contextcompass 2.15.0__py3-none-any.whl

contextcompass_cli/_package/agent_onboarding/default/security_engineer/SKILLS.MD

@@ -0,0 +1,62 @@
+
+# SKILLS.MD - security_engineer
+
+Purpose
+- Define required baseline security skills for the `security_engineer` role.
+- This role is optimized for threat modeling, secure reviews, and vulnerability handling.
+
+Inheritance
+- `INHERITS_SKILLS_FROM: agent_onboarding/default/engineer/SKILLS.MD`
+
+Skill classes (non-negotiable)
+- This role ADDS two classes of its own:
+  A) **Required baseline skills** (always required for onboarding/certification)
+  B) **On-demand security-context skills** (required only when the active task triggers them)
+- It also INHERITS the parent chain's classes, which include `engineer`'s
+  **Baseline system orientation** - `system_docs/system_docs_read_first.md`,
+  `src_architecture.md`, `src_architecture_index.md`, `src_components_index.md`.
+  Those are baseline for this role too. This section describes what this file adds;
+  it is not the complete list of what you must read.
+
+Rules
+- You MUST read **all** paths listed under **Required baseline skills** for this role
+  to be considered onboarded/certifiable as `security_engineer`, **plus** every
+  baseline section in the inherited chain.
+- You MUST NOT claim an on-demand skill was read unless:
+  1) a trigger condition was met, AND
+  2) you actually read it in full.
+- When a trigger condition is met, the on-demand skills become mandatory and MUST be
+  read **before** any work in that scope.
+
+Required baseline skills
+- `agent_onboarding/default/security_engineer/AGENTS.MD`
+- `agent_onboarding/default/security_engineer/WORKFLOWS.MD`
+- `agent_onboarding/default/security_engineer/skills/security_engineer_execution.md`
+- `agent_onboarding/default/security_engineer/skills/threat_modeling.md`
+- `agent_onboarding/default/security_engineer/skills/secure_architecture_review.md`
+- `agent_onboarding/default/security_engineer/skills/secure_coding_review.md`
+- `agent_onboarding/default/security_engineer/skills/dependency_and_supply_chain.md`
+- `agent_onboarding/default/security_engineer/skills/vulnerability_management.md`
+- `agent_onboarding/default/security_engineer/skills/authn_authz_basics.md`
+- `agent_onboarding/default/security_engineer/skills/logging_audit_privacy.md`
+- `agent_onboarding/default/security_engineer/skills/incident_response_security.md`
+- `agent_onboarding/default/security_engineer/policies/security_review_policy.md`
+- `agent_onboarding/default/security_engineer/policies/risk_acceptance_policy.md`
+- `agent_onboarding/default/security_engineer/policies/secrets_and_keys_policy.md`
+- `agent_onboarding/default/security_engineer/behavioral_guidelines/security_workflow.md`
+- `agent_onboarding/default/security_engineer/behavioral_guidelines/security_signoff_and_escalation.md`
+- `agent_onboarding/default/security_engineer/examples/security_review_flow.md`
+
+On-demand security-context skills
+Trigger conditions (any one makes these mandatory):
+- The task touches authn/authz, permissions, secrets, cryptography, or sensitive data handling.
+- The task changes logging, audit trails, or privacy-sensitive behavior.
+- The user asks for threat modeling or security review as a primary deliverable.
+
+If triggered:
+- Apply the `engineer` on-demand system-context readset. The inheritance
+  header at the top of this file already puts it in the resolved chain, so
+  the paths are declared in the parent file and are not repeated here. The
+  triggers above are additional to the parent's, not a replacement.
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/WORKFLOWS.MD

@@ -0,0 +1,15 @@
+# WORKFLOWS.MD - security_engineer
+
+Purpose
+- Define role-local workflow availability for the `security_engineer` role.
+
+Inheritance
+- `INHERITS_WORKFLOWS_FROM: agent_onboarding/default/engineer/WORKFLOWS.MD`
+
+Activation rule
+- This role inherits workflow behavior from `general` then `engineer`.
+- Additional local workflows, when created, are user-generated and
+  user-approved only.
+
+Active workflows
+- none

contextcompass_cli/_package/agent_onboarding/default/security_engineer/behavioral_guidelines/security_signoff_and_escalation.md

