wdi-method 0.6.19 → 0.6.24

package/kit/.constitution/method/scripts/validate.py

@@ -51,6 +51,7 @@ CHECK_ORDER = (
     "memlog-home",
     "spec-names-release-prd",
     "ticket-status-one-home",
+    "archived-spec-closed",
     "defect-root-cause",
     "entity-one-writer",
     "spec-after-g4",
@@ -172,7 +173,7 @@ def git(root: Path, *args: str) -> str | None:
     try:
         out = subprocess.run(
             ["git", "-C", str(root), *args],
-            capture_output=True, text=True, timeout=30, check=False,
+            capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=30, check=False,
         )
     except (OSError, subprocess.SubprocessError):
         return None
@@ -656,7 +657,8 @@ def lc_registered(c: Corpus, r: Result) -> None:  # was V12
             if area not in areas:
                 r.fail("lc-registered", str(ticket.get("id")),
                        f"its spec is already closed, but `{area}` is not registered as an `area` "
-                       f"in components.yaml")
+                       f"in components.yaml. For corpus- or documentation-only tickets with no "
+                       f"application code changes, use `touches: []` instead of inventing an area name.")
         pid = str(ticket.get("component") or "")
         row = pc_by_id.get(pid)
         if row is None or (str(spec.get("id")), pid) in seen:
@@ -942,6 +944,35 @@ def ticket_status_one_home(c: Corpus, r: Result) -> None:  # was V18
                                "`status:` in frontmatter")
 
 
+def archived_spec_closed(c: Corpus, r: Result) -> None:
+    """A spec whose `spec_folder` points to `.archive/` MUST have status `closed`.
+
+    Archiving is reserved for completed specs. Active work belongs in `.scratch/` where tickets
+    are materialized into git worktrees for implementation.
+    """
+    for spec in c.spec_list:
+        sid = str(spec.get("id") or "")
+        folder = str(spec.get("spec_folder") or "").strip()
+        if not folder:
+            for t in spec.get("tickets") or []:
+                if isinstance(t, dict) and str(t.get("spec_folder") or "").strip():
+                    folder = str(t.get("spec_folder")).strip()
+                    break
+        clean = folder.replace("\\", "/").strip()
+        while clean.startswith("./"):
+            clean = clean[2:]
+        if clean.startswith("/"):
+            clean = clean.lstrip("/")
+        norm = os.path.normpath(clean).replace("\\", "/") if clean else ""
+        if (clean == ".archive" or clean.startswith(".archive/") or
+                norm == ".archive" or norm.startswith(".archive/")):
+            status = str(spec.get("status") or "").strip()
+            if status != "closed":
+                r.fail("archived-spec-closed", sid,
+                       f"points to `{folder}` under `.archive/` but its status is `{status or 'unspecified'}` — "
+                       "only closed specs may be archived")
+
+
 PLATFORM = "_platform"
 CROSS_CUTTING = ".how/_platform/cross-cutting.md"
 # The section heading entity-one-writer looks for. A heading a SCRIPT matches is a machine-facing key, and
@@ -1288,6 +1319,7 @@ PAST_RECORD = (
     ".control/decisions/",
     ".control/questions/answered.md",
     ".control/reports/",
+    ".archive/",
 )
 # Corpus that §25 freezes as-is. Its citation of a now-retired prototype is authorized by DEC-016.
 FROZEN = (".what/",)
@@ -1655,7 +1687,7 @@ def custom_room_declared(c: Corpus, r: Result) -> None:  # was V27
 # The two rendered trees are DELIBERATELY absent from this list. They are regenerated by this
 # script, so a product that declines to commit derived output is making a choice the method allows.
 COMMITTED_DIRS = (".constitution", ".control", ".what", ".how", "_bmad-output", ".work",
-                  ".scratch")
+                  ".scratch", ".archive")
 
 # Probed inside each directory above, and named so that no honest pattern would ever mean to match
 # it. The distinction this draws is the entire point of the check: `.work/upstream/` or
@@ -1678,7 +1710,7 @@ def _ignore_rule(root: Path, rel: str) -> tuple[bool, str]:
     try:
         out = subprocess.run(
             ["git", "-C", str(root), "check-ignore", "-v", "--no-index", rel],
-            capture_output=True, text=True, timeout=30, check=False,
+            capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=30, check=False,
         )
     except (OSError, subprocess.SubprocessError):
         return (False, "")
@@ -1712,6 +1744,20 @@ def corpus_in_git(c: Corpus, r: Result) -> None:
                    f"is excluded from git by `{rule}` — the method commits this folder, "
                    f"so no clone has what is in it")
 
+    dispatch_file = c.root / ".control" / "custom-dispatch.yaml"
+    if dispatch_file.exists():
+        try:
+            ls_res = subprocess.run(
+                ["git", "-C", str(c.root), "ls-files", ".control/custom-dispatch.yaml"],
+                capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=30, check=False,
+            )
+            if ls_res.returncode == 0 and ls_res.stdout.strip():
+                r.fail("custom-dispatch-untracked", ".control/custom-dispatch.yaml",
+                       "is tracked in git — local runner configuration must never be committed; "
+                       "add it to .gitignore and run `git rm --cached .control/custom-dispatch.yaml`")
+        except (OSError, subprocess.SubprocessError):
+            pass
+
 
