // Header must start at column 0 to prevent matching nested keys
+  const headerRegex = new RegExp(`^${blockName}:[ \\t]*(?:#.*)?$`);
+  const headerIndex = lines.findIndex((l) => headerRegex.test(l));
+
+  if (headerIndex === -1) {
+    const blockContent = validEntries.map(([k, v]) => `  ${k}: ${v}`).join("\n");
+    const newBlockLines = [`${blockName}:`, ...validEntries.map(([k, v]) => `  ${k}: ${v}`)];
+
+    // If adding policy and product exists, place policy right after product block
+    if (blockName === "policy") {
+      const productHeaderRegex = /^product:[ \t]*(?:#.*)?$/;
+      const productHeaderIndex = lines.findIndex((l) => productHeaderRegex.test(l));
+      if (productHeaderIndex !== -1) {
+        let nextIndex = lines.length;
+        for (let i = productHeaderIndex + 1; i < lines.length; i++) {
+          if (/^[a-zA-Z0-9_-]+:|^---/.test(lines[i])) {
+            nextIndex = i;
+            break;
+          }
+        }
+        let lastIndented = productHeaderIndex;
+        for (let i = nextIndex - 1; i > productHeaderIndex; i--) {
+          if (/^\s/.test(lines[i])) {
+            lastIndented = i;
+            break;
+          }
+        }
+        if (lines[lastIndented + 1] === "") {
+          const insertLines = nextIndex < lines.length ? [...newBlockLines, ""] : newBlockLines;
+          lines.splice(lastIndented + 2, 0, ...insertLines);
+        } else {
+          const insertLines = nextIndex < lines.length ? ["", ...newBlockLines, ""] : ["", ...newBlockLines];
+          lines.splice(lastIndented + 1, 0, ...insertLines);
+        }
+        return lines.join("\n");
+      }
+    }
+
+    const cleanBody = body.replace(/^\uFEFF/, "");
+    return cleanBody ? `${blockName}:\n${blockContent}\n\n${cleanBody}` : `${blockName}:\n${blockContent}\n`;
+  }
+
+  // End of block is reached at the next top-level mapping key or document separator
+  let nextBlockIndex = lines.length;
+  for (let i = headerIndex + 1; i < lines.length; i++) {
+    if (/^[a-zA-Z0-9_-]+:|^---/.test(lines[i])) {
+      nextBlockIndex = i;
+      break;
+    }
+  }
+
+  let lastIndentedIndex = headerIndex;
+  for (let i = nextBlockIndex - 1; i > headerIndex; i--) {
+    if (/^\s/.test(lines[i])) {
+      lastIndentedIndex = i;
+      break;
+    }
+  }
+
+  const toAppend = [];
+  for (const [key, value] of validEntries) {
+    // Only match direct children at 2 spaces indentation
+    const keyRegex = new RegExp(`^  ${key}:[ \\t]*`);
+    let foundIndex = -1;
+    for (let i = headerIndex + 1; i < nextBlockIndex; i++) {
+      if (keyRegex.test(lines[i])) {
+        foundIndex = i;
+        break;
+      }
+    }
+
+    if (foundIndex !== -1) {
+      // Preserve any trailing inline comment
+      const commentMatch = lines[foundIndex].match(/(?:[ \t]+#.*)$/);
+      const inlineComment = commentMatch ? commentMatch[0] : "";
+      lines[foundIndex] = `  ${key}: ${value}${inlineComment}`;
+    } else {
+      toAppend.push(`  ${key}: ${value}`);
+    }
+  }
+
+  if (toAppend.length > 0) {
+    lines.splice(lastIndentedIndex + 1, 0, ...toAppend);
+  }
+
+  return lines.join("\n");
+}
+
+function readBlockValue(body, blockName, key) {
+  const lines = body.split("\n");
+  const headerRegex = new RegExp(`^${blockName}:[ \\t]*(?:#.*)?$`);
+  const headerIndex = lines.findIndex((l) => headerRegex.test(l));
+  if (headerIndex === -1) return "";
+
+  let nextBlockIndex = lines.length;
+  for (let i = headerIndex + 1; i < lines.length; i++) {
+    if (/^[a-zA-Z0-9_-]+:|^---/.test(lines[i])) {
+      nextBlockIndex = i;
+      break;
+    }
+  }
+
+  const doubleQuotedRegex = new RegExp(`^  ${key}:[ \\t]*"((?:[^"\\\\]|\\\\.)*)"`);
+  const singleQuotedRegex = new RegExp(`^  ${key}:[ \\t]*'((?:[^'\\\\]|\\\\.)*)'`);
+  const bareRegex = new RegExp(`^  ${key}:[ \\t]*([^\\n#]*)`);
+
+  for (let i = headerIndex + 1; i < nextBlockIndex; i++) {
+    const dQuoted = lines[i].match(doubleQuotedRegex);
+    if (dQuoted) {
+      return dQuoted[1].replaceAll('\\"', '"').replaceAll('\\\\', '\\').trim();
+    }
+    const sQuoted = lines[i].match(singleQuotedRegex);
+    if (sQuoted) {
+      return sQuoted[1].replaceAll("''", "'").trim();
+    }
