Codex compatibility note:

- Invoke repository skills with $skill-name in Codex; this mirrored copy rewrites legacy Claude /skill-name references.
- Task tracker mandate: BEFORE executing any workflow or skill step, create/update task tracking for all steps and keep it synchronized as progress changes.
- User-question prompts mean to ask the user directly in Codex.
- Ignore Claude-specific mode-switch instructions when they appear.
- Strict execution contract: when a user explicitly invokes a skill, execute that skill protocol as written.
- Subagent authorization: when a skill is user-invoked or AI-detected and its protocol requires subagents, that skill activation authorizes use of the required spawn_agent subagent(s) for that task.
- Do not skip, reorder, or merge protocol steps unless the user explicitly approves the deviation first.
- For workflow skills, execute each listed child-skill step explicitly and report step-by-step evidence.
- If a required step/tool cannot run in this environment, stop and ask the user before adapting.

<!-- CODEX:PROJECT-REFERENCE-LOADING:START -->

Codex Project-Reference Loading (No Hooks)

Codex uses static project-reference loading instead of runtime-injected project docs. When coding, planning, debugging, testing, or reviewing, open project docs explicitly using this routing.

Always read:

• docs/project-config.json (project-specific paths, commands, modules, and workflow/test settings)
• docs/project-reference/docs-index-reference.md (routes to the full docs/project-reference/* catalog)
• docs/project-reference/lessons.md (always-on guardrails and anti-patterns)

Missing/stale context route: If docs/project-config.json, the docs index, lessons.md, CLAUDE.md, AGENTS.md, or any task-required reference doc is missing or stale, auto-run $project-init or the narrow setup route ($project-config, $docs-init, $scan-all, $scan --target=<key>, $claude-md-init) before ordinary project-specific work. If Codex mirrors or AGENTS.md are missing/stale, ask the user to run $sync-codex; do not auto-run it.

Situation-based docs:

• Project structure/architecture/tech-stack/deployment/setup (any layer — backend, frontend, or infra): project-structure-reference.md
• Backend/CQRS/API/domain/entity changes: backend-patterns-reference.md, domain-entities-reference.md
• Frontend/UI/styling/design-system: frontend-patterns-reference.md, scss-styling-guide.md, design-system/README.md
• Spec authoring, docs/specs/ pathing, or TC format: feature-spec-reference.md, spec-system-reference.md, spec-principles.md
• Behavior/public-contract changes or spec-test-code sync: workflow-spec-test-code-cycle-reference.md plus the spec docs above
• Derived spec indexes/ERDs/reimplementation guides: spec-system-reference.md and source Feature Specs under docs/specs/
• Integration test implementation/review: integration-test-reference.md
• E2E test implementation/review: e2e-test-reference.md
• Code review/audit work: code-review-rules.md plus domain docs above based on changed files

Do not read all docs blindly. Start from docs-index-reference.md, then open only relevant files for the task.

<!-- CODEX:PROJECT-REFERENCE-LOADING:END -->

<!-- PROMPT-ENHANCE:STEP-TASK-ANCHOR:START -->

[BLOCKING] Execute skill steps in declared order. NEVER skip, reorder, or merge steps without explicit user approval.
[BLOCKING] Before each step or sub-skill call, update task tracking: set in_progress when step starts, set completed when step ends.
[BLOCKING] Every completed/skipped step MUST include brief evidence or explicit skip reason.
[BLOCKING] If Task tools are unavailable, create and maintain an equivalent step-by-step plan tracker with the same status transitions.

<!-- PROMPT-ENHANCE:STEP-TASK-ANCHOR:END -->

Quick Summary

Goal: UNDERSTAND the feature first, then script it — investigate the capability end-to-end until you can answer the comprehension bar with file:line, and only then produce a stakeholder-ready demo guide that lists every main user story with its REAL test-case IDs, gives a step-by-step demo flow per case, explains how the domain stores/changes the data and how that solves the feature, and places every case on the proof ladder — so the presenter can show the behaviour, explain the data behind it, and never claim proof that was not earned.

Summary — read this if nothing else. A demo guide written from names and guesses stages a demo that breaks in the room. So: investigate first, prove every claim, then write. Main steps, in order:

1. RESOLVE scope — prompt → current working context → ask the user directly. NEVER invent the feature silently.
2. LOAD the contract (references/demo-guide-template.md) and SIZE the target into a tier S0–S4; announce both in one line.
3. DECOMPOSE into story groups (≥2 from tier S2) and BREAK THE WORK INTO TASKS before the first deep read — the current task list first; a group task completes only when its block is on disk.
4. [BLOCKING GATE] UNDERSTAND the feature — clear the 6-question comprehension bar with file:line each, delegating to read-only investigation skills ($scout, $investigate, $debug-investigate, $graph-trace, $spec-index) when a direct read cannot answer one. No demo step is written before this gate clears.
5. GATHER the five inventories — stories + REAL IDs · domain storage/solution · demo path & setup · proof · discriminator — each on its own degradation ladder ending in a stated blocker, never in invention.
6. MAP story → cases and persist the map before writing.
7. TRACE domain storage & solution per case — read the entity/migration/handler; never infer persistence from names.
8. OPEN the guide + ledger before case one, ACCUMULATE story by story on disk; announce anything deferred or dropped.
9. PROVE & VALIDATE — place every case on the proof ladder, write the transparency note, run the validation gate.

Flags: feature-or-scope arg · --context · --output · --lang · --html · --stories.

Workflow:

1. Resolve Scope, Load Contract, Size & Task — scope precedence prompt → context → ASK; read the template contract; size into a tier; decompose into story groups; create the task list BEFORE the first deep read.
2. Understand the Feature FIRST [BLOCKING] — clear the comprehension bar; delegate gathering to read-only skills; write the Understanding Brief to disk.
3. Gather the Five Inventories — portable discovery via docs/project-config.json; every inventory walks its ladder and records the rung it landed on.
4. Map Stories → Cases — main stories, REAL TC-* / test IDs, coverage gaps named.
5. Trace Domain Storage & Solution — per case: what is persisted/changed, by which entity/migration/handler, and which rule consumes it (file:line each).
6. Open the Guide + Ledger, Accumulate — spine first, one block per story group, ledger updated as each lands.
7. Write Each Case — setup → numbered demo flow → expected result as the discriminator → domain storage/solution.
8. Prove — proof ladder per case + test-execution transparency note.
9. Validate — the gate below; nothing declared done before it passes.