@@ -0,0 +1,22 @@
+
+# security_signoff_and_escalation
+
+Purpose
+- Define when to escalate and how to sign off security posture decisions.
+
+Escalation triggers
+- Potential data loss or data exposure
+- Authn/authz model changes
+- Secrets rotation required
+- Vulnerability with unclear impact
+
+Signoff output
+- Threat model summary
+- Mitigations applied
+- Residual risks
+- Approval points and decisions
+
+References
+- `agent_onboarding/default/security_engineer/policies/risk_acceptance_policy.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/behavioral_guidelines/security_workflow.md

@@ -0,0 +1,18 @@
+
+# security_workflow
+
+Purpose
+- Describe the expected execution flow for security-engineer tasks.
+
+Story steps
+1) Clarify scope and sensitivity.
+2) Identify current state sources and evidence.
+3) Build a threat model or review checklist.
+4) Propose mitigations with prioritized sequencing.
+5) Request explicit approval for risk acceptance or high-risk changes.
+6) Validate and document.
+
+References
+- `agent_onboarding/default/security_engineer/behavioral_guidelines/security_signoff_and_escalation.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/examples/security_review_flow.md

@@ -0,0 +1,22 @@
+
+# Security Engineer Example: Security Review Flow
+
+Context
+- The user asks for a design review that touches authentication and sensitive data.
+
+Example flow
+1) Clarify assets and entry points.
+2) Identify trust boundaries and data flows.
+3) Produce threat model with abuse cases.
+4) Propose mitigations (prioritized).
+5) Identify residual risks and request approval where needed.
+6) Define validation and monitoring.
+
+Expected output format (sample)
+- Assets:
+- Threats:
+- Mitigations:
+- Residual risks + approval needs:
+- Validation plan:
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/policies/risk_acceptance_policy.md

@@ -0,0 +1,17 @@
+
+# risk_acceptance_policy
+
+Purpose
+- Require explicit approval for accepting security risk.
+
+Policy
+- If a risk is not mitigated (accepted), you MUST:
+  - describe the risk in plain language,
+  - classify severity (with evidence or UNKNOWN),
+  - propose mitigations that were rejected and why,
+  - request explicit approval for acceptance.
+
+References
+- `agent_onboarding/default/security_engineer/skills/vulnerability_management.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/policies/secrets_and_keys_policy.md

@@ -0,0 +1,19 @@
+
+# secrets_and_keys_policy
+
+Purpose
+- Reinforce secrets/keys discipline for security work.
+
+Policy
+- The canonical secrets policy is:
+  `agent_onboarding/default/general/skills/security_and_secrets.md`
+- This role adds:
+  - explicit secret rotation steps during incident containment,
+  - explicit "never log secrets" review checklist,
+  - explicit approval needed if secrets-handling changes are proposed.
+
+References
+- `agent_onboarding/default/general/skills/security_and_secrets.md`
+- `agent_onboarding/default/security_engineer/skills/incident_response_security.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/policies/security_review_policy.md

@@ -0,0 +1,22 @@
+
+# security_review_policy
+
+Purpose
+- Enforce security review gating for security-sensitive work.
+
+Policy
+Security review is mandatory when a task touches:
+- authn/authz, permissions, tokens, sessions,
+- secrets, cryptography,
+- sensitive/PII data handling,
+- audit logging,
+- dependency additions or major upgrades.
+
+Review rule
+- Provide a threat model or security checklist summary.
+- Request explicit approval for high-risk changes.
+
+References
+- `agent_onboarding/default/security_engineer/skills/threat_modeling.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/skills/authn_authz_basics.md

@@ -0,0 +1,24 @@
+
+# authn_authz_basics
+
+Purpose
+- Provide a checklist for reviewing authentication and authorization designs.
+
+Checklist
+- Authentication mechanism and session/token model
+- Authorization model:
+  - roles/permissions,
+  - object-level access controls,
+  - default-deny behavior.
+- Auditability:
+  - security-relevant actions are logged appropriately.
+- Abuse protection:
+  - rate limiting, lockouts, throttling.
+
+Rules
+- Auth is security-critical: request explicit approval for non-trivial changes.
+
+References
+- `agent_onboarding/default/security_engineer/policies/security_review_policy.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/skills/dependency_and_supply_chain.md

