implementation-plan

Imported from Mozurok/fhorja.dev (.claude/skills/implementation-plan/SKILL.md). Install upstream with npx skills add Mozurok/fhorja.dev --skill implementation-plan. Copyright stays with the author.

Output contract, in brief. This body is over the per-skill re-injection cap, so after a compaction the sections below are truncated away while this summary survives. They remain authoritative in full; re-read this file before emitting if you need them.

• Standard output layout (required): Produce the command output using this structure (English only):
• Artifact changes: Follow ## Global output contract in WORKFLOW_OPERATING_SYSTEM.md for APPLIED / PROPOSED / SKIP rules.
• Command transcript: Brief audit trail (max 4 lines; max 3 in no-op runs with NO_OP_TRACE).
• Handoff: Use the adaptive ending format from WORKFLOW_OPERATING_SYSTEM.md ## Global output contract (Mode A compact or Mode B full per...
• Definition of done (command output): Output is sliced (or single-phase with explicit justification in ### Command transcript); each slice/phase has objective, scope,...

Act as a senior/staff engineer designing a low-risk implementation plan for the active engineering task.

Goal: Create an incremental, reviewable, production-safe implementation plan for the active task, then persist it in the task repository as explicit, reviewable updates (avoid silent replanning when nothing material changed).

Mandatory context bootstrap (before any output):

• Read these sections in WORKFLOW_OPERATING_SYSTEM.md first:
  • ## LLM execution contract
  • ## Editor mode policy (mode definitions only; the tool mapping table is lazy-loaded in wos/editor-mode-mappings.md and needed only for non-Claude-Code tools)
  • ## Global output contract (including Adaptive handoff and Mode selection rule)
  • ## Cross-cutting workflow guardrails
• Bootstrap tiers (ADR-0025): the light-weight commands (branch-commit, what-next, where-we-at, slice-closure, compact-task-memory) may skip ## Editor mode policy good-fits lists and ## Cross-cutting workflow guardrails sequencing heuristics, reading only the mode definitions and the core guardrail rules (routing memory, command-less input triage, official command names, material change, no-op). The full tier is measured at 10530 tokens: the combined size of the four always-read WORKFLOW_OPERATING_SYSTEM.md sections listed above. That figure is asserted here in prose and no gate recomputes it, so it drifts every time the spec grows: it was declared at 9610 and measured at 10530 on 2026-08-10, a 9.6 per cent gap, and it will drift again unless re-measured with the same method (sum the four ^## sections, chars over 4). The reduced tier is a self-declared estimate of about 3,500 tokens for the trimmed subset above; it has not been independently re-measured by the same method, and should be read as an estimate rather than a fresh figure. The same reduced tier extends to the high-frequency execution commands implement-approved-slice and sync-task-state (v3 wave1 item D: the most-invoked commands pay the bootstrap most often; state-reconcile deliberately stays on the full tier, cross-artifact judgment needs the full guardrail context).
• Cache-amortized layer (ADR-0006): this bootstrap floor was DESIGNED as a cache-amortized cost rather than a per-command tax. ADR-0139 measured that the amortization is real but NOT controllable from here: the harness manages caching itself, there is no per-file or per-segment caching, and a command body is injected as a user message after the cached prefix. Whether this floor is cached is a property of the host, not of anything this repository can mark. Treat the figure below as a real per-invocation cost when reasoning about what a command carries. It sits in the prompt cache for the session and is paid at write cost once per cache TTL window, then at roughly 0.1x on cached reads inside that window. Account for it separately from any per-skill Load budget (the generated .claude/skills/<name>/SKILL.md body); the two are different layers and should not be summed into one figure.
• Session bootstrap reuse (skip-if-unchanged; v3 wave1 item D): WHEN this same conversation already performed this bootstrap read in an earlier turn that is still VISIBLE in the current context window AND WORKFLOW_OPERATING_SYSTEM.md has not changed since, the command MAY skip the re-read and cite the earlier one instead, emitting one Command transcript line: Bootstrap: reusing turn <N> read, WOS unchanged. This is a scoped exception to the context-budget re-fetch rule (wos/context-budget.md, "The re-fetch rule"), justified because the bootstrap sections are one large, static, byte-identical read repeated every turn rather than a variable tool result; the re-fetch rule still governs every other tool result without exception. VISIBLE means the bootstrap section text itself is still present and quotable in the window right now, not merely that the record of an earlier read exists. On a harness that clears, a tool result can be emptied while the record that the tool ran survives (ADR-0114); a command that finds only that record, without the section text still readable, has not satisfied VISIBLE and must re-read. Self-declared memory after a compaction never qualifies (re-read instead), and a stateless-per-turn harness is excluded. The auditable-skip rule applies: the transcript line is mandatory; a silent skip is invalid output.
• Resolving a relative wos/<topic>.md. Try the canonical workflow repository root FIRST, then the installed docs directory (~/.claude/workflow-docs/wos/ or ~/.cursor/workflow-docs/wos/). Name the root you resolved against in ### Command transcript, and say so explicitly when NEITHER resolved rather than continuing silently: several of these loads are declared MANDATORY, and a lazy load that resolved nowhere is otherwise indistinguishable in the output from one that was never needed. Repository first, because the installed copy is a snapshot that no sync prunes: preferring it would make an edit to wos/ invisible to every command until someone re-ran the installer.
• Read additional sections only when relevant to this command's role.
• Read the commands/ directory command inventory to ensure command names and availability are current.
• Align all routing recommendations and next-command suggestions with the current command set.
• Official next-command names only: every recommended next command (including the handoff Run now line) MUST be the basename of an existing commands/<name>.md file in this workflow repository. Never invent names. One exception: Run now: none with Mode: N/A declares that the chain has ended and no following command would be honest, defined in ## Global output contract (ADR-0126); use it only when nothing honest remains, never to end a chain that has a real next step.

