wdi-method 0.6.24 → 0.6.25

package/CHANGELOG.md

@@ -10,6 +10,18 @@ version contains every fix below it.
 
 ---
 
+## [0.6.25] - 2026-09-19
+
+### Changed
+
+- **Ephemeral Subagent Handoff Lifecycle & Mandatory Scratch Deletion:** `wdi-daily-what-to-build` mandates that subagent handoff packets, raw CLI logs, and review outputs are disposable execution scratch (not product evidence). Review outputs are strictly scoped to `<slug>-review-output.md`, and all scratch files under `.work/wdi-daily-what-to-build/` MUST be deleted upon coordinator fold-in and stamping. Raw review files MUST NOT be staged, committed, or archived into `.scratch/` or `.archive/`.
+- **Distillation Scope Extension:** `wdi-build` Phase 4 Distillation checklist explicitly requires verifying and cleaning lingering triage scratch under `.work/wdi-daily-what-to-build/` before closing a spec.
+- **Selective Staging Discipline on Autopilot:** `wdi-autopilot` explicitly prohibits broad wildcard staging (`git add .`, `git add -A`, `git add --all`). Staging is restricted to application code, tests, `.control/`, and `.scratch/<active-spec>/`. Ephemeral execution scratch under `.work/` is barred from the run branch, and mandate finish requires a clean sweep of temporary `.work/` files.
+- **Enriched Ephemeral Precondition Guidance:** `wdi-daily-what-to-test` enriches Step 0.4 halt guidance when untracked files match `.work/` scratch, providing direct remediation instructions instead of generic dirty tree errors.
+- **Scaffold Ignore for Raw Tool Dumps:** `bin/wdi-method.js` now automatically ensures `.work/*.txt`, `.work/*.log`, and `.work/tmp/` are ignored in `.gitignore` on install/update, preventing raw CLI redirection dumps from causing dirty working tree preflight halts.
+
+**What a repo that already has the method installed does about it.** Run `npx wdi-method@latest update`. It updates the daily skills with strict scratch cleanup and staging guardrails, and ensures ephemeral tool dumps in `.work/` are ignored in `.gitignore`.
+
 ## [0.6.24] - 2026-09-18
 
 ### Added

package/bin/wdi-method.js

@@ -917,6 +917,23 @@ function ensureGitignoreSmoke(target) {
   }
 }
 
+function ensureGitignoreScratchDumps(target) {
+  const gitignorePath = path.join(target, ".gitignore");
+  const rules = [".work/*.txt", ".work/*.log", ".work/tmp/"];
+  if (fs.existsSync(gitignorePath)) {
+    const content = fs.readFileSync(gitignorePath, "utf8");
+    const lines = content.split(/\r?\n/).map((l) => l.trim());
+    const missing = rules.filter((r) => !lines.includes(r) && !lines.includes(`/${r}`));
+    if (missing.length === 0) return;
+    const separator = content.endsWith("\n") ? "" : "\n";
+    fs.writeFileSync(gitignorePath, `${content}${separator}# Ephemeral execution scratch and raw tool dumps\n${missing.join("\n")}\n`, "utf8");
+    note(`added ${missing.join(", ")} to .gitignore`);
+  } else {
+    fs.writeFileSync(gitignorePath, `# Ephemeral execution scratch and raw tool dumps\n${rules.join("\n")}\n`, "utf8");
+    note(`created .gitignore with ${rules.join(", ")}`);
+  }
+}
+
 function seedDailyTierScaffold(target) {
   const control = path.join(target, ".control");
   if (!fs.existsSync(control)) return;
@@ -949,6 +966,7 @@ function seedDailyTierScaffold(target) {
 
   ensureGitignoreCustomDispatch(target);
   ensureGitignoreSmoke(target);
+  ensureGitignoreScratchDumps(target);
 
   const localDispatchDest = path.join(control, "custom-dispatch.yaml");
   if (!fs.existsSync(localDispatchDest) && fs.existsSync(exampleSrc)) {

package/kit/skills/wdi-autopilot/SKILL.md

@@ -150,6 +150,11 @@ only on one machine. What an iteration MUST NOT do is start a metered runner: no
 marked ready, no re-run requested on a ticket that is not finished. Evidence during the run is the **local**
 suite, which `wdi-build` Phase 3 Step 2 already requires and which costs nothing. See § Cycle-end CI.
 
