wdi-method 0.6.8 → 0.6.18

package/CHANGELOG.md

@@ -0,0 +1,213 @@
+# Changelog
+
+What changed in `wdi-method`, newest first. Every entry says what it means for a repo that already has
+the method installed — most often nothing beyond `npx wdi-method@latest update`.
+
+A version here is a **git tag**. `npm publish` is a separate, deliberate step (see
+[`CONTRIBUTING.md`](CONTRIBUTING.md)), so some versions exist as a tag and a GitHub release without ever
+having been served from npm. The registry always holds the newest published version, and a published
+version contains every fix below it.
+
+---
+
+## 0.6.18 — 2026-09-08
+
+- **This file.** The version history was only readable as `git log`, which is the wrong place to look for
+  it when you are deciding how carefully to read an `update` diff.
+- **The README had the validator count wrong.** It said twenty-seven; `validate.py` has run twenty-nine
+  named checks since `withdrawn-recorded` arrived in 0.6.14. It also now says what the validators treat as
+  corpus, which 0.6.17 changed.
+
+## 0.6.17 — 2026-09-08
+
+- **The corpus walker honours `.gitignore`.** The walk pruned only a hardcoded folder list, so a vendored
+  dependency tree inside an ignored folder was read as this product's corpus — one repo saw 172
+  `cites-resolve` findings from source code it had deliberately ignored. The ignored set is now computed
+  once per run (`git ls-files --others --ignored --exclude-standard --directory`), and the hardcoded list
+  stays as the fallback for a checkout that is not a git repository. `.gitignore` still cannot hide real
+  corpus: `corpus-in-git` fails when a folder the method commits is ignored.
+- **`timeline.py` no longer crashes on a capability that has tickets.** `cap_tickets()` returns
+  `(spec, ticket)` pairs and the span helper read each item as a ticket row, so generating the timeline
+  raised `AttributeError` and `/wdi-report progress` could not publish at all.
+
+**For a consuming repo:** `update`, then regenerate — a `timeline.md` or `report.md` written before this
+is dated and must not be read as current.
+
+## 0.6.16 — 2026-09-07
+
+- **A superseded mandate still stands for what it accepted.** `mandate-accept` asked a question about the
+  past — was there a mandate on the day this decision was accepted — and answered it with the mandate's
+  status *today*. Superseding a mandate, which `wdi-autopilot`'s own instructions call for when a run
+  ends, therefore turned every decision that run had accepted permanently red; and an `applied` decision
+  is frozen, so there was no repair the corpus was allowed to make. The check now reads the mandate's
+  state at the delegation date, and bounds the window by the **earlier** of `mandate.expires` and the date
+  of the decision that superseded it — a revoked delegation ends when it was revoked, whatever its
+  `expires` still says. `superseded_by` is read from the decision file's frontmatter as well as the
+  registry row, because the template puts it there.
+
+## 0.6.15 — 2026-09-07
+
+- The dangling-promise finding carries its own repair. `withdrawn-recorded` named the problem without
+  saying what to write, and a finding nobody can act on is a finding that gets switched off.
+
+## 0.6.14 — 2026-09-07
+
+- **New validator `withdrawn-recorded`:** a promise that was withdrawn stays in the registry and says who
+  withdrew it. Deleting the row loses the fact that it was ever promised.