Key Rules (the contract):

• UNDERSTAND BEFORE YOU SCRIPT. The Step 1 comprehension bar is a [BLOCKING] gate: until you can answer all six questions with file:line, you have no demo to write. — why: a demo step invented from a screen name is a demo that fails live, in front of the people it was written for.
• Scope precedence is prompt → current context → ASK. An explicit feature in the prompt wins; else derive from current work; else ask the user directly — NEVER invent a feature.
• Every case carries four parts: setup/preconditions · numbered step-by-step demo flow · expected result phrased as the discriminator vs the old behaviour · how the domain stores/changes data & solves the feature. A case missing the storage/solution part is incomplete.
• PROOF IS EARNED, NEVER ASSERTED. Every case sits on one of the four proof rungs (Step 7), and ✅ ran is licensed only by a test executed this session with its command and result recorded. There is no fifth rung: a case you cannot place is a stated blocker.
• REAL IDs ONLY — NEVER invent a test case ID. A story with no case says "no test covers this" and is recorded as a coverage gap. — why: a fabricated ID retires a risk that is still live.
• Cite file:line for every storage/behaviour claim — read the entity, the mapping, and the migration. NEVER infer persistence from a field name.
• A demo step is traced to a real user path, or it is a stated blocker — NEVER an invented click, endpoint, or screen, and never state faked by a path a user could not reach.
• DELEGATE THE GATHERING, NEVER THE SCRIPTING. Read-only delegates only; their output is INPUT, re-verified at file:line before it becomes a claim. NEVER delegate to a mutating or findings-emitting skill ($fix, $changes-review, $code-review, $plan-execute).
• ACCUMULATE ON DISK, NEVER IN CONTEXT. Open the guide before case one; append per case and per story group; synthesize the guide-level sections from the written blocks. — why: partial results on disk beat complete results that never got written.
• NO SECRET VALUES, ANYWHERE. Setup steps, run commands, and seed instructions name the setting, the file, and the account role — never a credential, token, key, connection string, or customer identifier. Secrets render <redacted:…> from the moment they would enter context.
• NO SILENT TRUNCATION. Anything deferred, sampled, or dropped is named in the guide header AND the chat summary — bounded coverage must never read as complete coverage.
• Portable — discover, don't hardcode. Resolve source roots, spec/test locations, run commands, and output dir from docs/project-config.json; degrade gracefully and say which rung you landed on.
• Scale buys MORE STORY GROUPS, never FEWER PARTS per case. "Too big to demo properly" is a conclusion this skill may never reach.

Be skeptical. Apply critical thinking, sequential thinking. Every claim needs traced proof, confidence >80% to act.

Demo Guide — Investigate-First, Proof-Carrying Demo Script

You are an investigator first, a presenter's coach second — in that order, and the order is the whole point.

• As an investigator you learn the feature before you script it: which capability it delivers, which entity owns the state it changes, how the data flows from the user's click to the persisted row and back to the pixel that proves it, and which rule makes the outcome correct. You read the code; you never infer persistence from a name.
• As a presenter's coach you hand a human a script they can run live in front of stakeholders: staged through real user paths, phrased as the discriminator that would have been WRONG under the old behaviour, and backed by an honest statement of what was actually proven versus merely traced.

The bar: a presenter who reads this guide could (a) stage the preconditions without asking anyone, (b) run every case live without improvising a step, (c) answer "where is that stored and what makes it correct?" for any case a stakeholder challenges, and (d) state exactly which cases are backed by a green test and which are being shown by trace alone. Anything less is a wish-list, not a demo guide.

Instructions, not documentation: this skill teaches HOW to build the guide from real project evidence, adapting to whatever the project actually has (specs, tests, PBIs, or just a diff).

Invocation

$demo-guide [feature-or-scope] [--context] [--output path] [--lang xx] [--html] [--stories "A,B"]

Step 0 — Resolve Scope, Load the Contract, Size & Task (cheap — costs seconds)

0.1 Resolve scope (prompt → context → ASK). Apply the precedence strictly — the skill's defining behaviour:

1. Prompt names a feature/scope → use it. Normalise to a concrete target: a spec file, a PBI/story id, a set of changed files, or a keyword set. Confirm it resolves to real artifacts before proceeding.
2. Prompt empty / only "generate demo guide" → derive from the current working context, in this order until one yields signal: active task list / workflow goal → git status + git diff (staged and unstaged) + branch name → recent commits vs the main branch → any in-progress plan/spec/release-note.
3. No usable signal → STOP and ask the user directly: "Which feature should I generate the demo guide for?" Offer the best 2-4 candidates you did find plus free-text. NEVER pick one silently.

State the resolved scope and its source in one line (e.g. Scope: <feature> — derived from branch diff (7 changed files)).

0.2 Load the output contract BEFORE gathering. Read references/demo-guide-template.md — the document structure, the per-case block, the proof rungs, the storage-block field map, and the translation/HTML rules. The shape of the guide decides what you must collect; improvising it from memory guarantees a thin case block. If the file is missing (partial distribution, vendored copy, incomplete mirror sync), degrade out loud, never silently: say which file is absent in one line and run on the inline contract in this file (Step 6's four mandatory parts, Step 7's proof ladder). The guide is still owed in full; only the elaboration is lost.

0.3 Size the target into a tier (count, do not estimate). In-scope files, distinct user-facing capabilities/flows, distinct modules/bounded contexts (docs/project-config.json → modules), and changed lines where a diff exists. First row whose trigger matches, top-down. Announce it: Scope: S2 · Multi — 14 files, 3 capabilities → 3 story groups.

Thresholds are the framework's existing map-reduce ladder (SYNC:systematic-review-batching: < 10 sequential · ≥ 10 batch · > 6 categories or > 40 files hierarchical) and match $understand's tiers deliberately. — why: a feature that gets understood and then demoed must be partitioned the same way twice, not by two competing maps.

Tier is a SHAPE dial, not a depth dial. It changes how many story groups exist and how the work is dispatched. It NEVER removes a case part, a proof rung, or the storage explanation.

0.4 Decompose into story groups, then task the work — BEFORE any deep read.

• A story group is a demoable unit — one user-facing capability whose cases can be staged in one sitting, ≤ 8 files or ≤ 2000 diff-lines. Decomposition axis, first rung yielding ≥2 cohesive groups: capability / user story → end-to-end flow → module / bounded context → screen or endpoint cluster (last resort, labelled "structural grouping — not a story boundary"). Record which rung you landed on. Tier S0/S1 → exactly one group.
• [BLOCKING] Create the task list BEFORE gathering. the current task list FIRST — an interrupted or compacted run resumes its tasks, never duplicates them. Then one task per story group plus the fixed tasks: size & decompose · understand-gate · scope-wide gather · open guide + ledger · {one per group} · proof & transparency · validate. Exactly one in_progress. A group task completes ONLY when that group's block is on disk — evidence is the path plus the cases it carries, never a summary in context. — why: a run that dies mid-guide must show exactly where it stopped.

Step 1 — Understand the Feature FIRST [BLOCKING GATE]

No demo step, no expected result, and no storage claim is written before this gate clears. Investigation is not a preamble to the guide — it is the thing that makes the guide true.

The comprehension bar — answer all six with file:line, for each story group:

1. What capability does this deliver, and what did the system do before it? The before → after in behaviour terms — this is what the demo's expected result must discriminate against.
2. Which entity/aggregate owns the state the feature changes, and which field/column/table holds it? Read the entity, the mapping/configuration, and the migration — not the property name.
3. What is the end-to-end flow? Entry point (screen/endpoint/job) → validation → handler/domain rule → persistence → the read path that renders the outcome the presenter will point at.
4. Which business rule or invariant makes the expected result correct, and where is it enforced? This is what a stakeholder's "but what if…" attacks.
5. What preconditions must exist, and which REAL user path stages each? Roles, configuration, seed data, prior state — every one reachable through actions a user could actually perform.
6. What proves it? The REAL TC-* / test IDs covering each case, which of them are runnable in this environment, and which cases have none.

Cannot answer one? Keep investigating — or delegate. NEVER paper over the gap with a plausible-looking step.

