yadflow 3.18.1 → 4.0.0-next.1

package/cli/setup.mjs

@@ -5,36 +5,23 @@ import os from 'node:os';
 import {
   c, log, step, guide, ok, info, warn, hand, fail, ask, askYesNo, run, has,
   exists, readJSON, readJSONStrict, writeJSON,
+  writeProductConfig,
 } from './lib.mjs';
-import { VERSION, IDE_TARGETS, PROJECT_FILES, DESIGN_TOOLS, DESIGN_PRIMARY, TESTING_TOOLS, TESTING_PRIMARY, LEARNING_TOOLS, LEARNING_PRIMARY } from './manifest.mjs';
+import { VERSION, IDE_TARGETS, IDE_AGENTS, DEFAULT_IDE_TARGETS, PROJECT_FILES, DESIGN_TOOLS, DESIGN_PRIMARY, TESTING_TOOLS, TESTING_PRIMARY, LEARNING_TOOLS, LEARNING_PRIMARY , productConfigPath } from './manifest.mjs';
 import {
-  moduleActions, repoActions, hubActions, hookActions, authorsActions,
+  moduleActions, repoActions, productActions, hookActions,
   legacyModuleActions, removedModuleActions, legacyRepoActions, legacyHubActions,
   safeIdeTargetsFor, detectedIdeTargetStateFor, recordManagedWrites,
 } from './plan.mjs';
-import { validateLogin, rolesForScope } from './platform.mjs';
+import { modeFields, modeOf } from './mode.mjs';
+import { recordActor } from './skip.mjs';
+import { loadSkillBindings, stepSkills } from './epic-state.mjs';
 
 // Parse a comma/space separated list into a clean, deduped array of trimmed tokens.
 export function parseList(s) {
   return [...new Set((s || '').split(/[,\s]+/).map((x) => x.trim()).filter(Boolean))];
 }
 
-// Parse a per-scope roles spec — `"hub=owner,reviewer backend=domain-owner"` — into the roster's
-// per-scope map `{ hub: ['owner','reviewer'], backend: ['domain-owner'] }`. Tokens are whitespace
-// separated; each is `scope=role[,role...]`. Malformed tokens (no `=`, empty scope/roles) are skipped.
-export function parseRolesSpec(s) {
-  const out = {};
-  for (const tok of (s || '').split(/\s+/).map((x) => x.trim()).filter(Boolean)) {
-    const eq = tok.indexOf('=');
-    if (eq < 0) continue;
-    const scope = tok.slice(0, eq).trim();
-    const roles = parseList(tok.slice(eq + 1));
-    if (!scope || !roles.length) continue;
-    out[scope] = [...new Set([...(out[scope] || []), ...roles])];
-  }
-  return out;
-}
-
 // Programmatic setup is strict; interactive setup keeps asking until it receives at least one valid
 // canonical target. Both paths return the same trimmed, ordered, deduplicated representation.
 export async function selectIdeTargets(root, provided, asker = ask) {
@@ -42,9 +29,14 @@ export async function selectIdeTargets(root, provided, asker = ask) {
   const detected = detectedIdeTargetStateFor(root);
   const present = detected.targets;
   for (const unsafe of detected.unsafe) warn(`${unsafe.message}; excluded from IDE defaults`);
-  const def = (present.length ? present : ['.claude']).join(',');
+  // Detected directories win: a project that already has `.cursor/` gets it offered back, and is not
+  // talked into a default it did not choose. Only a project with NO agent directory sees the default.
+  const def = (present.length ? present : DEFAULT_IDE_TARGETS).join(',');
   for (;;) {
-    const answer = await asker(`IDE targets to install ${c.dim('(comma-separated: ' + IDE_TARGETS.join(', ') + ')')}`, def);
+    // Each target is listed with the agents that actually read it, because the directory name does not
+    // say. A Codex or Gemini CLI user shown a bare `.agents` has no way to know it is the one for them.
+    const menu = IDE_TARGETS.map((t) => `${t} = ${(IDE_AGENTS[t] || []).join(', ')}`).join('; ');
+    const answer = await asker(`IDE targets to install ${c.dim('(comma-separated — ' + menu + ')')}`, def);
     if (answer === undefined || answer === null) throw new Error('IDE target selection ended before a valid choice was provided');
     const values = String(answer ?? '').split(',').map((s) => s.trim()).filter(Boolean);
     try {
@@ -63,22 +55,22 @@ export function detectPlatform(remoteUrl = '') {
 }
 export const gitHead = (cwd) => run('git', ['rev-parse', 'HEAD'], { cwd }).stdout || null;
 
-// Containment: a repo path must live inside the WORKSPACE — the hub root's parent. The standard
-// multi-repo layout puts the code repos BESIDE the hub, not under it (project/{product,backend,frontend}),
-// so `../backend` has to register; containing to the hub root instead forced separate git repos to nest
-// inside the hub's own repo (issue #129). A nested path (demo-repos/api) still works.
+// Containment: a repo path must live inside the WORKSPACE — the Product root's parent. The standard
+// multi-repo layout puts the code repos BESIDE the Product, not under it (project/{product,backend,frontend}),
+// so `../backend` has to register; containing to the Product root instead forced separate git repos to nest
+// inside the Product's own repo (issue #129). A nested path (demo-repos/api) still works.
 //
 // The bound stays real: the registry path is later joined and executed against (repomix cwd,
 // .coderabbit.yaml + CI wiring), and even the read-only remote probe must not run against an arbitrary
 // outside path — so `../../elsewhere` and absolute-outside paths are still rejected. The path.sep-suffixed
 // compare avoids the /project vs /project-evil prefix trap, now one level up at the workspace.
-// A sibling of the hub (../product-evil) is, correctly, indistinguishable from ../backend: both are
-// ordinary workspace members. The workspace DIRECTORY ITSELF (`..`) is not: it contains the hub, so
-// registering it as a code repo would point repomix and the CI writes at the whole tree. Only the hub
+// A sibling of the Product (../product-evil) is, correctly, indistinguishable from ../backend: both are
+// ordinary workspace members. The workspace DIRECTORY ITSELF (`..`) is not: it contains the Product, so
+// registering it as a code repo would point repomix and the CI writes at the whole tree. Only the Product
 // root itself (a monorepo, `.`) and strict descendants of the workspace pass.
 //
-// Place the hub one level below the workspace root (project/product), not directly in $HOME — the
-// workspace is the trust boundary, and a shallow hub makes every sibling of it registerable.
+// Place the Product one level below the workspace root (project/product), not directly in $HOME — the
+// workspace is the trust boundary, and a shallow Product makes every sibling of it registerable.
 export function insideWorkspace(root, rpath) {
   const projectRoot = path.resolve(root);
   const parent = path.dirname(projectRoot);
@@ -87,145 +79,19 @@ export function insideWorkspace(root, rpath) {
   return resolved === projectRoot || resolved.startsWith(workspace + path.sep);
 }
 
