diff --git a/.claude/commands/build.md b/.claude/commands/build.md
new file mode 100644
--- /dev/null
+++ b/.claude/commands/build.md
@@ -1,0 +1,48 @@
+---
+description: Build incrementally. Implement changes in thin vertical slices with TDD and atomic commits. Run after /plan.
+allowed-tools: Task, Skill, Read, Write, Edit, Glob, Grep, Bash(git add:*), Bash(git commit:*), Bash(git status:*), Bash(git diff:*), Bash(python3:*)
+argument-hint: [plan-step-or-task-description]
+---
+
+@CLAUDE.md
+
+Invoke the code-qualities-assessment and golden-principles skills.
+
+Build: $ARGUMENTS
+
+Use Task(subagent_type="implementer") as the primary agent. If no argument provided, check for recent /plan output or ask what to build.
+
+Evaluate across all 5 axes:
+
+1. **Test-first discipline** - Red before green before refactor. No code without a failing test.
+2. **Commit atomicity** - Each commit is one logical change, rollback-safe.
+3. **Code quality** - Cohesion, coupling, encapsulation, testability, non-redundancy.
+4. **Complexity budget** - Cyclomatic complexity <=10. Methods <=60 lines. No nesting.
+5. **Standards compliance** - Golden principles, style enforcement, naming conventions.
+
+## Software Hierarchy of Needs
+
+Design emerges bottom-up. Enforce qualities before reaching for patterns.
+
+1. Qualities: Cohesion, Coupling, DRY, Encapsulation, Testability
+2. Principles: Open-Closed, Encapsulate by Policy, Separation of Concerns
+3. Practices: Programming by Intention, State Always Private, CVA
+4. Wisdom: Design to interfaces, Favor delegation over inheritance, Encapsulate what varies, Separate use from creation
+5. Patterns: Only when the problem demands it. Three similar lines beat a premature abstraction.
+
+## Process
+
+1. Read the task or plan step
+2. Write a failing test (red)
+3. Write the minimum code to pass (green)
+4. Refactor toward the hierarchy of needs (refactor)
+5. Run golden-principles and taste-lints before committing
+6. Commit atomically with conventional message
+7. Repeat for next slice
+
+## Guardrails
+
+- Hard to test? Fix the design, not the test. Indicates tight coupling or weak encapsulation.
+- Ask "how would I test this?" even without tests.
+- Every method should read like a sentence (Programming by Intention).
+- Favor delegation over inheritance. A makes B, or A uses B. Never both.

diff --git a/.claude/commands/plan.md b/.claude/commands/plan.md
new file mode 100644
--- /dev/null
+++ b/.claude/commands/plan.md
@@ -1,0 +1,47 @@
+---
+description: Plan how to build it. Decompose specs into milestones with dependencies and risk mitigations. Run after /spec.
+allowed-tools: Task, Skill, Read, Glob, Grep
+argument-hint: [spec-output-or-issue-number]
+---
+
+@CLAUDE.md
+
+Invoke the planner and execution-plans skills.
+
+Plan how to build: $ARGUMENTS
+
+Use Task(subagent_type="milestone-planner") for milestone breakdown, then Task(subagent_type="task-decomposer") for atomic tasks. If no argument provided, check for recent /spec output or ask what to plan.
+
+Evaluate across all 5 axes:
+
+1. **Scope integrity** - Nothing unnecessary, nothing missing
+2. **Dependency ordering** - Can tasks execute in the stated sequence?
+3. **Risk coverage** - All P0 risks have mitigations
+4. **Estimate confidence** - Complexity-based sizing (S/M/L), not time-based
+5. **Reversibility** - Which steps are hard to undo?
+
+## Principles
+
+- **Programming by Intention**: Sergeant methods direct workflow. Each task should read like an intent, not an implementation.
+- **OODA Loop**: Observe (read the spec), Orient (map to existing code), Decide (sequence tasks), Act (commit the plan). Faster loops win.
+- **First Principles**: Question the requirement, try to delete the step, then optimize, then speed up, then automate. Never automate something that should not exist.
+
+## Process
+
+1. Read the spec or issue
+2. Map sub-problems to existing code (what already exists?)
+3. Break into milestones with clear exit criteria
+4. Decompose milestones into atomic tasks (each independently verifiable)
+5. Sequence by dependencies, flag parallel opportunities
+6. Run pre-mortem on the plan itself
+7. Route to Task(subagent_type="critic") for validation
+
+## Output
+
+Structured plan with:
+
+- Milestones (numbered, with exit criteria)
+- Tasks per milestone (atomic, with acceptance criteria)
+- Dependency graph (what blocks what)
+- Risk register (risk, likelihood, mitigation)
+- Deferred items (explicitly out of scope for this plan)