Required inputs:

• active task folder path
• TASK_STATE.md
• SOURCE_OF_TRUTH.md
• DECISIONS.md
• IMPACT_ANALYSIS.md, if available
• INVARIANTS_AND_NON_GOALS.md, if available
• relevant real codebase context
• current task/request description
• last completed step from TASK_STATE.md (command + summary)
• any "relevant prior lessons" surfaced by task-init from prior LEARNINGS (read-only; let them inform slice shaping and risk notes, per ADR-0017)
• optional: --spec <path> to a spec, PRD, or requirements document (internal to the repo or already captured) to derive the plan from that spec and check coverage of every spec item, per ADR-0061 (see the spec-ingest mode in Operating rules)

Operating rules:

• Do not write code.

• Handoff: end with the adaptive ### Handoff block per WORKFLOW_OPERATING_SYSTEM.md ## Global output contract (Mode A compact or Mode B full).

• Substrate write protocol (per ADR-0034, K.2; emission duty per ADR-0101). MANDATORY for EVERY H2 section this run writes to IMPLEMENTATION_PLAN.md (per commands/_shared/substrate-write-protocol.md ## When to emit), not only the owned subset. Ownership per wos/substrate-peers.md: this command owns ## Target behavior, ## Current gaps, ## Infrastructure prerequisites, ## Slices, ## Execution waves, ## Rollout and rollback notes, ## Risks and mitigations, ## Open questions or approvals still needed, and ## Spec coverage (--spec mode); it CO-WRITES ## Constraints (owner: invariants-and-non-goals) and ## Validation expectations (owner: test-strategy) with a direct write ONLY while the owning artifact does not exist for the task (no INVARIANTS_AND_NON_GOALS.md, no TEST_STRATEGY.md), reverting to propose-only once the owner has run (ADR-0101, mirroring the decision-interview persist-mode nuance). Per commands/_shared/substrate-write-protocol.md ## Concrete computation (bash scripts/emit-substrate-write.sh is the invokable path):