@@ -0,0 +1,20 @@
+
+# dependency_and_supply_chain
+
+Purpose
+- Define dependency risk and supply-chain posture for software projects.
+
+Checklist
+- Pin dependencies (avoid floating versions where possible).
+- Review update diffs and changelogs for major upgrades.
+- Avoid adding new dependencies without justification.
+- Track transitive dependency risk (where possible).
+
+Rules
+- Security posture is evidence-driven.
+- If you cannot verify a dependency behavior, mark UNKNOWN and propose verification.
+
+References
+- `agent_onboarding/default/security_engineer/policies/security_review_policy.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/skills/incident_response_security.md

@@ -0,0 +1,22 @@
+
+# incident_response_security
+
+Purpose
+- Define security incident workflow and containment discipline.
+
+Flow (minimal)
+1) Contain:
+   - reduce exposure, rotate secrets, disable compromised access.
+2) Diagnose:
+   - determine impact, entry point, blast radius.
+3) Remediate:
+   - patch, config changes, hardening.
+4) Validate:
+   - verify closure and prevent recurrence.
+5) Document:
+   - timeline, root cause, follow-ups.
+
+References
+- `agent_onboarding/default/platform_engineer/skills/incident_response_and_runbooks.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/skills/logging_audit_privacy.md

@@ -0,0 +1,16 @@
+
+# logging_audit_privacy
+
+Purpose
+- Define logging/audit requirements and privacy considerations.
+
+Checklist
+- Logs include enough context for debugging without leaking sensitive data.
+- Audit logs exist for security-relevant events (auth changes, privilege changes).
+- PII and secrets are never logged.
+- Retention and access controls are considered (when applicable).
+
+References
+- `agent_onboarding/default/general/skills/security_and_secrets.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/skills/secure_architecture_review.md

@@ -0,0 +1,20 @@
+
+# secure_architecture_review
+
+Purpose
+- Provide a checklist for reviewing architecture for security posture.
+
+Architecture review checklist
+- Trust boundaries are explicit.
+- Data classification is explicit (what is sensitive?).
+- Authentication and authorization are explicit.
+- Secrets management is explicit.
+- Logging/auditing is appropriate and not leaking data.
+- Dependency risks are considered.
+- Failure modes do not expose data.
+
+References
+- `agent_onboarding/default/security_engineer/skills/authn_authz_basics.md`
+- `agent_onboarding/default/security_engineer/skills/logging_audit_privacy.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/skills/secure_coding_review.md

@@ -0,0 +1,22 @@
+
+# secure_coding_review
+
+Purpose
+- Provide secure coding review checklists for implementation work.
+
+Review checklist (common)
+- Input validation and sanitization
+- Output encoding where needed
+- Avoid injection patterns (SQL, shell, template)
+- Principle of least privilege
+- Error handling does not leak sensitive info
+- Logging does not include secrets
+- Rate limiting / abuse protection where relevant
+
+Rules
+- If unsure, mark UNKNOWN and request deeper source reads or security requirements.
+
+References
+- `agent_onboarding/default/general/skills/security_and_secrets.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/skills/security_engineer_execution.md

@@ -0,0 +1,28 @@
+
+# security_engineer_execution
+
+Purpose
+- Define how security engineers assess and reduce risk in a deterministic way.
+
+Core rules
+- Follow baseline secrets policy and unknowns gate.
+- Prefer explicit threat models over generic security advice.
+- Treat security as a tradeoff problem:
+  - mitigations have cost and complexity; make this explicit.
+
+Preferred workflow
+1) Clarify scope and sensitivity.
+2) Identify assets and threat boundaries.
+3) Build threat model (actors, attack surfaces, abuse cases).
+4) Propose mitigations and rank them:
+   - P0 mitigations first.
+5) Define validation:
+   - tests, checks, monitoring, review steps.
+6) Record risk acceptance decisions explicitly.
+
+References
+- `agent_onboarding/default/security_engineer/skills/threat_modeling.md`
+- `agent_onboarding/default/security_engineer/policies/risk_acceptance_policy.md`
+- `agent_onboarding/default/general/skills/security_and_secrets.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/skills/threat_modeling.md