-// Validate + record one code repo into the registry (the testable half of the connect loop).
-// A path that is not a git repository is rejected and NOTHING is written — a registry entry with
-// syncedHead:null would only surface later as an unexplained "unknown status" in the CI gates.
-// Grant per-repo roles to roster members by writing into each person's `roles[<repo>]` array in
-// hub.json. `grants` maps a role -> the yad names that hold it for this repo. A name that is not in
-// the roster is warned about and skipped (the roster is the source of identity). Idempotent.
-export function addRepoRoles(root, repo, grants = {}) {
-  const hubPath = path.join(root, PROJECT_FILES.hubConfig);
-  const hub = readJSON(hubPath, null);
-  if (!hub || !Array.isArray(hub.roster)) return;
-  const byName = new Map(hub.roster.map((e) => [e.name, e]));
-  let touched = false;
-  for (const [role, names] of Object.entries(grants)) {
-    for (const nm of names) {
-      const entry = byName.get(nm);
-      if (!entry) { warn(`'${nm}' is not in the roster — skipped ${role} for ${repo}`); continue; }
-      // Normalize to the per-scope map, migrating the legacy shapes: a flat array or a single
-      // `role` string both become hub roles so nothing is lost.
-      if (!entry.roles || typeof entry.roles !== 'object' || Array.isArray(entry.roles)) {
-        const hub = Array.isArray(entry.roles) ? entry.roles : (entry.role ? [entry.role] : []);
-        entry.roles = hub.length ? { hub } : {};
-        delete entry.role;
-      }
-      const list = Array.isArray(entry.roles[repo]) ? entry.roles[repo] : [];
-      if (!list.includes(role)) { list.push(role); touched = true; }
-      entry.roles[repo] = list;
-    }
-  }
-  if (touched) writeJSON(hubPath, hub);
-}
-
-// Normalize a roster entry's roles in place to the per-scope map, migrating the two legacy shapes
-// (a flat array, or a single `role` string) into `roles.hub` so nothing is lost. Mirrors the
-// migration addRepoRoles does; pulled out so upsert/remove share it.
-function normalizeRoles(entry) {
-  if (!entry.roles || typeof entry.roles !== 'object' || Array.isArray(entry.roles)) {
-    const hub = Array.isArray(entry.roles) ? entry.roles : (entry.role ? [entry.role] : []);
-    entry.roles = hub.length ? { hub } : {};
-    delete entry.role;
-  }
-  return entry.roles;
-}
-
-// Build the hub.json object for a (re)configure write, preserving user-owned identity data the wizard
-// does not re-collect: top-level `verified_authors` (and any other existing fields), plus a previously
-// populated `roster` when this run collected none (solo re-runs skip the reviewer loop). Never blanks a
-// non-empty roster; never drops verified_authors. Mirrors the safe { ...cur } merge on the keep path.
-// Trade-off (deliberate, fail-safe): a reconfigure can no longer EMPTY a populated roster — collecting
-// zero reviewers keeps the existing entries. To actually remove members, use `yad roster remove` (or
-// edit hub.json directly); this flow only ever grows or replaces the roster, never silently clears it.
+// Build the hub.json object for a (re)configure write: the fields this run collected, laid over the
+// existing file so nothing the wizard does not ask about is dropped. Mirrors the safe { ...cur } merge
+// on the keep path. That includes a `roster` or `verified_authors` an older release wrote (E62): the
+// wizard no longer collects or reads either, and it never deletes them — `yad doctor` names them as
+// unused instead.
 export function buildReconfiguredHub(cur, fields) {
-  const { roster, ...rest } = fields;
-  const keptRoster = (Array.isArray(roster) && roster.length)
-    ? roster
-    : (Array.isArray(cur?.roster) ? cur.roster : []);
-  return { ...(cur || {}), ...rest, roster: keptRoster };
-}
-
-// Upsert one roster member into hub.json, keyed by `login`. Deep-merges the per-scope `roles` map so
-// scopes the caller did not name are preserved; sets `name`/`email` when given; validates the login
-// against the hub (warn-only — a miss flags `unverified`, `checked:false` skips silently). Creates the
-// hub.json shell if absent. Returns { entry, created }.
-export function upsertRosterEntry(root, { login, name, email, roles = {}, platform } = {}) {
-  if (!login) { warn('roster upsert needs a login — skipped'); return { entry: null, created: false }; }
-  const hubPath = path.join(root, PROJECT_FILES.hubConfig);
-  const hub = readJSON(hubPath, null) || { platform: platform && platform !== 'none' ? platform : null, bridge_enabled: false, bridge: false, default_branch: 'main', roster: [] };
-  if (!Array.isArray(hub.roster)) hub.roster = [];
-  let entry = hub.roster.find((e) => e.login === login);
-  const created = !entry;
-  if (!entry) { entry = { login, name: name || login, roles: {} }; hub.roster.push(entry); }
-  if (name) entry.name = name;
-  if (email) entry.email = email;
-  normalizeRoles(entry);
-  for (const [scope, list] of Object.entries(roles || {})) {
-    const cur = Array.isArray(entry.roles[scope]) ? entry.roles[scope] : [];
-    entry.roles[scope] = [...new Set([...cur, ...list])];
-  }
-  if (email && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) warn(`'${email}' does not look like an email address`);
-  const plat = platform || hub.platform;
-  if (plat && plat !== 'none') {
-    const v = validateLogin(plat, login);
-    if (v.checked && !v.exists) { warn(`'${login}' not found on ${plat} — saved as unverified`); entry.unverified = true; }
-    else if (v.checked && v.exists) { ok(`verified ${login} on ${plat}`); delete entry.unverified; }
-  }
-  writeJSON(hubPath, hub);
-  return { entry, created };
+  return { ...(cur || {}), ...fields };
 }
 