+
+## 0.6.13 — 2026-09-07
+
+- A story id already scoped to its wave is not scoped twice — the pre-0.6 rename was double-prefixing ids
+  that had been written correctly.
+
+## 0.6.12 — 2026-09-07
+
+- Flattening a pre-rename wave is `wdi-upgrade`'s work, not a re-cut. The skill was inventing a new
+  decomposition where it should have been moving one that already existed.
+
+## 0.6.11 — 2026-09-07
+
+- `update` leaves a closed spec's folder where it is. Moving a finished spec's folder rewrote history for
+  nothing.
+
+## 0.6.10 — 2026-09-07
+
+- `update` reports the two things `wdi-upgrade` now has to move, instead of leaving them for a reader to
+  discover.
+
+## 0.6.9 — 2026-09-07
+
+- The TUI refuses a missing engine too, in step 2's place. The CLI had checked since 0.6.8; the
+  interactive path had not, and that is the path a first install actually takes.
+
+## 0.6.8 — 2026-09-07
+
+- **The G5 engines are the repo's own, invocable, and BMad's replacements are locked out.** `install` and
+  `update` refuse until `to-spec`, `to-tickets`, `implement`, `tdd`, `code-review` and `domain-modeling`
+  are in the repo; `wdi-build` invokes them itself, so `wdi-autopilot` can finish a spec unattended; and
+  thirteen BMad skills retired at G5 are denied model invocation. A spec also gets one predefined home,
+  `.scratch/<spec-id>-<slug>/`.
+
+**For a consuming repo:** the largest jump in the 0.6 line. The README section *"Moving a repo from 0.6.7
+or earlier to 0.6.8"* walks all four changes, and `npx wdi-method engines --fix` repairs what can be
+repaired without touching anything you wrote.
+
+## 0.6.7 — 2026-09-06
+
+- `plan-dates` reported nothing at all, because it raised before it could report; and a legacy story file
+  was looked for in the wrong folder.
+- A closed pre-rename wave stays visible to the RTM instead of disappearing from it.
+
+## 0.6.6 — 2026-09-06
+
+- **New validator `corpus-in-git`:** a folder the method commits MUST NOT be gitignored. A corpus git
+  cannot see is a corpus the clone lacks.
+- The git rule is stated where the bootstrap reads it, not only where the detail lives.
+
+## 0.6.5 — 2026-09-05
+
+- The README said three things that 0.6.2 through 0.6.4 had made untrue.
+
+## 0.6.4 — 2026-09-05
+
+- The test suite depended on the author's machine, and 0.6.3 failed CI because of it.
+
+## 0.6.3 — 2026-09-05
+
+- The ticket engines are required, and their config ships pre-answered — so `/setup-matt-pocock-skills` is
+  not part of getting started.
+- *"What now"* is answered after install and after update, in the README and in `wdi-help`.
+- Three real migrations, none of them `wdi-upgrade`'s: a mechanical rename, a printed warning, and a skill
+  that heals its own ledger.
+
+## 0.6.2 — 2026-09-05
+
+- **New skill `wdi-autopilot`:** one mandate, then every `FR` in scope delivered unattended, every answer
+  recorded in one ledger. It stops at one of three places — done, at capacity, or blocked — and one run
+  lands as one pull request. An adversarial review closed ten findings before release, two of them in the
+  validator.
+
+**For a consuming repo:** `update` renames a pre-0.6.2 ledger to `autopilot-<mandate-id>.md`. The content
+is never rewritten.
+
+## 0.6.1 — 2026-09-03
+
+- **New skill `wdi-explain-to-me`:** a decision briefing the owner reads, written in the owner's language.
+
+## 0.6.0 — 2026-09-03