 ENGINE_HOMES = (".claude", ".agents", ".agent", ".cursor", ".codex")
 ENGINE_FLAGGED = ("to-spec", "to-tickets", "implement")
@@ -1858,7 +1904,7 @@ def run_checks(c: Corpus, asof: dt.date) -> Result:
     # no two copies left to compare.
     # V19 is REPEALED. It checked one line item — an `RTR-` file in .control/reports/ — and the
     # retrospective it archived was the only thing spec size `L` ever decided. Both went together.
-    for fn in (goal_has_fr, fr_has_uc, uc_scheduled, ticket_has_test, nfr_has_enforcer, refs_resolve, no_cycles, applied_dec_touches, locked_gate_passed, parallel_tickets_blocked, lc_registered, review_trace, chain_links, memlog_home, spec_names_release_prd, ticket_status_one_home, defect_root_cause, entity_one_writer, spec_after_g4, high_risk_named, mandate_accept, cites_resolve, container_built, custom_room_declared, corpus_in_git, engines_invocable, withdrawn_recorded, id_allocated_once):
+    for fn in (goal_has_fr, fr_has_uc, uc_scheduled, ticket_has_test, nfr_has_enforcer, refs_resolve, no_cycles, applied_dec_touches, locked_gate_passed, parallel_tickets_blocked, lc_registered, review_trace, chain_links, memlog_home, spec_names_release_prd, ticket_status_one_home, archived_spec_closed, defect_root_cause, entity_one_writer, spec_after_g4, high_risk_named, mandate_accept, cites_resolve, container_built, custom_room_declared, corpus_in_git, engines_invocable, withdrawn_recorded, id_allocated_once):
         fn(c, r)
     plan_dates(c, r, asof)
     return r
@@ -2048,7 +2094,57 @@ def gen_rtm(c: Corpus) -> dict:
     return {"rtm": lines}
 
 
-def gen_status(c: Corpus, rtm: dict, result: Result) -> dict:
+def _active_mandates(c: Corpus, asof: dt.date | None = None) -> dict:
+    """Project active mandate status into status.yaml: resolution (one | none | ambiguous),
+    active_ids list, and active_mandate dict.
+
+    An active accepted mandate MUST have type: mandate, status: accepted, an unexpired
+    expires date (today <= expires), and no superseded_by or status: superseded.
+    """
+    today = asof or dt.date.today()
+    actives: list[dict] = []
+    for dec in c.decs:
+        if str(dec.get("type") or "") != "mandate":
+            continue
+        status = str(dec.get("status") or "")
+        if status != "accepted":
+            continue
+        did = str(dec.get("id") or "")
+        ref = str(dec.get("superseded_by") or _dec_fm(c, dec).get("superseded_by") or "").strip()
+        if ref or status == "superseded":
+            continue
+        params = dec.get("mandate") if isinstance(dec.get("mandate"), dict) else {}
+        expires = _dec_date(c, {"date": params.get("expires")})
+        if expires is None or expires < today:
+            continue
+        actives.append({
+            "id": did,
+            "status": status,
+            "expires": expires.isoformat(),
+            "scope": params.get("scope", "all"),
+        })
+    actives.sort(key=lambda a: a["id"])
+    if len(actives) == 1:
+        return {
+            "resolution": "one",
+            "active_ids": [actives[0]["id"]],
+            "active_mandate": actives[0],
+        }
+    elif len(actives) > 1:
+        return {
+            "resolution": "ambiguous",
+            "active_ids": [a["id"] for a in actives],
+            "active_mandate": None,
+        }
+    else:
+        return {
+            "resolution": "none",
+            "active_ids": [],
+            "active_mandate": None,
+        }
+
+
+def gen_status(c: Corpus, rtm: dict, result: Result, asof: dt.date | None = None) -> dict:
     lines = rtm.get("rtm") or []
     counted = [line for line in lines if not line.get("exempt")]
     exempt = len(lines) - len(counted)
@@ -2071,6 +2167,7 @@ def gen_status(c: Corpus, rtm: dict, result: Result) -> dict:
         "validators_red": result.red,
         "validators_skipped": dict(sorted(result.skipped.items())),
         "open_questions": _question_budget(c),
+        "mandates": _active_mandates(c, asof),
     }
 
 
@@ -2870,7 +2967,7 @@ def page_sdd(c: Corpus, pid: str) -> str:
     return "\n".join(parts) + "\n"
 