1. Read-only delegates ONLY. NEVER invoke a skill that mutates files or issues findings/verdicts ($fix, $changes-review, $code-review, $why-review, $plan-execute) — this skill emits a script, not a verdict, and mutates nothing but its own output.
2. MUST ATTENTION delegate on evidence of need — NEVER by reflex. Try read + grep + trace first, within the group's budget. Announce each delegation in one line and record it in the guide header: Delegated: $investigate — Story B mechanics. — why: the reader calibrates on the provenance chain exactly as on a grep-derived claim.
3. A delegate's output is INPUT, never a finished block. Re-verify every claim at file:line before it enters the guide; a TC-* ID that arrives through a delegate is still one you must have read yourself. The anti-hallucination bar does not relax by passing through another skill.
4. At tier S3+, delegation happens INSIDE the group's sub-agent, never in the orchestrator. — why: delegating from the orchestrator pulls a whole investigation transcript into the one context the grouping exists to protect.

Gate exit — write the Understanding Brief to disk before Step 2 ends: per story group, the six answers with their file:line anchors, the delegations used, and any question you could NOT answer (named as a blocker, never left blank). This brief is what Steps 4, 6 and 7 are written from — never memory.

Step 2 — Gather the Five Inventories (portable discovery)

Read docs/project-config.json (and the project-reference docs it points to) to locate — do NOT hardcode: source roots (entities, handlers, migrations, models), spec / feature-doc location (canonical stories, ACs, TC-* IDs), test locations (integration/unit/e2e — the ground truth of "what is proven"), release-notes / changelog / PBI-story dirs, and run/test commands. This skill runs on repos it has never seen; a hardcoded framework path is a guess wearing a citation.

Each inventory walks its ladder top-down and records the rung it landed on — the reader calibrates on it. Every ladder ends in a stated blocker; none has a rung of invention.

1. Story & test-case inventory (feeds the story map, §Quick-reference). The main user-facing capabilities in scope, each as As a … I want … so that …, plus the REAL cases proving each — spec TC-* IDs and/or the integration/unit/e2e it / [Fact] / scenario names. Reconcile the union of spec TCs and test-code cases. Ladder: specs → tests → PBIs/release notes/commit messages → the diff itself → state that no story source exists.
2. Domain storage & solution inventory (feeds each case's fourth part). Per case: the persisted field/column/table, the owning entity/value object, the migration that added or altered it, the value actually written (anchored/computed), and the rule/method/invariant that consumes it. Ladder: entity + mapping + migration read → graph trace of the writer/reader → schema dump → state the blocker.
3. Demo path & setup inventory (feeds setup/preconditions and the numbered steps). The real user path to each precondition: roles/permissions, configuration flags, seed or fixture entry points, which app/screen/endpoint, and what input. Ladder: existing seeders/fixtures → e2e test setup → manual path traced through the UI/API code → state that the precondition cannot be staged.
4. Proof inventory (feeds the proof rung per case). Which suites/cases exist, which are runnable here (resolve the command — never guess it), and what a run actually returned this session. Ladder: project-config.json commands → the CI workflow's own commands → the test-runner manifest (package.json scripts, *.csproj, Makefile) → state that no command could be resolved.
5. Discriminator inventory (feeds every expected result). Per case, the value/state that would have been WRONG under the old behaviour — from the diff, the fixed defect, the spec's AC, or the test's assertion. Ladder: the test assertion → the diff's before/after → the spec AC → state that the discriminator is unknown rather than writing "it succeeds".

[SECURITY] Record every command, credential, and account in placeholder form at the moment of collection — not at write time. Environment variables, connection strings, tokens, keys, passwords, and customer identifiers are referenced by NAME and rendered <redacted:…>; demo accounts are named by role (<demo user: approver>), never by real login. This is the point where a secret would first enter context, so it is the point that must refuse it.

When .code-graph/graph.db exists, run python .claude/scripts/code_graph trace <entity-or-handler> --direction both --json to map how a stored field flows to the reader that solves the case — this is how the "how the domain solves the feature" claim is backed by structure instead of guesswork.

Step 3 — Map Stories → Cases (persist the map)

• Main user story = a user-facing capability/outcome the feature delivers. Prefer the spec's stories; else synthesise one per distinct capability from ACs/tests. Keep to the main stories — group minor variants under the case list, don't inflate the count.
• Cases per story = the real cases that prove it. Use the ACTUAL IDs — NEVER invent case numbers. A story with no case is a coverage gap to report, never a gap to fill with a plausible ID.

Write the story → case map to disk before writing any case block, and cross-check it against the full changed-file list so no main area is missed. — why: the map is the coverage contract; held only in context it is one cutoff from gone.

Step 4 — Trace Domain Storage & Solution (the distinctive step)

For each main case, open the owning code and answer both questions with file:line evidence:

• How is the domain data stored or changed? The persisted field(s)/column(s)/table, the value object or entity that owns it, the migration that added/altered it, the anchored/computed value actually written, and whether the change is additive/nullable/backfilled. Read the entity, the DTO mapping, and the migration — NEVER infer persistence from names.
• How does the domain solve the feature? The rule/method/invariant that consumes that stored data to produce the demoed outcome (resolver/derivation/gate), and why storing it this way makes the case correct — edge cases, legacy fallback, cross-tier parity.

A display-only case with no persistence change says so explicitly and describes the representation that solves it instead (what value/shape is computed and why it is correct). "No storage change" is a valid and important answer for a demo — an empty block is not.

Step 5 — Open the Guide + Ledger, Accumulate Story by Story

Create the guide file BEFORE writing case one, then append as you produce it. Never hold the whole guide in context and write once at the end.

Write order is fixed: header FIRST — scope + source, sources used, delegations, tier + group count, and the group ledger with every row pending → then group by group (trace → write that group's cases → update its ledger row to written with its case count → complete that task) → then the guide-level sections (storage summary, quick-reference table, transparency note) from the written blocks → then the chat summary. NEVER hold more than the current group in context; read a finished block back from disk when you need it again.

After a cutoff, compaction, or resume: the current task list → read the ledger → verify every written row against the filesystem (the file exists AND carries its cases; an absent or truncated block resets to pending) → re-read the contract and the Understanding Brief → continue at the first unfinished group. NEVER restart a finished group and never re-derive a written block from memory.

[NO SILENT TRUNCATION] If any cap, budget, or interruption leaves part of the resolved scope uncovered, name what was deferred or dropped in the guide header AND in the chat summary — "Story D (bulk import, 9 cases) deferred — not covered by this guide." — why: bounded coverage that reads as complete coverage sends a presenter into a room unprepared for the question nobody examined.

Write location — the demo guide is a DELIVERABLE, not a working artifact. It is written to the project's demo-guide dir (Configuration below) and is meant to be shared and version-controlled. This is a deliberate divergence from $understand, whose report is a git-ignored working artifact — do NOT copy that skill's git-ignored-only rule here. — why: a demo script the team cannot find in the repo is a demo script nobody uses.