+
+- **Two trees, one home per fact.** The working set points and the rendered page answers, so a human gets
+  a complete document while the corpus keeps no copies. This is the release the validators' rule against
+  comparing two copies of one fact comes from.
+- The units are renamed: wave and story are retired, `waves.yaml` becomes `specs.yaml`, and size decides
+  the spec.
+- The BMad engine layer below G5 is retired in favour of `to-spec`, `to-tickets` and `implement`;
+  `wdi-blueprint` wraps `domain-modeling` as its engine.
+- UX runs and **lands** at G2, breaking a deadlock where the container was never in its path.
+- A decision's first home is the document it governs, and no `DEC-` is mandatory.
+- The corpus is present tense, and stale is not a finding.
+- `wdi-review` stopped being a treadmill; gate *shape* and checklist *length* became separate knobs.
+
+**For a consuming repo:** run `wdi-upgrade` after updating, before any other skill. The validators read
+the new shape, and a corpus half in the old one answers them wrongly. The untagged 0.5.13 and 0.5.14
+bumps — the review panel dropping its two-CLI-family requirement, and the platform picker aligning with
+BMad — are included here.
+
+## 0.5.12 — 2026-08-22
+
+- Blueprint actor headings lose the orphaned separator a nameless actor left behind.
+
+## 0.5.11 — 2026-08-22
+
+- Version bump only; no method change.
+
+## 0.5.10 — 2026-08-19
+
+- The inventory engine littered the room it was asked to read.
+
+## 0.5.9 — 2026-08-19
+
+- The package ships no stack at all: a skeleton, and a skill that writes it. A stack baked into a generic
+  package is an assumption every consumer inherits.
+
+## 0.5.8 — 2026-08-19
+
+- `inventory.py`: the engine stays in the package, the stack moves to the room that owns it.
+
+## 0.5.7 — 2026-08-19
+
+- The method assumed a stack, and a path was only the visible half of that assumption.
+
+## 0.5.6 — 2026-08-19
+
+- The guard a real component actually needed, which the retired V24 could never have been.
+
+## 0.5.5 — 2026-08-19
+
+- V24 was unsatisfiable for every consumer, and the language sweep had missed nineteen strings.
+
+## 0.5.4 — 2026-08-19
+
+- `portability.md` was right about the path and wrong about everything else.
+
+## 0.5.3 — 2026-08-19
+
+- The 0.5.0 split was unreachable for the repos that needed it.
+- Python bytecode is kept out of the tarball — 0.5.2 shipped 123 kB of it, and a `.pyc` embeds the
+  absolute path it was compiled from.
+
+## 0.5.2 — 2026-08-19
+
+- **The direction was reversed:** a method change is authored *here* and proven against a fixture corpus
+  the registry scripts actually run against, instead of being promoted out of a live product. `promote`
+  became a rescue tool that refuses to run without `--rescue`.
+- An external audit of 0.5.0 found the `AGENTS.md` block calling the whole kit non-binding.
+- Bahasa Indonesia is swept out of the generic package; the installer's interface is English.
+- Included here: `.constitution/` becoming exactly two folders, `method/` and `project/` (0.5.0), and the
+  0.5.1 republish of a kit that had shipped pre-fix overlay content.
+
+## 0.3.0 — 2026-08-18
+
+- First public release: an interactive installer, a replaceable `AGENTS.md` method block, two language
+  settings asked separately, and `.constitution/project/` as the custom room `update` never overwrites and
+  `promote` never publishes.