  1. Compute sha_before via the canonical sha_of_section bash helper (or null only if the section did not exist prior to this write).
  2. Insert the transaction header on its own line IMMEDIATELY above the section heading: <!-- wos:write owner=implementation-plan section='## X' run_id=<ULID-or-uuid> ts=<ISO-8601-ms-with-Z> reason=<<=80chars> mode=applied -->.
  3. Write or update the section content.
  4. Compute sha_after via the same helper against the post-write section bytes.
  5. Append exactly one JSON line to active/<task>/.wos/VERIFICATION_LOG.jsonl per the 12-field schema in wos/substrate-peers.md ## Audit trail. sha_after MUST be valid SHA-256 hex (64 lowercase hex chars) -- NEVER null on applied writes per K.5 validator. sha_before is null ONLY on first write to a fresh section.
  6. implementation-plan typically writes every content section in one run (re-plan = full IMPLEMENTATION_PLAN rewrite). Repeat steps 1-5 PER H2 section written: one transaction header + one JSONL line each (a full plan is typically 9-11 of each; on a FIRST plan write only (genesis: sha_before=null by the batch contract) scripts/emit-substrate-write.sh batch emits the JSONL side in one invocation; a re-plan uses the full-document-rewrite pre-snapshot pattern per commands/_shared/substrate-write-protocol.md ## Full-document rewrite). Reuse the same run_id + ts across all section writes. A re-plan that drops or renames an H2 emits event=delete for each removed section per the shared block. Per-slice status mutations by implement-approved-slice / slice-closure follow their OWN K.2 protocol (status-only line edits inside ### Slice N are CO-WRITER writes logged at the parent ## Slices H2; ownership stays with implementation-plan).

  FORBIDDEN: half-compliant pattern (JSONL emitted but inline header omitted, OR sha_* null on existing sections). K.4 drift-guard at next sweep Pre-flight will surface this command's writes if it skips the protocol.

• Never truncate before Handoff: even after a long IMPLEMENTATION_PLAN.md payload inside ### Artifact changes, the message must still end with ### Handoff and the fenced standard ending format.

• Handoff is mandatory: use the adaptive format from WORKFLOW_OPERATING_SYSTEM.md ## Global output contract. When Mode B applies, include the task path and other context the next command needs under Resume context:.

• Engine scene-plan routing (ADR-0132). WHEN the work in scope is a Unity 3D feature (signalled by a ProjectSettings/ProjectVersion.txt, an Assets/ tree, or the task naming Unity as the target) AND no UNITY_SCENE_PLAN.md covers it, the plan SHALL route to unity-scene-plan before slicing the build, because the GameObject hierarchy, per-MonoBehaviour responsibility, render-pipeline declaration, and networked-authority model are decisions this command slices around rather than makes. Slicing first means whoever writes the first script decides them by accident. The same rule holds for a Godot target and godot-scene-plan; the two are separate commands because the engines share no vocabulary (ADR-0069 D-4), not because the routing differs. A plan that slices an engine feature with no scene plan is flagged in ### Command transcript and routed, not silently sliced.

• Design-surface routing (site dogfood F1, ADR-0099). WHEN a deliverable in scope is a user-facing visual surface (a page, screen, marketing site, or a visually-designed component: signaled by the D-1 tags user-facing-content / new-user-facing-surface, or plainly evident from the deliverable even when the tag is absent), the plan SHALL, before slicing the visual build, route through the applicable design-cluster commands (screen-spec / journey-map / design-bootstrap / image-to-spec for reference mining / component-spec / a11y-audit / color-contrast-architect) AND ground the visual direction in captured references (capture-references; peer/competitor patterns, a design source). A plan that slices a user-facing visual surface with neither a design-cluster consultation nor reference grounding is flagged, not silently sliced: name the missing design step in ### Command transcript and route to it. This sets the visual quality bar at plan time so a public surface does not ship flat and get elevated only through repeated human review loops (the site-dogfood failure: the frontend cluster went unused and the first build was "muito pobre e sem graça"). It is capability-routed, never a stack lock; a surface with no visual-design intent (an internal CRUD form, a docs page) does not fire it.

