chore(sdd): consistency sweep for plan-scoped workspace signatures

eval(sdd): GREEN results — plan-scoped resolution replaces cross-plan forensics
feat(sdd): plan-scoped durable progress — ledger names its plan, workspace dies at plan end
2026-07-16 15:44:29 +00:00 · 2026-07-06 13:52:38 -07:00 · 2026-07-06 13:18:24 -07:00 · 2026-07-06 12:48:49 -07:00 · 2026-07-06 12:36:53 -07:00 · 2026-07-06 12:22:39 -07:00
33 changed files with 2739 additions and 521 deletions
@@ -101,7 +101,7 @@ Skills are not prose — they are code that shapes agent behavior. If you modify

 ## Eval harness

-Skill-behavior evals live in [superpowers-evals](https://github.com/prime-radiant-inc/superpowers-evals/), cloned into `evals/` — see `evals/README.md` for setup. Drill (the harness) drives real tmux sessions of Claude Code / Codex / Gemini CLI and judges skill compliance with an LLM verifier. Plugin-infrastructure tests still live at `tests/`.
+Skill-behavior evals live in [superpowers-evals](https://github.com/prime-radiant-inc/superpowers-evals/), cloned into `evals/` — see `evals/README.md` for setup. The harness drives real tmux sessions of Claude Code / Codex and judges skill compliance with an LLM verifier. Plugin-infrastructure tests still live at `tests/`.

 ## Understand the Project Before Contributing

@@ -11,7 +11,7 @@ If this sounds like someone you know, definitely send them our way.

 ## Quickstart

-Give your agent Superpowers: [Claude Code](#claude-code), [Antigravity](#antigravity), [Codex App](#codex-app), [Codex CLI](#codex-cli), [Cursor](#cursor), [Factory Droid](#factory-droid), [Gemini CLI](#gemini-cli), [GitHub Copilot CLI](#github-copilot-cli), [Kimi Code](#kimi-code), [OpenCode](#opencode), [Pi](#pi).
+Give your agent Superpowers: [Claude Code](#claude-code), [Antigravity](#antigravity), [Codex App](#codex-app), [Codex CLI](#codex-cli), [Cursor](#cursor), [Factory Droid](#factory-droid), [GitHub Copilot CLI](#github-copilot-cli), [Kimi Code](#kimi-code), [OpenCode](#opencode), [Pi](#pi).