package/README.md

@@ -29,11 +29,10 @@ page it is on.
 
 ## Install
 
-Three steps, in this order. The first is required before step 3 will run; the second can wait until
-**Both are required, and the installer refuses without either.** BMad has always been checked; the ticket
-engines are checked too, because every repo that learned they were missing learned it inside `wdi-build`
-with a spec already open. `--skip-engines-check` is the escape for the two cases that earn it: CI, and a
-repo that will never reach G5.
+Three steps, in this order, and **step 3 refuses until steps 1 and 2 are done** — through the TUI and
+through `--yes` alike. BMad has always been checked; the engines are checked too, because every repo that
+learned they were missing learned it inside `wdi-build` with a spec already open. `--skip-engines-check`
+is the escape for the two cases that earn it: CI, and a repo that will never reach G5.
 
 **1. BMad Method** — in the product repo, picking the same agents you will give this installer:
 
@@ -380,12 +379,17 @@ A `DEC-` freezes when it is applied. A change of mind produces a new one; it nev
 
 ## The mechanical half
 
-`validate.py` runs twenty-seven named validators — `goal-has-fr`, `cites-resolve`, `no-cycles`,
+`validate.py` runs twenty-nine named validators — `goal-has-fr`, `cites-resolve`, `no-cycles`,
 `id-allocated-once`, and the rest, each named for the thing it checks — over the registries and the
 corpus, and `inventory.py` derives the three inventories from code and reports the difference against the
 plan without patching either side. There is no validator that compares two copies of one fact, because
 the corpus keeps no copies.
 
+**The corpus is what git tracks.** A vendored dependency tree inside a gitignored folder is not this
+product's writing, and since 0.6.17 the walk skips what the repo ignores. The other half of that rule is
+`corpus-in-git`: a folder the method commits MUST NOT be ignored, so `.gitignore` cannot be used to quiet
+a finding about a file that really is yours.
+
 The validators exist because prose that nothing checks is prose that gets contradicted by the first
 person in a hurry. Every one of them also states **the state in which it does not apply** — a rule that
 demands a trace before the trace can exist is a rule that gets switched off, and a validator nobody
@@ -514,6 +518,9 @@ Open an [issue](https://github.com/wiradigitalid/wdi-method/issues) for a bug or
 [`CONTRIBUTING.md`](CONTRIBUTING.md) before sending a pull request — it explains where a change belongs,
 how versioning works here, and what to check before publishing.
 
+[`CHANGELOG.md`](CHANGELOG.md) is what changed in each version, and what each change means for a repo
+that already has the method installed. Read it before an `update` that crosses more than a patch.
+
 ## License
 
 MIT — see [LICENSE](LICENSE). Requires Node 20+ and [uv](https://docs.astral.sh/uv/) for the Python