-// Inverse of addRepoRoles: drop the named role(s) from a member's `roles[<repo>]` scope, removing the
-// scope key when it empties. Member is found by yad `name` (matching addRepoRoles). Idempotent.
-export function removeRepoRole(root, name, repo, roles = []) {
-  const hubPath = path.join(root, PROJECT_FILES.hubConfig);
-  const hub = readJSON(hubPath, null);
-  if (!hub || !Array.isArray(hub.roster)) return;
-  const entry = hub.roster.find((e) => e.name === name);
-  if (!entry) { warn(`'${name}' is not in the roster — nothing to revoke for ${repo}`); return; }
-  normalizeRoles(entry);
-  const cur = Array.isArray(entry.roles[repo]) ? entry.roles[repo] : [];
-  const next = cur.filter((r) => !roles.includes(r));
-  if (next.length === cur.length) return; // nothing removed
-  if (next.length) entry.roles[repo] = next; else delete entry.roles[repo];
-  writeJSON(hubPath, hub);
-}
-
-// Keep repos.json `domain_owners` in sync when a domain-owner role is granted/revoked via the roster,
-// so the gate's per-repo reviewer-routing and the derivation fallback never drift from hub.json. Adds
-// or removes the yad `name` and mirrors `domain_owner = domain_owners[0]`. No-op + warn if the repo is
-// not registered. Returns true when the registry was written.
-export function setRepoDomainOwners(root, repo, name, { add = true } = {}) {
-  const regPath = path.join(root, PROJECT_FILES.reposRegistry);
-  const registry = readJSON(regPath, { repos: [] });
-  const entry = (registry.repos || []).find((r) => r.name === repo);
-  if (!entry) { warn(`repo '${repo}' is not registered (.sdlc/repos.json) — domain_owners not synced`); return false; }
-  const owners = Array.isArray(entry.domain_owners) ? [...entry.domain_owners] : (entry.domain_owner ? [entry.domain_owner] : []);
-  const has = owners.includes(name);
-  let next;
-  if (add) { if (has) return false; next = [...owners, name]; }
-  else { if (!has) return false; next = owners.filter((o) => o !== name); }
-  entry.domain_owners = next;
-  entry.domain_owner = next[0] || '';
-  writeJSON(regPath, registry);
-  return true;
-}
-
-// Reconcile one repo's roles for a member to exactly `want`: grant what is new, revoke what is gone,
-// and mirror domain-owner changes into repos.json. `current` is the member's existing roles for the
-// repo. Shared by the `yad roster` walk and the `yad setup` per-repo role step. Idempotent.
-export function reconcileRepoRoles(root, name, repo, current = [], want = []) {
-  const toAdd = want.filter((r) => !current.includes(r));
-  const toRemove = current.filter((r) => !want.includes(r));
-  if (!toAdd.length && !toRemove.length) { info(`    ${repo}: unchanged`); return; }
-  if (toAdd.length) addRepoRoles(root, repo, Object.fromEntries(toAdd.map((r) => [r, [name]])));
-  if (toRemove.length) removeRepoRole(root, name, repo, toRemove);
-  if (toAdd.includes('domain-owner')) setRepoDomainOwners(root, repo, name, { add: true });
-  if (toRemove.includes('domain-owner')) setRepoDomainOwners(root, repo, name, { add: false });
-  ok(`    ${repo}: ${want.length ? want.join(', ') : 'cleared'}`);
-}
-
-export function registerRepo(root, registry, { name, rpath, platform, domain_owner = '', domain_owners = null, default_branch = 'main', today = null, pack = true }) {
+// Validate + record one code repo into the registry (the testable half of the connect loop).
+// A path that is not a git repository is rejected and NOTHING is written — a registry entry with
+// syncedHead:null would only surface later as an unexplained "unknown status" in the CI gates.
+export function registerRepo(root, registry, { name, rpath, platform, default_branch = 'main', today = null, pack = true }) {
   if (!insideWorkspace(root, rpath)) {
     warn(`${rpath} resolves outside the workspace (the project root's parent) — skipped`);
     return null;
@@ -240,12 +106,11 @@ export function registerRepo(root, registry, { name, rpath, platform, domain_own
     if (plat) warn(`unknown platform '${platform}' — using ${detected}`);
     plat = detected;
   }
-  // A repo can have multiple domain owners. `domain_owners` is the array of record; `domain_owner`
-  // is kept as the first element so anything still reading the legacy single-owner field works.
-  const owners = (domain_owners && domain_owners.length) ? domain_owners : (domain_owner ? [domain_owner] : []);
+  // No `domain_owner` / `domain_owners` (E62): people are not stored. A registry entry an older release
+  // wrote may still carry them; nothing reads them, and `yad doctor` names them as unused.
   const repo = {
     name, path: rpath, git_url: (remote.ok && remote.stdout) || null, platform: plat,
-    domain_owner: owners[0] || '', domain_owners: owners, default_branch,
+    default_branch,
     connectedAt: today, lastSyncedAt: today,
     // Only claim a synced HEAD when a pack is actually produced. The greenfield path skips packing
     // (pack:false), so leave syncedHead null — the repo then reads as "needs an initial pack" in
@@ -263,7 +128,7 @@ export function registerRepo(root, registry, { name, rpath, platform, domain_own
 // Record the project's design-tool connection into .sdlc/design.json (the deterministic half of the
 // connect loop; MCP detection itself is an AI step, handed off to `yad-connect-design`). An unknown tool
 // falls back to the primary adapter rather than being rejected — mirrors registerRepo's platform
-// fallback and the hub step. `none` is the explicit markdown-only choice.
+// fallback and the Product step. `none` is the explicit markdown-only choice.
 export function registerDesign(root, { tool, project_url = null, files = null, today = null } = {}) {
   // Idempotent re-connect: carry the original first-connect date forward (the schema defines
   // connectedAt as "first connect"); only lastSyncedAt moves. Mirrors repo.mjs refresh.
@@ -345,6 +210,18 @@ export function registerLearning(root, { tool, kb = null, today = null } = {}) {
   return learning;
 }
 