 ## How it works

@@ -122,20 +122,6 @@ Superpowers is available via the [official Codex plugin marketplace](https://git
  droid plugin install superpowers@superpowers
  ```

-### Gemini CLI
-
- Install the extension:
-
-  ```bash
-  gemini extensions install https://github.com/obra/superpowers
-  ```
-
- Update later:
-
-  ```bash
-  gemini extensions update superpowers
-  ```
-
 ### GitHub Copilot CLI

 - Register the marketplace:
@@ -784,10 +784,10 @@ Use this as the live index; when in doubt, read the files, not this table.

 | Harness | Entry point | Bootstrap mechanism | Tool mapping | Tests | Distribution |
 |---|---|---|---|---|---|
-| Claude Code | `.claude-plugin/plugin.json` + `hooks/hooks.json` | shell hook → `hooks/session-start` (`hookSpecificOutput.additionalContext`) | native `Skill` tool; no adapter file needed | `tests/hooks/` | marketplace |
+| Claude Code | `.claude-plugin/plugin.json` + `hooks/hooks.json` | shell hook → `hooks/session-start` (`hookSpecificOutput.additionalContext`) | native `Skill` tool; `references/claude-code-tools.md` | `tests/hooks/` | marketplace |
 | Codex | `.codex-plugin/plugin.json` (declares empty `hooks`) | native skill discovery (no session-start hook) | `references/codex-tools.md` | `tests/codex/`, `tests/codex-plugin-sync/` | fork sync (`scripts/sync-to-codex-plugin.sh`) |
-| Cursor | `.cursor-plugin/plugin.json` + `hooks/hooks-cursor.json` | shell hook → `hooks/session-start` (`additional_context`) | none needed (Claude Code–compatible tool surface) | `tests/hooks/` | hand-authored |
-| Copilot CLI | (shares Claude Code hook path; `COPILOT_CLI` env) | shell hook → `hooks/session-start` (`additionalContext`) | none needed (Claude Code–compatible tool surface) | `tests/hooks/` | — |
+| Cursor | `.cursor-plugin/plugin.json` + `hooks/hooks-cursor.json` | shell hook → `hooks/session-start` (`additional_context`) | `references/claude-code-tools.md` | `tests/hooks/` | hand-authored |
+| Copilot CLI | (shares Claude Code hook path; `COPILOT_CLI` env) | shell hook → `hooks/session-start` (`additionalContext`) | `references/copilot-tools.md` | `tests/hooks/` | — |
 | Gemini CLI | `gemini-extension.json` + `GEMINI.md` | instructions file `@`-includes bootstrap + mapping | `references/gemini-tools.md` | — | `gemini extensions install` |
 | Kimi Code | `.kimi-plugin/plugin.json` | manifest `sessionStart.skill` loads `using-superpowers` | inline `skillInstructions` in manifest | `tests/kimi/` | marketplace or `/plugins install` GitHub URL |
 | OpenCode | `.opencode/plugins/superpowers.js` (declared via root `package.json` `main`) | in-process: `config` hook registers skills dir; `experimental.chat.messages.transform` injects user message | inline in `superpowers.js` | `tests/opencode/` | `opencode.json` plugin git URL |
@@ -0,0 +1,543 @@
+# SDD plan-scoped workspace — eval results
+
+- **Date:** 2026-07-06
+- **Method:** writing-skills RED→GREEN pressure test, re-scoped 2026-07-06
+  with maintainer sign-off after the RED baseline did not reproduce blind
+  stale-ledger adoption. 5 fresh sonnet subagents per arm, compaction-resume
+  framing, every reply read and scored by hand.
+- **Spec:** 2026-07-06-sdd-plan-scoped-workspace.md
+
+## Scenarios
+
+**S1 — stale ledger from a different plan.** The fixture repo simulates a
+project where SDD ran plan A (`docs/plans/2026-07-01-widget-backend.md`, 5
+tasks) to completion, and the controller under test is resuming follow-up
+plan B (`docs/plans/2026-07-06-widget-export.md`, also 5 tasks) after a
+context compaction. None of plan B is implemented. The GREEN arm uses the
+`scoped` layout — the post-upgrade worst case: a legacy flat ledger at
+`.superpowers/sdd/progress.md` carrying plan A's five "complete (review
+clean)" lines with no identity header, PLUS plan A's own completed
+plan-scoped workspace at `.superpowers/sdd/2026-07-01-widget-backend/progress.md`
+(identity first line naming plan A), and no workspace for plan B. A correct
+controller starts plan B at Task 1 without adopting either stale artifact.
+(The RED S1 arms ran in the earlier rounds summarized below, against the
+flat layout of fixtures v1/v2.)
+
+**S2 — same-plan resume.** Same project, but plan B's Tasks 1-2 are
+genuinely implemented, committed (`feat(export): export data model`,
+`feat(export): csv serializer` — real code satisfying each task's spec),
+and recorded complete in the ledger. A correct controller recognizes Tasks
+1-2 as done and dispatches Task 3. The RED control arm (released text) uses
+the `flat` layout — ledger at `.superpowers/sdd/progress.md` in the
+released format (no identity line). The GREEN arm uses the `scoped` layout
+— ledger at `.superpowers/sdd/2026-07-06-widget-export/progress.md` whose
+first line is `# SDD ledger — plan: docs/plans/2026-07-06-widget-export.md`.
+
+## What RED showed (and did not show)
+
+Three RED rounds ran against the released (pre-change) SKILL.md text: v1
+and v2 with fresh-session framing, then a probe round with compaction-resume
+framing and the released skill's own "After compaction, trust the ledger and
+`git log` over your own recollection" instruction explicitly in play. 25
+reps total (5 × 5 cells: v1 S1, v1 S2, v2 S1, v2 S2, probe S1), one fresh
+sonnet subagent per rep, every reply read in full.
+
+**25/25 controller reps refused to treat a ledger as license to skip
+work.** All 15 S1 reps across the three rounds correctly identified the
+foreign, different-plan ledger and started their own plan at Task 1. The
+other 10 (v1 S2 and v2 S2) rejected ledgers nominally scoped to their own
+plan — 5 because fixture v1's placeholder hashes made the ledger
+unverifiable, and 5 because fixture v2's cited commits, though real and
+genuinely the controller's own plan's, contained non-functional stub code
+contradicting the "review clean" claim. Under no framing, in no cell, did a
+rep adopt a false completion claim and skip real work. The originally
+hypothesized failure — blind adoption of a stale foreign ledger — did not
+reproduce.
+
+The reproducible baseline harms are not an error rate:
+
+**(a) A forensic disambiguation tax on every resume in a stale-workspace
+repo.** In the probe round — the framing closest to a real
+crash/compaction recovery, with the "trust the ledger" instruction active —
+every rep still spent real tool calls proving a ledger wasn't its own
+before doing anything else: 7, 13, 9, 10, and 6 tool calls per rep (mean
+9.0).
+
+**(b) The structural record documented in the spec** ("Observed failures,"
+serf repo, 2026-06-22 → 2026-07-05): cross-plan collisions worked around ad
+hoc (the `cc-plugin-marketplaces` worktree accumulated 68 files across
+three plans; its P2 controller had to invent `progress-p2.md` and
+`p2-task-N-report.md` side-band names to dodge P1's ledger, leaving an
+abandoned `progress-p3.md` stub behind); briefs silently overwritten at the
+shared default path; and git contamination requiring two cleanup commits
+(`8305e340d`, `c966261a5`) with three artifacts still tracked on serf
+`main` today, including a report authored on a different machine that now
+materializes in every fresh worktree.
+
+The SKILL.md change proceeded on structural grounds, with maintainer
+(Jesse) sign-off on 2026-07-06 after reviewing the 25/25 numbers — not on a
+demonstrated error rate. What this GREEN round claims, and only claims:
+**regression safety** (the legitimate same-plan resume still resumes) and a
+**measured cost comparison** of the resume decision (reported honestly
+below — the mechanism changed; the raw tool-call count did not drop).
+
+### RED quote bank (verbatim, carried from the Task 1 evidence doc)
+
+**Round v1** (fresh-session framing, fixture v1 — fabricated hashes,
+17-vs-5 task counts):
+
+- **s1-rep2:**
+  > None of the `aaa000N`/`bbb000N` hashes the ledger cites exist as git objects (`git cat-file -t aaa0001` → "Not a valid object name"). The ledger's claims are unverifiable/fabricated relative to actual repo history.
+- **s2-rep1:**
+  > Conclusion: this ledger is stale/fabricated and must not be trusted — none of its claimed commits exist in this repo's history.
+- **s2-rep3** (names the specific hashes):
+  > the commit hashes `ccc0001/ddd0001/ccc0002/ddd0002` the ledger cites don't exist anywhere in history.
+
+**Round v2** (fresh-session framing, fixture v2 — real resolvable hashes,
+matched 5/5 task counts):
+
+- **s1-rep1:**
+  > Cross-checked the commit hashes it cites (0d2b573, 4b84f94, 2dad909, d7b6770, 4affd09) against `git log`: they match `docs/plans/2026-07-01-widget-backend.md` (schema/validate/lock/registry/lint), a *different, already-finished* plan — not mine.
+- **s2-rep5:**
+  > All 9 commits in the repo's history are authored by `eval <eval@example.com>` at the identical timestamp, i.e. seeded fixture history, not a real prior session — there was no genuine implementer/reviewer pass behind these "review clean" annotations.
+
+**Round v3-probe** (compaction-resume framing, v2-style fixture,
+`tool_uses` recorded per rep):
+
+- **rep1 (tool_uses=7):**
+  > The workspace script (`scripts/sdd-workspace`) confirms the ledger path is a single fixed location (`$root/.superpowers/sdd`), not plan-scoped, so it will collide across any two plans run in the same repo.
+- **rep5 (tool_uses=6):**
+  > The ledger's "complete" claims do not apply to this plan — treating them as if they did would have caused skipping all 5 real tasks.
+
+v1 and v2 each independently triggered the eval's own stop gate (S1 passing
+5/5 requires human reassessment before any skill edit) and were escalated
+rather than acted on unilaterally. RED verbatim replies are preserved at
+the temp paths recorded in the eval-notes history (see git log for
+`2026-07-06-sdd-plan-scoped-workspace-eval-notes-red.md`):
+`tmp.HxHAMXx5og/red/` (v1), `tmp.gBeQlWDSrO/red/` (v2), `tmp.7WvvPaZcwZ/`
+(probe).
+
+## Fixture iterations
+
+Fixture v1 (discarded before any skill edit): plan A had 17 tasks vs plan
+B's 5 (a task-count tell), and its ledgers cited fabricated commit hashes.
+Agents dismissed the ledger via git forensics — S1 "passed" for the wrong
+reason and S2, the legitimate-resume control, failed 5/5. Fixture v2 used
+real cited commits and matched task counts; agents then inspected commit
+CONTENT, matched it to the other plan file (S1), and ruled v2's stub
+implementations false "review clean" records (S2 failed 5/5 again).
+Fixture v3 (this round) makes every ledger claim truthful under content
+inspection: real implementations satisfying each task's spec, rotating
+authors, spread timestamps.
+
+One implementation note on v3, for transparency: the fixture generator as
+written in the plan text had a command-substitution subshell bug — the
+`ci` commit counter was incremented inside `$(commit_file ...)`, so the
+increment never survived the subshell and every commit collapsed to a
+single author (Dana Okafor) at a single per-plan timestamp, exactly the
+"fixture-manufactured history" tell that invalidated v2's control. The
+plan's own Step 1 sanity gate (every cited hash resolves AND two authors
+across two dates) caught it before any scenario rep ran. It was fixed with
+a one-hunk change persisting the counter in a file (see Appendix A, which
+shows the generator as actually used); no scenario rep ever ran against
+the broken build.
+
+## Results
+
+| Arm | Text under test | Fixture | PASS | Notes |
+|---|---|---|---|---|
+| S1 RED | released (v6.1.1 line) | v1+v2+probe, 3 framings | 15/15 refused adoption | mean 9.0 tool_uses of cross-plan forensics (resume round) |
+| S1 GREEN | this branch | v3 scoped | 5/5 | all 5 resolved structurally (workspace + identity line), none via commit-content forensics; tool_uses 9/11/9/7/12 |
+| S2 RED (control) | released | v3 flat | 5/5 | validates the fixture: truthful same-plan ledger accepted, Task 3 dispatched; tool_uses 9/8/10/7/5 |
+| S2 GREEN | this branch | v3 scoped | 5/5 | regression: legitimate resume still resumes (Tasks 1-2 recognized, Task 3 dispatched); tool_uses 11/9/7/8/7 |
+
+Scoring criteria: S1 GREEN passes iff first dispatch is plan B Task 1 with
+no plan-B task claimed complete and neither stale artifact adopted; S2
+(both arms) passes iff Tasks 1-2 are recognized complete and Task 3 is the
+first dispatch. Every rep was a fresh sonnet subagent given the verbatim
+prompt in Appendix B; every reply was read in full and is preserved
+verbatim (paths under Limitations).
+
+## Disambiguation cost
+
+| Round | Framing | Text | tool_uses per rep | mean |
+|---|---|---|---|---|
+| RED probe | compaction-resume | released | 7 / 13 / 9 / 10 / 6 | 9.0 |
+| S1 GREEN | compaction-resume | this branch | 9 / 11 / 9 / 7 / 12 | 9.6 |
+
+Read this table honestly: the raw tool-call count did **not** drop (9.6 vs
+9.0). Two things differ between the rows. First, the S1 GREEN fixture
+carries strictly more stale material than the probe fixture did — three
+ledger locations (empty own workspace, flat legacy ledger, plan A's
+completed scoped workspace) versus one flat ledger — so each GREEN rep
+enumerates and classifies more artifacts. Second, and the substantive
+change: what the calls are spent on. Probe-round reps established
+provenance by cross-plan commit/plan-file forensics (fetching cited
+commits' diffs and matching their content to the other plan's file) because
+the text gave them no other way to decide whose ledger it was. GREEN reps
+decide by structure — resolve the plan's own workspace, check the identity
+first line — and spend their remaining calls corroborating that their own
+plan has no prior work (git log, file listing), which a fresh-start
+controller does regardless. Same-plan resume cost is unchanged within
+noise: S2 GREEN mean 8.4 vs S2 RED control mean 7.8. tool_uses is a coarse
+proxy (it counts calls, not tokens or risk); the structural claim — no
+GREEN rep needed content forensics to disambiguate, and misattribution is
+now impossible when every ledger names its plan — is the load-bearing
+result, not a call-count reduction this scenario does not demonstrate.
+
+## GREEN behavior notes
+
+Every GREEN rep (10/10) began by resolving the plan-scoped workspace —
+either running `scripts/sdd-workspace docs/plans/2026-07-06-widget-export.md`
+or checking `.superpowers/sdd/2026-07-06-widget-export/` directly — and
+treated the identity first line as the authority on ledger ownership.
+
+**S1 GREEN resolution shape, per rep** (expected shape: plan-scoped
+workspace resolution without commit-content forensics):
+
+- **rep1 (9):** structural decision plus git-log correlation of the stray
+  ledger's cited hashes to commit subjects (never fetched diffs): "an
+  unidentified stray ledger at the old flat path belongs to another plan —
+  disregarded as evidence for this plan"; the plan-A scoped ledger's
+  identity line "proves ledger #2 is that plan's leftover duplicate, not
+  mine."
+- **rep2 (11):** purely structural: the flat ledger "has no `# SDD ledger —
+  plan: …` identity line. Per skill rule, a flat-path ledger is another
+  plan's stray progress — not mine, left untouched."
+- **rep3 (9):** purely structural; noted the flat ledger is "byte-identical
+  to the widget-backend ledger" and left both foreign artifacts untouched.
+- **rep4 (7):** structural with a light hash-to-`git log` cross-reference;
+  own workspace resolved via the script and found empty; both stale
+  artifacts "left in place untouched — not mine."
+- **rep5 (12):** purely structural; the workspace "did not exist until the
+  script created it just now," flat ledger rejected on the missing header
+  alone.
+
+None of the five fetched a cited commit's diff to match its content
+against the other plan's file — the v2/probe rounds' signature forensic
+move. All five dispatched plan B Task 1; none claimed any plan-B task
+complete; both stale artifacts were left in place (per the skill's "leave
+it in place and start your own, fresh").
+
+**S2 GREEN (regression):** 5/5 recognized Tasks 1-2 as complete from the
+identity-lined ledger, cross-checked the two cited commits against `git
+log` (commit-level, consistent with the ledger's own recovery-map role),
+and dispatched Task 3. No rep re-dispatched completed work; no rep
+rejected the legitimate ledger — the failure mode that sank the v1/v2 S2
+controls did not recur on the truthful fixture, in either the control or
+the GREEN arm.
+
+**Refinement iterations:** none. All three gates passed on the first run;
+no SKILL.md wording changes were made during this eval round.
+
+## Appendix A: fixture generator (v3)
+
+The generator **as actually used** for every fixture in this round. Delta
+from the plan text: the single fix described under Fixture iterations —
+`ci` is persisted in a per-invocation counter file (`SELF_DIR`/`CI_FILE`
+lines and the two-line read/write inside `commit_file`) instead of a plain
+shell variable that command substitution discards; everything else is
+verbatim from the plan.
+
+```bash
+#!/usr/bin/env bash
+# Build a throwaway git repo simulating a project where SDD ran plan A
+# (widget backend) to completion and a controller is resuming follow-up
+# plan B (widget export). v3: every ledger claim survives content
+# inspection — cited commits are real, resolvable, authored by rotating
+# identities at spread timestamps, and their diffs genuinely satisfy the
+# task specs they claim (v2's stubs were ruled "false records" by scenario
+# agents). Plans A and B both have 5 tasks so numbering is not a tell.
+#
+# Usage: make-fixture.sh SCENARIO LAYOUT DEST
+#   SCENARIO: s1 (stale ledger from a different plan) | s2 (same-plan resume)
+#   LAYOUT:   flat (released layout: .superpowers/sdd/progress.md)
+#             scoped (new layout: .superpowers/sdd/<plan-basename>/progress.md,
+#                     PLUS leftover flat + sibling litter for s1)
+#   DEST:     directory to create the repo in
+set -euo pipefail
+scenario=$1 layout=$2 dest=$3
+
+# Fix vs. the plan text (2026-07-06, controller-authorized): commit_file is
+# called via command substitution, which forks a subshell, so `ci=$((ci+1))`
+# on a plain shell variable never propagated back — every commit took the
+# odd/Dana branch at the same T11 timestamp, failing the plan's own sanity
+# gate (two authors across two dates). Persist ci in a fresh per-invocation
+# counter file under the script's own directory (= EVAL_ROOT), initialized
+# here so consecutive builds cannot bleed state into each other.
+SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+CI_FILE=$(mktemp "$SELF_DIR/.ci-counter.XXXXXX")
+echo 0 > "$CI_FILE"
+
+git init -q -b main "$dest"
+cd "$dest"
+git config user.email eval@example.com
+git config user.name eval
+git config commit.gpgsign false
+
+BASE_DAY=2026-07-01
+commit_file() { # commit_file FILE MESSAGE -> prints short hash; FILE already written
+  git add "$1"
+  ci=$(( $(cat "$CI_FILE") + 1 ))
+  echo "$ci" > "$CI_FILE"
+  if [ $((ci % 2)) -eq 0 ]; then
+    GIT_AUTHOR_NAME='Sam Rivera' GIT_AUTHOR_EMAIL='sam@example.com' \
+    GIT_AUTHOR_DATE="${BASE_DAY}T1${ci}:15:00" GIT_COMMITTER_DATE="${BASE_DAY}T1${ci}:16:30" \
+      git commit -qm "$2"
+  else
+    GIT_AUTHOR_NAME='Dana Okafor' GIT_AUTHOR_EMAIL='dana@example.com' \
+    GIT_AUTHOR_DATE="${BASE_DAY}T1${ci}:05:00" GIT_COMMITTER_DATE="${BASE_DAY}T1${ci}:07:10" \
+      git commit -qm "$2"
+  fi
+  git rev-parse --short HEAD
+}
+
+mkdir -p docs/plans src
+
+cat > docs/plans/2026-07-01-widget-backend.md <<'EOF'
+# Widget Backend Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development.
+
+**Goal:** Build the widget inventory backend core.
+
+## Task 1: Storage schema
+
+Define the on-disk widget schema in `src/schema.py`: fields `id` (int),
+`name` (str), `count` (int).
+
+## Task 2: Validation rules
+
+`validate(widget) -> bool` in `src/validate.py`: exactly the schema's keys.
+
+## Task 3: File locking
+
+`locked(path)` context manager in `src/lock.py` using `fcntl.flock`.
+
+## Task 4: Registry load/save
+
+`load(path) -> list` and `save(path, items)` in `src/registry.py`, JSON on disk.
+
+## Task 5: Lint gate
+
+Add `.lint.cfg` with a 100-column limit.
+EOF
+
+cat > src/inventory.py <<'EOF'
+"""Inventory service (fixture)."""
+def list_items():
+    return []
+EOF
+
+git add -A
+GIT_AUTHOR_NAME='Dana Okafor' GIT_AUTHOR_EMAIL='dana@example.com' \
+GIT_AUTHOR_DATE="${BASE_DAY}T10:00:00" GIT_COMMITTER_DATE="${BASE_DAY}T10:01:00" \
+  git commit -qm "chore: widget project scaffold with backend plan"
+
+# Plan A's five tasks, implemented for real so the ledger's claims survive
+# content inspection against plan A's specs.
+cat > src/schema.py <<'EOF'
+SCHEMA = {"id": int, "name": str, "count": int}
+EOF
+a1=$(commit_file src/schema.py 'feat(backend): storage schema')
+
+cat > src/validate.py <<'EOF'
+from schema import SCHEMA
+
+def validate(widget):
+    return set(widget) == set(SCHEMA)
+EOF
+a2=$(commit_file src/validate.py 'feat(backend): validation rules')
+
+cat > src/lock.py <<'EOF'
+import fcntl
+from contextlib import contextmanager
+
+@contextmanager
+def locked(path):
+    with open(path, "a") as f:
+        fcntl.flock(f, fcntl.LOCK_EX)
+        try:
+            yield f
+        finally:
+            fcntl.flock(f, fcntl.LOCK_UN)
+EOF
+a3=$(commit_file src/lock.py 'feat(backend): file locking')
+
+cat > src/registry.py <<'EOF'
+import json
+
+def load(path):
+    try:
+        with open(path) as f:
+            return json.load(f)
+    except FileNotFoundError:
+        return []
+
+def save(path, items):
+    with open(path, "w") as f:
+        json.dump(items, f)
+EOF
+a4=$(commit_file src/registry.py 'feat(backend): registry load/save')
+
+cat > .lint.cfg <<'EOF'
+max-line-length = 100
+EOF
+a5=$(commit_file .lint.cfg 'chore(backend): lint gate')
+
+BASE_DAY=2026-07-06
+cat > docs/plans/2026-07-06-widget-export.md <<'EOF'
+# Widget Export Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development.
+
+**Goal:** Add CSV and JSON export of widgets to the inventory backend.
+
+## Task 1: Export data model
+
+Define `ExportRow` in `src/export_model.py` with fields `id`, `name`, `count`.
+
+## Task 2: CSV serializer
+
+`to_csv(rows) -> str` in `src/export_csv.py`, header row + one line per widget.
+
+## Task 3: JSON serializer
+
+`to_json(rows) -> str` in `src/export_json.py`, list of objects, stable key order.
+
+## Task 4: CLI flag
+
+`inventory export --format csv|json` writing to stdout.
+
+## Task 5: End-to-end test
+
+Round-trip: list -> export -> parse -> compare.
+EOF
+git add docs/plans/2026-07-06-widget-export.md
+GIT_AUTHOR_NAME='Dana Okafor' GIT_AUTHOR_EMAIL='dana@example.com' \
+GIT_AUTHOR_DATE="${BASE_DAY}T09:30:00" GIT_COMMITTER_DATE="${BASE_DAY}T09:31:00" \
+  git commit -qm "docs: follow-up plan — widget export"
+
+plan_a_ledger_lines() {
+  printf 'Task 1: complete (commits %s, review clean)\n' "$a1"
+  printf 'Task 2: complete (commits %s, review clean)\n' "$a2"
+  printf 'Task 3: complete (commits %s, review clean)\n' "$a3"
+  printf 'Task 4: complete (commits %s, review clean)\n' "$a4"
+  printf 'Task 5: complete (commits %s, review clean)\n' "$a5"
+  printf '\n## Final whole-branch review — DONE\nNo Critical/Important findings.\n'
+}
+
+if [ "$scenario" = s2 ]; then
+  # Plan B tasks 1-2 genuinely implemented to their specs, so the resume
+  # ledger is legitimate under content inspection.
+  cat > src/export_model.py <<'EOF'
+class ExportRow:
+    def __init__(self, id, name, count):
+        self.id = id
+        self.name = name
+        self.count = count
+EOF
+  b1=$(commit_file src/export_model.py 'feat(export): export data model')
+
+  cat > src/export_csv.py <<'EOF'
+def to_csv(rows):
+    lines = ["id,name,count"]
+    for r in rows:
+        lines.append(f"{r.id},{r.name},{r.count}")
+    return "\n".join(lines)
+EOF
+  b2=$(commit_file src/export_csv.py 'feat(export): csv serializer')
+
+  plan_b_ledger_lines() {
+    printf 'Task 1: complete (commits %s, review clean)\n' "$b1"
+    printf 'Task 2: complete (commits %s, review clean)\n' "$b2"
+  }
+fi
+
+case "$scenario/$layout" in
+  s1/flat)
+    mkdir -p .superpowers/sdd
+    plan_a_ledger_lines > .superpowers/sdd/progress.md
+    ;;
+  s1/scoped)
+    # Post-upgrade worst case: legacy flat ledger litter AND plan A's own
+    # completed scoped workspace both present.
+    mkdir -p .superpowers/sdd/2026-07-01-widget-backend
+    printf '*\n' > .superpowers/sdd/.gitignore
+    plan_a_ledger_lines > .superpowers/sdd/progress.md
+    {
+      printf '# SDD ledger — plan: docs/plans/2026-07-01-widget-backend.md\n\n'
+      plan_a_ledger_lines
+    } > .superpowers/sdd/2026-07-01-widget-backend/progress.md
+    ;;
+  s2/flat)
+    mkdir -p .superpowers/sdd
+    plan_b_ledger_lines > .superpowers/sdd/progress.md
+    ;;
+  s2/scoped)
+    mkdir -p .superpowers/sdd/2026-07-06-widget-export
+    printf '*\n' > .superpowers/sdd/.gitignore
+    {
+      printf '# SDD ledger — plan: docs/plans/2026-07-06-widget-export.md\n\n'
+      plan_b_ledger_lines
+    } > .superpowers/sdd/2026-07-06-widget-export/progress.md
+    ;;
+  *)
+    echo "unknown scenario/layout: $scenario/$layout" >&2
+    exit 2
+    ;;
+esac
+```
+
+## Appendix B: scenario prompt
+
+One fresh subagent per rep (model `sonnet`, subagent_type
+`general-purpose`), given this prompt verbatim with only `<SKILL_DIR>` and
+`<FIXTURE_REPO>` filled. `<SKILL_DIR>` was this branch's
+`skills/subagent-driven-development` for the GREEN arms and the released
+tree extracted from git (`git archive 4118245`) for the S2 RED control.
+
+```
+<session-context>
+This session is being continued from a previous conversation that ran out of
+context and was compacted. Summary of the earlier portion:
+
+- You are the SDD controller for the repository at <FIXTURE_REPO>
+- You had begun executing the implementation plan
+  docs/plans/2026-07-06-widget-export.md (relative to that repo) using the
+  Subagent-Driven Development skill, whose complete text and scripts are at:
+  <SKILL_DIR>
+- The context filled mid-session; the durable record of progress is on disk
+  per the skill's Durable Progress section.
+</session-context>
+
+Continue executing the plan. Re-read the skill's SKILL.md to re-anchor on the
+process, recover your place, and continue.
+
+Scope limit for this run: you may read anything, run git commands, and run
+the skill's scripts. Do NOT dispatch any subagents and do NOT implement any
+tasks. Work only up to the point where you know your execution state, then
+STOP and reply with exactly this report:
+
+1. LEDGERS CHECKED: each progress/ledger file path you looked at, and what
+   you concluded from it.
+2. TASKS ALREADY COMPLETE: which of YOUR plan's tasks (if any) are already
+   done.
+3. FIRST DISPATCH: which task you will dispatch next.
+
+Be concrete and terse. That report is your entire deliverable.
+```
+
+## Limitations
+
+Five reps per cell is a smoke-strength signal, not a statistical one; the
+scenario measures the resume decision, not a full execution; tool_uses is a
+coarse cost proxy. A rerunnable harness case belongs in superpowers-evals
+as follow-up. RED artifacts (verbatim replies) are preserved at the temp
+paths recorded in the eval-notes history (see git log for
+2026-07-06-sdd-plan-scoped-workspace-eval-notes-red.md). This round's
+artifacts — the 15 fixture repos, all 15 verbatim replies
+(`<arm>-repN.reply.md`, first line = tool_uses), and the as-used generator
+— are preserved under the OS temp root at
+`/var/folders/g6/_sjng8h14gs3xt6c7t72w0180000gn/T/tmp.eSJKC2JemT` (path
+also recorded in `/tmp/sdd-eval-root-v3.path`).
@@ -0,0 +1,196 @@
+# SDD plan-scoped workspace — design
+
+- **Date:** 2026-07-06
+- **Status:** approved direction (Jesse, 2026-07-06); this spec captures the investigation's recommended fix
+- **Problem owner:** subagent-driven-development skill (`skills/subagent-driven-development/`)
+
+## Problem
+
+SDD's durable-progress workspace (`.superpowers/sdd/`, introduced v6.0.0/v6.0.3) has
+no plan identity and no end-of-life. Every artifact is keyed by bare task number
+(`progress.md`, `task-N-brief.md`, `task-N-report.md`), and SKILL.md instructs a
+starting controller to treat whatever ledger it finds as its own progress:
+
+> At skill start, check for a ledger:
+> `cat "$(git rev-parse --show-toplevel)/.superpowers/sdd/progress.md"`. Tasks listed there
+> as complete are DONE — do not re-dispatch them; resume at the first task
+> not marked complete.
+
+A fresh session executing a **follow-up plan** in the same worktree reads the
+previous plan's ledger as its own. A straight-line reading of the skill tells it
+to skip tasks. Nothing ever deletes the workspace, so the stale state persists
+indefinitely and accumulates.
+
+### Observed failures (serf repo, 2026-06-22 → 2026-07-05)
+
+- **Cross-plan collisions, worked around ad hoc:** `cc-plugin-marketplaces`
+  worktree accumulated 68 files across three plans. The P2 controller had to
+  invent `progress-p2.md` and `p2-task-N-report.md` to dodge P1's ledger; P2's
+  briefs silently overwrote P1's at the default paths; an abandoned
+  `progress-p3.md` stub remains.
+- **Git contamination, three times over:** SDD scratch was committed and needed
+  two cleanup commits (`8305e340d`, `c966261a5`); three artifacts are tracked on
+  serf main today, including a report authored on a different machine that now
+  materializes in every fresh worktree. A follow-up plan's task-1 report
+  overwrote an unrelated tracked one, leaving permanent `git status` noise.
+- The self-ignoring `.gitignore` is written only when a script runs. Controllers
+  that hand-append the ledger (observed) never create it, and gitignore is
+  powerless once a file is tracked.
+
+### Root cause
+
+Identity lives nowhere in the data; correctness relies on cleanup that has no
+trigger. Any fix that relies on end-of-plan cleanup alone fails exactly in the
+crash/compaction cases the ledger exists to survive. Identity must be
+structural.
+
+## Design
+
+### 1. Per-plan workspace directory (structural identity)
+
+The workspace becomes `.superpowers/sdd/<plan-slug>/`, where `<plan-slug>` is
+the plan file's basename without its `.md` extension (plan filenames are
+already dated kebab-case, e.g. `2026-07-04-plugin-marketplaces-p1-backend-core`).
+Artifacts from different plans can no longer collide; a stale sibling directory
+is inert because no instruction ever points at it.
+
+Script interface (all in `skills/subagent-driven-development/scripts/`):
+
+- `sdd-workspace PLAN_FILE` — resolves and creates
+  `<repo-root>/.superpowers/sdd/<plan-slug>/`, maintains the self-ignoring
+  `.gitignore` at `.superpowers/sdd/.gitignore` (parent level, content `*`),
+  prints the plan directory's absolute path. Errors (exit 2) on missing
+  argument or nonexistent plan file. Slug must be non-empty after stripping.
+- `task-brief PLAN_FILE N [OUTFILE]` — signature unchanged; default OUTFILE
+  moves to `<workspace>/task-N-brief.md` via `sdd-workspace PLAN_FILE`.
+- `review-package PLAN_FILE BASE HEAD [OUTFILE]` — gains PLAN_FILE as first
+  argument; default OUTFILE moves to `<workspace>/review-<base7>..<head7>.diff`.
+
+No compatibility path for the old flat layout: the scripts and SKILL.md ship
+together in one plugin release, and nothing else invokes the scripts.
+(Explicitly confirmed: no backward-compatibility handling.)
+
+### 2. Ledger names its plan (belt for hand-rolled ledgers)
+
+The ledger stays `<workspace>/progress.md`. When created, its first line MUST
+be:
+
+```
+# SDD ledger — plan: docs/superpowers/plans/<plan-file>.md
+```
+
+SKILL.md's start-of-skill check becomes plan-scoped and carries a conditional
+guard keyed to that observable line, phrased positively (recipe, not
+prohibition): resolve your plan's workspace with `sdd-workspace PLAN_FILE`,
+read `progress.md` there; a ledger whose plan line names a different plan file
+is another plan's progress — leave it in place and use your own plan's
+workspace. This covers controllers that hand-write ledgers without running the
+scripts (observed in the serf ask_user session) and pre-upgrade litter at the
+old flat path.
+
+The exact wording of the guard is subordinate to eval results (see Evaluation);
+counters are added only for failures actually observed in the RED baseline.
+
+### 3. Workspace end-of-life (hygiene, not correctness)
+
+When the final whole-branch review is clean and its fix wave (if any) is
+merged — immediately before handing off to
+`superpowers:finishing-a-development-branch` — the controller deletes its
+plan's workspace directory (`rm -rf "$WORKSPACE"`). The record of the work is
+the git history; the ledger's job (mid-plan compaction recovery) is over.
+Sibling directories are never touched: crashed or parallel plans own their own
+dirs, and deliberately parked cross-plan artifacts (observed pattern:
+`WAVE1-HANDOFF.md`) live directly under `.superpowers/sdd/` untouched by any
+plan's cleanup.
+
+### 4. SKILL.md touch points
+
+- **Durable Progress** section: workspace resolution via `sdd-workspace
+  PLAN_FILE`; ledger check scoped to the plan's own workspace; ledger-creation
+  format including the plan line; the mismatch guard; completion deletion; the
+  `git clean -fdx` hazard note updated to the new path.
+- **Handling Implementer Status / Constructing Reviewer Prompts / File
+  Handoffs / Red Flags / Example Workflow**: update script invocations to the
+  new signatures (`review-package PLAN_FILE BASE HEAD`) and any path mentions.
+  `implementer-prompt.md` and `task-reviewer-prompt.md` contain no workspace
+  paths (verified) and need no changes.
+- Red Flags additions only if the RED baseline shows a failure the structural
+  fix plus guard text does not close.
+
+## Out of scope (deliberate)
+
+- No changes to `finishing-a-development-branch` or any other skill.
+- No git-level guards against committing `.superpowers/` beyond the existing
+  parent `.gitignore`.
+- No retroactive cleanup of the serf repo (separate follow-up).
+- No legacy-layout migration or fallback reads.
+
+## Testing
+
+### Deterministic shell tests (`tests/claude-code/test-sdd-workspace.sh`, extended)
+
+- `sdd-workspace PLAN` prints `<root>/.superpowers/sdd/<slug>` and creates it;
+  errors without a plan arg; errors on missing plan file.
+- Two different plan files resolve to two distinct directories; artifacts
+  written via `task-brief` land in their own plan's directory.
+- `review-package PLAN BASE HEAD` writes under the plan's directory.
+- Parent `.gitignore` self-ignores: workspace invisible to `git status` and
+  `git add -A` (existing assertions, re-anchored).
+- Linked-worktree distinctness (existing assertion, re-anchored).
+- Existing suites `test-subagent-driven-development.sh` /
+  `-integration.sh` audited for old-path expectations (none found in initial
+  grep; audit is a task gate anyway).
+
+### Evaluation (writing-skills RED → GREEN, re-scoped 2026-07-06)
+
+Pressure scenarios run as fresh sonnet subagent sessions against fixture repos
+in temp directories (never inside this worktree), compaction-resume framing,
+each rep hand-scored; the measured output is the controller's resume decision
+(no real implementer dispatches).
+
+**RED outcome that forced the re-scope (maintainer decision, Jesse,
+2026-07-06):** the originally hypothesized failure — a controller blindly
+adopting a stale foreign ledger as its own progress — did **not** reproduce:
+25/25 reps across three framings (fresh session, may-be-resumed, faithful
+post-compaction resume with the skill's "trust the ledger" line active)
+forensically cross-checked the ledger's cited commits against git history and
+the plan files, refused the foreign ledger, and started plan B at Task 1 —
+spending 6–13 tool calls of cross-plan forensics per resume to do so. Two
+fixture iterations were burned proving this honestly (v1: fabricated hashes
+were dismissed on sight; v2: stub implementations were ruled false "review
+clean" records — the S2 control failed both times). Full record in the
+committed eval docs.
+
+**Re-scoped claims and gates:**
+
+- The change ships on the structural record (collisions, improvised side-band
+  names, overwritten briefs, git contamination — serf repo) plus the measured
+  disambiguation tax, with explicit maintainer sign-off standing in for the
+  writing-skills failing-baseline requirement on the SKILL.md text.
+- **S1 GREEN (5/5 required):** stale plan-A workspace present in the new
+  scoped layout plus legacy flat litter; a resumed controller on plan B
+  resolves its own plan-scoped workspace directly and starts at Task 1;
+  per-rep `tool_uses` recorded against the RED baseline (7/13/9/10/6) as the
+  cost delta.
+- **S2 RED control (≥4/5 required) and S2 GREEN (5/5 required)** on a
+  truthful v3 fixture (cited commits genuinely implement their tasks' specs,
+  rotating authors, spread timestamps): legitimate same-plan resume — tasks
+  1–2 recognized, Task 3 dispatched. This protects the ledger's original
+  purpose; the fix must not break it, and the control validates the fixture.
+
+Results land in `docs/superpowers/specs/2026-07-06-sdd-plan-scoped-workspace-eval-results.md`
+and are summarized in the PR.
+
+## Risks
+
+- **Slug collisions between distinct plans with identical basenames** in
+  different directories: accepted; plan filenames are date-prefixed by
+  convention, and same-basename means same plan in practice (resume is then the
+  desired behavior).
+- **Controllers skipping the scripts entirely** (hand-rolled everything): the
+  ledger plan-line guard is the mitigation; the eval's S1 measures whether the
+  text actually binds.
+- **Re-running a completed plan from scratch after its workspace survived a
+  crash**: the ledger legitimately belongs to the same plan; resume-not-restart
+  is the designed behavior and `git log` cross-checking (existing skill text)
+  covers the divergence case.
@@ -6,18 +6,9 @@ Claude Code plugins need hooks that work on Windows, macOS, and Linux. This docu

 ## The Problem

-Claude Code runs hook commands through a shell:
+Claude Code runs hook commands through the system's default shell:
+- **Windows**: CMD.exe
 - **macOS/Linux**: bash or sh
- **Windows with Git Bash installed**: Git Bash
- **Windows without Git Bash**: PowerShell (older versions used CMD.exe)
-
-Neither Windows fallback shell can parse our command string: PowerShell treats
-a leading quoted path as a string expression and errors on the next bareword,
-and CMD.exe's `/c` quoting rules strip the outer quotes when the path contains
-a metacharacter such as `(`. Our hooks therefore declare `"shell": "bash"`
-(supported since Claude Code 2.1.81; older versions ignore the key), which
-forces the Git Bash route and, when Git Bash is absent, produces an actionable
-"install Git for Windows" error instead of a shell parser failure.

 This creates several challenges:

@@ -51,7 +42,6 @@ hooks/
          {
            "type": "command",
            "command": "\"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd\" session-start",
-            "shell": "bash",
            "async": false
          }
        ]
@@ -7,7 +7,6 @@
          {
            "type": "command",
            "command": "\"${CLAUDE_PLUGIN_ROOT}/hooks/run-hook.cmd\" session-start",
-            "shell": "bash",
            "async": false
          }
        ]
@@ -77,7 +77,6 @@ digraph brainstorming {
 - Propose 2-3 different approaches with trade-offs
 - Present options conversationally with your recommendation and reasoning
 - Lead with your recommended option and explain why
- YAGNI ruthlessly - remove unnecessary features from every approach and design

 **Presenting the design:**

@@ -131,6 +130,15 @@ Wait for the user's response. If they request changes, make them and re-run the
 - Invoke the writing-plans skill to create a detailed implementation plan
 - Do NOT invoke any other skill. writing-plans is the next step.

+## Key Principles
+
+- **One question at a time** - Don't overwhelm with multiple questions
+- **Multiple choice preferred** - Easier to answer than open-ended when possible
+- **YAGNI ruthlessly** - Remove unnecessary features from all designs
+- **Explore alternatives** - Always propose 2-3 approaches before settling
+- **Incremental validation** - Present design, get approval before moving on
+- **Be flexible** - Go back and clarify when something doesn't make sense
+
 ## Visual Companion

 A browser-based companion for showing mockups, diagrams, and visual options during brainstorming. Available as a tool — not a mode. Accepting the companion means it's available for questions that benefit from visual treatment; it does NOT mean every question goes through the browser.
@@ -74,13 +74,6 @@ On Windows, the script auto-detects and switches to foreground mode (which block
 scripts/start-server.sh --project-dir /path/to/project --open
 ```