 
-def generate(c: Corpus, result: Result) -> list[Path]:
+def generate(c: Corpus, result: Result, asof: dt.date | None = None) -> list[Path]:
     """Machine tables into `.control/generated/`; every page a human reads into the two rendered
     trees, at the mirror path of the working document it projects."""
     out_dir = c.root / ".control" / "generated"
@@ -2881,7 +2978,7 @@ def generate(c: Corpus, result: Result) -> list[Path]:
         "risks": gen_risks(c),
         "dag": gen_dag(c),
         "rtm": rtm,
-        "status": gen_status(c, rtm, result),
+        "status": gen_status(c, rtm, result, asof),
     }
     written = []
     for name in GENERATED_ORDER:
@@ -2938,6 +3035,9 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument("--asof", default=None,
                         help="reference date for plan-dates, format YYYY-MM-DD (default: today). "
                              "Stated explicitly so a run can be repeated exactly")
+    parser.add_argument("--baseline", nargs="?", const=".github/validate-baseline.txt", default=None,
+                        help="path to baseline findings file (default: .github/validate-baseline.txt); "
+                             "exits 0 if current findings match baseline exactly")
     args = parser.parse_args(argv)
 
     if not args.check and not args.generate:
@@ -2953,10 +3053,27 @@ def main(argv: list[str] | None = None) -> int:
     result = run_checks(corpus, asof)
 
     if args.generate:
-        for path in generate(corpus, result):
+        for path in generate(corpus, result, asof):
             print(f"  wrote {path.relative_to(root).as_posix()}")
 
     if result.findings:
+        if args.baseline:
+            base_p = Path(args.baseline)
+            if not base_p.is_absolute():
+                base_p = root / base_p
+            if base_p.is_file():
+                current_fmt = [f"  {f.vid:<26} {f.subject}: {f.message}".rstrip()
+                               for f in sorted(result.findings, key=lambda f: f.sort_key)]
+                base_lines = [l.rstrip() for l in base_p.read_text(encoding="utf-8").splitlines() if l.strip()]
+                if sorted(current_fmt) == sorted(base_lines):
+                    print(f"\nGREEN (baseline match) — {len(result.findings)} finding(s) match baseline `{base_p.relative_to(root).as_posix()}`")
+                    if result.skipped:
+                        print("\nSkipped:")
+                        for vid, why in sorted(result.skipped.items()):
+                            print(f"  {vid:<26} {why}")
+                    print(f"\nV14 reference date: {asof.isoformat()}")
+                    return 0
+
         print(f"\nRED — {len(result.findings)} findings across {len(result.red)} validators\n")
         for finding in sorted(result.findings, key=lambda f: f.sort_key):
             print(f"  {finding.vid:<26} {finding.subject}: {finding.message}")

package/kit/skills/wdi-autopilot/SKILL.md

@@ -14,15 +14,18 @@ hold, the same panel reviews the code. What changes is who answers when a skill
 
 | Door | When | Does | Asks |
 |---|---|---|---|
-| **Preflight** | **No mandate row exists at all**, and the owner asked for one in this turn | Checks everything, prints one page, waits for the owner's confirmation, writes the mandate, starts the loop | Yes — this is the only place this skill MAY ask |
+| **Preflight** | **No active accepted mandate exists**, and the owner asked for one in this turn | Checks everything, prints one page, waits for the owner's confirmation, writes the mandate, starts the loop | Yes — this is the only place this skill MAY ask |
 | **Iteration** | A mandate at `accepted` whose `expires` has not passed | Reads the registry and the ledger's `## Resume`, works from where the last iteration stopped for as long as it safely can, records, returns only at one of three stops | **Never** |
 | **Finish, lapsed** | A mandate at `accepted` whose `expires` **has** passed | Goes straight to § Finish, marks the run lapsed, cancels the loop | **Never** |
+| **Terminal / No-op** | A mandate at `applied` or `superseded` (or unattended invocation with no unworked mandate) | Clean no-op: reports mandate already completed/lapsed, cancels any active loop task, and halts immediately | **Never** |
 
 **A run MUST NOT write itself a mandate.** Preflight is reachable only when the owner asked for it in the
 turn that is running; a loop firing MUST NOT open it, whatever the mandate's state. Without that, an expired
 mandate would put the next firing back at preflight — where the defaults are already filled in and nobody is
 awake to refuse them — and the run would renew its own authority. The lapsed door exists precisely so the
-expiry ends the run instead of restarting it.
+expiry ends the run instead of restarting it. If an unattended iteration fires after a mandate has already
+reached `status: applied` or `superseded`, the skill MUST NOT attempt to re-open Preflight or restart work;
+it MUST perform a clean, single-line no-op and cancel any lingering loop scheduler.
 