+// The solo switch as setup writes it: `solo` and `mode` in step, through the same `modeFields` `yad mode` uses
+// (E10). Setup records `mode_set` only when it CHANGES the mode of a Product that already had a config — a
+// first run is not a switch. It takes no reason, because an interview answer or a `--solo` / `--team` flag
+// is the choice itself; the record names `yad setup` so the change is still attributable.
+export function setupModeFields(root, cur, solo, opts = {}) {
+  const had = !!cur && typeof cur === 'object' && Object.keys(cur).length > 0;
+  const { mode_set: set, ...fields } = modeFields(cur, solo ? 'solo' : 'team', {
+    by: had ? recordActor(root) : null, date: opts.today ?? null, reason: 'yad setup',
+  });
+  return had && set ? { ...fields, mode_set: set } : fields;
+}
+
 function applyActions(actions, { force = false } = {}) {
   let changed = 0;
   for (const a of actions) {
@@ -357,7 +234,7 @@ function applyActions(actions, { force = false } = {}) {
     if (a.status === 'ok' && !force) continue;
     a.apply();
     changed++;
-    info(`${a.status === 'missing' ? 'installed' : 'updated'} ${a.scope}/${a.item}${a.backup ? ` (previous content saved to ${path.basename(a.backup)})` : ''}`);
+    info(`${a.status === 'missing' || a.status === 'new' ? 'installed' : 'updated'} ${a.scope}/${a.item}${a.backup ? ` (previous content saved to ${path.basename(a.backup)})` : ''}`);
   }
   if (!changed) info('already up to date');
   return changed;
@@ -368,19 +245,23 @@ function applyActions(actions, { force = false } = {}) {
 // otherwise we prompt with a default. Pure of side effects — it only reads. Returns
 // { solo, team_size, codebase, repo_layout, configureTools }.
 export async function resolveProfile(root, opts = {}) {
-  const hub = readJSON(path.join(root, PROJECT_FILES.hubConfig), null);
+  const hub = readJSON(productConfigPath(root), null);
   const prev = (hub && hub.profile) || {};
 
   // 1. Solo or team (+ size). --solo / --team <n> win; else carry hub.solo forward; else ask.
   let solo, team_size;
   if (opts.solo) { solo = true; team_size = 1; }
   else if (opts.team != null) { team_size = Math.max(1, parseInt(opts.team, 10) || 1); solo = team_size <= 1; }
-  else if (typeof hub?.solo === 'boolean') { solo = hub.solo; team_size = prev.team_size ?? (solo ? 1 : 2); }
+  // Either spelling carries forward: the older `review_gate.solo: true` also waives the gates, and asking again
+  // would default a configured team Product to solo and switch approvals off with nobody choosing it (E10).
+  else if (typeof hub?.solo === 'boolean' || hub?.review_gate?.solo === true) { solo = modeOf(hub) === 'solo'; team_size = prev.team_size ?? (solo ? 1 : 2); }
   else {
-    // Default from any existing roster: a hub already carrying reviewers is a team; otherwise solo.
-    const rosterN = Array.isArray(hub?.roster) ? hub.roster.length : 0;
-    solo = !(await ask('Solo or team?', rosterN > 1 ? 'team' : 'solo')).toLowerCase().startsWith('t');
-    team_size = solo ? 1 : Math.max(2, parseInt(await ask('  how many team members?', String(rosterN || 2)), 10) || 2);
+    // No mode recorded. The default used to come from the roster's size; it now comes from the team size
+    // setup recorded, and a Product that exists with neither defaults to TEAM (E62). Solo waives every
+    // approval, so it must be a choice, never what a scripted re-run of an old Product falls into.
+    const known = prev.team_size ?? (hub ? 2 : 1);
+    solo = !(await ask('Solo or team?', known > 1 ? 'team' : 'solo')).toLowerCase().startsWith('t');
+    team_size = solo ? 1 : Math.max(2, parseInt(await ask('  how many team members?', String(Math.max(2, known))), 10) || 2);
   }
 
   // 2. Greenfield (new code) or brownfield (existing code).
@@ -406,14 +287,14 @@ export async function resolveProfile(root, opts = {}) {
 }
 
 // The guided, idempotent first-run wizard: a Step 0 profile interview (resolveProfile) that branches
-// the remaining steps — install, hub + roster, optional tools, repos, wiring — and persists the profile.
+// the remaining steps — install, Product platform, optional tools, repos, wiring — and persists the profile.
 export async function runSetup(root, opts = {}) {
   log(c.bold(`\nSDLC Workflow setup  ${c.dim('v' + VERSION)}`));
   log(c.dim(`target: ${root}`));
 