diff --git a/.claude/commands/review.md b/.claude/commands/review.md
new file mode 100644
--- /dev/null
+++ b/.claude/commands/review.md
@@ -1,0 +1,49 @@
+---
+description: Review before merge. Five-axis code review across architecture, security, quality, tests, and standards. Run after /test.
+allowed-tools: Task, Skill, Read, Glob, Grep, Bash(git diff:*), Bash(git log:*), Bash(git status:*)
+argument-hint: [branch-or-pr-number]
+---
+
+@CLAUDE.md
+
+Invoke the analyze, code-qualities-assessment, and security-scan skills.
+
+Review the current changes across all five axes: $ARGUMENTS
+
+If no argument, review the current branch diff against main.
+
+Sequential evaluation order:
+
+1. **Architecture** - Follows existing patterns? Clean boundaries? Right abstraction level? Coupling intentional? ADR conformance?
+2. **Security** - Input validated? Secrets safe? Auth checked? OWASP top 10? STRIDE threats? CWE scan? (Use Task(subagent_type="security"))
+3. **Code quality** - Score all 5 qualities: cohesion, coupling, encapsulation, testability, non-redundancy. Cyclomatic complexity <=10? Methods <=60 lines?
+4. **Test completeness** - Every new code path has a test? Failure paths covered? Acceptance criteria verified?
+5. **Standards** - Golden principles, taste lints, style enforcement, naming conventions
+
+## Principles
+
+- **Design to interfaces**: Review signatures from the consumer perspective. Hidden implementation details should stay hidden.
+- **Encapsulate what varies**: If the diff introduces variation, is it encapsulated? Or scattered?
+- **Chesterton's Fence**: Before removing code, verify you understand why it existed.
+- **Principle of Least Privilege**: New permissions, scopes, or access? Challenge each one.
+
+## Process
+
+1. Read the diff (git diff main...HEAD)
+2. Architecture pass: Task(subagent_type="architect") evaluates structure
+3. Security pass: Task(subagent_type="security") evaluates threats
+4. Quality pass: invoke code-qualities-assessment skill
+5. Test pass: Task(subagent_type="qa") evaluates coverage
+6. Standards pass: invoke golden-principles and taste-lints skills
+7. Synthesize findings
+
+## Output
+
+Categorize each finding as **Critical**, **Important**, or **Suggestion**.
+
+Structured review with:
+
+- Finding (what is wrong)
+- Location (file:line)
+- Severity (Critical/Important/Suggestion)
+- Fix (specific recommendation)