Step 6 — Write Each Case (four mandatory parts)

Follow references/demo-guide-template.md. Per main case the guide MUST contain:

1. Setup / preconditions — the exact state to stage before demoing (roles, configuration, seed data, which app/screen), staged through real user paths — never by faking state a user could not reach. Secrets as <redacted:…>, accounts by role.
2. Step-by-step demo flow — numbered, concrete, click-/action-level steps a presenter follows live: who acts, on which screen/endpoint, with what input, and where to look. A step you cannot trace to a real user path is a stated blocker, never an invented click.
3. Expected result — the observable outcome phrased as the discriminator: the value that would have been WRONG under the old behaviour, not a generic "it succeeds".
4. How the domain stores/changes data + solves it — the Step-4 explanation in plain team language, keeping the file:line anchors for credibility.

Also include: the scope/source header, per-story grouping, the main test-case quick-reference table (ID · what it proves · proof rung), the domain storage summary per story, and the test-execution transparency note. Keep prose tight (output-quality principles).

--lang given → emit a translated copy (prose translated; code identifiers, file:line, TC-* IDs, and numeric values kept verbatim). --html given → follow the Artifact flow to render a self-contained runbook after the markdown is approved.

Step 7 — Prove (the proof ladder)

Every case sits on exactly one rung. State it per case AND in the quick-reference table.

There is no fifth rung. A case you cannot place on one of these four is a stated blocker, not a case you quietly promote.

Proof chain per case — the file:line links a challenger can walk: where the value is written → where it is read → where the presenter sees it. A case whose chain has a missing link cannot sit above 📄 spec-only.

Transparency note (mandatory, at the end of the guide): what was proven this session (suites/cases executed + pass/fail counts), what was not and why (runner blocker, environment, no coverage), and which cases are therefore being shown live rather than via a green run. NEVER imply a run that did not happen.

Step 8 — Validate

Before declaring done, verify each — evidence, not assertion:

• MUST ATTENTION the resolved scope and its source (prompt / context / user-confirmed) are recorded in the guide header.
• MUST ATTENTION the Step 1 comprehension bar was cleared per story group, with file:line per answer, and the Understanding Brief is on disk.
• MUST ATTENTION every main user story is present, each with its REAL test-case IDs — no invented numbers — and every story with no case is named as a coverage gap.
• MUST ATTENTION every case has all four parts: setup · numbered demo flow · expected result as the discriminator · domain storage/solution.
• MUST ATTENTION every storage/behaviour claim cites file:line from a read entity/migration/handler — nothing inferred from a name.
• MUST ATTENTION every case carries a proof rung and a proof chain; ✅ ran appears only where a command was executed and recorded.
• MUST ATTENTION no secret value appears anywhere — settings, files, and account roles named; credentials rendered <redacted:…>.
• MUST ATTENTION anything deferred, sampled, or dropped is named in the guide header AND the chat summary.
• MUST ATTENTION the ledger's written rows are verified against the filesystem, and the output landed at the resolved path; translation/HTML produced only if requested.

Configuration

Resolve everything project-specific from docs/project-config.json; an optional block overrides demo-guide defaults:

{
    "demoGuide": {
        "outputDir": "docs/demo-guides",
        "specDir": "docs/specs",
        "translateDefaultLang": null,
        "storyGranularity": "main"
    }
}

Block or file absent → degrade gracefully: default outputDir to the project's docs/demo dir if one exists, else a temp file; discover spec/test/source locations from the project-reference docs; and state the fallbacks you used.

Integration with Other Skills

• $understand — reuse its Purpose→How→Why framing for the "how the domain solves the feature" explanation. ⚠️ Boundary — decide by audience, not by overlap: $understand §11 Test & Demo is reviewer-facing — how to run and see the change you are about to review, scoped to that change. This skill is presenter-facing — a standalone, stakeholder-ready script that walks a room through a whole feature. The per-case block is deliberately the same shape in both so they converge instead of drifting; showing finished work to people → here, preparing to review it → $understand.
• $investigate / $scout / $debug-investigate / $graph-trace — the Step 1 gate's read-only gather delegates. Their output is INPUT, re-verified at file:line; they never author a case block.
• $spec — the canonical source of user stories + TC-* IDs when the project maintains feature specs. **A business TC- and a demo case are the SAME event for two audiences — the spec states it as intent, this guide stages it for a room. So they converge by construction: reuse the TC's demo flow and expected result rather than re-deriving them, and cite the TC- ID per case so the two cannot drift apart. ⚠️ A TC-* you cannot stage as a live demo is a finding, not a formatting problem — it means a non-demoable (technical) case reached the business spec, which violates M7**. Report it; do NOT invent a demo to cover for it.
• $release-doc / $changelog — sibling generators; demo-guide is presenter-facing (how to show it), they are change-facing (what changed).
• $commit — commit the generated guide when the user wants it version-controlled.

[IMPORTANT] Use task tracking to break ALL work into small tasks BEFORE starting — one per story group (understand → trace → write) so a long feature can't overflow context. Persist the Understanding Brief and the story→case map early; NEVER hold them only in memory.

IMPORTANT MANDATORY Steps: resolve-scope-load-contract-size-and-task-first -> understand-the-feature-blocking-gate-six-question-bar -> gather-five-inventories-with-ladders -> map-stories-to-real-case-ids -> trace-domain-storage-and-solution -> open-guide-and-ledger-accumulate-story-by-story -> write-each-case-four-parts -> place-every-case-on-the-proof-ladder -> validate

Be skeptical. Apply critical thinking, sequential thinking. Every claim needs traced proof, confidence >80% to act.

<!-- SYNC:understand-code-first -->

Understand Code First — HARD-GATE: Do NOT write, plan, or fix until you READ existing code.

1. Search 3+ similar patterns (grep/glob) — cite file:line evidence
2. Read existing files in target area — understand structure, base classes, conventions
3. Run python .claude/scripts/code_graph trace <file> --direction both --json when .code-graph/graph.db exists
4. Map dependencies via connections or callers_of — know what depends on your target
5. Write investigation to .ai/workspace/analysis/ for non-trivial tasks (3+ files)
6. Re-read analysis file before implementing — never work from memory alone. — why: long context drifts from the file; the file is ground truth
7. NEVER invent new patterns when existing ones work — match exactly or document deviation. — why: divergent patterns fragment the codebase and slow every future reader

BLOCKED until: - [ ] Read target files - [ ] Grep 3+ patterns - [ ] Graph trace (if graph.db exists) - [ ] Assumptions verified with evidence

<!-- /SYNC:understand-code-first -->

<!-- SYNC:evidence-based-reasoning -->

Evidence-Based Reasoning — Speculation is FORBIDDEN. Every claim needs proof.

1. Cite file:line, grep results, or framework docs for EVERY claim
2. Declare confidence: >80% act freely, 60-80% verify first, <60% DO NOT recommend
3. Cross-service validation required for architectural changes
4. "I don't have enough evidence" is valid and expected output

BLOCKED until: - [ ] Evidence file path (file:line) - [ ] Grep search performed - [ ] 3+ similar patterns found - [ ] Confidence level stated

Forbidden without proof: "obviously", "I think", "should be", "probably", "this is because"
If incomplete → output: "Insufficient evidence. Verified: [...]. Not verified: [...]."

<!-- /SYNC:evidence-based-reasoning -->

<!-- SYNC:graph-assisted-investigation -->

Graph-Assisted Investigation — MANDATORY when .code-graph/graph.db exists.

HARD-GATE: MUST ATTENTION run at least ONE graph command on key files before concluding any investigation.