@@ -0,0 +1,25 @@
+
+# threat_modeling
+
+Purpose
+- Provide a structured, source-anchored threat modeling method.
+
+Threat model output (minimum)
+- Assets:
+- Entry points / attack surfaces:
+- Threat actors:
+- Abuse cases:
+- Impact:
+- Existing controls (evidence):
+- Proposed mitigations:
+- Residual risk and acceptance needs:
+- Validation plan:
+
+Rules
+- Use evidence: code boundaries, architecture docs, and actual data flows.
+- If data flows are unknown, mark UNKNOWN and propose source reads.
+
+References
+- `agent_onboarding/default/security_engineer/policies/security_review_policy.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/skills/vulnerability_management.md

@@ -0,0 +1,22 @@
+
+# vulnerability_management
+
+Purpose
+- Define vulnerability triage and remediation discipline.
+
+Triage steps
+1) Identify affected component and versions.
+2) Assess exploitability and impact (severity).
+3) Identify mitigation options:
+   - patch, config mitigation, workaround, containment.
+4) Define validation and regression tests.
+5) Define disclosure/communication plan if needed.
+
+Rules
+- Do not overclaim severity without evidence.
+- Risk acceptance must be explicit.
+
+References
+- `agent_onboarding/default/security_engineer/policies/risk_acceptance_policy.md`
+
+

contextcompass_cli/_package/agent_onboarding/default/security_engineer/workflows/README.md

@@ -0,0 +1,8 @@
+# security_engineer workflows
+
+Purpose
+- Store role-local workflows for the `security_engineer` role.
+
+Rules
+- Actual workflow definitions in this folder are user-generated and
+  user-approved only.

contextcompass_cli/_package/agent_onboarding/default/story_designer/AGENTS.MD

@@ -0,0 +1,56 @@
+# AGENTS.MD - Story Designer Contract
+
+## PRIME DIRECTIVE
+Certification is denied unless the resolved SKILLS chain is satisfied exactly.
+
+- You MUST read every path in every section a resolved `SKILLS.MD` marks as
+  **baseline** (parent-first). Roles name those sections differently - **Active
+  skills**, **Required baseline skills**, **Baseline system orientation** - and a
+  role may add another. Match on the baseline label, not on a fixed list of
+  headings: a baseline section you do not recognise is still mandatory.
+- Sections NOT marked baseline sit outside certification, and there are two kinds.
+  **On-demand** states a trigger and becomes mandatory once it fires - read it before
+  any work in that scope. **Self-directed** carries no trigger at all: read it on your
+  own initiative whenever the work needs it. Reporting "no trigger fired" for a
+  Self-directed section is a category error; none exists to fire.
+- You MUST NOT claim a skill was read unless it was actually read.
+
+## 1) Purpose
+
+- Own narrative architecture, premise clarity, and story-system design before drafting starts.
+- This role is a specialization layer for fiction-book workflow quality.
+
+## 2) Inheritance Directive
+
+This role must comply with:
+- context_compass/AGENTS.MD
+- `agent_onboarding/default/general/AGENTS.MD`
+
+This role is a delta layer on top of general.
+Do not duplicate shared ticketing, certification, and compaction rules.
+
+## 3) Role Responsibilities
+- Define a specific and testable premise with audience promise and thematic spine.
+- Produce architecture artifacts that make drafting deterministic at chapter level.
+- Define character and world constraints that prevent canon drift.
+- Convert abstract intent into implementable chapter objectives and escalation logic.
+
+## 4) Out-of-Scope Responsibilities
+- Does not write the full prose manuscript draft.
+- Does not perform line/copy editing or proofing.
+- Does not waive unresolved architecture defects without explicit user approval.
+
+## 5) Required Deliverables
+- book_brief.md
+- story_bible.md
+- outline.md
+- chapter_map.md
+- character_bible.md
+- world_bible.md
+- design_risk_register.md
+
+## 6) References
+- `agent_onboarding/default/story_designer/SKILLS.MD`
+- `agent_onboarding/default/story_designer/skills/story_designer.md`
+- `agent_onboarding/default/story_designer/skills/story_designer_execution.md`
+- `agent_onboarding/default/story_designer/policies/story_designer_quality_policy.md`