diff --git a/.claude/commands/ship.md b/.claude/commands/ship.md
new file mode 100644
--- /dev/null
+++ b/.claude/commands/ship.md
@@ -1,0 +1,44 @@
+---
+description: Ship it. Pre-flight validation, CI check, and PR creation. Run after /review.
+allowed-tools: Task, Skill, Read, Glob, Grep, Bash(git diff:*), Bash(git log:*), Bash(git status:*), Bash(git push:*), Bash(python3:*)
+argument-hint: [target-branch]
+---
+
+@CLAUDE.md
+
+Invoke the pipeline-validator skill.
+
+Ship the current branch: $ARGUMENTS
+
+Use Task(subagent_type="devops") as the primary agent. Default target is main unless specified.
+
+Pre-flight checks (all must pass):
+
+1. **Pipeline health** - All CI checks green? No suppressed failures? Run pipeline-validator.
+2. **Security posture** - Final security-scan clean? No new CWE findings? No secrets in diff?
+3. **Review complete** - Has /review been run? Any unresolved Critical findings?
+4. **Tests passing** - All tests green? No skipped tests without justification?
+5. **Standards clean** - Golden principles and taste lints pass?
+
+## Principles
+
+- **Faster is safer**: Small, frequent shipments reduce blast radius. Ship early.
+- **No deliberate debt**: If it is not ready, do not ship it. Fix it or defer it.
+- **Observability first**: If you cannot measure it, you cannot ship it safely.
+
+## Process
+
+1. Run pre-flight checks (all 5 above)
+2. If any check fails: report what failed, why, and how to fix. Stop.
+3. If all pass: validate PR description (run /validate-pr-description command)
+4. Create PR via /push-pr command
+5. Report: what shipped, PR link, any warnings
+
+## Output
+
+Ship report:
+
+- Pre-flight results (pass/fail per check)
+- PR link (if created)
+- Warnings (non-blocking concerns)
+- Next steps (monitoring, follow-up items)

diff --git a/.claude/commands/spec.md b/.claude/commands/spec.md
new file mode 100644
--- /dev/null
+++ b/.claude/commands/spec.md
@@ -1,0 +1,45 @@
+---
+description: Define what to build. Transform a problem into testable requirements with acceptance criteria.
+allowed-tools: Task, Skill, Read, Glob, Grep
+argument-hint: [problem-statement-or-issue-number]
+---
+
+@CLAUDE.md
+
+Invoke the cva-analysis and decision-critic skills.
+
+Define what to build for: $ARGUMENTS
+
+Use Task(subagent_type="spec-generator") to produce requirements. If no argument provided, ask what problem to solve.
+
+Evaluate across all 5 axes:
+
+1. **Problem clarity** - Is the right problem being solved? Could a reframing yield 10x impact?
+2. **Requirement testability** - Can each requirement be verified pass/fail?
+3. **Completeness** - No gaps between problem statement and acceptance criteria?
+4. **Traceability** - REQ to DESIGN to TASK linkage established?
+5. **Feasibility** - Buildable within constraints? Existing code to leverage?
+
+## Principles
+
+- **CVA**: Identify commonalities first, then variabilities, then relationships. Greatest risk is the wrong abstraction.
+- **YAGNI**: Only specify what is needed now. Speculative requirements create waste.
+- **Separation of Concerns**: Each requirement addresses one concern. Mixed concerns signal a missing decomposition.
+
+## Process
+
+1. Clarify the problem (what, who, why, constraints)
+2. Search for existing solutions in the codebase (grep for related patterns)
+3. Apply CVA: what is common across use cases? What varies?
+4. Write requirements as testable acceptance criteria
+5. Run pre-mortem: what fails first?
+6. Run decision-critic: challenge assumptions before committing
+
+## Output
+
+Structured requirements with:
+
+- Problem statement (1-2 sentences)
+- Acceptance criteria (numbered, testable)
+- Out of scope (explicit exclusions)
+- Open questions (unresolved unknowns)