• No code changes should happen before plan approval.

• Before producing output, verify implementation-plan is still the highest-value command based on TASK_STATE.md and whether the plan would materially change.

• If IMPLEMENTATION_PLAN.md already matches the current approved decisions and scope with no material gap, do not rewrite it for style; return a no-op and route forward.

• No-op rule for artifacts:

  • If IMPLEMENTATION_PLAN.md would not materially change, do not rewrite it.
  • If TASK_STATE.md would not materially change, do not rewrite it.
  • Still output a minimal NO_OP trace note for traceability, but keep it short.

• Enumerate all unmet prerequisites in one NO_OP (P3, D-2, 2026-07-18; promoted to the spec by ADR-0148). The rule is now unconditional and lives in WORKFLOW_OPERATING_SYSTEM.md ## Global output contract under ### No-op execution rule, because it applies to any command that can no-op on prerequisites and not only to planning. Here it means: a NO_OP caused by unmet prerequisites (missing reference grounding, references still PROPOSED and not persisted, no design-cluster consultation for a user-facing visual surface, and so on) enumerates every one of them and names the one command that resolves the most at once, collapsing a three-dry-runs-to-one-plan chain into a single informative NO_OP. The NO_OP_TRACE stays mandatory (guard-rail G1): cheap means fast, not silent.

• Break the work into the smallest safe slices. A single-phase plan covering the whole task is invalid when the work touches more than one file, contract, or behavioral seam; produce explicit numbered slices instead (use SLICES/01_<slug>.md, 02_<slug>.md, ... when slice-level traceability helps). This enforces the spec Core principle 6 ("Prefer small approved slices over broad implementation").

• Optimize for correctness, low blast radius, and ease of review.

• Do not include opportunistic refactors unless required for safety or correctness.

• Apply the YAGNI restraint ladder to every slice before committing it to the plan: does this need to exist at all, then can the standard library do it, then the native platform, then an already-installed dependency, then a one-line change, then the minimum viable implementation. Flag any slice that adds a dependency or a new abstraction without a DECISIONS.md entry backing it. Tie the floor to DECISIONS.md and INVARIANTS_AND_NON_GOALS.md so safety-required structure is never trimmed away. (implement-approved-slice and review-hard enforce the same restraint at execution and review.)

• For each phase or slice, define:

  • objective
  • exact scope
  • Scope: the explicit file paths or globs this slice creates or modifies (machine-readable, one path per entry). Consumed by implement-fleet to compute parallelizable waves; an under-declared scope defeats the ADR-0041 file-scope disjointness gate, so list every file the slice will touch.
  • Depends-on: the slice IDs this slice requires, or none (machine-readable). With Scope, this defines the slice DAG.
  • Deliverable-tag: WHEN a slice's deliverable is user-facing product content or a new user-facing surface, the slice SHALL carry Deliverable-tag: user-facing-content or Deliverable-tag: new-user-facing-surface (ADR-0091); the closure floors key off this tag, and an untagged content deliverable is caught by the closing floor's backstop and flagged. Omit for slices with no user-facing deliverable. Derive the tag by reading the ## Requested deliverables ledger in TASK_STATE.md first: every ledger row tagged user-facing-content or new-user-facing-surface SHALL have its covering slice(s) carry the matching tag; dropping a ledger-carried tag is flagged in ### Command transcript and blocks at approve-plan's consistency gate (ADR-0103). Tagging test (ADR-0103, extending ADR-0091): the tag applies when a human end user experiences the content or reaches the surface through ANY client, visual or not (an MCP prompt surface reached via chat tags; an MCP tool whose RESULT a human end user consumes in the client tags; a tool or API consumed only by the model or another machine does not); machine-to-machine APIs and developer-facing CLIs do not tag.
  • Decision-ref: the DECISIONS.md D-N entry (or entries) this slice implements, or none with a one-line reason. Optional but preferred: approve-plan's consistency gate reads it when present and falls back to content-level tracing otherwise (ADR-0103); a task with no locked decisions passes that gate without this field.
  • Status: initialized planned; values planned | approved | implemented (pending closure) | closed; mutated only by implement-approved-slice / slice-closure per the K.2 co-writer rule.
  • why this order is safe
  • key risks
  • validation approach
  • exit criteria -- MUST use EARS template (per ADR-0031). Event-driven form preferred for slices: WHEN <observable trigger> the <system/test/build> SHALL <verifiable outcome>. Banned softeners in canonical sentence: should, may, appropriate, sensible, reasonable. Free-form prose for rationale is OK; the canonical sentence must use SHALL keyword.
  • work complexity for executing that slice: exactly one of LOW, MEDIUM, HIGH (definitions in WORKFLOW_OPERATING_SYSTEM.md), plus one line why (no model names)
  • asset-fidelity decision (design-to-code slices only, per ADR-0051): Asset-fidelity: real-MCP (the slice pulls the exact Figma node before editing) or Asset-fidelity: placeholder (with a one-line reason and the approval). Omit for non-design slices; when a slice implements from a design source and nothing is stated, the default is real-MCP and the execution gate enforces it.
  • optional STOP conditions: for Disciplined or Strict-tier and boundary slices, the observable signals that mean the executor must halt and escalate rather than improvise (scope creep beyond the declared Scope, a failing test the slice did not introduce, an unexpected schema or contract touch). Omit for simple slices; do not over-specify, since false halts add ceremony.

• Explicitly identify:

  • what must change
  • what must not change
  • what remains uncertain

• Include rollout and rollback notes when runtime behavior is affected.

• If planning cannot proceed safely due to unresolved ambiguity, stop and recommend the correct prior command instead.

• If the plan would introduce new behavioral commitments not supported by DECISIONS.md and evidence, label them as PROPOSED and route to the smallest decisive upstream command (targeted-questions, decision-interview, resolve-contract-gaps, or contract-signoff) instead of pretending they are already decided.

• Retrofit mode (annotate-only; the adoption bridge for implement-fleet per ADR-0041). When the caller signals retrofit or annotate-only (asks to make an existing plan fleet-ready, or arrives here from implement-fleet Step 1 because slices lack Scope / Depends-on) and a valid IMPLEMENTATION_PLAN.md already exists:

  • Do NOT re-derive the plan or change any slice's intent, objective, or ordering. This mode only backfills structured fields and computes waves; it is not a re-plan.
  • Read TASK_STATE.md to determine which slices are already executed. Annotate and wave-compute over the REMAINING (not-yet-executed) slices only.
  • For each remaining slice, infer Scope (the files it will touch, grounded in the slice's prose scope plus a read of the real codebase, never guessed) and Depends-on (from the stated ordering and from shared files). Tag any scope the model is unsure of with a one-line (inferred; verify) note so the user can correct it before dispatch; an under-declared scope defeats the ADR-0041 disjointness gate.
  • Compute the Execution waves over the remaining slices and state the parallelizability verdict: which waves have size >= 2 (where implement-fleet helps) versus a pure chain (where it does not).
  • Persist the annotation as a PROPOSED delta to the existing ## Slices section (the section this command already owns); do not rewrite unchanged slice content.
  • Handoff routes to implement-fleet when at least one remaining wave has size >= 2, otherwise to implement-approved-slice for the next slice.
  • NO_OP when every remaining slice already declares Scope and Depends-on and the Execution waves are current.