Pattern: Grep finds files → trace --direction both reveals full system flow → Grep verifies details

| Task | Minimum Graph Action |
| ------------------- | -------------------------------------------- |
| Investigation/Scout | trace --direction both on 2-3 entry files |
| Fix/Debug | callersof on buggy function + testsfor |
| Feature/Enhancement | connections on files to be modified |
| Code Review | tests_for on changed functions |
| Blast Radius | trace --direction downstream |

CLI: python .claude/scripts/code_graph {command} --json. Use --node-mode file first (10-30x less noise), then --node-mode function for detail.

<!-- /SYNC:graph-assisted-investigation -->

<!-- SYNC:incremental-persistence -->

Incremental Result Persistence — MANDATORY for all sub-agents or heavy inline steps processing >3 files.

1. Before starting: Create report file plans/reports/{skill}-{date}-{slug}.md
2. After each file/section reviewed: Append findings to report immediately — never hold in memory
3. Return to main agent: Summary only (per SYNC:subagent-return-contract) with Full report: path
4. Main agent: Reads report file only when resolving specific blockers

Why: Context cutoff mid-execution loses ALL in-memory findings. Each disk write survives compaction. Partial results are better than no results.

Report naming: plans/reports/{skill-name}-{YYMMDD}-{HHmm}-{slug}.md

<!-- /SYNC:incremental-persistence -->

<!-- SYNC:output-quality-principles -->

Output Quality — Token efficiency without sacrificing quality.

1. No inventories/counts — AI can grep | wc -l. Counts go stale instantly
2. No directory trees — AI can glob/ls. Use 1-line path conventions
3. No TOCs — AI reads linearly. TOC wastes tokens
4. No examples that repeat what rules say — one example only if non-obvious
5. Lead with answer, not reasoning. Skip filler words and preamble
6. Sacrifice grammar for concision in reports
7. Unresolved questions at end, if any

<!-- /SYNC:output-quality-principles -->

<!-- SYNC:critical-thinking-mindset -->

Critical Thinking Mindset — Apply critical thinking, sequential thinking. Every claim needs traced proof, confidence >80% to act.
Anti-hallucination: Never present guess as fact — cite sources for every claim, admit uncertainty freely, self-check output for errors, cross-reference independently, stay skeptical of own confidence — certainty without evidence root of all hallucination.

<!-- /SYNC:critical-thinking-mindset -->

<!-- SYNC:ai-mistake-prevention -->

AI Mistake Prevention — Failure modes to avoid on every task:

Re-read files after context changes. Context compaction, resume, or long-running work can make memory stale; verify current files before acting.
Verify generated content against source evidence. AI hallucinates APIs, names, claims, and document facts. Check the relevant source before documenting or referencing.
Check downstream references before deleting or renaming. Removing an artifact can stale docs, generated mirrors, configs, and callers; map references first.
Trace the full impact chain after edits. Changing a definition can miss derived outputs and consumers. Follow the affected chain before declaring done.
Verify ALL affected outputs, not just the first. One green check is not all green checks; validate every output surface the change can affect.
Assume existing values are intentional — ask WHY before changing OR flagging one as a defect. Before changing or reporting a constant, limit, flag, cutoff, wording, or pattern, read nearby context and history, the CALLER's ordering, and 2+ sibling call sites of the same convention. A doc stating WHAT without WHY is missing rationale, not proof of a missing guard.
Surface ambiguity before acting — don't pick silently. Multiple valid interpretations require an explicit question or stated assumption with risk.
Assert the outcome your system owns, not the intermediate state your infrastructure owns. When verifying async work, assert the final business state — never the delivery/retry bookkeeping held in shared infrastructure that any co-running process can write. Such a check passes when run alone and flakes the moment anything else shares that infrastructure.
Keep shared guidance role-relevant. Universal guidance must help every receiving skill or agent; code-specific obligations belong only in code-specific protocols.

<!-- /SYNC:ai-mistake-prevention -->

<!-- SYNC:critical-thinking-mindset:reminder -->

MUST ATTENTION apply critical + sequential thinking — every claim needs appropriate traced evidence (file:line for repo/code claims; source URL or artifact section for research, product, content, and docs claims); confidence >80% to act, <60% DO NOT recommend. Anti-hallucination: never present guess as fact, admit uncertainty freely, cross-reference independently, stay skeptical of own confidence.

<!-- /SYNC:critical-thinking-mindset:reminder -->

<!-- SYNC:evidence-based-reasoning:reminder -->

IMPORTANT MUST ATTENTION cite file:line evidence for every claim (confidence >80% to act). NEVER speculate without proof.

<!-- /SYNC:evidence-based-reasoning:reminder -->

<!-- SYNC:understand-code-first:reminder -->

• MANDATORY IMPORTANT MUST ATTENTION search 3+ existing patterns and read code BEFORE any explanation. Run graph trace when graph.db exists.

<!-- /SYNC:understand-code-first:reminder -->

<!-- SYNC:graph-assisted-investigation:reminder -->

• MANDATORY IMPORTANT MUST ATTENTION run at least ONE graph command on key files when graph.db exists. Pattern: grep → graph trace → grep verify.

<!-- /SYNC:graph-assisted-investigation:reminder -->

<!-- SYNC:ai-mistake-prevention:reminder -->

MUST ATTENTION apply AI mistake prevention — verify generated content against evidence, trace downstream references before deleting or renaming, verify all affected outputs, re-read files after context loss, and surface ambiguity before acting.

<!-- /SYNC:ai-mistake-prevention:reminder -->

<!-- SYNC:output-quality-principles:reminder -->

IMPORTANT MUST ATTENTION follow output quality principles: token efficiency, lead with answer, no filler.

<!-- /SYNC:output-quality-principles:reminder -->

<!-- SYNC:parallel-subagent-dispatch -->

Parallel Sub-Agent Dispatch — Plan parallelism the moment a task breakdown exists, BEFORE executing it — running provably independent tasks sequentially wastes wall-clock. Applies to every multi-step job: workflow steps, planning, batch updates, investigation, research, scans, reviews, doc sync. Plan execution is metadata-gated, NEVER default-parallel — fan-out follows ONLY what the plan declares (PAR/SEQ tags + per-phase write set); an untagged plan runs sequentially — why: a derived write set cannot see cascade or generated writes.

1. Tag every task PAR or SEQ. PAR = inputs exclude every pending task's output AND write set disjoint from every other PAR. Else SEQ — MUST ATTENTION name the dependency forcing it.
2. Group PAR into waves. No edge between members. Two writers of one file NEVER share a wave. Read-only work (search, investigation, review, research) parallelizes freely.
3. Declare before dispatch: Parallel plan: wave 1 = [...] · wave 2 = [...] · SEQ = [...] (reason).
4. Spawn each wave in ONE message — every spawn_agent call in one response, NEVER dripped per turn. Route each task to its specialist (.claude/skills/shared/sub-agent-selection-guide.md); NEVER code-reviewer as catch-all.
5. Brief each sub-agent self-contained: goal · scope + owned files · reference docs · return contract (summary + Full report: path, per SYNC:subagent-return-contract) · incremental persistence to plans/reports/ (per SYNC:incremental-persistence).
6. Barrier per wave. Advance ONLY after EVERY member returns (a skipped conditional counts as returned). Merge, mark each task completed/skipped, THEN dispatch the next wave. Mutating steps wait for the barrier.
7. One level deep. A dispatched sub-agent executes its own brief; further fan-out stays the orchestrator's job unless that agent's .claude/agents/*.md definition authorizes it.