package/bin/wdi-method.js

@@ -1234,6 +1234,78 @@ function setLanguagePolicy(target, { docLanguage, docFilenameLanguage, chosen })
 // move, because moving it takes a decision about meaning: which PRD an `FR` belongs to, whether a
 // sentence was an assumption or a constraint. The `wdi-upgrade` skill does that half. This only
 // DETECTS it, cheaply, so the summary can say how much is waiting and where.
+/** Specs whose folder is not where the convention puts it — and that are still WORK.
+ *
+ * A closed spec is exempt, and one measured repo is why: ten closed specs, none open. Reporting all
+ * ten would ask somebody to move ten folders of finished work and repoint every cite into them, for
+ * nothing — `spec_folder` still resolves, and a closed spec's ticket file is already allowed to be
+ * gone. The same exemption `ticket-status-one-home` grants, for the same reason: the convention binds
+ * work, not the record of work that is done.
+ *
+ * Scanned line by line rather than parsed: this installer has no YAML reader, and both the flat
+ * `specs:` shape and the pre-rename `waves:` one open a row the same way.
+ */
+function specsOutsideScratch(text) {
+  const out = [];
+  let id = "";
+  let status = "";
+  let folder = "";
+  const flush = () => {
+    if (id && folder && status !== "closed" && !folder.startsWith(".scratch/")) out.push(id);
+    id = "";
+    status = "";
+    folder = "";
+  };
+  for (const line of text.split(/\r?\n/)) {
+    const row = /^\s{2}-\s+id:\s*(\S+)/.exec(line);
+    if (row) {
+      flush();
+      id = row[1].replace(/['"]/g, "");
+      continue;
+    }
+    if (!id) continue;
+    const st = /^\s+status:\s*(\S+)/.exec(line);
+    if (st && !status) status = st[1].replace(/['"]/g, "");
+    const sf = /^\s+spec_folder:\s*(\S+)/.exec(line);
+    if (sf && !folder) folder = sf[1].replace(/['"]/g, "");
+  }
+  flush();
+  return out;
+}
+
+/** Specs still in the pre-rename plan shape that are NOT closed — the ones with work left in them.
+ *
+ * Same scanner shape as `specsOutsideScratch`, and the same exemption for the same reason: the
+ * convention binds work, not the record of work that is done.
+ */
+function specsInLegacyShape(text) {
+  const out = [];
+  let id = "";
+  let status = "";
+  let legacy = false;
+  const flush = () => {
+    if (id && legacy && status !== "closed") out.push(id);
+    id = "";
+    status = "";
+    legacy = false;
+  };
+  for (const line of text.split(/\r?\n/)) {
+    const row = /^\s{2}-\s+id:\s*(\S+)/.exec(line);
+    if (row) {
+      flush();
+      id = row[1].replace(/['"]/g, "");
+      if (/^W\d+$/.test(id)) legacy = true;
+      continue;
+    }
+    if (!id) continue;
+    const st = /^\s+status:\s*(\S+)/.exec(line);
+    if (st && !status) status = st[1].replace(/['"]/g, "");
+    if (/^\s+(epics|stories):/.test(line)) legacy = true;
+  }
+  flush();
+  return out;
+}
+
 function pendingUpgrades(target) {
   const has = (...p) => fs.existsSync(path.join(target, ...p));
   const read = (...p) => (has(...p) ? fs.readFileSync(path.join(target, ...p), "utf8") : "");
@@ -1247,7 +1319,32 @@ function pendingUpgrades(target) {
   };
   const items = [];
   if (has(".control", "registry", "requirements.yaml")) items.push("requirements.yaml → goals.yaml + requirements-<slug>.yaml");
-  if (/^\s*-\s*id:\s*W\d+|^\s*(epics|stories):/m.test(read(".control", "registry", "specs.yaml"))) items.push("specs.yaml rows still W<n>/epics/stories (wdi-build re-cuts)");
+  // The file the engines actually read. `/setup-matt-pocock-skills` writes its own answer here — no
+  // `specs.yaml`, no predefined path — and `seedAgentDocs` will not overwrite a file the product owns,
+  // so without this probe the repo never learns why its tickets scatter.
+  if (has("docs", "agents", "issue-tracker.md")
+      && !read("docs", "agents", "issue-tracker.md").includes("seeded by `wdi-method`")) {
+    items.push("docs/agents/issue-tracker.md is not the method's answer (npx wdi-method engines --fix)");
+  }
+  const strays = specsOutsideScratch(read(".control", "registry", "specs.yaml"));
+  if (strays.length) {
+    items.push(`spec_folder outside .scratch/<spec-id>-<slug>/ on ${strays.join(", ")} `
+               + `(the folder moves, then its cites)`);
+  }
+  // Reported only where it is still WORK. A closed pre-rename wave is read correctly (0.6.7 taught
+  // `Corpus.tickets()` to flatten `epics`/`stories` in memory), its `W<n>` id is a retired alias by
+  // design, and its ticket files are already allowed to be gone. Nothing there is waiting to move.
+  //
+  // Until 0.6.11 this fired on every legacy row and pointed at `wdi-build` to "re-cut" it. That
+  // instruction outlived the design it came from: `wdi-build` Phase 2 invokes `to-spec`/`to-tickets`
+  // to write a NEW contract and publish new tickets, and has no mode that converts an old wave.
+  // Three repos carrying twenty, forty-five and ten closed legacy rows were each told to run a skill
+  // that would answer "not mine" and stop.
+  const legacyOpen = specsInLegacyShape(read(".control", "registry", "specs.yaml"));
+  if (legacyOpen.length) {
+    items.push(`${legacyOpen.join(", ")} still in the W<n>/epics/stories shape and not closed `
+               + `(flattened into tickets, id kept as its retired alias)`);
+  }
   if (/^## (Executive Summary|Vision|Assumptions|Prerequisites)\s*$/m.test(read(".what", "_product-brief", "brief.md"))) items.push("brief.md in the 14-section shape");
   // Sections by NAME: the numbers moved between kits (Non-Goals was §7 in one, §5 in the next).
   if (anyIn(".what/_prd", "prd.md", /^## (\d+\.\s*)?(Document Purpose|Glossary|Non-Goals|Open Questions|Assumptions Index)\b|\*\*Proof of done:\*\*/m)) items.push("a prd.md in the 12-section shape, or with FR blocks");
@@ -1807,6 +1904,17 @@ async function runWizard(pre) {
     process.exit(1);
   }
 