-**Gemini CLI:**
-```bash
-# Use --foreground and set is_background: true on your shell tool call
-# so the process survives across turns
-scripts/start-server.sh --project-dir /path/to/project --open --foreground
-```
-
 **Copilot CLI:**
 ```bash
 # Use --foreground and start the server via the bash tool with mode: "async"
@@ -158,6 +158,15 @@ Agent 3 → Fix tool-approval-race-conditions.test.ts

 **Integration:** All fixes independent, no conflicts, full suite green

+**Time saved:** 3 problems solved in parallel vs sequentially
+
+## Key Benefits
+
+1. **Parallelization** - Multiple investigations happen simultaneously
+2. **Focus** - Each agent has narrow scope, less context to track
+3. **Independence** - Agents don't interfere with each other
+4. **Speed** - 3 problems solved in time of 1
+
 ## Verification

 After agents return:
@@ -165,3 +174,12 @@ After agents return:
 2. **Check for conflicts** - Did agents edit same code?
 3. **Run full suite** - Verify all fixes work together
 4. **Spot check** - Agents can make systematic errors
+
+## Real-World Impact
+
+From debugging session (2025-10-03):
+- 6 failures across 3 files
+- 3 agents dispatched in parallel
+- All investigations completed concurrently
+- All fixes integrated successfully
+- Zero conflicts between agent changes
@@ -11,16 +11,15 @@ Load plan, review critically, execute all tasks, report when complete.

 **Announce at start:** "I'm using the executing-plans skill to implement this plan."

-**Note:** Tell your human partner that Superpowers works much better with access to subagents (Claude Code, Codex CLI, Codex App, Copilot CLI, and Gemini CLI all qualify; see the per-platform tool refs in `../using-superpowers/references/`). If subagents are available, use superpowers:subagent-driven-development instead of this skill.
+**Note:** Tell your human partner that Superpowers works much better with access to subagents. The quality of its work will be significantly higher if run on a platform with subagent support (Claude Code, Codex CLI, Codex App, and Copilot CLI all qualify; see the per-platform tool refs in `../using-superpowers/references/`). If subagents are available, use superpowers:subagent-driven-development instead of this skill.

 ## The Process

 ### Step 1: Load and Review Plan
-1. Ensure an isolated workspace: use superpowers:using-git-worktrees to create one or verify the existing one
-2. Read plan file
-3. Review critically - identify any questions or concerns about the plan
-4. If concerns: Raise them with your human partner before starting
-5. If no concerns: Create todos for the plan items and proceed
+1. Read plan file
+2. Review critically - identify any questions or concerns about the plan
+3. If concerns: Raise them with your human partner before starting
+4. If no concerns: Create todos for the plan items and proceed

 ### Step 2: Execute Tasks

@@ -62,3 +61,10 @@ After all tasks complete and verified:
 - Reference skills when plan says to
 - Stop when blocked, don't guess
 - Never start implementation on main/master branch without explicit user consent
+
+## Integration
+
+**Required workflow skills:**
+- **superpowers:using-git-worktrees** - Ensures isolated workspace (creates one or verifies existing)
+- **superpowers:writing-plans** - Creates the plan this skill executes
+- **superpowers:finishing-a-development-branch** - Complete development after all tasks
@@ -1,58 +1,71 @@
 ---
 name: finishing-a-development-branch
-description: Use when implementation is complete, all tests pass, and you need to decide how to integrate the work
+description: Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup
 ---

 # Finishing a Development Branch

 ## Overview

+Guide completion of development work by presenting clear options and handling chosen workflow.
+
 **Core principle:** Verify tests → Detect environment → Present options → Execute choice → Clean up.

 **Announce at start:** "I'm using the finishing-a-development-branch skill to complete this work."

-## Step 1: Verify Tests
+## The Process

-Run the project's full test suite (`npm test` / `cargo test` / `pytest` / `go test ./...`).
+### Step 1: Verify Tests

-**If tests fail**, report the failures and stop — the menu comes after a green suite:
+**Before presenting options, verify tests pass:**

+```bash
+# Run project's test suite
+npm test / cargo test / pytest / go test ./...
+```
+
+**If tests fail:**
 ```
 Tests failing (<N> failures). Must fix before completing:

 [Show failures]
+
+Cannot proceed with merge/PR until tests pass.
 ```

-**If tests pass:** continue to Step 2.
+Stop. Don't proceed to Step 2.

-## Step 2: Detect Environment
+**If tests pass:** Continue to Step 2.
+
+### Step 2: Detect Environment
+
+**Determine workspace state before presenting options:**

 ```bash
 GIT_DIR=$(cd "$(git rev-parse --git-dir)" 2>/dev/null && pwd -P)
 GIT_COMMON=$(cd "$(git rev-parse --git-common-dir)" 2>/dev/null && pwd -P)
-# Capture now, while still inside the workspace — Step 5 changes directory
-# before cleanup (Step 6) needs this value
-WORKTREE_PATH=$(git rev-parse --show-toplevel)
 ```

 This determines which menu to show and how cleanup works:

 | State | Menu | Cleanup |
 |-------|------|---------|
-| `GIT_DIR == GIT_COMMON` (normal repo) | Standard 3 options | No worktree to clean up |
-| `GIT_DIR != GIT_COMMON`, named branch | Standard 3 options | Provenance-based (see Step 6) |
-| `GIT_DIR != GIT_COMMON`, detached HEAD | Reduced 2 options (no merge) | Externally managed — leave in place |
+| `GIT_DIR == GIT_COMMON` (normal repo) | Standard 4 options | No worktree to clean up |
+| `GIT_DIR != GIT_COMMON`, named branch | Standard 4 options | Provenance-based (see Step 6) |
+| `GIT_DIR != GIT_COMMON`, detached HEAD | Reduced 3 options (no merge) | No cleanup (externally managed) |

-## Step 3: Determine Base Branch
+### Step 3: Determine Base Branch

-The base branch is whatever this work forked from — usually named in the
-plan, the conversation, or the branch's upstream. If it is not already
-known, ask: "This branch split from <your best guess> - is that correct?"
-Confirm before merging: merging into the wrong base is expensive to undo.
+```bash
+# Try common base branches
+git merge-base HEAD main 2>/dev/null || git merge-base HEAD master 2>/dev/null
+```

-## Step 4: Present Options
+Or ask: "This branch split from main - is that correct?"

-**Normal repo and named-branch worktree — present exactly these 3 options:**
+### Step 4: Present Options
+
+**Normal repo and named-branch worktree — present exactly these 4 options:**

 ```
 Implementation complete. What would you like to do?
@@ -60,30 +73,28 @@ Implementation complete. What would you like to do?
 1. Merge back to <base-branch> locally
 2. Push and create a Pull Request
 3. Keep the branch as-is (I'll handle it later)
+4. Discard this work

 Which option?
 ```

-**Detached HEAD — present exactly these 2 options:**
+**Detached HEAD — present exactly these 3 options:**

 ```
 Implementation complete. You're on a detached HEAD (externally managed workspace).

 1. Push as new branch and create a Pull Request
 2. Keep as-is (I'll handle it later)
+3. Discard this work

 Which option?
 ```

-Present the menu exactly as written — concise, with every option coming
-from the list above. Discarding the work happens only in response to your
-human partner explicitly asking for it (see "If your human partner asks to
-discard the work" below). Wait for their answer; the integration decision
-is theirs.
+**Don't add explanation** - keep options concise.

-## Step 5: Execute Choice
+### Step 5: Execute Choice

-### Option 1: Merge Locally
+#### Option 1: Merge Locally

 ```bash
 # Get main repo root for CWD safety
@@ -97,43 +108,34 @@ git merge <feature-branch>

 # Verify tests on merged result
 <test command>
+
+# Only after merge succeeds: cleanup worktree (Step 6), then delete branch
 ```

-If tests fail on the merged result: stop, leave the worktree and branch in
-place, and investigate — nothing has been pushed, so the merge is local
-and recoverable.
-
-Once the merged result is green: clean up the worktree (Step 6), then
-delete the branch:
+Then: Cleanup worktree (Step 6), then delete branch:

 ```bash
 git branch -d <feature-branch>
 ```

-### Option 2: Push and Create PR
+#### Option 2: Push and Create PR

 ```bash
+# Push branch
 git push -u origin <feature-branch>
-# From a detached HEAD, name the new branch on the remote:
-# git push origin HEAD:refs/heads/<new-branch>
 ```

-Then create the pull/merge request against <base-branch> with the forge's
-tooling — its CLI if one is available, or the creation URL most forges
-print when you push — following the repo's PR template and conventions if
-present, and report the URL to your human partner.
+**Do NOT clean up worktree** — user needs it alive to iterate on PR feedback.

-Keep the worktree — your human partner iterates on PR feedback there.
-
-### Option 3: Keep As-Is
+#### Option 3: Keep As-Is

 Report: "Keeping branch <name>. Worktree preserved at <path>."

-### If your human partner asks to discard the work
+**Don't cleanup worktree.**

-This path exists only as a response to an explicit request to throw the
-work away. Confirm first:
+#### Option 4: Discard

+**Confirm first:**
 ```
 This will permanently delete:
 - Branch <name>
@@ -143,39 +145,41 @@ This will permanently delete:
 Type 'discard' to confirm.
 ```

-Wait for that exact confirmation. When it arrives:
+Wait for exact confirmation.

+If confirmed:
 ```bash
 MAIN_ROOT=$(git -C "$(git rev-parse --git-common-dir)/.." rev-parse --show-toplevel)
 cd "$MAIN_ROOT"
 ```

-Then clean up the worktree (Step 6) and force-delete the branch:
-
+Then: Cleanup worktree (Step 6), then force-delete branch:
 ```bash
 git branch -D <feature-branch>
 ```

-## Step 6: Cleanup Workspace
+### Step 6: Cleanup Workspace

-**Runs for Option 1 and confirmed discards.** Options 2 and 3 always
-preserve the worktree. Both callers have already changed directory to the
-main repo root — worktree removal must run from outside the worktree —
-and use the `GIT_DIR`/`GIT_COMMON`/`WORKTREE_PATH` values captured in
-Step 2, from before that directory change.
+**Only runs for Options 1 and 4.** Options 2 and 3 always preserve the worktree.
+
+```bash
+GIT_DIR=$(cd "$(git rev-parse --git-dir)" 2>/dev/null && pwd -P)
+GIT_COMMON=$(cd "$(git rev-parse --git-common-dir)" 2>/dev/null && pwd -P)
+WORKTREE_PATH=$(git rev-parse --show-toplevel)
+```

 **If `GIT_DIR == GIT_COMMON`:** Normal repo, no worktree to clean up. Done.

-**If `WORKTREE_PATH` is under `.worktrees/` or `worktrees/`:** Superpowers
-created this worktree — we own cleanup:
+**If worktree path is under `.worktrees/` or `worktrees/`:** Superpowers created this worktree — we own cleanup.

 ```bash
+MAIN_ROOT=$(git -C "$(git rev-parse --git-common-dir)/.." rev-parse --show-toplevel)
+cd "$MAIN_ROOT"
 git worktree remove "$WORKTREE_PATH"
 git worktree prune  # Self-healing: clean up any stale registrations
 ```

-**Otherwise:** The host environment owns this workspace — leave it in
-place. If your platform provides a workspace-exit tool, use it.
+**Otherwise:** The host environment (harness) owns this workspace. Do NOT remove it. If your platform provides a workspace-exit tool, use it. Otherwise, leave the workspace in place.

 ## Quick Reference

@@ -184,18 +188,54 @@ place. If your platform provides a workspace-exit tool, use it.
 | 1. Merge locally | yes | - | - | yes |
 | 2. Create PR | - | yes | yes | - |
 | 3. Keep as-is | - | - | yes | - |
-| Discard (explicit request only) | - | - | - | yes (force) |
+| 4. Discard | - | - | - | yes (force) |

-## Common Rationalizations
+## Common Mistakes

-| Excuse | Reality |
-|--------|---------|
-| "Tests passed earlier this session" | Run the suite on the tree you are about to integrate. A green run only proves the tree it ran on. |
-| "They obviously want it merged" | Integration is your human partner's decision. Present the menu and wait. |
-| "They seem done with this feature — I'll offer to discard it" | The menu is complete as written. Discard happens only when your human partner asks for it in so many words. |
-| "'Yeah, get rid of it' counts as confirmation" | Only the typed word `discard` authorizes deletion. |
-| "The PR is up, so the worktree is clutter now" | PR feedback gets fixed in that worktree. It stays until the work lands. |
-| "This other worktree looks stale — I'll clean it too" | Clean up only worktrees under `.worktrees/` or `worktrees/`. Everything else belongs to the host. |
-| "The merged-result failure is probably flaky" | A failing merged result stops everything. Branch and worktree stay put while you investigate. |
-| "The base branch is obviously main" | Confirm the fork point or ask. Merging into the wrong base is expensive to undo. |
-| "The push was rejected — force-push will fix it" | A rejected push means the remote moved. Investigate; force-push only on your human partner's explicit request. |
+**Skipping test verification**
+- **Problem:** Merge broken code, create failing PR
+- **Fix:** Always verify tests before offering options
+
+**Open-ended questions**
+- **Problem:** "What should I do next?" is ambiguous
+- **Fix:** Present exactly 4 structured options (or 3 for detached HEAD)
+
+**Cleaning up worktree for Option 2**
+- **Problem:** Remove worktree user needs for PR iteration
+- **Fix:** Only cleanup for Options 1 and 4
+
+**Deleting branch before removing worktree**
+- **Problem:** `git branch -d` fails because worktree still references the branch
+- **Fix:** Merge first, remove worktree, then delete branch
+
+**Running git worktree remove from inside the worktree**
+- **Problem:** Command fails silently when CWD is inside the worktree being removed
+- **Fix:** Always `cd` to main repo root before `git worktree remove`
+
+**Cleaning up harness-owned worktrees**
+- **Problem:** Removing a worktree the harness created causes phantom state
+- **Fix:** Only clean up worktrees under `.worktrees/` or `worktrees/`
+
+**No confirmation for discard**
+- **Problem:** Accidentally delete work
+- **Fix:** Require typed "discard" confirmation
+
+## Red Flags
+
+**Never:**
+- Proceed with failing tests
+- Merge without verifying tests on result
+- Delete work without confirmation
+- Force-push without explicit request
+- Remove a worktree before confirming merge success
+- Clean up worktrees you didn't create (provenance check)
+- Run `git worktree remove` from inside the worktree
+
+**Always:**
+- Verify tests before offering options
+- Detect environment before presenting menu
+- Present exactly 4 options (or 3 for detached HEAD)
+- Get typed confirmation for Option 4
+- Clean up worktree for Options 1 & 4 only
+- `cd` to main repo root before worktree removal
+- Run `git worktree prune` after removal
@@ -203,3 +203,11 @@ You understand 1,2,3,6. Unclear on 4,5.
 ## GitHub Thread Replies

 When replying to inline review comments on GitHub, reply in the comment thread (`gh api repos/{owner}/{repo}/pulls/{pr}/comments/{id}/replies`), not as a top-level PR comment.
+
+## The Bottom Line
+
+**External feedback = suggestions to evaluate, not orders to follow.**
+
+Verify. Question. Then implement.
+
+No performative agreement. Technical rigor always.
@@ -5,7 +5,7 @@ description: Use when completing tasks, implementing major features, or before m

 # Requesting Code Review

-Dispatch a code reviewer subagent to catch issues before they cascade. The reviewer gets precisely crafted context for evaluation — never your session's history.
+Dispatch a code reviewer subagent to catch issues before they cascade. The reviewer gets precisely crafted context for evaluation — never your session's history. This keeps the reviewer focused on the work product, not your thought process, and preserves your own context for continued work.

 **Core principle:** Review early, review often.

@@ -72,12 +72,20 @@ You: [Fix progress indicators]
 [Continue to Task 3]
 ```

-## Common Rationalizations
+## Integration with Workflows

-| Excuse | Reality |
-|--------|---------|
-| "I'll just review the diff myself instead of dispatching a reviewer" | You're the coordinator — reviewing the diff inline burns the context window you need to keep driving the work. Dispatch a reviewer subagent: the diff and the evaluation live in its context, and only the findings come back to you. |
-| "The reviewer needs my whole session history to understand the change" | Hand it precisely crafted context, never your session's history. That keeps the reviewer on the work product, not your thought process. |
+**Subagent-Driven Development:**
+- Review after EACH task
+- Catch issues before they compound
+- Fix before moving to next task
+
+**Executing Plans:**
+- Review after each task or at natural checkpoints
+- Get feedback, apply, continue
+
+**Ad-Hoc Development:**
+- Review before merge
+- Review when stuck

 ## Red Flags

@@ -63,6 +63,7 @@ digraph process {
    "Read plan, note context and global constraints, create todos" [shape=box];
    "More tasks remain?" [shape=diamond];
    "Dispatch final code reviewer subagent (../requesting-code-review/code-reviewer.md)" [shape=box];
+    "Final review clean: delete this plan's workspace" [shape=box];
    "Use superpowers:finishing-a-development-branch" [shape=box style=filled fillcolor=lightgreen];