+**Selective Staging Discipline:** Staging MUST be strictly selective (`git add <path>`). The coordinator
+and builders MUST NOT use broad wildcard staging (`git add .`, `git add -A`, `git add --all`). Staging MUST include
+only application code, tests, `.control/`, and `.scratch/<active-spec>/`. Ephemeral execution scratch under `.work/`
+MUST NOT be staged or committed into the run branch.
+
 **Runnable** means: not listed under Blocked in `## Resume`, and not parked by the mandate. A blocked row is
 retried only when the owner unblocks it or a later change removes the cause — and the ledger row that
 recorded the block says which. A run that re-picks a blocked step spends the whole mandate window on it, and
@@ -401,10 +406,13 @@ When § The work table reaches § Finish:
    (e.g. `ci_override: local-only-approved-by: "<Person, Date>"` per `.constitution/method/ci-guide.md`),
    the run MUST NOT mark the draft PR ready (`gh pr ready`). The PR MUST remain as a Draft, no cloud runner
    is awaited, and the final output report explicitly states: *"locally verified; cloud verification intentionally deferred by mandate"*.
-5. **Cancel the loop cleanly:** in Claude Code, inspect scheduled jobs via `CronList`, identify the job firing
+5. **Clean ephemeral execution scratch:** delete all temporary scratch files under `.work/` created during
+   this mandate run (such as temporary triage outputs, diff dumps, and scratch files). Ephemeral execution scratch
+   MUST NOT survive the mandate finish or be left on the run branch.
+6. **Cancel the loop cleanly:** in Claude Code, inspect scheduled jobs via `CronList`, identify the job firing
    `/wdi-autopilot`, and call `CronDelete` on its task ID to eliminate zombie loop firings; elsewhere, call the platform's
    loop cancellation mechanism or inform the owner that the loop has completed its mandate and has nothing left to do.
-6. Write the final report as the Output below. The owner merges; the run never does.
+7. Write the final report as the Output below. The owner merges; the run never does.
 
 ## Red Flags — STOP
 
@@ -415,6 +423,7 @@ When § The work table reaches § Finish:
 - Closing a spec while the run branch's own full suite is red, or marking the PR ready while CI is red
 - **Starting a cloud run before § Finish** — a PR marked ready mid-run, a workflow dispatched to check a
   ticket, or an intermediate push left free to match a bare `on: push` trigger
+- Staging with broad wildcards (`git add .`, `git add -A`, `git add --all`) or committing ephemeral `.work/` scratch into the run branch
 - Answering the quota problem by committing less often, instead of by fixing what a push triggers
 - Spending the one cloud run on a head whose local suite was never run
 - Re-merging a branch whose merge was reverted, instead of cutting a new one

package/kit/skills/wdi-build/SKILL.md

@@ -347,6 +347,8 @@ out.
 4. **Distillation.** Every applicable row of the ownership table in `corpus-guide.md` has been landed by its
    owner. Anything durable in the spec folder leaves it now, or dies with it — **the ticket files included.**
    Their prose is working output; what survives is the index in `specs.yaml` and whatever the checklist routed.
+   Distillation also encompasses deleting any lingering ephemeral triage scratch under `.work/wdi-daily-what-to-build/`
+   for this spec. A spec MUST NOT close with uncleaned `.work/` scratch files.
 5. **RTM green.** Every traceability row for this spec is closed. New risks are in the risk register with an
    owner.
 6. Mark the spec `status: closed` in `specs.yaml`.