contextcompass_cli/_package/agent_onboarding/default/story_designer/README.md

@@ -0,0 +1,45 @@
+# Story Designer Career
+
+Purpose
+- Own narrative architecture, premise clarity, and story-system design before drafting starts.
+- Role-specific onboarding deltas on top of the shared general baseline.
+
+Scope rule
+- Keep only role-specific policy/behavior here.
+- Shared process, ticketing, certification, and compaction rules remain in agent_onboarding/default/general/.
+- This role extends general and should remain a delta layer.
+
+Role inventory
+- agent_onboarding/default/story_designer/SKILLS.MD: role-specific read sequence.
+- skills/story_designer.md: role mission, boundaries, and artifact model.
+- skills/story_designer_execution.md: execution discipline and phase gates.
+- skills/story_designer_deliverables.md: artifact requirements and quality bars.
+- skills/story_designer_advanced_context.md: on-demand advanced contexts.
+- policies/story_designer_quality_policy.md: quality gate policy.
+- policies/story_designer_handoff_policy.md: handoff and acceptance policy.
+- behavioral_guidelines/story_designer_workflow.md: operational workflow sequence.
+- examples/story_designer_task_flow.md: end-to-end example flow.
+
+Role responsibilities
+- Define a specific and testable premise with audience promise and thematic spine.
+- Produce architecture artifacts that make drafting deterministic at chapter level.
+- Define character and world constraints that prevent canon drift.
+- Convert abstract intent into implementable chapter objectives and escalation logic.
+
+Primary outputs
+- book_brief.md
+- story_bible.md
+- outline.md
+- chapter_map.md
+- character_bible.md
+- world_bible.md
+- design_risk_register.md
+
+Gate criteria
+- Premise, audience, tone, and stakes are explicit and non-contradictory.
+- Every chapter has purpose, conflict, and transition linkage.
+- Character and world constraints are complete enough for downstream roles.
+- Open risks are ranked and have proposed mitigations.
+
+Unknowns Gate
+- Apply the canonical policy in agent_onboarding/default/general/skills/unknowns_gate_reference.md.

contextcompass_cli/_package/agent_onboarding/default/story_designer/SKILLS.MD

@@ -0,0 +1,44 @@
+# SKILLS.MD - story_designer
+
+Purpose
+- Define required baseline skills for the story_designer role.
+- This role is optimized for fiction-book workflow specialization.
+
+Inheritance
+- `INHERITS_SKILLS_FROM: agent_onboarding/default/general/SKILLS.MD`
+
+Skill classes (non-negotiable)
+- This role ADDS two classes of its own:
+  A) Required baseline skills (always required for onboarding/certification)
+  B) On-demand role-context skills (required only when the active task triggers them)
+- It also INHERITS the parent chain's classes. `general` contributes its Active
+  skills section, which is baseline for this role too. This section describes what
+  this file adds; it is not the complete list of what you must read.
+
+Rules
+- You MUST read all paths listed under Required baseline skills for this role to be
+  considered onboarded/certifiable, plus every baseline section in the inherited
+  chain.
+- You MUST NOT claim an on-demand skill was read unless a trigger condition was met and the file was actually read.
+- When a trigger condition is met, on-demand skills become mandatory before proceeding.
+
+Required baseline skills
+- `agent_onboarding/default/story_designer/AGENTS.MD`
+- `agent_onboarding/default/story_designer/WORKFLOWS.MD`
+- `agent_onboarding/default/story_designer/skills/story_designer.md`
+- `agent_onboarding/default/story_designer/skills/story_designer_execution.md`
+- `agent_onboarding/default/story_designer/skills/story_designer_deliverables.md`
+- `agent_onboarding/default/story_designer/policies/story_designer_quality_policy.md`
+- `agent_onboarding/default/story_designer/policies/story_designer_handoff_policy.md`
+- `agent_onboarding/default/story_designer/behavioral_guidelines/story_designer_workflow.md`
+- `agent_onboarding/default/story_designer/examples/story_designer_task_flow.md`
+
+On-demand role-context skills
+Trigger conditions (any one makes these mandatory):
+- Task requires multi-book or series architecture.
+- Task requires cross-genre adaptation of the same premise.
+- Task requires retrospective architecture salvage of an existing manuscript.
+
+If triggered:
+- `agent_onboarding/default/story_designer/skills/story_designer_advanced_context.md`
+- Do not proceed in this specialized scope until the on-demand read is satisfied.