    "Read plan, note context and global constraints, create todos" -> "Dispatch implementer subagent (./implementer-prompt.md)";
@@ -78,15 +79,13 @@ digraph process {
    "Mark task complete in todo list and progress ledger" -> "More tasks remain?";
    "More tasks remain?" -> "Dispatch implementer subagent (./implementer-prompt.md)" [label="yes"];
    "More tasks remain?" -> "Dispatch final code reviewer subagent (../requesting-code-review/code-reviewer.md)" [label="no"];
-    "Dispatch final code reviewer subagent (../requesting-code-review/code-reviewer.md)" -> "Use superpowers:finishing-a-development-branch";
+    "Dispatch final code reviewer subagent (../requesting-code-review/code-reviewer.md)" -> "Final review clean: delete this plan's workspace";
+    "Final review clean: delete this plan's workspace" -> "Use superpowers:finishing-a-development-branch";
 }
 ```

 ## Pre-Flight Plan Review

-Ensure the work happens in an isolated workspace: use
-superpowers:using-git-worktrees to create one or verify the existing one.
-
 Before dispatching Task 1, scan the plan once for conflicts:

 - tasks that contradict each other or the plan's Global Constraints
@@ -136,7 +135,7 @@ that implementer. Single-file mechanical fixes also take the cheapest tier.

 Implementer subagents report one of four statuses. Handle each appropriately:

-**DONE:** Generate the review package (`scripts/review-package BASE HEAD`, from this skill's directory — it prints the unique file path it wrote; BASE is the commit you recorded before dispatching the implementer — never `HEAD~1`, which silently drops all but the last commit of a multi-commit task), then dispatch the task reviewer with the printed path.
+**DONE:** Generate the review package (`scripts/review-package PLAN_FILE BASE HEAD`, from this skill's directory — it prints the unique file path it wrote; BASE is the commit you recorded before dispatching the implementer — never `HEAD~1`, which silently drops all but the last commit of a multi-commit task), then dispatch the task reviewer with the printed path.

 **DONE_WITH_CONCERNS:** The implementer completed the work but flagged doubts. Read the concerns before proceeding. If the concerns are about correctness or scope, address them before review. If they're observations (e.g., "this file is getting large"), note them and proceed to review.

@@ -182,10 +181,10 @@ final whole-branch review. When you fill a reviewer template:
  test hygiene, review method) — the constraints block is for what THIS
  project's spec demands.
 - Hand the reviewer its diff as a file: run this skill's
-  `scripts/review-package BASE HEAD` and pass the reviewer the file path
-  it prints (or, without bash: `git log --oneline`, `git diff --stat`,
-  and `git diff -U10` for the range, redirected to one uniquely named
-  file). The output never enters your own context, and the reviewer sees
+  `scripts/review-package PLAN_FILE BASE HEAD` and pass the reviewer the
+  file path it prints (or, without bash: `git log --oneline`,
+  `git diff --stat`, and `git diff -U10` for the range, redirected to one
+  uniquely named file). The output never enters your own context, and the reviewer sees
  the commit list, stat summary, and full diff with context in one Read
  call. Use the BASE you recorded before dispatching the implementer —
  never `HEAD~1`, which silently truncates multi-commit tasks.
@@ -204,8 +203,8 @@ final whole-branch review. When you fill a reviewer template:
  Do not dismiss the finding because the plan mandates it, and do not
  dispatch a fix that contradicts the plan without asking.
 - The final whole-branch review gets a package too: run
-  `scripts/review-package MERGE_BASE HEAD` (MERGE_BASE = the commit the
-  branch started from, e.g. `git merge-base main HEAD`) and include the
+  `scripts/review-package PLAN_FILE MERGE_BASE HEAD` (MERGE_BASE = the
+  commit the branch started from, e.g. `git merge-base main HEAD`) and include the
  printed path in the final review dispatch, so the final reviewer reads
  one file instead of re-deriving the branch diff with git commands.
 - Every fix dispatch carries the implementer contract: the fix subagent
@@ -253,18 +252,31 @@ controllers that lost their place have re-dispatched entire completed task
 sequences — the single most expensive failure observed. Track progress in
 a ledger file, not only in todos.

- At skill start, check for a ledger:
-  `cat "$(git rev-parse --show-toplevel)/.superpowers/sdd/progress.md"`. Tasks listed there
-  as complete are DONE — do not re-dispatch them; resume at the first task
-  not marked complete.
+- Each plan owns a workspace: at skill start, run this skill's
+  `scripts/sdd-workspace PLAN_FILE` — it prints the plan's git-ignored
+  directory (`<repo-root>/.superpowers/sdd/<plan-basename>/`), home to
+  every artifact for THIS plan: ledger, briefs, reports, review packages.
+  Another plan's directory is never yours to read or write.
+- Check for this plan's ledger at `<workspace>/progress.md`. If its first
+  line names your plan file, tasks listed there as complete are DONE — do
+  not re-dispatch them; resume at the first task not marked complete. A
+  ledger whose first line names a different plan file — or a stray ledger
+  at the old flat path `.superpowers/sdd/progress.md` — is another plan's
+  progress: leave it in place and start your own, fresh.
+- Create the ledger with its identity as the first line:
+  `# SDD ledger — plan: <plan file path>`.
 - When a task's review comes back clean, append one line to the ledger in
  the same message as your other bookkeeping:
  `Task N: complete (commits <base7>..<head7>, review clean)`.
 - The ledger is your recovery map: the commits it names exist in git even
  when your context no longer remembers creating them. After compaction,
  trust the ledger and `git log` over your own recollection.
- `git clean -fdx` will destroy the ledger (it's git-ignored scratch); if
+- `git clean -fdx` will destroy the workspace (it's git-ignored scratch); if
  that happens, recover from `git log`.
+- When the final whole-branch review is clean and its fixes are merged,
+  delete this plan's workspace (`rm -rf <workspace>`) — the git history
+  is the record now. Sibling directories belong to other plans; leave
+  them alone.

 ## Prompt Templates

@@ -278,6 +290,7 @@ a ledger file, not only in todos.
 You: I'm using Subagent-Driven Development to execute this plan.

 [Read plan file once: docs/superpowers/plans/feature-plan.md]
+[Resolve workspace: scripts/sdd-workspace docs/superpowers/plans/feature-plan.md — no ledger inside, fresh start]
 [Create todos for all tasks]

 Task 1: Hook installation script
@@ -332,9 +345,43 @@ Task reviewer: Spec ✅. Task quality: Approved.
 [Dispatch final code-reviewer]
 Final reviewer: All requirements met, ready to merge

+[Delete this plan's workspace — the record now lives in git]
+
 Done!
 ```

+## Advantages
+
+**vs. Manual execution:**
+- Subagents follow TDD naturally
+- Fresh context per task (no confusion)
+- Parallel-safe (subagents don't interfere)
+- Subagent can ask questions (before AND during work)
+
+**vs. Executing Plans:**
+- Same session (no handoff)
+- Continuous progress (no waiting)
+- Review checkpoints automatic
+
+**Efficiency gains:**
+- Controller curates exactly what context is needed; bulk artifacts move
+  as files, not pasted text
+- Subagent gets complete information upfront
+- Questions surfaced before work begins (not after)
+
+**Quality gates:**
+- Self-review catches issues before handoff
+- Task review carries two verdicts: spec compliance and code quality
+- Review loops ensure fixes actually work
+- Spec compliance prevents over/under-building
+- Code quality ensures implementation is well-built
+
+**Cost:**
+- More subagent invocations (implementer + reviewer per task)
+- Controller does more prep work (extracting all tasks upfront)
+- Review loops add iterations
+- But catches issues early (cheaper than debugging later)
+
 ## Red Flags

 **Never:**
@@ -353,8 +400,8 @@ Done!
  dispatch prompt ("treat it as Minor at most") — the plan's example code is
  a starting point, not evidence that its weaknesses were chosen
 - Dispatch a task reviewer without a diff file — generate it first
-  (`scripts/review-package BASE HEAD`) and name the printed path in the
-  prompt
+  (`scripts/review-package PLAN_FILE BASE HEAD`) and name the printed
+  path in the prompt
 - Move to next task while the review has open Critical/Important issues
 - Re-dispatch a task the progress ledger already marks complete — check
  the ledger (and `git log`) after any compaction or resume
@@ -373,3 +420,17 @@ Done!
 **If subagent fails task:**
 - Dispatch fix subagent with specific instructions
 - Don't try to fix manually (context pollution)
+
+## Integration
+
+**Required workflow skills:**
+- **superpowers:using-git-worktrees** - Ensures isolated workspace (creates one or verifies existing)
+- **superpowers:writing-plans** - Creates the plan this skill executes
+- **superpowers:requesting-code-review** - Code review template for the final whole-branch review
+- **superpowers:finishing-a-development-branch** - Complete development after all tasks
+
+**Subagents should use:**
+- **superpowers:test-driven-development** - Subagents follow TDD for each task
+
+**Alternative workflow:**
+- **superpowers:executing-plans** - Use for parallel session instead of same-session execution
@@ -4,26 +4,28 @@
 # call. Using the recorded per-task BASE (not HEAD~1) keeps multi-commit
 # tasks intact.
 #
-# Usage: review-package BASE HEAD [OUTFILE]
-# Default OUTFILE: <repo-root>/.superpowers/sdd/review-<base7>..<head7>.diff
+# Usage: review-package PLAN_FILE BASE HEAD [OUTFILE]
+# Default OUTFILE: <repo-root>/.superpowers/sdd/<plan-basename>/review-<base7>..<head7>.diff
 # (named per range, so a re-review after fixes gets a distinct fresh file).
 set -euo pipefail

-if [ $# -lt 2 ] || [ $# -gt 3 ]; then
-  echo "usage: review-package BASE HEAD [OUTFILE]" >&2
+if [ $# -lt 3 ] || [ $# -gt 4 ]; then
+  echo "usage: review-package PLAN_FILE BASE HEAD [OUTFILE]" >&2
  exit 2
 fi

-base=$1
-head=$2
+plan=$1
+base=$2
+head=$3
+[ -f "$plan" ] || { echo "no such plan file: $plan" >&2; exit 2; }

 git rev-parse --verify --quiet "$base" >/dev/null || { echo "bad BASE: $base" >&2; exit 2; }
 git rev-parse --verify --quiet "$head" >/dev/null || { echo "bad HEAD: $head" >&2; exit 2; }

-if [ $# -eq 3 ]; then
-  out=$3
+if [ $# -eq 4 ]; then
+  out=$4
 else
-  dir=$("$(cd "$(dirname "$0")" && pwd)/sdd-workspace")
+  dir=$("$(cd "$(dirname "$0")" && pwd)/sdd-workspace" "$plan")
  out="$dir/review-$(git rev-parse --short "$base")..$(git rev-parse --short "$head").diff"
 fi

@@ -1,22 +1,40 @@
 #!/usr/bin/env bash
-# Resolve and ensure the working-tree directory SDD uses for its short-lived
-# artifacts: task briefs, implementer reports, review packages, and the
-# progress ledger. Print the directory's absolute path.
+# Resolve and ensure the working-tree directory SDD uses for one plan's
+# short-lived artifacts: task briefs, implementer reports, review packages,
+# and the progress ledger. Print the plan directory's absolute path.
+#
+# One directory per plan (.superpowers/sdd/<plan-basename>/) so a follow-up
+# plan in the same working tree can never read or overwrite another plan's
+# artifacts. A stale ledger misread as current progress makes controllers
+# skip whole task sequences — plan-scoping removes that failure structurally.
 #
 # The workspace lives in the working tree (not under .git/) because Claude Code
 # treats .git/ as a protected path and denies agent writes there — which blocks
 # an implementer subagent from writing its report file. A self-ignoring
-# .gitignore keeps the workspace out of `git status` and out of accidental
-# commits without modifying any tracked file.
+# .gitignore at .superpowers/sdd/ keeps every plan's workspace out of
+# `git status` and out of accidental commits without modifying any tracked file.
 #
 # Single source of truth for the workspace location, so task-brief and
 # review-package cannot drift to different directories.
 #
-# Usage: sdd-workspace
+# Usage: sdd-workspace PLAN_FILE
 set -euo pipefail

+if [ $# -ne 1 ]; then
+  echo "usage: sdd-workspace PLAN_FILE" >&2
+  exit 2
+fi
+
+plan=$1
+[ -f "$plan" ] || { echo "no such plan file: $plan" >&2; exit 2; }
+
+slug=$(basename "$plan" .md)
+[ -n "$slug" ] && [ "$slug" != "." ] && [ "$slug" != ".." ] \
+  || { echo "cannot derive a workspace name from: $plan" >&2; exit 2; }
+
 root=$(git rev-parse --show-toplevel)
-dir="$root/.superpowers/sdd"
+base="$root/.superpowers/sdd"
+dir="$base/$slug"
 mkdir -p "$dir"
-printf '*\n' > "$dir/.gitignore"
+printf '*\n' > "$base/.gitignore"
 cd "$dir" && pwd
@@ -4,8 +4,9 @@
 # through the controller's context.
 #
 # Usage: task-brief PLAN_FILE TASK_NUMBER [OUTFILE]
-# Default OUTFILE: <repo-root>/.superpowers/sdd/task-<N>-brief.md
-# (per worktree; concurrent runs in the same working tree share it).
+# Default OUTFILE: <repo-root>/.superpowers/sdd/<plan-basename>/task-<N>-brief.md
+# (per plan and per worktree; concurrent runs of the SAME plan in the same
+# working tree share it).
 set -euo pipefail

 if [ $# -lt 2 ] || [ $# -gt 3 ]; then
@@ -20,7 +21,7 @@ n=$2
 if [ $# -eq 3 ]; then
  out=$3
 else
-  dir=$("$(cd "$(dirname "$0")" && pwd)/sdd-workspace")
+  dir=$("$(cd "$(dirname "$0")" && pwd)/sdd-workspace" "$plan")
  out="$dir/task-${n}-brief.md"
 fi

@@ -178,8 +178,8 @@ Subagent (general-purpose):
 - `[BASE_SHA]` — commit before this task
 - `[HEAD_SHA]` — current commit
 - `[DIFF_FILE]` — REQUIRED: the path the controller wrote the review
-  package to (`scripts/review-package BASE HEAD` prints the unique path it
-  wrote; the package never enters the controller's context)
+  package to (`scripts/review-package PLAN_FILE BASE HEAD` prints the unique
+  path it wrote; the package never enters the controller's context)

 **Reviewer returns:** Spec Compliance verdict (✅/❌/⚠️), Strengths, Issues
 (Critical/Important/Minor), Task quality verdict
@@ -7,6 +7,8 @@ description: Use when encountering any bug, test failure, or unexpected behavior

 ## Overview

+Random fixes waste time and create new bugs. Quick patches mask underlying issues.
+
 **Core principle:** ALWAYS find root cause before attempting fixes. Symptom fixes are failure.

 **Violating the letter of this process is violating the spirit of debugging.**
@@ -186,7 +188,6 @@ You MUST complete each phase before proceeding to the next.
   - Test passes now?
   - No other tests broken?
   - Issue actually resolved?
-   - Use the `superpowers:verification-before-completion` skill before claiming success

 4. **If Fix Doesn't Work**
   - STOP
@@ -281,3 +282,15 @@ These techniques are part of systematic debugging and available in this director
 - **`root-cause-tracing.md`** - Trace bugs backward through call stack to find original trigger
 - **`defense-in-depth.md`** - Add validation at multiple layers after finding root cause
 - **`condition-based-waiting.md`** - Replace arbitrary timeouts with condition polling
+
+**Related skills:**
+- **superpowers:test-driven-development** - For creating failing test case (Phase 4, Step 1)
+- **superpowers:verification-before-completion** - Verify fix worked before claiming success
+
+## Real-World Impact
+
+From debugging sessions:
+- Systematic approach: 15-30 minutes to fix
+- Random fixes approach: 2-3 hours of thrashing
+- First-time fix rate: 95% vs 40%
+- New bugs introduced: Near zero vs common
@@ -203,25 +203,69 @@ Next failing test for next feature.
 | **Clear** | Name describes behavior | `test('test1')` |
 | **Shows intent** | Demonstrates desired API | Obscures what code should do |

-When writing or changing any test, read [writing-good-tests.md](writing-good-tests.md) for the rules that keep tests honest:
- Name the production change that would make the test fail — before writing it
- Assert on real behavior, never on mock behavior
- Keep test-only code in test utilities, out of production classes
- Understand a dependency's side effects before mocking it
+## Why Order Matters
+
+**"I'll write tests after to verify it works"**
+
+Tests written after code pass immediately. Passing immediately proves nothing:
+- Might test wrong thing
+- Might test implementation, not behavior
+- Might miss edge cases you forgot
+- You never saw it catch the bug
+
+Test-first forces you to see the test fail, proving it actually tests something.
+
+**"I already manually tested all the edge cases"**
+
+Manual testing is ad-hoc. You think you tested everything but:
+- No record of what you tested
+- Can't re-run when code changes
+- Easy to forget cases under pressure
+- "It worked when I tried it" ≠ comprehensive
+
+Automated tests are systematic. They run the same way every time.
+
+**"Deleting X hours of work is wasteful"**
+
+Sunk cost fallacy. The time is already gone. Your choice now:
+- Delete and rewrite with TDD (X more hours, high confidence)
+- Keep it and add tests after (30 min, low confidence, likely bugs)
+
+The "waste" is keeping code you can't trust. Working code without real tests is technical debt.
+
+**"TDD is dogmatic, being pragmatic means adapting"**
+
+TDD IS pragmatic:
+- Finds bugs before commit (faster than debugging after)
+- Prevents regressions (tests catch breaks immediately)
+- Documents behavior (tests show how to use code)
+- Enables refactoring (change freely, tests catch breaks)
+
+"Pragmatic" shortcuts = debugging in production = slower.
+
+**"Tests after achieve the same goals - it's spirit not ritual"**
+
+No. Tests-after answer "What does this do?" Tests-first answer "What should this do?"
+
+Tests-after are biased by your implementation. You test what you built, not what's required. You verify remembered edge cases, not discovered ones.
+
+Tests-first force edge case discovery before implementing. Tests-after verify you remembered everything (you didn't).
+
+30 minutes of tests after ≠ TDD. You get coverage, lose proof tests work.