+    const bare = lines[i].match(bareRegex);
+    if (bare) return bare[1].trim();
+  }
+  return "";
+}
+
+export function readProductIdentity(text) {
+  const { body } = lf(text);
+  return {
+    name: readBlockValue(body, "product", "name"),
+    client: readBlockValue(body, "product", "client"),
+  };
+}
+
+export function writeProductIdentity(text, { name, client }) {
+  const { body, crlf } = lf(text);
+  const pairs = [
+    ["name", yamlQuote(name)],
+    ["client", yamlQuote(client ?? "")],
+  ];
+  const nextBody = upsertBlockKeys(body, "product", pairs);
+  return restore(nextBody, crlf);
+}
+
+export function identityIsPlaceholder(name) {
+  return !name || name === "{product}";
+}
+
+// ---------------------------------------------------------------------- policy (language & branches)
+//
+// Language settings:
+//   doc_language           the PROSE of working documents in .what/ .how/ .control/
+//   doc_filename_language  the SLUG part of a document filename
+//
+// Branch settings:
+//   primary_branch         trunk / production branch (defaults to "main")
+//   development_branch     active development branch (defaults to "main")
+
+function readPolicyValue(body, key) {
+  return readBlockValue(body, "policy", key);
+}
+
+export function readLanguagePolicy(text) {
+  const { body } = lf(text);
+  return {
+    docLanguage: readPolicyValue(body, "doc_language"),
+    docFilenameLanguage: readPolicyValue(body, "doc_filename_language"),
+  };
+}
+
+export function writeLanguagePolicy(text, { docLanguage, docFilenameLanguage }) {
+  const { body, crlf } = lf(text);
+  const pairs = [];
+  if (docLanguage !== undefined) pairs.push(["doc_language", yamlQuote(docLanguage)]);
+  if (docFilenameLanguage !== undefined) pairs.push(["doc_filename_language", yamlQuote(docFilenameLanguage)]);
+  const nextBody = upsertBlockKeys(body, "policy", pairs);
+  return restore(nextBody, crlf);
+}
+
+export function readBranchPolicy(text) {
+  const { body } = lf(text);
+  const primary = readPolicyValue(body, "primary_branch");
+  const development = readPolicyValue(body, "development_branch");
+  return {
+    primaryBranch: primary || "main",
+    developmentBranch: development || "main",
+  };
+}
+
+export function writeBranchPolicy(text, { primaryBranch, developmentBranch }) {
+  const { body, crlf } = lf(text);
+  const pairs = [];
+  if (primaryBranch !== undefined) pairs.push(["primary_branch", yamlQuote(primaryBranch)]);
+  if (developmentBranch !== undefined) pairs.push(["development_branch", yamlQuote(developmentBranch)]);
+  const nextBody = upsertBlockKeys(body, "policy", pairs);
+  return restore(nextBody, crlf);
+}
+
+// A first install has nowhere to read a product name from, so the folder is the best guess available —
+// and a guess the owner can accept with Enter beats a field they must type. `acme-billing-portal`
+// becomes `Acme Billing Portal`; camelCase splits too. It is a SUGGESTION: G1 confirms the real name.
+export function humaniseFolderName(name) {
+  return String(name || "")
+    .replace(/[._-]+/g, " ")
+    .replace(/([a-z\d])([A-Z])/g, "$1 $2")
+    .replace(/\s+/g, " ")
+    .trim()
+    .split(" ")
+    .filter(Boolean)
+    .map((w) => (w === w.toUpperCase() && w.length <= 4 ? w : w[0].toUpperCase() + w.slice(1)))
+    .join(" ");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wdi-method",
-  "version": "0.6.18",
+  "version": "0.6.24",
   "description": "WDI Method — software delivery method that wraps BMad",
   "type": "module",
   "bin": {
@@ -13,8 +13,12 @@
     "kit-overlay/",
     "scaffold/",
     "README.md",
+    "README.id.md",
+    "README.ja.md",
+    "README.zh.md",
     "CHANGELOG.md",
     "LICENSE",
+    "NOTICE",
     "!**/__pycache__",
     "!**/*.pyc"
   ],
@@ -35,10 +39,10 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/wiradigitalid/wdi-method.git"
+    "url": "git+https://github.com/wiradeltaid/wdi-method.git"
   },
   "bugs": {
-    "url": "https://github.com/wiradigitalid/wdi-method/issues"
+    "url": "https://github.com/wiradeltaid/wdi-method/issues"
   },
-  "homepage": "https://github.com/wiradigitalid/wdi-method#readme"
+  "homepage": "https://github.com/wiradeltaid/wdi-method#readme"
 }