   // 0. Profile interview — branch the wizard to the user's situation (solo/team, code, repo layout).
   const { solo, team_size, codebase, repo_layout, configureTools } = await resolveProfile(root, opts);
-  // Steps: interview, preflight, install, hub, tools (1 if deferred else 3), repos, wire, coderabbit, done.
+  // Steps: interview, preflight, install, Product, tools (1 if deferred else 3), repos, wire, coderabbit, done.
   const total = 8 + (configureTools ? 3 : 1);
   let _n = 0;
   const S = (title) => step(++_n, total, title);
@@ -437,9 +318,9 @@ export async function runSetup(root, opts = {}) {
   if (!has('npx')) warn('npx not found — repomix packing will be skipped');
 
   // Install the module
-  S('Install the module (skills + _bmad registration)');
+  S('Install the module (skills + .sdlc/config.yaml)');
   guide([
-    'Copies the yad-* skills into your AI tool(s) so they appear in Claude Code / agents / opencode.',
+    'Copies the yad-* skills into your AI tool(s) so they appear in Claude Code, Codex CLI, Cursor, Gemini CLI, Copilot, Zencoder or opencode.',
     'Enter the IDE folders to install into, comma-separated; default = whatever is already present.',
   ]);
   const ideTargets = await selectIdeTargets(root, opts.ideTargets);
@@ -480,89 +361,76 @@ export async function runSetup(root, opts = {}) {
     }
   }
 