package/kit/skills/wdi-daily-what-to-build/SKILL.md

@@ -108,6 +108,8 @@ Reviewer resolution:
   stop and report immediately (fail-closed).
 - Dispatch execution & process discipline:
   - Cap shell-out dispatch at a hard wall-clock limit (default 600s, or `timeout_s` if defined in `custom-dispatch.yaml`).
+  - If review output is written to disk, it MUST be scoped to the slug: `.work/wdi-daily-what-to-build/<slug>-review-output.md`
+    (MUST NOT use un-scoped generic names like `terra-review-output.md` or `review.md`).
   - Run backgrounded with polling or synchronous wait. If the timeout expires, or the process exits non-zero,
     or the output file cannot be read: terminate the entire process tree by its PID (MUST NOT use process name-based
     killing). Record in the final report: `peer review: fell back to coordinator self-review after timeout/failure`.
@@ -137,6 +139,18 @@ under the coordinator's orchestration, the coordinator writes the `spec_reviewed
 ```
 The coordinator MUST NOT delegate registry stamping to external shell-out processes.
 
+### Clean Ephemeral Review Artifacts (Mandatory Deletion)
+Handoff packets, raw reviewer transcripts, and shell redirection logs generated during this triage pass are
+disposable execution scratch, NOT product evidence. Once the advisory review is evaluated, folded into the draft,
+and stamped in `specs.yaml`:
+- The coordinator MUST delete all scratch files created under `.work/wdi-daily-what-to-build/` for this `<slug>`
+  (including `<slug>-second-opinion.md`, `<slug>-review-output.md`, and any temporary CLI stdout/stderr dumps such
+  as `.work/*.txt` or `.work/*.log`).
+- Handoff packets and raw review text MUST NOT be left in the working tree, MUST NOT be staged or committed to git,
+  and MUST NOT be archived or moved into `.scratch/` or `.archive/` (distillation deletes scratch; archiving is
+  reserved for completed specification documents).
+- A triage pass MUST NOT hand off with uncleaned `.work/wdi-daily-what-to-build/` artifacts on disk.
+
 ### Validation
 Run canonical validation using `uv`:
 ```bash
@@ -151,5 +165,6 @@ uv run .constitution/method/scripts/validate.py --generate --baseline
 ## 6. Stop and hand off
 
 Report what now exists (or that the notes were green) and its file path. State explicitly whether `spec_reviewed`
-was stamped or if peer review fell back to coordinator self-review. MUST NOT commit, push, or start `wdi-autopilot`
-in this same run — state that as the next step and wait for the maintainer to request it.
+was stamped or if peer review fell back to coordinator self-review, and confirm that all ephemeral `.work/` scratch
+artifacts have been deleted. MUST NOT commit, push, or start `wdi-autopilot` in this same run — state that as the
+next step and wait for the maintainer to request it.

package/kit/skills/wdi-daily-what-to-test/SKILL.md

@@ -32,7 +32,10 @@ closed tickets and specs, never invented from memory.
    immediately and report to the maintainer; per `.constitution/method/branch-guide.md`, MUST NOT guess
    or silently fall back to `main`.
 4. Verify the primary working tree is clean (`git status --porcelain`). If uncommitted changes exist,
-   stop and report without modifying git state.
+   stop and report without modifying git state. If the uncommitted files match known ephemeral triage scratch
+   under `.work/` (such as uncleaned `.work/wdi-daily-what-to-build/` packets or raw CLI dump logs), explicitly
+   report them as abandoned scratch from a previous run and provide the exact remediation command
+   (e.g. `Remove-Item <paths>`) rather than an ambiguous dirty tree error.
 
 ## 1. Sync (Fast-Forward Only)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wdi-method",
-  "version": "0.6.24",
+  "version": "0.6.25",
   "description": "WDI Method — software delivery method that wraps BMad",
   "type": "module",
   "bin": {