 Typing `/wdi-autopilot` while a mandate is active opens the iteration door, not the preflight. To change a
 setting, the owner supersedes the mandate with a new one — `wdi-decision` owns supersession. A superseded
@@ -44,12 +47,12 @@ NOT start the loop while any row in the first two groups is red.
 | | This skill and `wdi-build` are themselves invocable — no `skillOverrides` entry in `settings.json` set to `off` or `user-invocable-only` | Either is overridden. Nothing else can start the loop, and the override is silent |
 | | The tracker the engines publish to is configured — `docs/agents/issue-tracker.md`, written once by `/setup-matt-pocock-skills` | Missing. `to-tickets` would stop to ask for it, and this skill never asks; the owner runs the setup before confirming |
 | | Reviewers separate from the builder can be dispatched | The session cannot spawn a second agent and any touched component is `risk_accepted: low` — Step 3 of `wdi-build` would block |
-| | `.constitution/project/codebase-stack-guide.md` names build and test commands, **and the test command exits 0 here** | Absent or failing. Every ticket's "full suite green once" and the smoke test read it. Found at minute one, not at hour six |
-| | The remote accepts the run branch — `git push --dry-run` — and `main` is reachable as a PR base | Auth or remote failure. The first real push is at the first spec close, hours in |
+| | `.constitution/project/codebase-stack-guide.md` names build and test commands, **and the test command exits 0 here** (prefer quiet output flags, e.g. `-- --quiet`, to keep context compact; on non-zero exit, surface the failure details and abort preflight) | Absent or failing. Every ticket's "full suite green once" and the smoke test read it. Found at minute one, not at hour six |
+| | The remote accepts the run branch — `git push --dry-run` — and `development_branch` (`policy.development_branch`, default `main`) is reachable as a PR base | Auth or remote failure. Fail-closed: if the configured `development_branch` does not exist locally or on remote (`refs/heads/<branch>` or `refs/remotes/origin/<branch>`), stop immediately and report to maintainer; MUST NOT guess or silently fall back to `main` (`.constitution/method/branch-guide.md`). The first real push is at the first spec close, hours in |
 | | A CI workflow is configured | None. § Finish would wait for checks that never arrive; say so and read the local suite as the evidence instead |
 | | **No workflow fires on an intermediate push** — the run branch is pushed dozens of times and a metered runner MUST NOT start on any of them. `ci-guide.md` § Trigger shape is the check: `workflow_dispatch` present, the automatic trigger `pull_request` `types: [ready_for_review]`, no bare `on: push` | A workflow triggers on every push. Fix it before the mandate is written — one autopilot run over fifteen tickets has spent most of a month's allowance in two days — or, where the workflow is not this repo's to change, the run holds every intermediate push and the preflight page says so |
-| **Position** | `gates_passed` in `index.yaml`, `g4_passed` per component, validators green (`validate.py`) | A red validator. Name it; autopilot MUST NOT start on a corpus already red |
-| | An isolated worktree | A shared checkout. `wdi-build` refuses one, so this skill refuses earlier |
+| **Position** | `gates_passed` in `index.yaml`, `g4_passed` per component, validators green (`uv run .constitution/method/scripts/validate.py --baseline`) | A red validator. Name it; autopilot MUST NOT start on a corpus already red |
+| | An isolated working tree | A shared or dirty checkout. Permitted: an isolated linked worktree (`git worktree add`), or an exclusive primary working tree checked out to `autopilot/<mandate-id>` with a clean working tree (`git status --porcelain` empty) dedicated to this run (`.constitution/method/branch-guide.md`). `wdi-build` refuses un-isolated checkouts, so this skill refuses earlier |
 | | `from_gate` — the first gate the run will hold itself | Below the last passed gate. Default: the gate after the last one passed |
 | **Settings** | `scope` — the `FR` ids to deliver, or `all` | — (default `all` open `FR`) |
 | | `parked` — what stops for the owner instead of being decided: any of `promise` · `ad-n` · `sensitive` | — (default **`ad-n`**, and nothing else. `decision-guide.md` says narrowing an invariant MUST NOT be softened further, so removing it is the owner's to say out loud — not a default they never saw) |
@@ -59,6 +62,7 @@ NOT start the loop while any row in the first two groups is red.
 | | Where the ledger and the final report will be written | — |
 | | The **run branch** — `autopilot/<mandate-id>`, using the next free `DEC-` id from `decisions.yaml`, which the mandate then takes — and that the run will open **one** PR from it | The branch already exists with commits nobody can account for |
 | **Runtime** | The session runs with permission prompts bypassed | Cannot be verified from inside the session. Printed as a line the owner confirms |
+| | Session survivability: on Linux/remote SSH, run inside `tmux` or `screen`; on Windows, in a dedicated persistent Windows Terminal window | Ephemeral terminal that aborts the loop on disconnect |
 
 **Every row arrives with its default already in it**, and the owner changes only what they want changed —
 the same rule the installer follows. A preflight that asks fourteen questions one at a time has failed.
@@ -102,11 +106,15 @@ On the owner's confirmation, and not before:
 The interval is the **pause between** iterations, not the length of one. An iteration that outlives it
 finishes first; the next firing waits.
 
+**Session survivability across environments:**
+- **Linux / Remote SSH:** Run inside a session manager such as `tmux` (`tmux new -s autopilot`) or `screen` before starting the loop. Disconnecting SSH or closing the terminal then leaves the autonomous loop running unharmed.
+- **Windows (PowerShell / Windows Terminal):** `tmux` is not native to Windows PowerShell. Run the session in a dedicated persistent Windows Terminal tab or window left active, or via background subagent tools (`run_in_background`). Do not invoke or require `tmux` on Windows environments.
+
 ## Door 2 — One iteration
 
 Open with three reads, in this order:
 
-1. `validate.py --generate`. `.control/generated/` is written by that flag and nothing else, so without it
+1. `uv run .constitution/method/scripts/validate.py --generate --baseline`. `.control/generated/` is written by that flag and nothing else, so without it
    every iteration reads a status file from before the run and re-holds gates that already passed. It sweeps
    the validators for free at the same time.
 2. **Reconcile `## Resume` against git.** Compare the run branch HEAD with the commit Resume names. A
@@ -195,7 +203,7 @@ the method's, and none of them relaxes here:
 
 ### One run, one branch, one PR
 
-A mandate is **one unit of work**, and it reaches `main` through **one door**: a single PR from the run
+A mandate is **one unit of work**, and it reaches the active development branch (`policy.development_branch`, default `main`) through **one door**: a single PR from the run
 branch, which the **owner** merges after the final review. This is what makes the result reviewable as a
 whole instead of as a stream of PRs nobody read.
 