-  // Detect hub platform + roster
-  S(solo ? 'Hub platform (solo — no roster)' : 'Hub platform & reviewer roster');
+  // Detect Product platform. No people are collected (E62): anyone with access approves on the platform.
+  S('Product platform');
   guide(solo
     ? [
-      'Your hub is this repo on GitHub/GitLab (or none for a file-only gate).',
-      'Solo: no roster needed — you review by merging your own PR (approval waived).',
+      'Your hub is this repo on GitHub/GitLab (or none for a local gate).',
+      'Solo: you review by merging your own PR (approval waived).',
     ]
     : [
       'Your hub is this repo on GitHub/GitLab; reviewers approve artifacts there.',
-      `Add your ${team_size}-person roster: platform login → yad name → hub role (owner/reviewer).`,
-      'An owner + 1 reviewer is required to pass a gate; skip now and add later with `yad roster add`.',
+      'yad keeps no list of people: anyone with access to the repo can approve, and the platform records who did.',
+      'A gate needs one approval, which should not come from the author (GitHub blocks self-approval; GitLab only if its settings do).',
+      'It also reports how many people it would like: 3 on a contract review, 2 where auth or payments is touched, 1 elsewhere. That extra number is advisory for now.',
     ]);
-  const hubPath = path.join(root, PROJECT_FILES.hubConfig);
-  if (exists(hubPath) && !(await askYesNo('hub.json exists — reconfigure?', false))) {
+  const productPath = productConfigPath(root);
+  if (exists(productPath) && !(await askYesNo('hub.json exists — reconfigure?', false))) {
     info('keeping existing .sdlc/hub.json');
   } else {
     const remote = run('git', ['remote', 'get-url', 'origin'], { cwd: root });
     if (!remote.ok && exists(path.join(root, '.git'))) info('no origin remote — platform detection skipped');
     let platform = detectPlatform(remote.ok ? remote.stdout : '');
-    platform = (await ask('Hub platform (github/gitlab/none)', platform || 'none')).toLowerCase();
+    platform = (await ask('Product platform (github/gitlab/none)', platform || 'none')).toLowerCase();
     if (!['github', 'gitlab', 'none'].includes(platform)) {
-      warn(`unknown platform '${platform}' — using none (file-only gate)`);
+      warn(`unknown platform '${platform}' — using none (local gate)`);
       platform = 'none';
     }
-    const roster = [];
-    // Solo mode needs no roster — the lone developer is owner and reviewer-by-merge.
-    if (!solo && await askYesNo('Add reviewers to the roster now?', true)) {
-      for (;;) {
-        const login = await ask('  reviewer platform login (blank to finish)', '');
-        if (!login) break;
-        const name = await ask('    yad name', login);
-        const email = await ask('    commit email (committer→login lookup + verified-commits gate; blank to skip)', '');
-        // Per-scope roles: capture the hub roles here; per-repo roles are added in step 7 when the
-        // repo is connected. A person can hold several roles (owner reviewer) at once.
-        const hubRoles = parseList(await ask('    hub roles (owner/reviewer, space-separated)', 'reviewer'));
-        const entry = { login, name, ...(email ? { email } : {}), roles: { hub: hubRoles } };
-        // Validate the login exists on the hub — warn-only (fail-open): a miss is flagged unverified
-        // but still saved. `checked:false` (no CLI/auth) skips the check silently.
-        if (platform !== 'none') {
-          const v = validateLogin(platform, login);
-          if (v.checked && !v.exists) { warn(`'${login}' not found on ${platform} — saved as unverified`); entry.unverified = true; }
-          else if (v.checked && v.exists) ok(`verified ${login} on ${platform}`);
-        }
-        if (email && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) warn(`'${email}' does not look like an email address`);
-        roster.push(entry);
-      }
-    }
-    const default_branch = platform === 'none' ? 'main' : await ask('Hub default branch', 'main');
-    // `bridge_enabled` is the canonical flag (hub-config schema); keep the legacy `bridge` spelling
-    // for anything that still reads it.
+    const default_branch = platform === 'none' ? 'main' : await ask('Product default branch', 'main');
+    // `ledger` is the canonical switch (shape 2): "verified" = CI writes the ledger, "local" = this
+    // machine does. The two booleans below say the same thing in the older spelling and are written
+    // ALONGSIDE it, not instead of it — add before you remove (rule 3). They are what a check gate
+    // that has not been refreshed by `yad update` yet still reads, and what a Product that is rolled back
+    // to a 3.x CLI would fall back to. They go in a later major, once nothing on either side reads them.
     const enabled = platform !== 'none';
-    // Record git_url — doctor needs it to scope the auth probe (YAD-CFG-005) and the bridge/PR flow
+    // Record git_url — doctor needs it to scope the auth probe (YAD-CFG-005) and the verified ledger/PR flow
     // needs it to open PRs. Derived from the origin remote already resolved above; null when local-only.
     const git_url = enabled ? ((remote.ok && remote.stdout.trim()) || null) : null;
-    // Merge into the existing file, never clobber: roster + verified_authors are user-owned identity
-    // data (the verified-commits gate's allowlist derives from them). A reconfigure that collects no
-    // reviewers (e.g. solo mode skips the loop) must NOT blank a populated roster or drop verified_authors.
-    // Read strict so a corrupt hub aborts here (YAD-STATE-001) rather than fail-open to `{}` and rewrite
-    // the file with identity stripped — the same silent-loss hole, just triggered by a parse failure.
-    const cur = readJSONStrict(hubPath, {}) || {};
+    // Merge into the existing file, never clobber: a key this wizard does not collect is kept as it is.
+    // Read strict so a corrupt Product aborts here (YAD-STATE-001) rather than fail-open to `{}` and rewrite
+    // the file with everything it did not collect stripped.
+    const cur = readJSONStrict(productPath, {}) || {};
+    // `ledger` belongs to shape 2. On a project still on shape 1 — one that has not run
+    // `yad migrate` yet — writing it would leave a file DECLARING shape 1 while carrying a shape-2
+    // field, which is rule 1 read backwards and makes `yad doctor`'s drift report a lie about the
+    // one file this shape change is about. The old booleans below say the same thing and are what
+    // the reader falls back to when `ledger` is absent, so nothing is lost by waiting: `yad migrate`
+    // adds the key, and the setting it computes is the one these booleans just recorded.
+    const onNewShape = (cur.schemaVersion ?? 1) >= 2 || !Object.keys(cur).length;
     const next = buildReconfiguredHub(cur, {
-      platform: enabled ? platform : null, git_url, bridge_enabled: enabled, bridge: enabled,
-      default_branch, roster, solo, profile: { codebase, repo_layout, team_size },
+      platform: enabled ? platform : null, git_url,
+      ...(onNewShape ? { ledger: enabled ? 'verified' : 'local' } : {}),
+      bridge_enabled: enabled, bridge: enabled,
+      default_branch, ...setupModeFields(root, cur, solo, opts), profile: { codebase, repo_layout, team_size },
     });
-    if (!roster.length && Array.isArray(cur.roster) && cur.roster.length) {
-      info(`kept existing roster (${cur.roster.length} member(s)) — reconfigure collected none`);
-    }
-    if (cur.verified_authors?.length) info(`preserved ${cur.verified_authors.length} verified_authors entry(ies)`);
-    writeJSON(hubPath, next);
-    ok(`wrote ${PROJECT_FILES.hubConfig} (${next.roster.length} reviewer(s)${solo ? ', solo mode' : ''})`);
+    writeProductConfig(root, next);
+    ok(`wrote ${PROJECT_FILES.productConfig} + ${PROJECT_FILES.hubConfig}${solo ? ' (solo mode)' : ''}`);
   }
   // Persist the profile + solo flag even on the "keeping existing" path, so re-running setup with new
   // flags (e.g. `yad setup --solo`) updates the mode without a full reconfigure. Merge, never clobber.
   // Also backfill a missing git_url from origin here (idempotent repair for the doctor's YAD-CFG-005).
-  if (exists(hubPath)) {
-    // Strict read for the same reason as the reconfigure write above: a corrupt hub must abort, never
-    // fail-open to `{}` and get rewritten with roster/verified_authors stripped on a plain re-run.
-    const cur = readJSONStrict(hubPath, {}) || {};
+  if (exists(productPath)) {
+    // Strict read for the same reason as the reconfigure write above: a corrupt Product must abort, never
+    // fail-open to `{}` and get rewritten with everything else stripped on a plain re-run.
+    const cur = readJSONStrict(productPath, {}) || {};
     const backfillUrl = (cur.platform && !cur.git_url)
       ? ((run('git', ['remote', 'get-url', 'origin'], { cwd: root }).stdout || '').trim() || null)
       : null;
-    if (cur.solo !== solo || JSON.stringify(cur.profile || {}) !== JSON.stringify({ codebase, repo_layout, team_size }) || backfillUrl) {
-      writeJSON(hubPath, { ...cur, ...(backfillUrl ? { git_url: backfillUrl } : {}), solo, profile: { codebase, repo_layout, team_size } });
+    const mode = setupModeFields(root, cur, solo, opts);
+    const modeMoved = Object.keys(mode).some((k) => JSON.stringify(cur[k]) !== JSON.stringify(mode[k]));
+    if (modeMoved || JSON.stringify(cur.profile || {}) !== JSON.stringify({ codebase, repo_layout, team_size }) || backfillUrl) {
+      writeProductConfig(root, { ...cur, ...(backfillUrl ? { git_url: backfillUrl } : {}), ...mode, profile: { codebase, repo_layout, team_size } });
+      if (mode.mode_set) info(`mode: ${mode.mode_set.from} → ${mode.mode_set.to} (recorded as mode_set)`);
       if (backfillUrl) info(`backfilled hub git_url from origin: ${backfillUrl}`);
       else info(`recorded profile: ${solo ? 'solo' : `team(${team_size})`}, ${codebase}, ${repo_layout}`);
     }
@@ -652,13 +520,13 @@ export async function runSetup(root, opts = {}) {
   S(repo_layout === 'monorepo' ? 'Connect your code repo (monorepo)' : 'Connect code repos');
   guide(repo_layout === 'monorepo'
     ? [
-      'One repo holds all the code; the contract lives in the hub and stories tag this single repo.',
-      codebase === 'greenfield' ? 'Greenfield: no code yet — the repomix code-pack step is skipped.' : 'Brownfield: the repo is packed so the front phases see what already exists.',
+      'One repo holds all the code; the contract lives in the Product and stories tag this single repo.',
+      codebase === 'greenfield' ? 'Greenfield: no code yet — the repomix code-pack step is skipped.' : 'Brownfield: the repo is packed so the Shape phases see what already exists.',
     ]
     : [
       'Register each code repo the feature touches; stories get tagged with the repos that implement them.',
-      'Per repo: name → path (inside this project) → platform → domain owner(s).',
-      codebase === 'greenfield' ? 'Greenfield: no code yet — the repomix code-pack step is skipped.' : 'Brownfield: each repo is packed so the front phases see what already exists.',
+      'Per repo: name → path (inside this project) → platform → default branch.',
+      codebase === 'greenfield' ? 'Greenfield: no code yet — the repomix code-pack step is skipped.' : 'Brownfield: each repo is packed so the Shape phases see what already exists.',
     ]);
   const regPath = path.join(root, PROJECT_FILES.reposRegistry);
   const registry = readJSON(regPath, { repos: [] });
@@ -670,20 +538,14 @@ export async function runSetup(root, opts = {}) {
       const name = await ask('  repo name (blank to finish)', '');
       if (!name) break;
       if (known.has(name)) { warn(`${name} already registered — skipping`); continue; }
-      // Siblings of the hub are the common layout (project/{product,backend}) — `../backend` is valid.
+      // Siblings of the Product are the common layout (project/{product,backend}) — `../backend` is valid.
       const rpath = await ask('    path (relative to project root, e.g. ../backend)', `demo-repos/${name}`);
       if (!insideWorkspace(root, rpath)) { warn(`${rpath} resolves outside the workspace (the project root's parent) — skipped`); continue; }
       const detected = run('git', ['remote', 'get-url', 'origin'], { cwd: path.resolve(root, rpath) });
       const platform = (await ask('    platform (github/gitlab)', detectPlatform(detected.ok ? detected.stdout : '') || 'github')).toLowerCase();
-      // Domain owners route the per-repo review. Solo (no roster) and monorepo (one repo = one owner)
-      // skip these prompts — there is no second person to route to.
-      const domain_owners = solo || mono ? [] : parseList(await ask('    domain owner(s) (yad names, space-separated)', ''));
-      const repoReviewers = solo || mono ? [] : parseList(await ask('    repo reviewer(s) (yad names, space-separated; blank to skip)', ''));
-      const repoOwners = solo || mono ? [] : parseList(await ask('    repo owner(s) (yad names, space-separated; blank to skip)', ''));
       const default_branch = await ask('    default branch', 'main');
-      const repo = registerRepo(root, registry, { name, rpath, platform, domain_owners, default_branch, today: opts.today ?? null, pack: !greenfield });
+      const repo = registerRepo(root, registry, { name, rpath, platform, default_branch, today: opts.today ?? null, pack: !greenfield });
       if (!repo) continue;
-      addRepoRoles(root, name, { 'domain-owner': domain_owners, reviewer: repoReviewers, owner: repoOwners });
       known.add(name);
       ok(`registered ${name}`);
       if (greenfield) info(`${name}: greenfield — skipped repomix pack (run \`yad repo refresh ${name}\` once it has code)`);
@@ -692,26 +554,8 @@ export async function runSetup(root, opts = {}) {
     }
   }
 