diff --git a/.claude/commands/test.md b/.claude/commands/test.md
new file mode 100644
--- /dev/null
+++ b/.claude/commands/test.md
@@ -1,0 +1,47 @@
+---
+description: Prove it works. Run layered tests and debug failures with hypothesis-driven investigation. Run after /build.
+allowed-tools: Task, Skill, Read, Write, Edit, Glob, Grep, Bash(git diff:*), Bash(git status:*), Bash(python3:*), Bash(pytest:*), Bash(npm test:*)
+argument-hint: [component-or-failure-description]
+---
+
+@CLAUDE.md
+
+Invoke the code-qualities-assessment and quality-grades skills.
+
+Test: $ARGUMENTS
+
+Use Task(subagent_type="qa") as the primary agent. For security testing, also invoke Task(subagent_type="security"). If no argument provided, test the current branch diff against main.
+
+Evaluate across all 5 axes:
+
+1. **Unit coverage** - Each method in isolation, dependencies injected
+2. **Integration coverage** - Contracts between components verified
+3. **Acceptance coverage** - Each requirement has a passing test
+4. **Security coverage** - OWASP top 10 scenarios exercised
+5. **Failure coverage** - Error paths tested, chaos hypotheses validated
+
+## Principles
+
+- **Testability is design feedback**: Hard to test means poor encapsulation, tight coupling, Law of Demeter violation, weak cohesion, or procedural code.
+- **Tests are proof**: A passing test is evidence. A missing test is a gap in knowledge.
+- **Hypothesis-driven debugging**: When a test fails, form a hypothesis before changing code. Verify the hypothesis. Then fix.
+
+## Process
+
+1. Identify what changed (git diff against main)
+2. Map changes to test coverage: which tests cover this code?
+3. Run existing tests first (catch regressions)
+4. Identify coverage gaps: new code paths without tests
+5. Write missing tests (unit first, then integration)
+6. For failures: hypothesis, verify, fix (never change code without understanding why)
+7. Run security-scan for CWE patterns
+8. Report: passing, failing, gaps, recommendations
+
+## Output
+
+Structured test report:
+
+- Tests run (count, pass/fail)
+- Coverage gaps (specific files and functions)
+- Security findings (CWE references)
+- Recommendations (what to add, what to fix)

diff --git a/.claude/commands/workflow/0-init.md b/.claude/commands/workflow/0-init.md
deleted file mode 100644
--- a/.claude/commands/workflow/0-init.md
+++ /dev/null
@@ -1,48 +1,0 @@
----
-description: Session initialization - enforce ADR-007 memory-first architecture at session start. Loads project context, creates session log, and declares current branch via Invoke-Init.ps1.
-argument-hint: [--session-number N] [--objective "text"]
-allowed-tools:
-  - Bash(pwsh .claude/skills/workflow/scripts/*)
-  - Bash(pwsh .claude/skills/session-init/scripts/*)
-  - Bash(git:*)
-  - Bash(ls:*)
-  - Read
-model: sonnet
----
-
-# /0-init — Session Initialization
-
-Enforce ADR-007 memory-first architecture at session start.
-
-## Context
-
-Recent sessions: !`ls -1 .agents/sessions/ | tail -5`
-
-Current branch: !`git branch --show-current`
-
-## Invocation
-
-```bash
-pwsh .claude/skills/workflow/scripts/Invoke-Init.ps1 $ARGUMENTS
-```
-
-## What This Command Does
-
-1. **Load project context** — initializes session state via Agent Orchestration MCP (graceful fallback if unavailable)
-2. **Load initial instructions** — read AGENTS.md for current project rules
-3. **Read HANDOFF.md** — load prior session context (read-only)
-4. **Surface prior context** — retrieves relevant session history via Agent Orchestration MCP (graceful fallback if unavailable)
-5. **Create session log** — via `New-SessionLog.ps1`
-6. **Declare current branch** — output git branch for orientation
-7. **Record evidence** — persist session state (graceful fallback if unavailable)
-
-## Arguments
-
-- `--session-number N`: Optional. Auto-detected from `.agents/sessions/`.
-- `--objective "text"`: Optional. Derived from branch name if omitted.
-
-## Related
-
-- Protocol: `.agents/SESSION-PROTOCOL.md`
-- ADR-007: `.agents/architecture/ADR-007-memory-first-architecture.md`
-- Session Init Skill: `.claude/skills/session-init/SKILL.md`
\ No newline at end of file