@@ -209,9 +217,9 @@ branch, one PR, nothing else on the remote.
 |---|---|
 | Step 4 pushes a ticket branch and opens a PR per ticket | The ticket is committed to the run branch — directly, or merged in from its own worktree by the coordinator. The ticket-closing checklist is still answered first. **No PR per ticket** |
 | Step 5 watches CI per PR | The coordinator pushes the run branch **at every spec close** — and that push starts **no cloud run**; the first push opens the one PR as a **draft**. CI runs **once**, at § Finish, and is judged exactly as Step 5 says on the pushed head SHA |
-| `MUST NOT merge` | Holds harder. The run never merges to `main`; the owner does, once, after § Finish |
+| `MUST NOT merge` | Holds harder. The run never merges to `primary_branch` or `development_branch`; the owner does, once, after § Finish |
 
-A second PR is a red flag. Where a change cannot ride the run branch — a hotfix `main` needs today — it is
+A second PR is a red flag. Where a change cannot ride the run branch — an urgent fix the target branch needs today — it is
 reported for the owner, not opened by the run.
 
 ### Cycle-end CI — the cloud runner fires once
@@ -283,6 +291,8 @@ what it decided while running* — and this is exactly one. `memlog-home` holds
 
 Frontmatter `artifact:` names the mandate's `DEC-` file — `memlog-home` demands it of every memlog.
 
+The mandate ledger file (`.control/memlog/autopilot-<mandate-id>.md` and its companion directory `.control/memlog/autopilot-<mandate-id>/`) is **permanent** and MUST NOT be deleted or removed during spec pruning or housekeeping — it preserves the provenance of autonomous runs.
+
 **It has two readers who want opposite things, and that is what shapes it.** The next iteration needs a
 resume point: where the last one stopped and what to do now. The owner needs every decision, with what it
 cost. Serving both from one flat table is what made a real ledger reach 41 KB by its twenty-second
@@ -351,11 +361,16 @@ applies it.
 
 When § The work table reaches § Finish:
 
-1. **Smoke test.** At `smoke_test: agent`: run the application with the commands
+1. **Smoke test.** Standardized smoke test locations:
+   - **Automated spec test:** `.scratch/<spec-id>-<slug>/smoke/` — spec-level smoke artifacts that archive alongside the spec when closed.
+   - **Human interactive test:** `.work/smoke/<target>.md` — ephemeral test scripts and physical run notes, cleaned up once the task finishes.
+   - **Mandate ledger:** `.control/memlog/autopilot-<mandate-id>.md` — permanent record of pass/fail results per `FR`, never pruned.
+
+   At `smoke_test: agent`: run the application with the commands
    `.constitution/project/codebase-stack-guide.md` names, exercise every closed `FR`'s proof of done from
    the PRD, record pass or fail per `FR` in the ledger. At `owner`: run nothing; the test script below is
    the whole deliverable.
-2. `validate.py --generate`, then `wdi-report` intent `progress`.
+2. `uv run .constitution/method/scripts/validate.py --generate --baseline`, then `wdi-report` intent `progress`.
 3. Raise the mandate to `applied`, `touches` naming the ledger, and rewrite `## Resume` one last time so it
    reads as the run's end state rather than a step that never came.
 4. **Leave the run branch in a state the owner can merge.** A ticket still in flight is either finished or
@@ -381,8 +396,14 @@ When § The work table reaches § Finish:
    Green marks the one PR **ready for review**. Red keeps it a **draft** and is reported red: a PR marked
    ready is an invitation to merge, and the run MUST NOT extend one over a red branch, nor patch to turn it
    green at the door.
-5. Cancel the loop: in Claude Code, the `loop` skill's cancel; elsewhere, tell the owner the loop has nothing
-   left to do.
+
+   **Signed CI override:** If the mandate decision block in `decisions.yaml` records a signed `ci_override`
+   (e.g. `ci_override: local-only-approved-by: "<Person, Date>"` per `.constitution/method/ci-guide.md`),
+   the run MUST NOT mark the draft PR ready (`gh pr ready`). The PR MUST remain as a Draft, no cloud runner
+   is awaited, and the final output report explicitly states: *"locally verified; cloud verification intentionally deferred by mandate"*.
+5. **Cancel the loop cleanly:** in Claude Code, inspect scheduled jobs via `CronList`, identify the job firing
+   `/wdi-autopilot`, and call `CronDelete` on its task ID to eliminate zombie loop firings; elsewhere, call the platform's
+   loop cancellation mechanism or inform the owner that the loop has completed its mandate and has nothing left to do.
 6. Write the final report as the Output below. The owner merges; the run never does.
 