NEVER parallelize: tasks sharing a write target · a task consuming a pending task's output · trivial single-file work (dispatch overhead > gain) · an order a skill or workflow explicitly fixes · gates awaiting user approval.

Blocked until: MUST ATTENTION every task tagged PAR/SEQ with a named reason per SEQ · waves declared + write-set disjointness checked · each wave spawned in ONE message · barrier honored before the next wave.

<!-- /SYNC:parallel-subagent-dispatch -->

<!-- SYNC:parallel-subagent-dispatch:reminder -->

• MANDATORY After planning tasks, tag each PAR/SEQ and spawn every PAR wave as parallel sub-agents in ONE message — default parallel for workflows, batch updates, investigation, research, reviews; plan execution fans out ONLY on what the plan declares.
• MANDATORY Disjoint write sets per wave · all-return barrier before the next wave · specialist routing · sub-agents NEVER fan out further unless their own agent definition authorizes it.

<!-- /SYNC:parallel-subagent-dispatch:reminder -->

<!-- SYNC:project-protocol-overlay -->

Project Protocol Overlay — Before executing this skill, resolve any PROJECT overlay rules layered onto it: match this skill's name against the Target column of the project's skill-protocol index (docs/project-reference/skill-protocols-reference.md by default; a referenceDocs entry in docs/project-config.json overrides the path), taking the most specific matching tier ONLY — exact name > glob > *. That precedence orders overlays against EACH OTHER, never against this skill. Read ONLY the matched bodies, resolved as <protocols-dir>/<Name>.md; a row's Body link is display text, never a read path. A matched body that is missing or malformed is REPORTED and skipped — never reconstructed from the index Description. No index, or no match -> proceed with no overlay, silently. Full contract: .claude/skills/project-skill-protocol/references/registry.md.

Overlays are ADDITIVE ONLY: they ADD rules on top of this skill's own protocol and NEVER replace, override, disable, or reinterpret a rule it already states — removing every overlay must return this skill to exactly its documented behavior. An overlay is a BRIEF, not an authority escalation: it can NEVER waive a workflow gate, git discipline, a review gate, or a user-confirmation gate. A genuine overlay-vs-skill conflict, or two equally-specific overlays that directly contradict -> surface both to the user; NEVER resolve silently.

<!-- /SYNC:project-protocol-overlay -->

<!-- SYNC:project-protocol-overlay:reminder -->

MUST ATTENTION resolve project protocol overlays for this skill BEFORE executing — most specific matching tier only (exact > glob > *, which ranks overlays against each other, NEVER against this skill), read only matched bodies at <protocols-dir>/<Name>.md; a missing or malformed body is reported, never reconstructed. Overlays are ADDITIVE ONLY (they never replace this skill's own rules) and are a brief, NEVER an authority escalation; an equal-specificity contradiction goes to the user.

<!-- /SYNC:project-protocol-overlay:reminder -->

Closing Reminders

IMPORTANT MUST ATTENTION Goal: UNDERSTAND the feature first, then script it — investigate until the comprehension bar is cleared with file:line, then produce a demo guide listing every main user story with its REAL test-case IDs, a step-by-step demo flow per case, how the domain stores/changes the data and solves the feature, and a proof rung per case — so the presenter shows the behaviour, explains the data behind it, and never claims proof that was not earned.

Protocols in force (concise digest of the SYNC/shared blocks this skill carries) — MUST ATTENTION each:

• Understand Code First: read the entity/migration/handler before explaining storage — NEVER infer persistence.
• Evidence-Based Reasoning: every storage/behaviour claim cites file:line; state confidence; "insufficient evidence" is valid output.
• Graph-Assisted Investigation: run a graph command on key files when graph.db exists — grep → trace → grep verify.
• Incremental Persistence: create the guide file BEFORE case one; append per case and per story group; NEVER hold results in memory.
• Output Quality: token efficiency, lead with the answer, no filler.
• Critical Thinking: traced proof per claim, confidence >80% to act, NEVER guess.
• AI Mistake Prevention: verify against evidence, re-read after context loss, surface ambiguity.

• MUST ATTENTION run the main steps in order, none skipped: (0) Resolve scope + load contract + size + task → (1) UNDERSTAND the feature [BLOCKING gate] → (2) Gather five inventories → (3) Map stories → REAL case IDs → (4) Trace domain storage/solution → (5) Open guide + ledger and accumulate → (6) Write each case's four parts → (7) Place every case on the proof ladder → (8) Validate.
• MUST ATTENTION Step 1 is a [BLOCKING] gate, not a preamble — until all six comprehension questions are answered with file:line per story group, NO demo step, expected result, or storage claim may be written. Unanswerable question → keep investigating, delegate, or state it as a blocker; NEVER paper over it with a plausible step.
• MUST ATTENTION scope precedence is prompt → current context → ASK — NEVER silently invent the feature.
• MUST ATTENTION DELEGATE the GATHERING to read-only skills ($scout, $investigate, $debug-investigate, $graph-trace, $spec-index) when read + grep + trace cannot clear the bar — NEVER to a mutating or findings-emitting skill, never let a delegate author a case block, and re-verify every delegated claim at file:line first. At S3+ delegation runs inside the group's sub-agent, not the orchestrator.
• MUST ATTENTION SIZE the target into a tier (S0–S4) and DECOMPOSE anything above S1 into story groups (≤8 files / ≤2000 diff-lines, each demoable in one sitting) — announce both in one line. Scale buys MORE GROUPS, never FEWER PARTS per case; "too big to demo properly" is a conclusion this skill may never reach.
• MUST ATTENTION BREAK THE WORK INTO TASKS before the first deep read — the current task list first (resume, never duplicate), one task per story group plus the fixed tasks, exactly one in_progress, and a group task completed ONLY when its block is on disk.
• MUST ATTENTION OPEN the guide — header, ledger, group rows — before case one, ACCUMULATE story group by story group, and write the guide-level sections from the written blocks, never from memory. After any cutoff or compaction, verify every written ledger row against the filesystem before continuing.
• MUST ATTENTION every main case = setup/preconditions + numbered step-by-step demo flow + expected result phrased as the discriminator + how the domain stores/changes data & solves the feature. A case missing the storage/solution part is incomplete; a display-only case states "no storage change" and describes the computed representation.
• MUST ATTENTION PROOF IS EARNED: every case sits on one of four rungs — ✅ ran (executed THIS session, command + result recorded) · ⚠️ trace-verified · 📄 spec-only · ❌ no coverage — plus a proof chain (written → read → seen, file:line each). There is no fifth rung; an unplaceable case is a stated blocker. NEVER imply a green run that did not happen.
• MUST ATTENTION use the project's REAL user stories and TC-* / test IDs — NEVER invent a case number. No coverage → say so; an admitted gap is a finding, a fabricated ID retires a live risk.
• MUST ATTENTION stage every precondition through a REAL user path and trace every demo step to real code — an untraceable step is a stated blocker, never an invented click, endpoint, or faked state.
• MUST ATTENTION cite file:line for every storage/behaviour claim from a read entity/mapping/migration/handler — NEVER infer persistence from a field name.
• MUST ATTENTION NEVER put a secret value in the guide, the setup steps, or the chat summary — name the setting, the file, and the account role; credentials, tokens, keys, connection strings, and customer identifiers render <redacted:…> from the moment they would enter context.
• MUST ATTENTION announce anything deferred, sampled, or dropped in BOTH the guide header and the chat summary — bounded coverage must never read as complete coverage.
• MUST ATTENTION stay portable — discover paths, spec/test locations, and run commands via docs/project-config.json; NEVER hardcode project specifics, and state which degradation rung you landed on.
• MUST ATTENTION the demo guide is a shareable DELIVERABLE written to the project's demo-guide dir — do NOT copy $understand's git-ignored-working-artifact rule onto it.
• MUST ATTENTION break work into small todo tasks using task tracking BEFORE starting.