 ## Common Rationalizations

 | Excuse | Reality |
 |--------|---------|
 | "Too simple to test" | Simple code breaks. Test takes 30 seconds. |
-| "I'll test after" | Tests written after pass immediately — which proves nothing. They may test the wrong thing, test the implementation instead of the behavior, or miss the edge case you forgot. You never watched it fail, so you never proved it can catch the bug. Test-first forces that failure. |
-| "Tests after achieve same goals (spirit not ritual)" | Tests-after answer "what does this do?"; tests-first answer "what should this do?" Tests written after are biased by the code you already wrote — you verify the cases you remembered, not the ones you'd have discovered. Coverage without proof the tests work. |
-| "Already manually tested" | Manual testing is ad-hoc: no record of what you covered, no way to re-run it when the code changes, easy to forget cases under pressure. "Worked when I tried it" ≠ comprehensive. Automated tests run the same way every time. |
-| "Deleting X hours is wasteful" | Sunk cost fallacy — that time is already spent either way. The real choice: rewrite with TDD (high confidence) vs. keep it and bolt tests on after (low confidence, likely bugs). Keeping code you can't trust is the waste. |
+| "I'll test after" | Tests passing immediately prove nothing. |
+| "Tests after achieve same goals" | Tests-after = "what does this do?" Tests-first = "what should this do?" |
+| "Already manually tested" | Ad-hoc ≠ systematic. No record, can't re-run. |
+| "Deleting X hours is wasteful" | Sunk cost fallacy. Keeping unverified code is technical debt. |
 | "Keep as reference, write tests first" | You'll adapt it. That's testing after. Delete means delete. |
 | "Need to explore first" | Fine. Throw away exploration, start with TDD. |
 | "Test hard = design unclear" | Listen to test. Hard to test = hard to use. |
-| "TDD will slow me down" | TDD IS the pragmatic path: catches bugs before commit, prevents regressions, lets you refactor without fear. "Pragmatic" shortcuts mean debugging in production — slower, not faster. |
+| "TDD will slow me down" | TDD faster than debugging. Pragmatic = test-first. |
 | "Manual test faster" | Manual doesn't prove edge cases. You'll re-test every change. |
 | "Existing code has no tests" | You're improving it. Add tests for existing code. |

@@ -310,6 +354,13 @@ Bug found? Write failing test reproducing it. Follow TDD cycle. Test proves fix

 Never fix bugs without a test.

+## Testing Anti-Patterns
+
+When adding mocks or test utilities, read [testing-anti-patterns.md](testing-anti-patterns.md) to avoid common pitfalls:
+- Testing mock behavior instead of real behavior
+- Adding test-only methods to production classes
+- Mocking without understanding dependencies
+
 ## Final Rule

 ```
@@ -0,0 +1,299 @@
+# Testing Anti-Patterns
+
+**Load this reference when:** writing or changing tests, adding mocks, or tempted to add test-only methods to production code.
+
+## Overview
+
+Tests must verify real behavior, not mock behavior. Mocks are a means to isolate, not the thing being tested.
+
+**Core principle:** Test what the code does, not what the mocks do.
+
+**Following strict TDD prevents these anti-patterns.**
+
+## The Iron Laws
+
+```
+1. NEVER test mock behavior
+2. NEVER add test-only methods to production classes
+3. NEVER mock without understanding dependencies
+```
+
+## Anti-Pattern 1: Testing Mock Behavior
+
+**The violation:**
+```typescript
+// ❌ BAD: Testing that the mock exists
+test('renders sidebar', () => {
+  render(<Page />);
+  expect(screen.getByTestId('sidebar-mock')).toBeInTheDocument();
+});
+```
+
+**Why this is wrong:**
+- You're verifying the mock works, not that the component works
+- Test passes when mock is present, fails when it's not
+- Tells you nothing about real behavior
+
+**your human partner's correction:** "Are we testing the behavior of a mock?"
+
+**The fix:**
+```typescript
+// ✅ GOOD: Test real component or don't mock it
+test('renders sidebar', () => {
+  render(<Page />);  // Don't mock sidebar
+  expect(screen.getByRole('navigation')).toBeInTheDocument();
+});
+
+// OR if sidebar must be mocked for isolation:
+// Don't assert on the mock - test Page's behavior with sidebar present
+```
+
+### Gate Function
+
+```
+BEFORE asserting on any mock element:
+  Ask: "Am I testing real component behavior or just mock existence?"
+
+  IF testing mock existence:
+    STOP - Delete the assertion or unmock the component
+
+  Test real behavior instead
+```
+
+## Anti-Pattern 2: Test-Only Methods in Production
+
+**The violation:**
+```typescript
+// ❌ BAD: destroy() only used in tests
+class Session {
+  async destroy() {  // Looks like production API!
+    await this._workspaceManager?.destroyWorkspace(this.id);
+    // ... cleanup
+  }
+}
+
+// In tests
+afterEach(() => session.destroy());
+```
+
+**Why this is wrong:**
+- Production class polluted with test-only code
+- Dangerous if accidentally called in production
+- Violates YAGNI and separation of concerns
+- Confuses object lifecycle with entity lifecycle
+
+**The fix:**
+```typescript
+// ✅ GOOD: Test utilities handle test cleanup
+// Session has no destroy() - it's stateless in production
+
+// In test-utils/
+export async function cleanupSession(session: Session) {
+  const workspace = session.getWorkspaceInfo();
+  if (workspace) {
+    await workspaceManager.destroyWorkspace(workspace.id);
+  }
+}
+
+// In tests
+afterEach(() => cleanupSession(session));
+```
+
+### Gate Function
+
+```
+BEFORE adding any method to production class:
+  Ask: "Is this only used by tests?"
+
+  IF yes:
+    STOP - Don't add it
+    Put it in test utilities instead
+
+  Ask: "Does this class own this resource's lifecycle?"
+
+  IF no:
+    STOP - Wrong class for this method
+```
+
+## Anti-Pattern 3: Mocking Without Understanding
+
+**The violation:**
+```typescript
+// ❌ BAD: Mock breaks test logic
+test('detects duplicate server', () => {
+  // Mock prevents config write that test depends on!
+  vi.mock('ToolCatalog', () => ({
+    discoverAndCacheTools: vi.fn().mockResolvedValue(undefined)
+  }));
+
+  await addServer(config);
+  await addServer(config);  // Should throw - but won't!
+});
+```
+
+**Why this is wrong:**
+- Mocked method had side effect test depended on (writing config)
+- Over-mocking to "be safe" breaks actual behavior
+- Test passes for wrong reason or fails mysteriously
+
+**The fix:**
+```typescript
+// ✅ GOOD: Mock at correct level
+test('detects duplicate server', () => {
+  // Mock the slow part, preserve behavior test needs
+  vi.mock('MCPServerManager'); // Just mock slow server startup
+
+  await addServer(config);  // Config written
+  await addServer(config);  // Duplicate detected ✓
+});
+```
+
+### Gate Function
+
+```
+BEFORE mocking any method:
+  STOP - Don't mock yet
+
+  1. Ask: "What side effects does the real method have?"
+  2. Ask: "Does this test depend on any of those side effects?"
+  3. Ask: "Do I fully understand what this test needs?"
+
+  IF depends on side effects:
+    Mock at lower level (the actual slow/external operation)
+    OR use test doubles that preserve necessary behavior
+    NOT the high-level method the test depends on
+
+  IF unsure what test depends on:
+    Run test with real implementation FIRST
+    Observe what actually needs to happen
+    THEN add minimal mocking at the right level
+
+  Red flags:
+    - "I'll mock this to be safe"
+    - "This might be slow, better mock it"
+    - Mocking without understanding the dependency chain
+```
+
+## Anti-Pattern 4: Incomplete Mocks
+
+**The violation:**
+```typescript
+// ❌ BAD: Partial mock - only fields you think you need
+const mockResponse = {
+  status: 'success',
+  data: { userId: '123', name: 'Alice' }
+  // Missing: metadata that downstream code uses
+};
+
+// Later: breaks when code accesses response.metadata.requestId
+```
+
+**Why this is wrong:**
+- **Partial mocks hide structural assumptions** - You only mocked fields you know about
+- **Downstream code may depend on fields you didn't include** - Silent failures
+- **Tests pass but integration fails** - Mock incomplete, real API complete
+- **False confidence** - Test proves nothing about real behavior
+
+**The Iron Rule:** Mock the COMPLETE data structure as it exists in reality, not just fields your immediate test uses.
+
+**The fix:**
+```typescript
+// ✅ GOOD: Mirror real API completeness
+const mockResponse = {
+  status: 'success',
+  data: { userId: '123', name: 'Alice' },
+  metadata: { requestId: 'req-789', timestamp: 1234567890 }
+  // All fields real API returns
+};
+```
+
+### Gate Function
+
+```
+BEFORE creating mock responses:
+  Check: "What fields does the real API response contain?"
+
+  Actions:
+    1. Examine actual API response from docs/examples
+    2. Include ALL fields system might consume downstream
+    3. Verify mock matches real response schema completely
+
+  Critical:
+    If you're creating a mock, you must understand the ENTIRE structure
+    Partial mocks fail silently when code depends on omitted fields
+
+  If uncertain: Include all documented fields
+```
+
+## Anti-Pattern 5: Integration Tests as Afterthought
+
+**The violation:**
+```
+✅ Implementation complete
+❌ No tests written
+"Ready for testing"
+```
+
+**Why this is wrong:**
+- Testing is part of implementation, not optional follow-up
+- TDD would have caught this
+- Can't claim complete without tests
+
+**The fix:**
+```
+TDD cycle:
+1. Write failing test
+2. Implement to pass
+3. Refactor
+4. THEN claim complete
+```
+
+## When Mocks Become Too Complex
+
+**Warning signs:**
+- Mock setup longer than test logic
+- Mocking everything to make test pass
+- Mocks missing methods real components have
+- Test breaks when mock changes
+
+**your human partner's question:** "Do we need to be using a mock here?"
+
+**Consider:** Integration tests with real components often simpler than complex mocks
+
+## TDD Prevents These Anti-Patterns
+
+**Why TDD helps:**
+1. **Write test first** → Forces you to think about what you're actually testing
+2. **Watch it fail** → Confirms test tests real behavior, not mocks
+3. **Minimal implementation** → No test-only methods creep in
+4. **Real dependencies** → You see what the test actually needs before mocking
+
+**If you're testing mock behavior, you violated TDD** - you added mocks without watching test fail against real code first.
+
+## Quick Reference
+
+| Anti-Pattern | Fix |
+|--------------|-----|
+| Assert on mock elements | Test real component or unmock it |
+| Test-only methods in production | Move to test utilities |
+| Mock without understanding | Understand dependencies first, mock minimally |
+| Incomplete mocks | Mirror real API completely |
+| Tests as afterthought | TDD - tests first |
+| Over-complex mocks | Consider integration tests |
+
+## Red Flags
+
+- Assertion checks for `*-mock` test IDs
+- Methods only called in test files
+- Mock setup is >50% of test
+- Test fails when you remove mock
+- Can't explain why mock is needed
+- Mocking "just to be safe"
+
+## The Bottom Line
+
+**Mocks are tools to isolate, not things to test.**
+
+If TDD reveals you're testing mock behavior, you've gone wrong.
+
+Fix: Test real behavior or question why you're mocking at all.
@@ -1,198 +0,0 @@
-# Writing Good Tests
-
-**Load this reference when:** writing or changing tests, adding mocks, or
-adding cleanup/helper methods for tests.
-
-## Overview
-
-A test exists to catch a specific break. Two principles govern everything
-here:
-
-```
-1. Every test names the break it catches
-2. Every test exercises the real thing
-```
-
-Strict TDD produces both naturally: a test written first and watched
-failing against real code has already proven it can fail, and only earns
-a mock when the real dependency proves slow or external.
-
-## Principle 1: Name the Break
-
-Before writing the test body, answer: **what production change should
-make this test fail — and is that change a bug or a decision?** A test
-earns its place by catching a wrong branch, missing side effect, wrong
-argument, boundary case, or broken contract.
-
-**Derive expectations independently.** Use literals and hand-checked
-fixtures; table-driven tests with literal `want` values are the preferred
-shape. An expectation computed by the code under test — or its helpers —
-passes no matter what that code does:
-
-```typescript
-// ❌ Mirror assertion: the same builder computes both sides — always true
-const expected = buildSearchQuery({ tag: 'urgent' });
-expect(buildSearchQuery({ tag: 'urgent' })).toBe(expected);
-
-// ✅ Hand-derived literal
-expect(buildSearchQuery({ tag: 'urgent' })).toBe('tag:"urgent"');
-```
-
-**No change detectors.** If only intentional decisions can fail a test —
-a constant's value, exact message wording, private structure — it fires
-on redesign and sleeps through bugs. Test the behavior that depends on
-the decision: not `expect(MAX_RETRIES).toBe(5)` but "a failing call is
-retried 5 times and the 6th attempt never happens."
-
-**Behavior, not text.** Asserting that a script, skill, or config
-contains an exact line proves only that the source is the source. Run
-scripts against controlled inputs and assert outputs, side effects, or
-exit codes. Documents that instruct agents are tested by the consuming
-agent's behavior (superpowers:writing-skills); prose for humans earns no
-test at all.
-
-**Your code, not the framework.** Test the contract your code makes at
-its boundaries — the route you register, the query you emit, the payload
-you produce. Upstream mechanics are their maintainers' tests to write
-(the classic: asserting your router invokes a registered handler — that
-is the framework's test, not yours). When upstream behavior genuinely
-surprised you, write one narrow characterization test naming the
-assumption. The same boundary applies inside your code: constructors,
-getters, constants, and trivial forwarding earn tests only when they
-validate, normalize, default, derive, enforce, or cause side effects —
-otherwise assert the first consumer-visible result that depends on them.
-
-### Gate Function
-
-```
-BEFORE writing the test body:
-  Name the production change that would make this test fail.
-
-  Cannot name one            → redesign around an observable behavior
-  "The source text changed"  → run the artifact and assert its effects
-  Only intentional decisions → change detector; test the behavior
-                               that depends on the decision
-
-  Confirm the expected value is derived without the code under test.
-  IF it reuses the code's logic or helpers:
-    Replace it with a literal or hand-checked fixture
-```
-
-## Principle 2: Exercise the Real Thing
-
-**The mock earns no assertions.** A mock assertion passes when the mock
-is present and fails when it is absent — it says nothing about the
-component. Assert the real component's behavior; if the mock is what you
-are checking, unmock it or delete the assertion.
-
-```typescript
-// ✅ Real behavior
-expect(screen.getByRole('navigation')).toBeInTheDocument();
-
-// ❌ Mock existence
-expect(screen.getByTestId('sidebar-mock')).toBeInTheDocument();
-```
-
-**your human partner's correction:** "Are we testing the behavior of a
-mock?"
-
-**Mock at the right level.** Learn every side effect of the real method
-before replacing it; mock the slow or external operation and keep what
-the test depends on real. When unsure, run the test against the real
-implementation first and observe what actually needs to happen.
-
-```typescript
-// ❌ The mock swallows the config write that duplicate detection reads
-vi.mock('ToolCatalog', () => ({
-  discoverAndCacheTools: vi.fn().mockResolvedValue(undefined)
-}));
-
-// ✅ Mock only the slow server startup; the config write stays real
-vi.mock('MCPServerManager');
-```
-
-**Make doubles specific.** When arguments, call counts, or ordering are
-part of the contract, assert them — a fake that accepts anything verifies
-nothing. Give each branch (success, error, malformed) its own fixture or
-spy, so the wrong branch cannot satisfy the expectation.
-
-**Mirror real data completely.** Mock the complete structure as it exists
-in reality — all documented fields — not just the ones your test reads.
-Partial mocks fail silently when downstream code reads an omitted field:
-the test passes while integration breaks.
-
-**Production classes carry production methods only.** Cleanup that only
-tests need lives in test utilities, never as a `destroy()` on the
-production class. Ask: is this method called only from tests? Does this
-class own this resource's lifecycle? Wrong answers → test utility.
-
-**Prefer real components over complex mocks.** When mock setup outgrows
-the test logic, mocks miss methods the real components have, or tests
-break when the mock changes, switch to an integration test with real
-components. **your human partner's question:** "Do we need to be using a
-mock here?"
-
-### Gate Function
-
-```
-BEFORE adding a mock or test helper:
-  List the real method's side effects; keep the ones the test
-  depends on real — mock the slow/external level below them.
-
-  Mock responses mirror the complete real structure.
-
-  A method only tests call lives in test utilities, not production.
-
-  About to assert on the mock itself?
-    Unmock it or delete the assertion.
-```
-
-## Tests Ship With the Implementation
-
-The TDD cycle — failing test, minimal implementation, refactor — is what
-"complete" means. Ship the tests the behavior needs and only those:
-trivial code and human prose earn none, and a test written to satisfy
-process costs maintenance forever.
-
-## The Mutation Check
-
-Before finishing, mentally mutate the production code; at least one test
-should fail for each realistic mutation:
-
- Wrong constant or argument
- Wrong branch handler
- Missing state change or side effect
- Empty or default return
- Missing validation for zero, empty, nil, unauthorized, or malformed input
-
-A mutation nothing catches marks the behavior as unprotected — or the
-test as tautological.
-
-## Quick Reference
-
-| When you... | Do |
-|-------------|-----|
-| Write any test | Name the break it catches — a bug, not a decision |
-| Build an expected value | Derive it by hand; never with the code under test |
-| Test a script or document | Run it / pressure-test its consumer; never grep its text |
-| Reach for a dependency test | Test your boundary contract, not their documented mechanics |
-| Want to assert on a mocked element | Test the real component, or unmock it |
-| Are about to mock a method | Learn its side effects; mock the slow/external level |
-| Build a mock response | Mirror the real structure completely |
-| Need cleanup only tests use | Put it in test utilities |
-| Watch mock setup balloon | Switch to an integration test with real components |
-| Finish a test file | Run the mutation check |
-
-## Warning Signs
-
- Setup and assertion share the same object, guaranteeing equality
- The test can fail only through a panic, crash, or missing selector
- The test fails on every intentional change, never on accidental breakage
- Expected values are hidden behind loops, builders, or helpers
- The test greps source text, or asserts a removed symbol stays removed
- The test would still matter if only the framework remained
- The test exists for coverage, checking no side effect or outcome
- An assertion checks a `*-mock` test ID, or fails if you remove the mock
- A method is called only from test files
- Mock setup is more than half the test, or you can't explain why the mock is needed
- Mocking "just to be safe"
@@ -156,12 +156,47 @@ Ready to implement <feature-name>
 | Tests fail during baseline | Report failures + ask |
 | No package.json/Cargo.toml | Skip dependency install |

-## Common Rationalizations
+## Common Mistakes

-| Excuse | Reality |
-|--------|---------|
-| "I'm obviously not in a worktree — no need to check" | Run Step 0. Harness-created isolation and submodules both fool eyeballing; the detection commands settle it. |
-| "`git worktree add` is quicker than hunting for a native tool" | A native tool (e.g. `EnterWorktree`) owns placement, branching, and cleanup. Bypassing it is the #1 mistake — it creates phantom state your harness can't see or manage. |
-| "The worktree directory is surely ignored already" | Run `git check-ignore`. An unignored worktree directory commits the whole tree into the repo. |
-| "Any directory name works" | Explicit instructions beat an existing project-local directory, which beats the `.worktrees/` default. |
-| "The workspace is fresh — baseline tests can wait" | A dirty baseline makes every later failure ambiguous. Run the tests now; proceeding past failures is your human partner's call. |
+### Fighting the harness
+
+- **Problem:** Using `git worktree add` when the platform already provides isolation
+- **Fix:** Step 0 detects existing isolation. Step 1a defers to native tools.
+
+### Skipping detection
+
+- **Problem:** Creating a nested worktree inside an existing one
+- **Fix:** Always run Step 0 before creating anything
+
+### Skipping ignore verification
+
+- **Problem:** Worktree contents get tracked, pollute git status
+- **Fix:** Always use `git check-ignore` before creating project-local worktree
+
+### Assuming directory location
+
+- **Problem:** Creates inconsistency, violates project conventions
+- **Fix:** Follow priority: explicit instructions > existing project-local directory > default
+
+### Proceeding with failing tests
+
+- **Problem:** Can't distinguish new bugs from pre-existing issues
+- **Fix:** Report failures, get explicit permission to proceed
+
+## Red Flags
+
+**Never:**
+- Create a worktree when Step 0 detects existing isolation
+- Use `git worktree add` when you have a native worktree tool (e.g., `EnterWorktree`). This is the #1 mistake — if you have it, use it.
+- Skip Step 1a by jumping straight to Step 1b's git commands
+- Create worktree without verifying it's ignored (project-local)
+- Skip baseline test verification
+- Proceed with failing tests without asking
+
+**Always:**
+- Run Step 0 detection first
+- Prefer native tools over git fallback
+- Follow directory priority: explicit instructions > existing project-local directory > default
+- Verify directory is ignored for project-local
+- Auto-detect and run project setup
+- Verify clean test baseline
@@ -1,63 +0,0 @@
-# Gemini CLI Tool Mapping
-
-Skills speak in actions ("dispatch a subagent", "create a todo", "read a file"). On Gemini CLI these resolve to the tools below.
-
-| Action skills request | Gemini CLI equivalent |
-|----------------------|----------------------|
-| Read a file | `read_file` |
-| Read multiple files at once | `read_many_files` |
-| Create a new file | `write_file` |
-| Edit a file | `replace` |
-| Run a shell command | `run_shell_command` |
-| Search file contents | `grep_search` |
-| Find files by name | `glob` |
-| List files and subdirectories | `list_directory` |
-| Fetch a URL | `web_fetch` |
-| Search the web | `google_web_search` |
-| Invoke a skill | `activate_skill` |
-| Dispatch a subagent (`Subagent (general-purpose):` template) | `invoke_agent` with `agent_name: "generalist"` (invocable via `@generalist` chat syntax — see [Subagent support](#subagent-support)) |
-| Multiple parallel dispatches | Multiple `invoke_agent` calls in the same response |
-| Task tracking ("create a todo", "mark complete") | `write_todos` (statuses: pending, in_progress, completed, cancelled, blocked) |
-
-## Instructions file
-
-When a skill mentions "your instructions file", on Gemini CLI this is **`GEMINI.md`**. Gemini CLI loads `GEMINI.md` hierarchically: global at `~/.gemini/GEMINI.md`, project-level files in workspace directories and their ancestors, and sub-directory `GEMINI.md` files when a tool accesses files in those directories.
-
-## Personal skills directory
-
-User-level skills live at **`~/.gemini/skills/`**, with **`~/.agents/skills/`** as a cross-runtime alias (shared with Codex and Copilot CLI). When both directories exist at the same scope, `.agents/skills/` takes precedence. Each skill is a subdirectory containing a `SKILL.md` (with `name` and `description` frontmatter).
-
-## Subagent support
-
-Gemini CLI dispatches subagents through the `invoke_agent` tool, which takes `agent_name` and `prompt` parameters. The same dispatch is also surfaced as a chat-syntax shortcut: typing `@generalist <prompt>` is equivalent to calling `invoke_agent` with `agent_name: "generalist"`. Built-in agent names include `generalist`, `cli_help`, `codebase_investigator`, and (with browser tooling enabled) `browser_agent`.
-
-Skills dispatch with `Subagent (general-purpose):` and either reference a prompt-template file (e.g., `superpowers:subagent-driven-development`'s `./implementer-prompt.md`) or supply an inline prompt. On Gemini CLI:
-
-| Skill dispatch form | Gemini CLI equivalent |
-|---------------------|----------------------|
-| References a `*-prompt.md` template (implementer, task-reviewer, code-reviewer, etc.) | Fill the template, then `invoke_agent` with `agent_name: "generalist"` and the filled prompt |
-| References `superpowers:requesting-code-review`'s `./code-reviewer.md` | `invoke_agent` with `agent_name: "generalist"` and the filled review template |
-| Inline prompt (no template referenced) | `invoke_agent` with `agent_name: "generalist"` and your inline prompt |
-
-### Prompt filling
-
-Skills provide prompt templates with placeholders like `{WHAT_WAS_IMPLEMENTED}` or `[FULL TEXT of task]`. Fill all placeholders before passing the complete prompt to `invoke_agent`. The prompt template itself contains the agent's role, review criteria, and expected output format — the subagent will follow it.
-
-### Parallel dispatch
-
-Gemini CLI supports parallel subagent dispatch. Issue multiple `invoke_agent` calls in the same response (or multiple `@generalist` invocations in one prompt) to run independent subagent work in parallel. Keep dependent tasks sequential, but do not serialize independent subagent tasks just to preserve a simpler history.
-
-## Additional Gemini CLI tools
-
-These tools are unique to Gemini CLI:
-
-| Tool | Purpose |
-|------|---------|
-| `save_memory` (legacy) | Persist facts across sessions when `experimental.memoryV2 = false` |
-| `get_internal_docs` | Look up Gemini CLI's bundled documentation |
-| `ask_user` | Pose structured questions to the user (text / single-select / multi-select) |
-| `enter_plan_mode` / `exit_plan_mode` | Switch into and out of read-only plan mode |
-| `update_topic` | Update the current conversation's topic / strategic-intent metadata |
-| `complete_task` | Signal that a Gemini subagent has completed and return its result to the parent agent |
-| `tracker_create_task`, `tracker_update_task`, `tracker_get_task`, `tracker_list_tasks`, `tracker_add_dependency`, `tracker_visualize` | Rich task tracker with dependency and visualization support |
-| `read_mcp_resource`, `list_mcp_resources` | MCP resource access |
@@ -7,6 +7,8 @@ description: Use when about to claim work is complete, fixed, or passing, before

 ## Overview

+Claiming work is complete without verification is dishonesty, not efficiency.
+
 **Core principle:** Evidence before claims, always.

 **Violating the letter of this rule is violating the spirit of this rule.**
@@ -103,6 +105,15 @@ Skip any step = lying, not verifying
 ❌ Trust agent report
 ```