 ## Red Flags — STOP
@@ -409,7 +430,7 @@ When § The work table reaches § Finish:
 - Spinning until `expires` on work that is not runnable, instead of finishing and naming the blockers
 - Returning after one step while work remains and none of the three stops applies
 - A second PR, any branch but the run branch pushed, a working branch left alive at Finish, or any merge
-  into `main` by the run — working branches and worktrees during the run are fine; surviving ones are not
+  into `primary_branch` or `development_branch` by the run — working branches and worktrees during the run are fine; surviving ones are not
 - Merging a red ticket into the run branch, or patching the branch forward instead of reverting the merge
 - Marking the PR ready over red CI, or handing over a run branch with a ticket half-applied
 - Parallel builders sharing a worktree, or a registry written by anyone but the coordinator

package/kit/skills/wdi-build/SKILL.md

@@ -39,7 +39,7 @@ that names the engine's `SKILL.md` path and carries out its process — or from
 names which; the seams, the `to-tickets` quiz, and § When the code turns out to be right are decided by the
 coordinator and written to the ledger, one row each; and whatever the mandate lists as `parked` still stops,
 reported for the owner rather than decided. One thing changes **shape** rather than owner: a mandate is one
-unit of work and reaches `main` through **one PR**, so Step 4 commits the ticket to the run branch instead of
+unit of work and reaches the active development branch (`policy.development_branch`, default `main`) through **one PR**, so Step 4 commits the ticket to the run branch instead of
 opening a PR per ticket, and Step 5 splits: the coordinator pushes the run branch at every spec close, but
 **the cloud run happens once, at `wdi-autopilot` § Finish** — every intermediate push starts nothing, and
 what a spec close is judged on until then is the run branch's own full suite, run locally. The checklist,
@@ -65,10 +65,11 @@ that cannot provide them is **blocked**, not excused.
 | Check | When it fails |
 |---|---|
 | Every component this spec touches has passed G4, **or** sits at `mode: catalog` | Route to `wdi-component`. `spec-after-g4` checks it, and `catalog` skipping G4 is by design, not an exception |
-| An isolated worktree | Isolate first. MUST NOT run in a shared checkout |
+| An isolated working tree | Isolate first. MUST NOT run in a shared or dirty checkout. Permitted isolation models: an isolated linked worktree (`git worktree add`), or an exclusive primary working tree checked out to the task branch with a clean status dedicated to this task (`.constitution/method/branch-guide.md`). Standing exception: Phase 1 (Open the spec) and Phase 2 (The contract and the tickets) authoring runs directly on `development_branch` (`policy.development_branch`, default `main`) with no code changes; the isolated working tree requirement binds Phase 3 (Ship each ticket) onward |
 | Every `prd` slug names a real `.what/_prd/<initiative>/` folder | A spec without a promise covering it is a spec nobody agreed to (`spec-names-release-prd`) |
+| Development branch verified locally or on remote (`refs/heads/<branch>` or `refs/remotes/origin/<branch>`) | Branch missing. Stop immediately and report to maintainer; MUST NOT guess or silently fall back to `main` (`.constitution/method/branch-guide.md`) |
 
-The repo commits straight to `main` and opens a PR only when asked. **Invoking this skill is that ask**, for
+The repo commits straight to the active development branch (`policy.development_branch`, default `main`) during Phase 1 & 2 authoring and opens a PR only when asked. **Invoking this skill is that ask**, for
 this spec only; it MUST NOT be read as standing permission for the next change.
 
 ## Phase 1 — Open the spec
@@ -302,7 +303,7 @@ The five items that left this list moved to Phase 4, where the information actua
 
 - MUST run the repository's commit/push audit before `git push`: refuse the forbidden paths, run the guard test,
   fix content on failure. A failing guard is a finding about the content — MUST NOT weaken the guard or the test.
-- MUST NOT push to `main`/`master`, MUST NOT force-push, MUST NOT merge.
+- MUST NOT push directly to protected branches (`primary_branch` or `development_branch` from `policy:`, default `main`), MUST NOT force-push, MUST NOT merge.
 - The coordinator MUST be the hand that pushes and opens the PR.
 
 ### Step 5 — watch CI, then judge
@@ -349,6 +350,11 @@ out.
 5. **RTM green.** Every traceability row for this spec is closed. New risks are in the risk register with an
    owner.
 6. Mark the spec `status: closed` in `specs.yaml`.
+7. **Housekeeping (Archive or Prune).** Once marked closed, offer the maintainer the choice to clean up
+   the completed spec directory from `.scratch/<spec-id>-<slug>/` using `/wdi-prune-or-archive`:
+   - **Archive:** `/wdi-prune-or-archive --spec <spec-id> --archive` (moves the directory to `.archive/specs/<spec-id>-<slug>/` and updates `spec_folder` in `specs.yaml`).
+   - **Prune:** `/wdi-prune-or-archive --spec <spec-id> --prune` (removes the completed spec directory from git and disk while preserving RTM history in `specs.yaml`).
+   If the maintainer declines or defers, leave the directory in `.scratch/`.
 