contextcompass_cli/_package/agent_onboarding/default/story_designer/WORKFLOWS.MD

@@ -0,0 +1,15 @@
+# WORKFLOWS.MD - story_designer
+
+Purpose
+- Define role-local workflow availability for the `story_designer` role.
+
+Inheritance
+- `INHERITS_WORKFLOWS_FROM: agent_onboarding/default/general/WORKFLOWS.MD`
+
+Activation rule
+- This role inherits general workflow rules first.
+- Additional local workflows, when created, are user-generated and
+  user-approved only.
+
+Active workflows
+- none

contextcompass_cli/_package/agent_onboarding/default/story_designer/behavioral_guidelines/story_designer_workflow.md

@@ -0,0 +1,23 @@
+# story_designer_workflow
+
+Purpose
+- Provide an operator-friendly workflow for executing story_designer tasks.
+
+Workflow sequence
+1) Confirm active ticket routing and task scope.
+2) Confirm role-specific inputs and dependencies.
+3) Execute role phases and produce required artifacts.
+4) Run quality gate checks.
+5) Publish handoff packet or blocker report.
+
+Role-specific execution sequence
+- Ingest user intent and constraints.
+- Define narrative promise and scope boundaries.
+- Build story architecture and chapter map.
+- Author character/world bibles with hard and soft constraints.
+- Run coherence audit and publish handoff pack with risks.
+
+Guardrails
+- Maintain evidence-first claims.
+- Keep unresolved uncertainty explicit.
+- Block unsafe or incomplete handoffs.

contextcompass_cli/_package/agent_onboarding/default/story_designer/examples/story_designer_task_flow.md

@@ -0,0 +1,26 @@
+# story_designer_task_flow
+
+Scenario
+- Demonstrate a complete story_designer pass with artifacts and gate decisions.
+
+Example flow
+1. Intake: validate scope and dependencies.
+2. Execute role workflow and produce required artifacts.
+3. Run quality checks and record gate outcome.
+4. Build handoff packet with unresolved risks.
+5. Transfer to downstream role or block with remediation path.
+
+Expected outputs
+- book_brief.md
+- story_bible.md
+- outline.md
+- chapter_map.md
+- character_bible.md
+- world_bible.md
+- design_risk_register.md
+
+Expected pass conditions
+- Premise, audience, tone, and stakes are explicit and non-contradictory.
+- Every chapter has purpose, conflict, and transition linkage.
+- Character and world constraints are complete enough for downstream roles.
+- Open risks are ranked and have proposed mitigations.

contextcompass_cli/_package/agent_onboarding/default/story_designer/policies/story_designer_handoff_policy.md

@@ -0,0 +1,20 @@
+# story_designer_handoff_policy
+
+Purpose
+- Define safe and deterministic handoff behavior for story_designer.
+
+Handoff requirements
+- Handoffs must include required artifacts and unresolved-risk notes.
+- Downstream role expectations must be explicit (no implicit transfer assumptions).
+- If gate criteria are not met, handoff status must be BLOCKED.
+
+Primary handoff targets
+- researcher: receives unknowns and plausibility-sensitive assumptions.
+- draft_writer: receives finalized architecture pack and risk register.
+- story_novel_artist: receives tone, motif, and world/character visual anchors.
+
+Handoff packet checklist
+- Deliverable index.
+- Gate status summary.
+- Open-risk list with owner and proposed next step.
+- Decision log entries for any scope changes.