+  // Step 2, refused in step 2's place. This used to be a line in the Detected note and nothing more,
+  // so an interactive install or update sailed past a repo with no engines in it — the same repo the
+  // `--yes` path refuses. The order matters as much as the stop: BMad is step 1, so a repo missing
+  // both is told about BMad first rather than sent to install the second thing.
+  const engineGate = enginesReport(target);
+  if (!engineGate.present && !pre.skipEngines) {
+    p.note(enginesMissingMessage(engineGate.missing), "Engines next");
+    p.outro("Install them into this repo, then run this again: npx wdi-method");
+    process.exit(1);
+  }
+
   let first = !hasWdi;
   if (hasWdi) {
     const update = cancelIf(

package/kit/.constitution/method/document/corpus-guide.md

@@ -63,6 +63,47 @@ decision or a PRD MAY point into it. Research, brainstorming, forge, and PRFAQ r
 A run folder MUST NOT be deleted **while anything still needs it** — the `update` intents re-read the original
 inputs in place. "Never deleted" is not the rule; the rule is a **retirement condition**, and it is below.
 
+**What git ignores is not corpus.** A vendored upstream checkout kept for reading, a scratch download, a
+build cache — if the product excludes it from git it is in no clone, nobody curates it, and the validators
+do not read it. The other half of that rule is `corpus-in-git`: a folder the method itself keeps MUST NOT be
+excluded, and the two lock together — material is either in git and checked, or ignored and not corpus. What
+`.gitignore` MUST NOT be used for is quieting a finding about a file that really is this product's.
+
+### A withdrawn promise STAYS in the registry
+
+A `BG` · `CAP` · `FR` · `NFR` · `UC` the product stops promising is marked, never deleted:
+
+```yaml
+  - id: CAP-8
+    title: "Publish an order as a public page"
+    status: withdrawn
+    withdrawn_by: DEC-026
+```
+
+**Why the row stays.** One repo deleted two withdrawn capabilities and paid for it in twelve
+`refs-resolve` findings: eight `DEC-` rows still named them in `serves:`, and six of those eight
+genuinely served them at the time. The other repair — editing those decisions — is refused by the
+section above: a `DEC-` is a record of what happened, and a retired name inside one is a fact about
+the past.
+
+**So a withdrawn row is read two ways, and both matter.** It is still **defined**: every old
+reference resolves, and `id-allocated-once` still refuses the number to anything else — an id is
+allocated once, withdrawal included. It is no longer **promised**: no `UC` is owed, no ticket, no RTM
+row, and `promise_progress` is not dragged down by something nobody promises any more.
+
+**Two rules keep it honest**, and `withdrawn-recorded` is what enforces both:
+
+- `withdrawn_by` MUST name a `DEC-` that exists. Retiring an id is decision-worthy on this method's
+  own terms — the **ID chain** row under § *Landing that MUST be confirmed first* says so outright —
+  and without the pointer `withdrawn` is only a word that quiets a validator.
+- A live row MUST NOT hang off a withdrawn one. An `FR` under a withdrawn `CAP` still promises
+  something whose capability nobody promises: withdraw it too, or move it under something live.
+  Withdrawal that takes half a chain with it silently is worse than the deletion it replaced, because
+  deletion at least went red.
+
+`wdi-product` owns the edit, because it owns the row. The withdrawal itself goes through
+`wdi-decision` first — the `DEC-` is what `withdrawn_by` points at.
+
 ## Who lands what
 
 There is no separate placement skill. A skill lands the output of the layer **it owns**, and the landing is