 The retrospective step is **repealed**, and `RTR-` with it. It was the only thing size `L` decided, and the
 only thing `V19` checked.

package/kit/skills/wdi-daily-autopilot/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: wdi-daily-autopilot
+description: Compose and launch the autonomous daily loop routine (default 10m interval) with self code-review and peer-review runners resolved from local configuration. Invoke as `/wdi-daily-autopilot [in-session] [peer] [interval] [--skip-peer-review]`.
+disable-model-invocation: true
+---
+
+# WDI Daily Autopilot Launch
+
+Composes the autonomous daily engineering routine, verifies or initiates the owner-accepted mandate
+required by `wdi-autopilot`, resolves coordinator self code-review and independent peer-review dispatch
+from local configuration or agent rules, and launches the execution via `/loop <interval>` (default
+`10m`).
+
+`/wdi-daily-autopilot [self-review] [peer] [interval] [--skip-peer-review|--no-review]`:
+- `[self-review]` — coordinator self code-review pass model (`default` or explicit model slug; alias `[in-session]`).
+  `default` indicates the current coordinating session executes self code-review directly.
+- `[peer]` — independent peer reviewer runner or model identifier.
+- `[interval]` — optional loop interval matching `^\d+[smhd]$` (e.g., `5m`, `10m`, `15m`). Defaults
+  to `10m` when omitted.
+- `--skip-peer-review` / `--no-review` — bypasses the secondary peer review pass. MUST NOT disable
+  coordinator self code-review, TDD cycles, or automated test suites.
+
+## 0. Precondition
+
+Confirm `.control/registry/index.yaml` exists in the repo root. If it does not, this is not a WDI
+Method product repo — report that and stop.
+
+## 1. Parse Arguments and Flags
+
+Parse inputs unambiguously using these rules:
+1. Check for review bypass flags: `--skip-peer-review` or `--no-review`. If present, mark peer review
+   as bypassed.
+2. Check for an interval token matching `^\d+[smhd]$`. If found, assign it to `<interval>`; otherwise
+   default `<interval>` to `10m`.
+3. For remaining positional arguments:
+   - If 1 argument remains: assign to `<peer>`, and default `<self-review>` to `default`.
+   - If 2 arguments remain: assign first to `<self-review>` and second to `<peer>`.
+   - If 0 arguments remain: read defaults from `.control/custom-dispatch.yaml` if present, else default
+     both to `default`.
+
+## 2. Resolve Runner Configuration
+
+Inspect the repository for `.control/custom-dispatch.yaml` (if not found in the current working directory and running inside a linked git worktree, resolve it from the main repository root via `(git rev-parse --git-common-dir)/..`):
+- **If `.control/custom-dispatch.yaml` exists**:
+  Read `runners:`, `roles:`, and `review_policy:`.
+  - If `review_policy.peer_review` is explicitly `false`, or if `roles.reviewer` is set to `none`, mark peer review as bypassed.
+  - If `<peer>` was not explicitly specified on the command line, use `roles.reviewer`. If resolved `<peer>` is `none`,
+    mark peer review as bypassed (coordinator self-review only).
+  - If `roles.deep_analyst` is `none`, document review and architecture analysis are handled by the main reviewer or
+    coordinator directly, without dispatching a separate deep analyst process.
+  - `roles.builder` is fixed to `coordinator`: the coordinating session implements code directly inside the active run worktree (ensuring tight TDD cycles, direct verification, and eliminating delegation/handoff hallucinations). Coding delegation (whether `in-session` subagents or external builder runners) is prohibited in the daily routine.
+    Guardrail: coordinator direct implementation MUST NOT eliminate independent peer review for components whose `risk_accepted` is not `low`; `roles.reviewer` MUST NOT be set to `none` in such cases.
+  - Resolve runner dispatch by `type:` for reviewer and deep analyst:
+    - `auto`: Evaluates whether the runner's target model is reachable in-session from the active
+      session profile (per the caller's global agent collaboration rules). Dispatches in-session via `Agent`
+      if reachable; falls back to shell-out using `command` if unreachable in-session.
+    - `in-session`: Dispatches strictly via in-session `Agent` subagent.
+    - `shell-out`: Executes the external shell-out `command` (single-string command). If `command` is absent
+      or empty, stop and report immediately (fail-closed).
+- **If `.control/custom-dispatch.yaml` does not exist**:
+  Resolve reviewer dispatch through the caller's active CLI environment.
+
+## 3. Mandate Verification & Preflight Requirement
+
+Per `wdi-autopilot` § Preflight, unattended loop iterations **require an active accepted mandate** in
+`.control/registry/decisions.yaml` whose expiry date has not lapsed. A loop MUST NOT self-authorize
+its own mandate.
+
+1. Check if an active accepted mandate exists:
+   - An active mandate MUST have BOTH `type: mandate` and `status: accepted` with an unexpired `expires:` date
+     (`today <= expires`) and no `superseded_by:` or `status: superseded`.
+   - **Primary lookup ($O(1)$):** Read `.control/generated/status.yaml` and inspect `mandates:`:
+     - If `mandates.resolution: one`: the active mandate is `mandates.active_mandate.id` (with its verified `expires` and `status`). Proceed directly to step 3.