diff --git a/.claude/commands/workflow/1-plan.md b/.claude/commands/workflow/1-plan.md
deleted file mode 100644
--- a/.claude/commands/workflow/1-plan.md
+++ /dev/null
@@ -1,54 +1,0 @@
----
-description: Planning phase - route task to planner (default), architect (--arch), or roadmap→high-level-advisor chain (--strategic).
-argument-hint: [--arch] [--strategic] <task-description>
-allowed-tools:
-  - Bash(pwsh .claude/skills/workflow/scripts/*)
-  - Bash(git:*)
-  - Bash(ls:*)
-  - Read
-  - mcp__agent_orchestration__invoke_agent
-  - mcp__agent_orchestration__track_handoff
-  - mcp__agent_orchestration__get_routing_recommendation
-model: sonnet
----
-
-# /1-plan — Planning Phase
-
-Route a planning task to the appropriate agent.
-
-## Context
-
-Current branch: !`git branch --show-current`
-
-Recent commits: !`git log --oneline -5`
-
-Planning artifacts: !`ls -1 .agents/planning/ 2>/dev/null | tail -10`
-
-## Invocation
-
-```bash
-pwsh .claude/skills/workflow/scripts/Invoke-Plan.ps1 $ARGUMENTS
-```
-
-## Variants
-
-| Flag | Agent | Use When |
-|------|-------|----------|
-| *(none)* | `planner` | Standard feature/task planning |
-| `--arch` | `architect` | Design decisions, ADR-worthy choices |
-| `--strategic` | `roadmap → high-level-advisor` | Roadmap, epics, strategic alignment |
-
-## Arguments
-
-- `--arch`: Use architect agent instead of planner.
-- `--strategic`: Chain roadmap agent → high-level-advisor.
-- Remaining text: Task description passed to agent.
-
-## Output
-
-Planning artifacts stored in `.agents/planning/`.
-
-## Related
-
-- ADR-013: `.agents/architecture/ADR-013-agent-orchestration-mcp.md`
-- Agent Orchestration Spec: `.agents/specs/agent-orchestration-mcp-spec.md`
\ No newline at end of file

diff --git a/.claude/commands/workflow/2-impl.md b/.claude/commands/workflow/2-impl.md
deleted file mode 100644
--- a/.claude/commands/workflow/2-impl.md
+++ /dev/null
@@ -1,49 +1,0 @@
----
-description: Implementation phase - invoke implementer agent (default), or run full sequential chain (--full), or parallel execution of implementer+qa+security (--parallel).
-argument-hint: [--full] [--parallel] <implementation-task>
-allowed-tools:
-  - Bash(pwsh .claude/skills/workflow/scripts/*)
-  - Bash(git:*)
-  - Bash(ls:*)
-  - Read
-  - mcp__agent_orchestration__invoke_agent
-  - mcp__agent_orchestration__track_handoff
-  - mcp__agent_orchestration__start_parallel_execution
-  - mcp__agent_orchestration__aggregate_parallel_results
-  - mcp__agent_orchestration__resolve_conflict
-model: sonnet
----
-
-# /2-impl — Implementation Phase
-
-Invoke the implementer agent, optionally chaining QA and security.
-
-## Context
-
-Planning artifacts: !`ls -1 .agents/planning/ 2>/dev/null | tail -10`
-
-Current branch: !`git branch --show-current`
-
-## Invocation
-
-```bash
-pwsh .claude/skills/workflow/scripts/Invoke-Impl.ps1 $ARGUMENTS
-```
-
-## Execution Modes
-
-| Flag | Mode | Description |
-|------|------|-------------|
-| *(none)* | Default | Implementer agent only |
-| `--full` | Sequential | implementer → qa → security |
-| `--parallel` | Parallel | implementer + parallel(qa, security) |
-
-## Arguments
-
-- `--full`: Run full sequential chain after implementation.
-- `--parallel`: Run QA and security in parallel after implementation.
-- Remaining text: Implementation task description.
-
-## Related
-
-- ADR-013: `.agents/architecture/ADR-013-agent-orchestration-mcp.md`
\ No newline at end of file