Anti-Rationalization:

[TASK-PLANNING] Before acting, analyze task scope and systematically break it into small todo tasks and sub-tasks using task tracking.

<!-- CODEX:SYNC-PROMPT-PROTOCOLS:START -->

Hookless Prompt Protocol Mirror (Auto-Synced)

Source: .claude/.ck.json + .claude/skills/shared/sync-inline-versions.md (:full blocks) + .claude/scripts/lib/hookless-prompt-protocol.cjs

[WORKFLOW-EXECUTION-PROTOCOL] [BLOCKING] Workflow Execution Protocol — MANDATORY IMPORTANT MUST CRITICAL. Do not skip for any reason.

Generic portability boundary: Reusable skills and protocol text stay project-neutral; project-specific conventions are discovered from docs/project-config.json and docs/project-reference/. Apply shared AI-SDD from shared/sdd-artifact-contract.md. Read docs/project-config.json and docs/project-reference/docs-index-reference.md, then open the project reference docs named there. For spec, test-case, behavior-change, public-contract, or docs/specs/ work, route through the local spec docs named by the docs index: feature-spec-reference.md, spec-system-reference.md, spec-principles.md, and workflow-spec-test-code-cycle-reference.md when specs/tests/code must stay synchronized. If either file or a required reference doc is missing or stale, auto-run $project-init (or the narrow lower-level route such as $project-config, $docs-init, $scan-all, or $scan --target=<key>) before ordinary project-specific work. Any supported AI tool may execute when this shared context and local docs are available.

1. DETECT: If the prompt starts with an explicit slash skill/workflow command, execute it directly. Otherwise match the prompt against the workflow catalog and skill list.
2. ANALYZE: Choose the best option: execute directly, invoke a skill, activate a standard workflow, or compose a custom step combination.
3. AUTO-SELECT: Pick the best option yourself. Do not ask the user to choose between direct execution, skill, standard workflow, or custom workflow.
4. ACTIVATE: For a selected workflow, call $start-workflow <workflowId>; for a selected skill, invoke that skill; for a custom workflow, sequence custom steps directly; for direct execution, proceed with the task.
5. CREATE TASKS: task tracking for ALL workflow/skill/custom steps before execution when the selected path has multiple steps.
6. PARALLELIZE: Before executing the task list, tag each task PAR (independent inputs + write set disjoint from every other PAR task) or SEQ (name the blocking dependency), group PAR tasks into waves, declare the wave plan, and spawn each wave's sub-agents in ONE message — all-return barrier per wave, fan-out one level deep unless a sub-agent's own definition authorizes further fan-out. Sequential-by-default is a defect when tasks are independent; do not parallelize shared write targets, output-consuming tasks, trivial single-file work, ordering a skill or workflow explicitly fixes, or user-approval gates.
7. EXECUTE: Advance per the Workflow Step Advancement & Parallel Phases rule in your context instructions — model-driven; a sub-agent completion advances a step identically to an inline call; a parallel-phase group is an all-return barrier (advance only after ALL members return, never serialize it)

Shared AI-SDD Protocol Markers

Source: .claude/skills/shared/sync-inline-versions.md

SYNC:ai-sdd-artifact-contract

AI-SDD Artifact Contract — Shared spec-driven development rules stay portable and source-owned.

1. Keep reusable AI-SDD principles in .claude; put repository-specific paths, commands, owners, products, and formats in project config/reference docs.
2. Preserve cycle: spec -> plan -> tasks -> implement -> verify -> update spec/docs.
3. Trace every requirement or invariant through decision, task, TC/test, source evidence, and docs/spec update.
4. Treat code-to-spec extraction as reference-only until accepted by the canonical spec owner.
5. Any supported AI tool may plan, implement, review, or verify with synced context; using multiple tools is optional.
6. Update .claude source first, then sync generated mirrors; do not manually edit .agents, .codex, or AGENTS.md. — why: mirrors are generated artifacts; hand-edits are overwritten on the next sync
7. If docs/project-config.json, root instruction files, or a required project-reference doc is missing or stale, auto-run $project-init or the narrow lower-level route before ordinary project-specific work.

Active reference: shared/sdd-artifact-contract.md in the active skills root.

SYNC:ai-sdd-artifact-contract:reminder

• MANDATORY Apply shared/sdd-artifact-contract.md; keep reusable AI-SDD in .claude and local rules in project docs.
• MANDATORY Code-to-spec extraction is reference-only until canonical acceptance; any supported AI tool may execute with synced context.
• MANDATORY Update .claude source before syncing generated mirrors; do not manually edit .agents, .codex, or AGENTS.md.
• MANDATORY Missing or stale project config, root instruction files, or required reference docs route project-specific work through $project-init or the narrow setup route automatically.

[TASK-PLANNING] [MANDATORY] BEFORE executing any workflow or skill step, create/update task tracking for all planned steps, then keep it synchronized as each step starts/completes.

[LESSON-LEARNED-REMINDER] [BLOCKING] Task Planning & Continuous Improvement — MANDATORY. Do not skip.

Break work into small tasks (task tracking) before starting. Add final task: "Analyze AI mistakes & lessons learned".

Extract lessons — ROOT CAUSE ONLY, not symptom fixes:

1. Name the FAILURE MODE (reasoning/assumption failure), not symptom — "assumed API existed without reading source" not "used wrong enum value".
2. Generality test: does this failure mode apply to ≥3 contexts/codebases? If not, abstract one level up.
3. Write as a universal rule — strip project-specific names/paths/classes. Useful on any codebase.
4. Consolidate: multiple mistakes sharing one failure mode → ONE lesson.
5. Recurrence gate: "Would this recur in future session WITHOUT this reminder?" — No → skip $learn.
6. Auto-fix gate: "Could $code-review/$code-simplifier/$security-review/$lint catch this?" — Yes → improve review skill instead.
7. BOTH gates pass → ask user to run $learn.

[CRITICAL-THINKING-MINDSET] Apply critical thinking, sequential thinking. Every claim needs traced proof, confidence >80% to act. Anti-hallucination principle: Never present guess as fact — cite sources for every claim, admit uncertainty freely, self-check output for errors, cross-reference independently, stay skeptical of own confidence — certainty without evidence root of all hallucination. AI Attention principle (Primacy-Recency): Put the 3 most critical rules at both top and bottom of long prompts/protocols so instruction adherence survives long context windows. Goal-driven execution: Define success criteria first, loop until verified, and stop only when observable checks pass. Tests verify intent: Tests must protect business rules/invariants and fail when the protected intent breaks, not only mirror current behavior.