+     - If `mandates.resolution: ambiguous`: stop and report immediately to the maintainer naming all `mandates.active_ids` (fail-closed; MUST NOT guess or choose between them).
+     - If `mandates.resolution: none`: proceed to step 2 (Preflight).
+   - **Fallback lookup (when `status.yaml` does not exist or lacks `mandates:`):**
+     - MUST NOT run a broad search for `type:\s*mandate` across `decisions.yaml` (which matches dozens of historical
+       `applied` mandates and overflows the tool output limit with hundreds of lines).
+     - Query specifically for an active mandate entry using multiline search (e.g. `Grep` with
+       `pattern: "type:\s*mandate[\s\S]{1,100}?status:\s*accepted|status:\s*accepted[\s\S]{1,100}?type:\s*mandate", multiline: true`).
+       Once a candidate match is found, verify its individual decision block to confirm `expires:` is present,
+       valid, and unexpired.
+     - **Fail-closed on multiple active mandates:** If more than 1 active accepted mandate is found, stop and
+       report immediately to the maintainer (fail-closed; MUST NOT guess or choose between them).
+   - MUST NOT call `Read` on the entire 1000+ line `decisions.yaml` file. When reading the latest decision ID
+     to determine the next candidate `DEC-` ID, read only the tail (e.g. the last 50-80 lines) of `decisions.yaml`.
+2. **If no active accepted mandate exists:**
+   - Execute `wdi-autopilot` Door 1 (Preflight) in this interactive turn.
+   - When checking open work to include in the mandate, query `specs.yaml` selectively (e.g. `Grep` for
+     `status:\s*(open|ready-for-dev)`) instead of reading all historical closed specs into context.
+     Inspect the candidate spec's folder using the `spec_folder:` path from `specs.yaml` (MUST NOT run
+     broad recursive searches on all of `.scratch/`).
+   - Run validator preflight via `uv run .constitution/method/scripts/validate.py --check --baseline`
+     (or `--generate --baseline`). If `.github/validate-baseline.txt` exists in the repo, the `--baseline` flag
+     guarantees that accepted repository baseline findings are recognized as green.
+   - When verifying the preflight test suite from `codebase-stack-guide.md`, run tests with quiet output flags
+     if supported (e.g. `-- --quiet` or standard concise runner flags) to avoid flooding the context window
+     with hundreds of verbose pass lines.
+   - **Fail-closed on test failure:** If the test suite command exits non-zero, immediately surface the failure
+     summary (the failing test names and error excerpt) and abort preflight; a mandate MUST NOT be opened on a
+     failing test suite.
+   - Present the one-page preflight summary and wait for the owner's explicit confirmation.
+   - Once confirmed, write the accepted mandate row into `decisions.yaml` and initialize its ledger.
+3. **If an active accepted mandate already exists:** Proceed directly to compose and launch the loop.
+
+## 4. Compose the Routine Mandate
+
+Fill the standing five-point routine template:
+
+```markdown
+Execute all FR/Tickets/Specs to completion under the active mandate:
+1. Coding & Implementation: author code directly as coordinator in the active worktree. No coding delegation — coordinator alone implements application and test changes following TDD red-to-green cycles. Boundary: coordinator edits application and test files only during ticket coding, and defers commits to step 5. Builder MUST NOT commit, push, merge, alter git branches, or write to .control/registry/ or .control/memlog/.
+2. Code review: perform code review — self code-review by coordinator, and peer review: <resolved peer command | "none due to config">.
+3. Testing & Verification: coordinator alone runs the authoritative test suite (from codebase-stack-guide.md) directly on the active worktree after the coding pass and verifies red-to-green evidence before staging or committing.
+4. Reviews and peer analysis: delegate document and architecture review to <resolved peer command | "coordinator self-review (peer review: none due to config)"> — follow wdi-review criteria for any touched architecture or spec documents.
+5. Worktree isolation & Integration: coordinator alone isolates ticket implementation into the run worktree, writes ledger decisions in .control/memlog/, stages/commits, and merges per wdi-autopilot. Peer review: <"peer reviewer inspects worktree without interfering with active build processes" | "none due to config">.
+```
+
+If peer review was bypassed (via `roles.reviewer: none`, `review_policy.peer_review: false`, or `--skip-peer-review`),
+explicitly record `peer review: none due to config` in items 2, 4, and 5, instructing the coordinator to perform direct
+self-review and self-verification without external peer dispatch.
+
+## 5. Launch
+
+Invoke the `loop` skill with `<resolved interval> /wdi-autopilot <composed text from step 4>`. This
+starts the loop execution.
+
+## 6. Verify Immediate Execution
+
+Before finishing, verify that `/wdi-autopilot` was invoked in this same turn for the first iteration
+rather than remaining idle until the first cron interval tick. If it did not run immediately, invoke
+`/wdi-autopilot` now to start the first iteration.
+
+## 7. Report and Stop
+
+Report the resolved configuration (in-session mechanism, peer review status, active mandate ID, and
+loop interval), confirm that the loop is active, and stop. MUST NOT intervene in or micromanage
+subsequent loop iterations.