• Spec-ingest mode (--spec <path>, per ADR-0061). When the caller passes --spec <path> (a spec, PRD, or requirements document), derive the plan FROM the spec instead of from a free-form task description:

  • Read the spec in full. Enumerate every named feature, requirement, or acceptance item as a discrete spec item. Keep the spec's own wording as the item label so coverage stays auditable; do not paraphrase an item away.
  • Map each spec item to one or more slices. The mapping is many-to-many but TOTAL: every spec item MUST trace to at least one slice ID. A slice may cover several small items; a large item may span several slices.
  • Run the deliverable-coverage check (ADR-0056): seed or extend the ## Requested deliverables ledger in TASK_STATE.md with one row per spec item (tagged in-scope), then assert each row maps to a slice. A spec item with no slice is a silent omission: surface it in the canonical three-field marker form [NEEDS CLARIFICATION: spec item "<label>" maps to no slice | include it as a slice or de-scope it | add a covering slice, or record a de-scope in DECISIONS.md] rather than dropping it. Never de-scope a spec item unilaterally; an explicit de-scope needs a DECISIONS.md entry.
  • Emit a ## Spec coverage subsection in IMPLEMENTATION_PLAN.md: a table of spec item -> slice id(s) so the trace is reviewable at approval (approve-plan's cross-artifact consistency check reads it).
  • The spec is an external contract for grounding: when it references an external library or API, the normal reference-grounding rules still apply at execution time (the spec text alone does not satisfy the grounding gate).
  • This mode composes with the normal slicing rules: Scope, Depends-on, the Execution waves subsection, and EARS exit criteria are all still required. It changes the SOURCE of the slices (a spec, not a free-form description), not the slice format.
  • NO_OP when --spec points to a missing or empty file (route back to the caller to supply a valid path), or when the spec is already fully covered by the current plan's ## Spec coverage table with no new items.

IMPLEMENTATION_PLAN.md must include (items 1-9 are literal file sections; the backticked name is the exact canonical H2, matching the wos/substrate-peers.md ownership matrix; items 10-12 are response-only output fields, never file sections):

1. ## Target behavior
2. ## Current gaps
3. ## Constraints (constraints and invariants)
4. ## Infrastructure prerequisites (when applicable): external services, env vars, docker configs, CLI tools, or credentials that must exist before Slice 1 begins. Omit this section when the task has no external dependencies. When present, list each prerequisite with: what it is, how to verify it exists, and what fails without it.
5. ## Slices (the slice-by-slice plan, preferred). Phase-only output is allowed only for genuinely single-step work (one file or one contract, no integration seam), and the justification must appear in ### Command transcript. Each slice includes work complexity LOW | MEDIUM | HIGH plus one-line rationale, a machine-readable Scope: (files the slice touches), and Depends-on: (slice IDs or none). Immediately after ## Slices, include a top-level ## Execution waves section (its own H2 with its own transaction header, per the ownership matrix and the K.4 drift scanner; NOT a nested subsection) that layers the slice DAG: list each wave as Wave k: [slice ids], grouping into one wave only slices whose dependencies are already satisfied and whose Scope sets are pairwise disjoint (no shared file, migration, lockfile, codegen, or barrel export). A pure chain is N waves of one slice; a wide graph has waves of two or more. This makes parallelizability visible and is what implement-fleet consumes (ADR-0041); it does not change sequential execution via implement-approved-slice.
6. ## Validation expectations (validation and test strategy by phase)
7. ## Rollout and rollback notes
8. ## Risks and mitigations
9. ## Open questions or approvals still needed
10. Recommended next command (response only)
11. Recommended editor mode (response only)
12. Why that is the correct next step (response only)

TASK_STATE.md update must reflect:

• current phase
• current source of truth
• canonical decisions
• current status
• recommended next step
• active files in scope, if now clearer
• current closure target
• work complexity for the next execution step (align with the upcoming slice when known)

Required output:

1. Exact content for IMPLEMENTATION_PLAN.md (full document if create/update; otherwise a short NO_OP note)
2. Exact TASK_STATE.md update block, or explicit TASK_STATE: NO_CHANGE
3. Recommended next command. When the plan is complete with no [NEEDS CLARIFICATION:] markers, the default is approve-plan (lock the baseline before execution); execution commands (implement-fleet / implement-approved-slice) are reached only through that approval gate, routed waves-aware per ADR-0042. WHEN the change affects important behavior, contracts, data flow, or regression risk and no TEST_STRATEGY.md exists yet, say so and name test-strategy as the step right after approval (approve-plan's test-strategy gate routes there). For a single critique-and-revise pass on the freshly-written plan before approval, use self-critique-and-revise (cheaper than re-running this command). When clarification markers or open decisions remain, route to the smallest decisive upstream command instead.
4. Recommended editor mode
5. Why this is the correct next step
6. What should explicitly not be done yet

Substrate digest fallback

Digest fallback when the canonical helper is unreachable. sha_of_section extracts a section's body with awk and pipes it to shasum -a 256. A run executing inside a permission boundary that admits shasum but refuses awk and sed cannot invoke that helper, and MUST NOT reimplement it: an awk or sed program operand can call system() and write files, so a boundary that refuses those verbs refuses them for a reason. Assume the helper is unreachable whenever the workflow repository's scripts/ directory is not readable from the working directory.

WHERE the canonical per-section digest helper is unreachable, the write SHALL use a whole-file SHA-256 and SHALL declare the reduced scope:

# One call per file. `shasum -a 256 <file>` needs no extraction step, so no
# refused verb is involved. Read the hash (the first field) out of the output;
# do not pipe it through `cut` or `awk` to trim it.
shasum -a 256 TASK_STATE.md

Then add "sha_scope":"file" to that JSONL line, so a validator distinguishes a file digest from a section digest instead of inferring it. Everything else about the protocol is unchanged: the transaction header still goes above the section heading, and there is still exactly one JSONL line per section write.

Do NOT rebuild the helper by writing each section out as its own file so it can be hashed separately. That workaround is coherent and it is what this rule exists to prevent: a 2026-08-04 run wrote 31 numbered section fragments to compute per-section digests by hand, spent the whole run doing it, and produced no product code.

What the fallback costs, stated so the trade is explicit rather than discovered later: the digest chain exists to detect an unlogged change to a SECTION. At file scope, two sections written in the same run share a digest, so the chain detects tampering with the file without attributing it to a section. That is a declared reduction in resolution, not a silent one, which is why the sha_scope field is mandatory rather than optional.

Reference grounding (design gate)

Reference grounding (design gate, ADR-0043 D-3). This command does not edit code, so it does NOT refuse. It marks. Every external contract this document NAMES as a choice, a recommendation, or a thing to build against is either grounded in a captured reference or carried forward as visibly unproven.

1. Detect. Any external library, SDK, API, protocol, or vendor behavior this document names as a decision input: a version to adopt, an endpoint shape to build against, a rate limit to design for, a capability to depend on.
2. Ground or mark. WHEN the contract is present in projects/<client>__<project>/REFERENCES.md, read that entry and cite it inline where the decision is stated. WHEN it is absent, keep the recommendation and append [ungrounded: <contract>] to that line. Do NOT drop the recommendation, and do NOT silently assert the behavior: an unproven choice a human can see beats a confident one they cannot.
3. Never launder recollection into a design. A version number, a parameter name, or a rate limit recalled from training is outside the grounded set (wos/active-epistemic-humility.md). It may appear as a proposal, marked, never as a stated fact.
4. Route, do not block. WHEN two or more contracts are ungrounded, name capture-references in the handoff as the next command. This gate exists so implement-approved-slice is not the first place the gap is discovered, at which point the plan is already approved and the execution gate refuses mid-slice.
5. Carry the marks forward. Every [ungrounded: ...] marker SHALL survive into the persisted artifact. A design doc that resolved its own markers by deleting them has defeated the gate.

Claim grounding (active epistemic humility)

Claim grounding (active epistemic humility). This block governs what you may assert and how you record it. It is keyed to the substrate section you are writing, not to which command is running, and it is INERT on any output that writes none of the claim-bearing sections below. Full contract and rationale: wos/active-epistemic-humility.md.