-  // Assign/update roles for ALREADY-connected repos. Skipped in solo mode (no roster). The connect loop
-  // above only prompts for repos you add now; this closes the gap so a member's role on a repo connected
-  // in an earlier run can be set without reconnecting. Mirrors `yad roster` (repo-driven).
-  const hub7 = readJSON(hubPath, null);
-  if (!solo && registry.repos.length && hub7 && Array.isArray(hub7.roster) && hub7.roster.length
-      && await askYesNo('Assign/update roles for connected repos?', false)) {
-    for (const member of hub7.roster) {
-      if (!(await askYesNo(`  edit ${member.name}'s repo roles?`, false))) continue;
-      for (const repo of registry.repos) {
-        const cur = rolesForScope(member, repo.name);
-        if (!(await askYesNo(`    set ${member.name}'s role on ${repo.name}? (current: ${cur.length ? cur.join(', ') : 'none'})`, false))) continue;
-        const input = await ask('      roles (domain-owner/reviewer/owner, space-separated; blank = clear)', cur.join(' '));
-        const want = parseList(input).filter((x) => ['owner', 'reviewer', 'domain-owner'].includes(x));
-        reconcileRepoRoles(root, member.name, repo.name, cur, want);
-      }
-    }
-  }
-
-  // Wire each connected repo + the hub itself
-  S('Wire connected repos + the hub (CI gates, PR template, gate-sync)');
+  // Wire each connected repo + the Product itself
+  S('Wire connected repos + the Product (CI gates, PR template, gate-sync)');
   guide(['Installs the CI safety gates, PR/MR template, and gate-sync — automatic, no input needed.']);
   if (registry.repos.length === 0) info('no repos to wire');
   // Every managed file this step writes is recorded (sha per repo root) so a LATER `yad update` can
@@ -726,16 +570,16 @@ export async function runSetup(root, opts = {}) {
     // same-named file is never touched.
     applyActions(legacyRepoActions(root, repo), { force: true });
   }
-  // the hub: event-driven gate-sync CI, so platform approvals/merges drive `yad gate ci`
-  const hubWiring = hubActions(root);
+  // the Product: event-driven gate-sync CI, so platform approvals/merges drive `yad gate ci`
+  const hubWiring = productActions(root);
   if (hubWiring.length) {
     log(`  ${c.bold('hub')} ${c.dim('(gate-sync + verified-commits CI)')}`);
     applyActions(hubWiring, { force: true });
     wired.push(...hubWiring);
   }
   applyActions(legacyHubActions(root), { force: true });
-  // the hub, locally: the harness ledger guard, so an agent is refused the CI-owned ledger write at
-  // the moment it tries it rather than by a failed pipeline later (#171). Bridge-gated like the CI
+  // the Product, locally: the harness ledger guard, so an agent is refused the CI-owned ledger write at
+  // the moment it tries it rather than by a failed pipeline later (#171). Verified-only like the CI
   // above — with no bridge the ledger is locally owned and the guard would be wrong.
   const hookWiring = hookActions(root, ideTargets);
   if (hookWiring.length) {
@@ -746,8 +590,6 @@ export async function runSetup(root, opts = {}) {
   // After every write to a managed path has landed (including the legacy renames), so the recorded
   // sha is the file's final state.
   recordManagedWrites(wired);
-  // author allowlists for the verified-commits gate (hub + every repo), from the roster emails
-  applyActions(authorsActions(root, registry.repos), { force: true });
 