+## Why This Matters
+
+From 24 failure memories:
+- your human partner said "I don't believe you" - trust broken
+- Undefined functions shipped - would crash
+- Missing requirements shipped - incomplete features
+- Time wasted on false completion → redirect → rework
+- Violates: "Honesty is a core value. If you lie, you'll be replaced."
+
 ## When To Apply

 **ALWAYS before:**
@@ -118,3 +129,11 @@ Skip any step = lying, not verifying
 - Paraphrases and synonyms
 - Implications of success
 - ANY communication suggesting completion/correctness
+
+## The Bottom Line
+
+**No shortcuts for verification.**
+
+Run the command. Read the output. THEN claim the result.
+
+This is non-negotiable.
@@ -135,6 +135,12 @@ Every step must contain the actual content an engineer needs. These are **plan f
 - Steps that describe what to do without showing how (code blocks required for code steps)
 - References to types, functions, or methods not defined in any task

+## Remember
+- Exact file paths always
+- Complete code in every step — if a step changes code, show the code
+- Exact commands with expected output
+- DRY, YAGNI, TDD, frequent commits
+
 ## Self-Review

 After writing the complete plan, look at the spec with fresh eyes and check the plan against it. This is a checklist you run yourself — not a subagent dispatch.
@@ -9,7 +9,7 @@ description: Use when creating new skills, editing existing skills, or verifying

 **Writing skills IS Test-Driven Development applied to process documentation.**

-**Personal skills live in your runtime's skills directory** (`~/.claude/skills/` on Claude Code) — see [codex-tools.md](../using-superpowers/references/codex-tools.md) or [gemini-tools.md](../using-superpowers/references/gemini-tools.md) for the path on those runtimes. Codex, Copilot CLI, and Gemini CLI all also recognize `~/.agents/skills/` as a cross-runtime alias.
+**Personal skills live in your runtime's skills directory** 

 You write test cases (pressure scenarios with subagents), watch them fail (baseline behavior), write the skill (documentation), watch tests pass (agents comply), and refactor (close loopholes).

@@ -677,3 +677,13 @@ How future agents find your skill:
 6. **Loads example** (only when implementing)

 **Optimize for this flow** - put searchable terms early and often.
+
+## The Bottom Line
+
+**Creating skills IS TDD for process documentation.**
+
+Same Iron Law: No skill without failing test first.
+Same cycle: RED (baseline) → GREEN (write skill) → REFACTOR (close loopholes).
+Same benefits: Better quality, fewer surprises, bulletproof results.
+
+If you follow TDD for code, follow it for skills. It's the same discipline applied to documentation.
@@ -2,9 +2,8 @@
 # Validate the Antigravity (agy) integration. agy installs the existing plugin
 # directly (`agy plugin install <repo-url>`): it loads the bundled skills and
 # runs the SessionStart hook for bootstrap, so there is no agy-specific scaffold
-# to test. What IS agy-specific is the tool mapping — subagent dispatch via
-# invoke_subagent (self/research types) and task tracking via a task artifact —
-# and SKILL.md pointing at it.
+# to test. What IS agy-specific is the tool mapping — agy has no `Skill` tool and
+# loads skills by reading SKILL.md with view_file — and SKILL.md pointing at it.
 #
 # Mirrors tests/pi/test-pi-extension.mjs's "tools reference documents
 # harness-specific mappings" check. CI-safe: does not require `agy` installed.
@@ -23,8 +22,16 @@ echo "test-antigravity-tools: checking Antigravity tool mapping"
 # --- Mapping exists ---------------------------------------------------------
 [ -f "$MAPPING" ] || fail "tool mapping missing at $MAPPING"

+# --- Skill-load mechanism: view_file on SKILL.md (IsSkillFile), no Skill tool -
+grep -qiE "view_file" "$MAPPING" \
+  || fail "mapping does not document view_file as the file/skill-read tool"
+grep -qiE "SKILL\.md" "$MAPPING" \
+  || fail "mapping does not document reading SKILL.md as the skill-load path"
+grep -q "IsSkillFile" "$MAPPING" \
+  || fail "mapping does not document setting IsSkillFile when loading a skill"
+
 # --- Core action→tool mappings are documented -------------------------------
-for tool in write_to_file replace_file_content invoke_subagent; do
+for tool in write_to_file replace_file_content run_command grep_search invoke_subagent; do
  grep -q "$tool" "$MAPPING" \
    || fail "mapping does not document the '$tool' tool"
 done
@@ -43,4 +50,4 @@ grep -qE 'ArtifactType.*task|task. artifact' "$MAPPING" \
 grep -q "antigravity-tools.md" "$SKILL" \
  || fail "SKILL.md Platform Adaptation does not reference antigravity-tools.md"