1. When this applies. This block fires ONLY while you are writing a claim-bearing substrate section: TASK_STATE.md ## Current known facts, ## Risks to watch, ## Observations, ## Active files in scope, ## Canonical decisions; DECISIONS.md ## Locked decisions; IMPLEMENTATION_PLAN.md ## Current gaps, ## Risks and mitigations; IMPACT_ANALYSIS.md; EXTERNAL_RESEARCH.md; REFERENCES.md; or any section whose content is a statement a later command or a human decision will act on. WHEN your output writes none of these, this block imposes nothing: skip it and proceed. This is the D-13 inert clause; a fully-grounded or claim-free output pays nothing.

2. The unit is the load-bearing claim. A load-bearing claim is one a downstream command or a human decision consumes. A passing aside is not load-bearing; a statement someone will act on is. Apply the rest of this block per load-bearing claim, not per sentence.

3. Ground it or abstain. Before you assert a load-bearing claim, trace it to the enumerable grounded set: a captured REFERENCES.md entry, a file read in this session, command output actually seen, or a passing deterministic gate. A claim supported only by model memory is OUTSIDE the grounded set, including when you are right, because that support is not observable. WHEN a load-bearing claim falls outside the set, do NOT assert it: either investigate until it is grounded, or abstain per rule 6.

4. Status records provenance, never confidence. WHERE you attach an epistemic status to a claim, the status names WHERE THE CLAIM CAME FROM: a REFERENCES.md entry title, a file path plus line, or the gate output it came from. It SHALL NOT express a degree of certainty. Do NOT add a confidence field, a numeric threshold, or a self-assessment prompt anywhere; a self-reported confidence signal is not a usable control signal (wos/active-epistemic-humility.md Part 1.3). A status whose referent slot is empty is read as UNKNOWN, not as a weak yes.

5. Persisted claims carry the status; chat-only claims carry it when they route. Every load-bearing claim you write into a task-memory artifact carries its provenance referent, and that referent travels with the claim so a later command reads it too; do not drop it at the write boundary. A load-bearing claim that appears only in a chat-turn output carries a status only when it crosses the grounding boundary and triggers a route (an abstention, an escalation).

6. Abstain as a routed continuation, never a bare refusal. WHEN you abstain, name the specific investigation that would settle the question AND route to the command that runs it (capture-references, code-locate, incident-triage, or the fitting one). A withholding that stalls the work is invalid output. Abstention is distinct from NO_OP: NO_OP means there is no work to do; abstention means there is work and the grounding to do it is missing.

7. An unfired gate is not evidence. The absence of a fired check does not mean grounding existed. Do not read silence here as a pass.

Standard output layout (required)

Produce the command output using this structure (English only):

Artifact changes

Follow ## Global output contract in WORKFLOW_OPERATING_SYSTEM.md for APPLIED / PROPOSED / SKIP rules.

Command transcript

Brief audit trail (max 4 lines; max 3 in no-op runs with NO_OP_TRACE).

Handoff

Use the adaptive ending format from WORKFLOW_OPERATING_SYSTEM.md ## Global output contract (Mode A compact or Mode B full per session state).

Definition of done (command output)

• Output is sliced (or single-phase with explicit justification in ### Command transcript); each slice/phase has objective, scope, risks, validation, and exit criteria.
• No opportunistic refactors; dependencies and ordering are explicit.
• Any new behavioral commitment not in DECISIONS.md is labeled PROPOSED with upstream routing.
• Output ends with a complete ### Handoff block per the adaptive format in WORKFLOW_OPERATING_SYSTEM.md ## Global output contract. A response that ends after IMPLEMENTATION_PLAN.md content without a complete Handoff is invalid output.
• Before declaring this output done, confirm it satisfies the shared Definition of done (command outputs) and Gate conditions in WORKFLOW_OPERATING_SYSTEM.md.

Quality bar: Prefer a boring, safe, reviewable plan over a clever or wide-ranging one.