package/scaffold/.control/custom-dispatch.yaml.example

@@ -0,0 +1,65 @@
+# .control/custom-dispatch.yaml.example
+# Optional machine-local runner and dispatch configuration for autonomous daily tier skills.
+# When seeded to `.control/custom-dispatch.yaml`, it remains local and gitignored.
+schema: 1
+
+runners: {}
+# Uncomment and customize runners on this machine:
+#
+# Auto runners (dispatches in-session if model is reachable from active session;
+# otherwise executes shell-out command):
+# sonnet:
+#   type: auto
+#   model: sonnet
+#   command: 'claude --model claude-sonnet-5 --effort high --dangerously-skip-permissions -p'
+#
+# opus:
+#   type: auto
+#   model: opus
+#   command: 'claude --model claude-opus-5 --effort high --dangerously-skip-permissions -p'
+#
+# External CLI runners (always shell-out):
+# NOTE: For roles.reviewer, runner commands MUST enforce read-only execution where supported
+# (e.g. `--trust-tools=fs_read` for kiro-cli, `--mode plan` for cursor-agent).
+#
+# terra:
+#   type: shell-out
+#   command: 'kiro-cli chat --model gpt-5.6-terra --effort high --trust-tools=fs_read --no-interactive'
+#   timeout_s: 600   # Hard wall-clock timeout in seconds for backgrounded dispatch (default: 600s)
+#
+# composer:
+#   type: shell-out
+#   command: 'cursor-agent --mode plan --model "composer-2.5"'
+#   timeout_s: 600
+#
+# sol:
+#   type: shell-out
+#   command: 'cursor-agent --mode plan --model "gpt-5.6-sol-high"'
+#   timeout_s: 600
+
+roles:
+  # Builder configuration:
+  #   builder is fixed to 'coordinator' (mandatory). The coordinating session implements code
+  #   directly in the active run worktree (tight TDD cycles, direct verification). Coding delegation
+  #   (in-session subagent or external builder runner) is prohibited in the daily routine to eliminate
+  #   handoff latency and delegation hallucinations.
+  #   Guardrail: builder: coordinator MUST NOT be paired with reviewer: none unless all touched
+  #   components have risk_accepted: low and the decision is recorded. A builder cannot be its own sole judge.
+  builder: coordinator
+
+  # Reviewer options:
+  #   - default: Resolves peer review via caller's active session / global agent rules
+  #   - <runner-id>: Dispatches peer review to the named runner
+  #   - none: Disables peer review pass (coordinator self-review only)
+  # NOTE: Reviewer runners in daily triage (wdi-daily-what-to-build) operate strictly as advisory /
+  # read-only critics. The coordinator alone applies edits to the spec/tickets and writes registry traces.
+  reviewer: default
+
+  # Deep analyst options (for architecture spine, complex debugging, or hard decisions):
+  #   - default: Uses reviewer runner or coordinator for deep analysis
+  #   - <runner-id>: Dispatches deep analysis to a dedicated high-reasoning runner
+  #   - none: Disables separate deep analyst dispatch (handled by reviewer/coordinator)
+  deep_analyst: default
+
+review_policy:
+  peer_review: true        # Set to false (or set reviewer: none) to bypass peer review pass

package/scaffold/.control/registry/index.yaml

@@ -9,6 +9,15 @@ product:
   name: "{product}"
   client: ""
 
+# POLICY SETTINGS. Language and branching rules for the repository.
+# Branch settings default to `main` if omitted. Set `development_branch` to match
+# `primary_branch` for single-branch workflows.
+policy:
+  doc_language: "English"
+  doc_filename_language: "English"
+  # primary_branch: main
+  # development_branch: development # Set equal to primary_branch for single-branch workflow
+
 # GLOBAL DEPTH. The only document-depth knob, and it MUST NOT also govern review intensity —
 # that is `risk_accepted` per component in components.yaml.
 #   catalog  UC list + three inventories + C4; zero extra files per component. G4 is skipped

package/scaffold/.control/test-targets/desktop.md

@@ -0,0 +1,15 @@
+# Desktop Smoke Test Target
+
+## Target Configuration
+# Optional build and process settings for this repository:
+# build_command: <build command from codebase-stack-guide.md>
+# profile: debug | release (default: release for visual/performance, debug for fast logic loops)
+# artifact_path: <path to compiled binary artifact>
+# process_name: <application process name>
+
+## Verification Checklist Template
+
+- [ ] Application launches cleanly without crashes or uncaught runtime panics
+- [ ] Primary window displays expected initial view and layout
+- [ ] User input, navigation, and window controls respond as expected
+- [ ] Application logs are free from unexpected warnings or errors

package/scaffold/.control/test-targets/mobile.md

@@ -0,0 +1,6 @@
+# Mobile Smoke Test Checklist Template
+
+- [ ] Application installs and launches on target device or emulator
+- [ ] Initial view displays cleanly without crashing
+- [ ] Touch gestures and primary navigation respond as expected
+- [ ] Device runtime log displays no unhandled exceptions

package/scaffold/.control/test-targets/web.md

@@ -0,0 +1,6 @@
+# Web Smoke Test Checklist Template
+
+- [ ] Application server starts and responds to HTTP requests
+- [ ] Initial route renders without 404 or 500 status codes
+- [ ] Interactive UI controls respond to user interaction
+- [ ] Browser console log shows no uncaught exceptions