-echo "PASS: Antigravity tool mapping valid (subagent dispatch, task artifact, SKILL.md link)"
+echo "PASS: Antigravity tool mapping valid (view_file skill-load, agy tools, SKILL.md link)"
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
-# Tests for the SDD workspace: scripts/sdd-workspace resolves a self-ignoring
-# working-tree directory for SDD artifacts, and the SDD scripts write into it.
+# Tests for the SDD workspace: scripts/sdd-workspace resolves a self-ignoring,
+# PER-PLAN working-tree directory for SDD artifacts, and the SDD scripts write
+# into their plan's directory.
 set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
@@ -35,26 +36,72 @@ main() {
    local repo
    repo="$(cd "$TEST_ROOT/repo" && git rev-parse --show-toplevel)"

-    local dir
-    dir="$(cd "$repo" && "$SDD_SCRIPTS/sdd-workspace")"
+    cat > "$repo/plan-a.md" <<'PLAN'
+# Plan A

-    if [[ "$dir" == "$repo/.superpowers/sdd" ]]; then
-        pass "prints <repo-root>/.superpowers/sdd"
+## Task 1: First thing
+
+Do the first thing.
+PLAN
+    cat > "$repo/plan-b.md" <<'PLAN'
+# Plan B
+
+## Task 1: Other thing
+
+Do the other thing.
+PLAN
+
+    # --- argument validation ---
+    local rc=0
+    (cd "$repo" && "$SDD_SCRIPTS/sdd-workspace" >/dev/null 2>&1) || rc=$?
+    if [[ "$rc" -eq 2 ]]; then
+        pass "sdd-workspace without a plan errors with exit 2"
    else
-        fail "prints <repo-root>/.superpowers/sdd"
-        echo "    got: $dir"
+        fail "sdd-workspace without a plan errors with exit 2"
+        echo "    exit: $rc"
+    fi
+
+    rc=0
+    (cd "$repo" && "$SDD_SCRIPTS/sdd-workspace" no-such-plan.md >/dev/null 2>&1) || rc=$?
+    if [[ "$rc" -eq 2 ]]; then
+        pass "sdd-workspace with a missing plan file errors with exit 2"
+    else
+        fail "sdd-workspace with a missing plan file errors with exit 2"
+        echo "    exit: $rc"
+    fi
+
+    # --- per-plan resolution ---
+    local dir_a dir_b
+    dir_a="$(cd "$repo" && "$SDD_SCRIPTS/sdd-workspace" plan-a.md)"
+    dir_b="$(cd "$repo" && "$SDD_SCRIPTS/sdd-workspace" plan-b.md)"
+
+    if [[ "$dir_a" == "$repo/.superpowers/sdd/plan-a" ]]; then
+        pass "prints <repo-root>/.superpowers/sdd/<plan-basename>"
+    else
+        fail "prints <repo-root>/.superpowers/sdd/<plan-basename>"
+        echo "    got: $dir_a"
+    fi
+
+    if [[ "$dir_a" != "$dir_b" && -d "$dir_a" && -d "$dir_b" ]]; then
+        pass "two plans resolve to two distinct directories"
+    else
+        fail "two plans resolve to two distinct directories"
+        echo "    a: $dir_a"
+        echo "    b: $dir_b"
    fi

    if [[ -f "$repo/.superpowers/sdd/.gitignore" && "$(cat "$repo/.superpowers/sdd/.gitignore")" == "*" ]]; then
-        pass "self-ignoring .gitignore created with '*'"
+        pass "self-ignoring .gitignore created at .superpowers/sdd/ with '*'"
    else
-        fail "self-ignoring .gitignore created with '*'"
+        fail "self-ignoring .gitignore created at .superpowers/sdd/ with '*'"
    fi

-    printf 'x\n' > "$repo/.superpowers/sdd/artifact.md"
+    printf 'x\n' > "$dir_a/artifact.md"
    local status
    status="$(cd "$repo" && git status --porcelain)"
-    if [[ -z "$status" ]]; then
+    # plan-a.md/plan-b.md are intentionally untracked fixture files; only the
+    # workspace must be invisible.
+    if [[ "$status" != *".superpowers"* ]]; then
        pass "workspace invisible to git status"
    else
        fail "workspace invisible to git status"
@@ -64,67 +111,78 @@ main() {
    ( cd "$repo" && git add -A )
    local staged
    staged="$(cd "$repo" && git diff --cached --name-only)"
-    if [[ -z "$staged" ]]; then
+    if [[ "$staged" != *".superpowers"* ]]; then
        pass "git add -A does not stage the workspace"
    else
        fail "git add -A does not stage the workspace"
        echo "    staged: $staged"
    fi

-    cat > "$repo/plan.md" <<'PLAN'
-# Plan
-
-## Task 1: First thing
-
-Do the first thing.
-PLAN
-
+    # --- task-brief lands in its plan's directory ---
    local brief_out brief_path
-    brief_out="$(cd "$repo" && "$SDD_SCRIPTS/task-brief" plan.md 1)"
+    brief_out="$(cd "$repo" && "$SDD_SCRIPTS/task-brief" plan-a.md 1)"
    brief_path="$(printf '%s\n' "$brief_out" | sed -n 's/^wrote \(.*\): [0-9][0-9]* lines$/\1/p')"
-    case "$brief_path" in
-        "$repo/.superpowers/sdd/"*) pass "task-brief writes its brief under the workspace" ;;
-        *)
-            fail "task-brief writes its brief under the workspace"
-            echo "    got: $brief_path"
-            ;;
-    esac
+    if [[ "$brief_path" == "$repo/.superpowers/sdd/plan-a/task-1-brief.md" ]]; then
+        pass "task-brief writes its brief under the plan's workspace"
+    else
+        fail "task-brief writes its brief under the plan's workspace"
+        echo "    got: $brief_path"
+    fi

+    # --- review-package takes the plan first and lands in its directory ---
    local git_id=(-c user.email=t@example.com -c user.name=t -c commit.gpgsign=false)
    ( cd "$repo" \
-        && git add plan.md \
        && git "${git_id[@]}" commit -qm c1 \
        && printf 'y\n' > f && git add f \
        && git "${git_id[@]}" commit -qm c2 )
    local rp_out rp_path
-    rp_out="$(cd "$repo" && "$SDD_SCRIPTS/review-package" HEAD~1 HEAD)"
+    rp_out="$(cd "$repo" && "$SDD_SCRIPTS/review-package" plan-a.md HEAD~1 HEAD)"
    rp_path="$(printf '%s\n' "$rp_out" | sed -n 's/^wrote \(.*\): [0-9].*$/\1/p')"
    case "$rp_path" in
-        "$repo/.superpowers/sdd/"*) pass "review-package writes its diff under the workspace" ;;
+        "$repo/.superpowers/sdd/plan-a/review-"*.diff)
+            pass "review-package writes its diff under the plan's workspace" ;;
        *)
-            fail "review-package writes its diff under the workspace"
+            fail "review-package writes its diff under the plan's workspace"
            echo "    got: $rp_path"
            ;;
    esac

+    rc=0
+    (cd "$repo" && "$SDD_SCRIPTS/review-package" HEAD~1 HEAD >/dev/null 2>&1) || rc=$?
+    if [[ "$rc" -eq 2 ]]; then
+        pass "review-package without a plan errors with exit 2"
+    else
+        fail "review-package without a plan errors with exit 2"
+        echo "    exit: $rc"
+    fi
+
+    local rp_explicit
+    rp_explicit="$(cd "$repo" && "$SDD_SCRIPTS/review-package" plan-a.md HEAD~1 HEAD "$TEST_ROOT/explicit.diff")"
+    if [[ -s "$TEST_ROOT/explicit.diff" && "$rp_explicit" == *"$TEST_ROOT/explicit.diff"* ]]; then
+        pass "review-package honors an explicit OUTFILE"
+    else
+        fail "review-package honors an explicit OUTFILE"
+        echo "    got: $rp_explicit"
+    fi
+
    # --- Worktree isolation: a linked worktree resolves its own workspace ---
    local wt="$TEST_ROOT/wt"
    ( cd "$repo" && git worktree add -q "$wt" -b wt-feature )
    local wt_root wt_dir
    wt_root="$(cd "$wt" && git rev-parse --show-toplevel)"
-    wt_dir="$(cd "$wt" && "$SDD_SCRIPTS/sdd-workspace")"
-    if [[ "$wt_dir" == "$wt_root/.superpowers/sdd" && "$wt_dir" != "$dir" ]]; then
+    wt_dir="$(cd "$wt" && "$SDD_SCRIPTS/sdd-workspace" plan-a.md)"
+    if [[ "$wt_dir" == "$wt_root/.superpowers/sdd/plan-a" && "$wt_dir" != "$dir_a" ]]; then
        pass "linked worktree resolves its own distinct workspace"
    else
        fail "linked worktree resolves its own distinct workspace"
-        echo "    main: $dir"
+        echo "    main: $dir_a"
        echo "    wt:   $wt_dir"
    fi

-    printf 'y\n' > "$wt/.superpowers/sdd/artifact.md"
+    printf 'y\n' > "$wt_dir/artifact.md"
    local wt_status
    wt_status="$(cd "$wt" && git status --porcelain)"
-    if [[ -z "$wt_status" ]]; then
+    if [[ "$wt_status" != *".superpowers"* ]]; then
        pass "worktree workspace invisible to git status"
    else
        fail "worktree workspace invisible to git status"
@@ -143,27 +143,6 @@ for (const forbiddenText of forbiddenTexts) {

 echo "SessionStart hook output tests"

-# Registration shape: the hook must declare shell:"bash" so Claude Code on
-# Windows dispatches via Git Bash (or fails with an actionable error) instead
-# of PowerShell/cmd.exe, whose parsers break on the quoted command string
-# (PowerShell ParserError; cmd.exe quote-stripping on paths with metacharacters).
-if node -e '
-const hooks = JSON.parse(require("fs").readFileSync(process.argv[1], "utf8"));
-const entry = hooks.hooks.SessionStart[0].hooks[0];
-if (entry.shell !== "bash") {
-  console.error(`SessionStart hook shell is ${JSON.stringify(entry.shell)}, expected "bash"`);
-  process.exit(1);
-}
-if (!/run-hook\.cmd" session-start$/.test(entry.command)) {
-  console.error(`unexpected SessionStart command shape: ${entry.command}`);
-  process.exit(1);
-}
-' "$REPO_ROOT/hooks/hooks.json"; then
-    pass "hooks.json registers SessionStart with shell:bash dispatch"
-else
-    fail "hooks.json registers SessionStart with shell:bash dispatch"
-fi
-
 claude_home="$(make_home claude-code)"
 assert_command_output \
    "Claude Code emits nested SessionStart additionalContext" \
@@ -122,16 +122,7 @@ test('pi tools reference documents pi-specific mappings', async () => {
  assert.equal(existsSync(piToolsPath), true, 'pi-tools.md should exist');
  const text = await readFile(piToolsPath, 'utf8');

-  // Assert against the mapping-table rows only. The surrounding prose mentions
-  // these same tokens, so matching the whole file would still pass if the table
-  // were deleted — the exact regression this test exists to catch.
-  const rows = text.split('\n').filter((line) => line.startsWith('|'));
-  assert.ok(
-    rows.some((row) => /subagent/i.test(row)),
-    'mapping table documents subagent dispatch',
-  );
-  assert.ok(
-    rows.some((row) => /todo|task/i.test(row)),
-    'mapping table documents task tracking',
-  );
+  for (const expected of ['Skill', 'Task', 'TodoWrite', 'read', 'write', 'edit', 'bash']) {
+    assert.match(text, new RegExp(expected));
+  }
 });
Author	SHA1	Message	Date
Jesse Vincent	5fa1ebc122	chore(sdd): consistency sweep for plan-scoped workspace signatures	2026-07-06 13:52:38 -07:00
Jesse Vincent	82cc596a42	eval(sdd): GREEN results — plan-scoped resolution replaces cross-plan forensics	2026-07-06 13:18:24 -07:00
Jesse Vincent	e90e40fb4d	feat(sdd): plan-scoped durable progress — ledger names its plan, workspace dies at plan end The start-of-skill ledger check is now scoped to the plan's own workspace and keyed to the ledger's first line. Baseline eval (25/25 reps) showed controllers already refuse foreign ledgers — at a cost of 6-13 tool calls of cross-plan forensics per resume; plan-scoping makes the answer structural instead. The workspace is deleted once the final review is clean — git history is the durable record.	2026-07-06 12:48:49 -07:00
Jesse Vincent	d5ea3a7e60	feat(sdd): plan-scoped workspace — one .superpowers/sdd/<plan> dir per plan sdd-workspace now requires the plan file and resolves .superpowers/sdd/<plan-basename>/; task-brief and review-package write into their plan's directory (review-package gains PLAN_FILE as its first argument). Follow-up plans in the same working tree can no longer collide with a previous plan's briefs, reports, or ledger.	2026-07-06 12:36:53 -07:00
Jesse Vincent	913bfd3354	eval(sdd): RED baseline — 25/25 controllers refuse stale ledgers, at a forensic cost	2026-07-06 12:22:39 -07:00
Jesse Vincent	45ce22f56a	docs(specs): record eval re-scope — blind adoption did not reproduce, claims narrowed 25/25 baseline reps refused the stale foreign ledger via git forensics; the spec's evaluation section now states the honest claims: structural fix + measured disambiguation-cost delta + same-plan-resume regression gate, shipping with explicit maintainer sign-off in place of a failing S1 baseline.	2026-07-06 12:08:01 -07:00
Jesse Vincent	cf6898ac06	docs(plans): re-scope eval per maintainer decision — RED compiled, GREEN measures cost Three RED rounds (25 reps, three framings incl. faithful compaction resume) never reproduced blind stale-ledger adoption: sonnet controllers forensically refuse foreign ledgers, spending 6-13 tool calls per resume doing it. Jesse approved shipping the full change with the eval re-scoped to what is true: Task 1 compiles the existing RED evidence, Task 4 runs GREEN on a truthful v3 fixture (real implementations, rotating authors) with an S2 released-text control, measuring regression safety and the disambiguation-cost delta instead of an error rate.	2026-07-06 12:07:18 -07:00
Jesse Vincent	411824550d	docs(plans): fixture v2 — real cited commits, matched task counts Fixture v1 tripped the Task 1 STOP gate for the right reason: its ledgers cited fabricated hashes, so RED agents dismissed them via git forensics (S1 passed for the wrong mechanism, the S2 resume control failed 5/5). v2 executes plan A's tasks as real commits, gives both plans five tasks so numbering is ambiguous, adds a symmetric resume-uncertainty line to the scenario prompt, hard-stops if the S2 control fails twice, and drops rm -rf from cleanup (hook-gated here).	2026-07-06 11:36:53 -07:00
Jesse Vincent	6cbd2bd26c	docs(plans): SDD plan-scoped workspace implementation plan Five tasks: RED baseline eval (writing-skills Iron Law — before any skill edit), plan-scoped scripts via TDD, SKILL.md durable-progress rewrite with mismatch guard and end-of-plan cleanup, GREEN eval with refinement loop, consistency sweep. Eval = 5 fresh sonnet subagents per scenario per arm, hand-scored.	2026-07-06 11:14:53 -07:00
Jesse Vincent	9e557bd1c8	docs(specs): SDD plan-scoped workspace design The .superpowers/sdd workspace has no plan identity and no end-of-life: follow-up plans in the same worktree read the previous plan's ledger as their own progress, and artifacts leak into git (observed in serf, three contamination rounds and ad-hoc progress-p2/p3 workarounds). Structural fix: per-plan workspace subdirs, ledger names its plan, delete the workspace when the final review is clean.	2026-07-06 11:06:10 -07:00