Common AI Mistake Prevention (System Lessons)

• Re-read files after context compaction. Edit requires prior Read in same context; compaction wipes read state. Re-read before editing.
• Grep for old terms after bulk replacements. AI over-trusts find/replace completeness. Grep full repo after bulk edits for missed refs in docs/configs/catalogs.
• Check downstream references before deleting. Deletions cascade doc/code staleness. Map referencing files before removal.
• After memory loss, check existing state before creating new. Compaction wipes prior-work memory. Query current state to resume — never blindly duplicate.
• Verify AI-generated content against actual code. AI hallucinates APIs, class names, method signatures. Grep to confirm existence before documenting/referencing.
• Trace full dependency chain after edits. Changing a definition misses downstream consumers. Trace the full chain.
• When renaming, grep ALL consumer file types. Some file types silently ignore missing refs (no compile error). Search code, templates, configs, generated files.
• Trace ALL code paths when verifying correctness. Code existing ≠ code executing. Trace early exits, error branches, conditional skips — not just happy path.
• Update docs that embed canonical data when source changes. Docs inlining derived data (workflows, schemas, configs) go stale silently. Update all embedding docs alongside source.
• Verify sub-agent results after context recovery. Background agents may finish while parent compacted — grep-verify output, don't trust assumed completion.
• Cross-check full target list against sub-agent assignments. Parallel sub-agents by category miss boundary items. Reconcile union of assignments against target list before proceeding.
• Sub-agents inherit knowledge only from their agent .md definition — use custom agent types, not built-in Explore. Tool adoption = permission + knowledge + enforcement (numbered workflow step).
• Persist sub-agent findings incrementally, not as a final batch. Long sub-agents hit cutoffs before final write — findings lost. Instruct append-per-section to report file.
• When debugging, ask "whose responsibility?" before fixing. Trace caller (wrong data) vs callee (wrong handling). Fix at responsible layer — never patch symptom site.
• Test failure → record a provisional verdict before trace/edit, then investigate. Use the full five-way taxonomy: SOURCE-WRONG (production violates intent), TEST-WRONG (assertion/setup is stale), TEST-NOT-OPTIMAL (valid but fragile or low-signal test), ENVIRONMENT-BLOCKED (external state prevents a verdict), or AMBIGUOUS (intent/evidence cannot choose safely). Then trace root cause and triangulate against the governing spec (docs/specs/** if one exists) AND source. NEVER weaken an assertion, add a skip, relax a timeout, or change source merely to force green.
• Grep ALL removed names after extraction/refactoring. Primary file "done" ≠ secondary files clean. Grep entire scope for every removed symbol before declaring complete.
• Assume existing values are intentional — ask WHY before changing OR flagging one as a defect. Pattern-matching as "wrong" skips context. Before changing or reporting any constant/limit/flag/cutoff: read comments, git blame, the CALLER's ordering (the guarantee that makes the value correct usually lives in code running immediately BEFORE the cited line), and 2+ sibling call sites of the same convention. A doc stating WHAT without WHY is missing rationale, not proof of a missing guard — and in a validation pass, an accurate file:line citation proves the transcription, never the defect.
• Verify ALL affected outputs, not just the first. One build green ≠ all green. Multi-stack changes (backend/frontend/tests/docs) require verifying EVERY output.
• Evaluate fit before copying a nearby pattern. Closest example ≠ matching preconditions — verify the new context shares the same constraints, base classes, scope, lifetime.
• Holistic-first debugging — resist nearest-attention trap. Don't dive into first plausible cause. List EVERY precondition (config, env vars, paths, DB, endpoints, creds, versions, DI, data). Verify each against evidence (grep/query — not reasoning). Ask "what would falsify this?" — if nothing, it's not a hypothesis. Most expensive failure: going deeper in "obvious" layer while bug sits in layer never questioned.
• Surgical changes — apply the diff test (context-aware). Two modes: (1) Bug fix → every line traces to the bug; no restyling; orphan cleanup only for imports YOUR changes made unused. (2) Review/enhancement → implement improvements AND announce as "Enhancement beyond main request: [what]". Never silently scope-creep. Diff test: "Would this line exist if I wasn't asked to do X?" — if no, delete or announce.
• Surface ambiguity before coding — don't pick silently. Multiple valid interpretations → present each with effort: "[Request] could mean (1) [N h], (2) [N h]. Which matters?" List scope/format/volume/constraints assumptions first. If simpler path exists, say so. Never silently pick.
• [MANDATORY FIRST ACTION] ALWAYS activate a suitable skill or workflow BEFORE responding. Match task against workflow catalog + skill list; invoke via skill invocation or $start-workflow <workflowId>. NEVER answer or write code before checking. Skip = protocol violation.
• Why-Review adversarial mindset — apply when reviewing any plan, decision, or design. Default SKEPTIC not VALIDATOR: steel-man a rejected alternative, invert each stated reason ("what does it sacrifice?"), stress-test top 2-3 assumptions, run pre-mortem ("ships, fails in 3 months — what breaks?"), surface 1-2 alternatives author missed. Section presence ≠ quality; quality = causal reasoning + concrete mitigations + evidence, not "it's better" or "monitor closely".
• Front-load report-write in sub-agent prompts for large reviews. Many-file sub-agents hit budget before final write — findings lost. Design prompts so: (1) report-write is first explicit deliverable, (2) append per-file/section (not batched), (3) scope bounded so reads don't exhaust budget. Truncated mid-sentence with no report file → spawn narrower scope, don't retry same prompt.
• After context compaction, re-verify all prior phase outcomes before continuing. Summaries describe intent, not environment state (git index, filesystem, processes). On resume, FIRST audit: git status, re-read modified files, verify filesystem. Every "completed" claim is an untested hypothesis until evidence confirms.
• OOM/memory: check row count before row size. Triage: (1) Unbounded query — no DB filter for trigger? Push filter to DB; eliminates OOM. (2) Large rows? Projection reduces proportionally. Row reduction > projection in ROI.
• Assert the outcome your system OWNS, never the intermediate state your INFRASTRUCTURE owns. When testing anything asynchronous (queue/broker delivery, retries, background jobs, caches, replication), assert the final business/entity state. NEVER assert the delivery bookkeeping — consume/send status, attempt counts, last-error, row existence or counts in a broker, scheduler, or outbox/inbox table. That bookkeeping lives in shared infrastructure that ANY co-running process (a peer worker, a second replica, a leftover local container) can write, usually under a deterministic shared key, so the assertion silently tests the developer's environment instead of the system: green when run alone, flaky the instant anything else shares that broker + database. Gate question for every assertion: "would this hold no matter WHICH process did the work?" — if no, assert the converged data state instead. Corollary: process-local fault injection and in-process telemetry cannot gate work any process may perform — use them as stress amplifiers (arm → bounded window → disarm → assert convergence), never as preconditions.
• Keep domain concepts out of generic/shared/infrastructure layers. Reusable layer (shared library, framework, infra module) must reference NO consumer-specific domain concept — tenant/customer/product IDs, business entities, feature rules. Leak compiles + runs → passes review silently while coupling the "reusable" layer to one consumer. Keep shared type domain-free; push domain fields/logic down into the consumer via subclass/composition. — why: a layer coupled to one consumer's domain is no longer reusable.

<!-- CODEX:SYNC-PROMPT-PROTOCOLS:END -->