   // Optional CodeRabbit
   S('AI review (CodeRabbit)');
@@ -768,17 +610,20 @@ export async function runSetup(root, opts = {}) {
   log('');
   // Tailored fastest path to the first epic, by profile.
   log(c.bold('Next:'));
+  // Which skill authors the epic is the PROJECT's setting (E6), and `yad setup` re-runs on a project
+  // that already has one — so naming the catalogue default here would send a team to a skill their own
+  // `yad next` never mentions again. `yad-backfill` stays literal: waking a brownfield anchor is the
+  // engine's own promote verb, not a step on any chain.
+  const epicSkill = stepSkills('epic', loadSkillBindings(root))[0] || 'yad-epic';
   if (codebase === 'brownfield' && registry.repos.length) {
-    hand('capture what already exists first: run `yad-backfill`, then your first epic with `yad-epic`');
+    hand(`capture what already exists first: run \`yad-backfill\`, then your first epic with \`${epicSkill}\``);
   } else {
-    hand('author your first epic: run `yad-epic`');
+    hand(`author your first epic: run \`${epicSkill}\``);
   }
   hand('your single next action, anytime: `yad next`');
-  if (!solo && !(readJSON(hubPath, null)?.roster || []).length) {
-    hand('add reviewers when ready: `yad roster add <login>` (an owner + 1 reviewer passes a gate)');
-  }
+  if (!solo) hand('reviewers need no setup: anyone with access approves on the platform; a gate needs one approval (not the author\'s own), resolved threads and the merge');
   log('');
-  log(c.bold('Then — AI-only steps (run in Claude Code):'));
+  log(c.bold('Then — AI-only steps (run in your AI agent):'));
   if (registry.repos.length) hand('generate code-maps: run `yad-connect-repos` for each connected repo');
   const design = readJSON(designPath, null);
   if (design && design.tool && design.tool !== 'none') {
@@ -794,11 +639,18 @@ export async function runSetup(root, opts = {}) {
   }
   log('');
   log(c.dim('Re-run anytime: `yad check` (report) / `yad check --fix` (reconcile).'));
+  // The --json answer (E1). A --json setup never prompts: every answer comes from a flag, or the run is
+  // refused (YAD-CLI-001) at the first question it would have asked — which can come after an earlier
+  // step has written, so a scripted setup passes every flag (or SDLC_NONINTERACTIVE for the defaults).
+  return {
+    profile: { solo, team_size, codebase, repo_layout }, ideTargets,
+    repos: registry.repos.map((r) => r.name ?? null), next: epicSkill,
+  };
 }
 
-// The repomix pack is a large, regenerable artifact — the hub tracks the AI-authored code-map, not the
+// The repomix pack is a large, regenerable artifact — the Product tracks the AI-authored code-map, not the
 // pack. `yad repo refresh --push` relies on the pack being gitignored (repo-publish.mjs never stages it);
-// this makes that assumption true in every hub, so a regenerated pack never strands as a dirty tree.
+// this makes that assumption true in every Product, so a regenerated pack never strands as a dirty tree.
 export const PACK_IGNORE_GLOB = '.sdlc/code-context/*/pack.md';
 
 // The exact lines ensurePackIgnored appends — a comment pair + the glob. Kept as data (not inline
@@ -810,7 +662,7 @@ export const PACK_IGNORE_BLOCK = [
   PACK_IGNORE_GLOB,
 ];
 
-// Idempotently ensure the hub `.gitignore` ignores the repomix pack. No-op (returns false) if the line
+// Idempotently ensure the Product `.gitignore` ignores the repomix pack. No-op (returns false) if the line
 // is already present (as its own entry); otherwise appends the managed block to a fresh or existing file
 // and returns true.
 export function ensurePackIgnored(root) {
@@ -832,7 +684,7 @@ export function packRepo(root, repo) {
   ensurePackIgnored(root); // keep the pack out of git before it is (re)written — see repo-publish.mjs invariant 1
   info(`${repo.name}: packing with repomix …`);
   const r = run('npx', ['repomix@latest', '--compress', '--include-logs', '--style', 'markdown', '-o', out], { cwd: repoRoot });
-  if (r.ok) { ok(`${repo.name}: cached ${repo.contextPack}`); hand(`${repo.name}: generate the code-map in Claude Code (yad-connect-repos)`); return true; }
+  if (r.ok) { ok(`${repo.name}: cached ${repo.contextPack}`); hand(`${repo.name}: generate the code-map in your AI agent (yad-connect-repos)`); return true; }
   fail(`${repo.name}: repomix failed — ${r.stderr.split('\n')[0] || 'unknown error'}`);
   return false;
 }