diff --git a/.claude/commands/workflow/3-qa.md b/.claude/commands/workflow/3-qa.md
deleted file mode 100644
--- a/.claude/commands/workflow/3-qa.md
+++ /dev/null
@@ -1,45 +1,0 @@
----
-description: Quality assurance - invoke QA agent, validate test coverage, check acceptance criteria, and report results.
-argument-hint: [--coverage-threshold N] <verification-scope>
-allowed-tools:
-  - Bash(pwsh .claude/skills/workflow/scripts/*)
-  - Bash(git:*)
-  - Bash(ls:*)
-  - Read
-  - mcp__agent_orchestration__invoke_agent
-  - mcp__agent_orchestration__track_handoff
-model: sonnet
----
-
-# /3-qa — Quality Assurance
-
-Invoke the QA agent and validate implementation quality.
-
-## Context
-
-Implementation artifacts: !`ls -1 .agents/sessions/ | tail -3`
-
-Current branch: !`git branch --show-current`
-
-## Invocation
-
-```bash
-pwsh .claude/skills/workflow/scripts/Invoke-QA.ps1 $ARGUMENTS
-```
-
-## What This Command Does
-
-1. Invoke `qa` agent via Agent Orchestration MCP
-2. Validate test coverage against threshold (default: 80%)
-3. Check acceptance criteria from planning artifacts
-4. Report pass/fail with details
-5. Track handoff back to orchestrator
-
-## Arguments
-
-- `--coverage-threshold N`: Minimum coverage percentage (default: 80).
-- Remaining text: Verification scope.
-
-## Related
-
-- ADR-006: `.agents/architecture/ADR-006-thin-workflows-testable-modules.md`
\ No newline at end of file

diff --git a/.claude/commands/workflow/4-security.md b/.claude/commands/workflow/4-security.md
deleted file mode 100644
--- a/.claude/commands/workflow/4-security.md
+++ /dev/null
@@ -1,46 +1,0 @@
----
-description: Security review - invoke security agent with OWASP Top 10 check, secret detection, and dependency audit.
-argument-hint: [--owasp-only] [--secrets-only] <security-scope>
-allowed-tools:
-  - Bash(pwsh .claude/skills/workflow/scripts/*)
-  - Bash(git:*)
-  - Bash(ls:*)
-  - Read
-  - mcp__agent_orchestration__invoke_agent
-  - mcp__agent_orchestration__track_handoff
-model: opus
----
-
-# /4-security — Security Review
-
-Comprehensive security assessment using the security agent.
-
-## Context
-
-Implementation artifacts: !`ls -1 .agents/sessions/ | tail -3`
-
-Current branch: !`git branch --show-current`
-
-## Invocation
-
-```bash
-pwsh .claude/skills/workflow/scripts/Invoke-Security.ps1 $ARGUMENTS
-```
-
-## What This Command Does
-
-1. Invoke `security` agent via Agent Orchestration MCP (model: opus per ADR-013)
-2. OWASP Top 10 check (skipped with `--secrets-only`)
-3. Secret detection scan (skipped with `--owasp-only`)
-4. Dependency audit for known vulnerabilities
-5. Generate security report with findings
-
-## Arguments
-
-- `--owasp-only`: Run only OWASP Top 10 check.
-- `--secrets-only`: Run only secret detection.
-- Remaining text: Security scope.
-
-## Related
-
-- ADR-013: `.agents/architecture/ADR-013-agent-orchestration-mcp.md`
\ No newline at end of file

diff --git a/.claude/commands/workflow/9-sync.md b/.claude/commands/workflow/9-sync.md
deleted file mode 100644
--- a/.claude/commands/workflow/9-sync.md
+++ /dev/null
@@ -1,116 +1,0 @@
----
-description: Auto-generate session documentation. Queries session history, generates workflow diagrams, updates session logs, and syncs memory. Use at the end of any workflow to capture what happened.
-model: sonnet
-argument-hint: [--dry-run]
-allowed-tools:
-  - Bash(python .claude/skills/workflow/scripts/*)
-  - Bash(git:*)
-  - mcp__serena__*
-  - mcp__forgetful__*
----
-
-# /9-sync — Auto-Documentation & Memory Sync
-
-Generate comprehensive session documentation automatically.
-
-## Overview
-
-This command closes the workflow loop by documenting what happened during a session. It:
-
-1. Collects session history (agents invoked, tools used, files changed)
-2. Generates a workflow sequence diagram (Mermaid)
-3. Extracts key decisions and artifacts
-4. Appends documentation to the session log
-5. Syncs context to Serena memory for cross-session persistence
-6. Suggests retrospective learnings
-
-## Execution Steps
-
-### Step 1: Gather Session Context
-
-Collect the current session state:
-
-```bash
-# Get current branch and recent commits
-git log --oneline -20 --since="$(date -d '8 hours ago' --iso-8601)" 2>/dev/null || git log --oneline -20
-
-# Get files changed in this session
-git diff --stat HEAD~10..HEAD 2>/dev/null || git diff --stat main..HEAD
-
-# Get current session log if it exists
-ls -t .agents/sessions/*.json 2>/dev/null | head -1
-```
-
-### Step 2: Generate Session Documentation
-
-Run the sync script to produce the session documentation:
-
-```bash
-python .claude/skills/workflow/scripts/sync_session_documentation.py $ARGUMENTS
-```
-
-This script will:
-
-- Scan git history for session commits
-- Identify agents referenced in commit messages
-- Generate a Mermaid sequence diagram
-- Produce a structured session summary
-
-### Step 3: Extract Decisions and Artifacts
-
-From the session context, identify:
-
-- **Decisions made**: ADRs created/modified, design choices documented
-- **Artifacts created**: New files, modified scripts, PRs opened
-- **Issues referenced**: GitHub issues addressed or discovered
-- **Risks identified**: Any blockers or concerns raised
-
-### Step 4: Update Session Log
-
-Append the sync output to the current session log in `.agents/sessions/`. The entry MUST include:
-
-| Field | Description |
-|-------|-------------|
-| `agents_invoked` | Ordered list of agents used (with duration estimates) |
-| `decisions_made` | Key decisions with rationale |
-| `artifacts_created` | Files, commits, issues, PRs |
-| `workflow_diagram` | Mermaid sequence diagram |
-| `retrospective_learnings` | Suggested improvements |
-
-### Step 5: Sync to Memory Systems
-
-Update persistent memory for cross-session context:
-
-1. **Serena**: Store key decisions and outcomes via `mcp__serena__save_memory`
-2. **Forgetful**: Record learnings via `mcp__forgetful__save_memory`
-
-### Step 6: Suggest Retrospective Learnings
-
-Based on the session, suggest:
-
-- What went well (patterns to repeat)
-- What could improve (process gaps)
-- What to watch for (emerging risks)
-
-## Arguments
-
-| Argument | Description |
-|----------|-------------|
-| `--dry-run` | Preview documentation without writing to session log |
-
-## Output
-
-The command produces a session sync report with sections for Workflow Diagram (Mermaid),
-Agents Invoked, Decisions Made, Artifacts Created, and Retrospective Learnings.
-
-## Dependencies
-
-- Session State MCP (`agents://history` resource) — graceful fallback to git history when unavailable
-- Serena MCP — for memory persistence
-- Forgetful MCP — for learning extraction
-
-## Related
-
-- [SESSION-PROTOCOL.md](../../../.agents/SESSION-PROTOCOL.md) — Session requirements
-- [ADR-007: Memory-First Architecture](../../../.agents/architecture/ADR-007-memory-first-architecture.md)
-- [PRD: Workflow Orchestration Enhancement](../../../.agents/planning/prd-workflow-orchestration-enhancement.md)
\ No newline at end of file

diff --git a/.markdownlint-cli2.yaml b/.markdownlint-cli2.yaml
--- a/.markdownlint-cli2.yaml
+++ b/.markdownlint-cli2.yaml
@@ -137,3 +137,12 @@
   # CLAUDE.md files are managed by the claude-mem plugin which prepends <claude-mem-context>
   # HTML tags, violating MD033 and MD041. These are tool-managed metadata, not authored markdown.
   - "**/CLAUDE.md"
+
+  # New lifecycle command files have only YAML frontmatter, no H1 heading. MD041 not applicable.
+  # Only the 6 new lifecycle commands are excluded; other command files retain full linting.
+  - ".claude/commands/spec.md"
+  - ".claude/commands/plan.md"
+  - ".claude/commands/build.md"
+  - ".claude/commands/test.md"
+  - ".claude/commands/review.md"
+  - ".claude/commands/ship.md"

diff --git a/AGENTS.md b/AGENTS.md
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -42,7 +42,7 @@
 |PRs: GitHub|Reviews: pr-comment-responder|Conflicts: merge-resolver
 |Session: session-init, session-end|CI fix: session-log-fixer|Push: /push-pr
 |Security: security-detection|Quality: analyze|Learn: reflect
-|Workflow: workflow (0-init, 1-plan, 2-impl, 3-qa, 4-security)
+|Lifecycle: /spec, /plan, /build, /test, /review, /ship
 
 ### ADR Review (BLOCKING)
 

diff --git a/CLAUDE.md b/CLAUDE.md
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -39,11 +39,19 @@
 The skill has specialized workflows that produce better results than ad-hoc answers.
 
 Key routing rules:
-- Bugs, errors, "why is this broken", 500 errors → invoke analyze
-- Ship, deploy, push, create PR → invoke github
-- QA, test the site, find bugs → invoke qa (subagent_type)
-- Code review, check my diff → invoke pr-comment-responder
-- Weekly retro → invoke reflect
-- Architecture review → invoke analyze
-- Save progress, checkpoint, resume → invoke session-end
-- Code quality, health check → invoke quality-grades
+- Bugs, errors, "why is this broken" → invoke analyze skill
+- PRs, issues, GitHub operations → invoke github skill
+- PR review threads, comment triage → invoke pr-comment-responder skill
+- Weekly retro → invoke reflect skill
+- Save progress, checkpoint → invoke session-end skill
+- Code quality, health check → invoke quality-grades skill
+
+## Lifecycle commands
+
+For development lifecycle phases, use these slash commands (not skills):
+- Define requirements, "what should we build" → /spec
+- Plan work, break down tasks, estimate → /plan
+- Implement, code, build features → /build
+- Test, prove it works, debug failures → /test
+- Review code, check my diff → /review
+- Ship, deploy, push, create PR → /ship

diff --git a/.claude/commands/build.md b/.claude/commands/build.md
new file mode 100644
--- /dev/null
+++ b/.claude/commands/build.md
@@ -1,0 +1,42 @@
+---
+description: Build incrementally. Implement changes in thin vertical slices with TDD and atomic commits. Run after /plan.
+allowed-tools: Task, Skill, Read, Write, Edit, Glob, Grep, Bash(*)
+argument-hint: [plan-step-or-task-description]
+---
+
+@CLAUDE.md
+
+Build: $ARGUMENTS
+
+If $ARGUMENTS is empty, check for recent /plan output in the conversation. If none found, ask the user what to build.
+
+## Agent
+
+Task(subagent_type="implementer"): You are a senior engineer. Discover the project's tech stack, coding patterns, and test conventions by reading the codebase. Build in thin vertical slices. Test-first when the project has tests. Commit atomically.
+
+For each slice:
+
+1. Read the task
+2. Understand the existing code patterns (read related files, check test conventions)
+3. Write a failing test if the project has a test framework
+4. Write the minimum code to pass
+5. Refactor toward quality (cohesion, encapsulation, simplicity)
+6. Commit with a conventional message
+
+## Quality Signals
+
+After implementation, invoke Skill(skill="code-qualities-assessment") to score the result.
+
+The agent should self-check:
+
+- Is this hard to test? That indicates a design problem, not a test problem.
+- Does every method read like a sentence? (Programming by Intention)
+- Is coupling intentional or accidental?
+- Would a stranger understand this code without asking questions?
+
+## Guardrails
+
+- Atomic commits. Each commit is one logical change, rollback-safe.
+- No code without understanding the existing patterns first.
+- Favor delegation over inheritance. A makes B, or A uses B. Never both.
+- Three similar lines beat a premature abstraction.

diff --git a/.claude/commands/plan.md b/.claude/commands/plan.md
new file mode 100644
--- /dev/null
+++ b/.claude/commands/plan.md
@@ -1,0 +1,45 @@
+---
+description: Plan how to build it. Decompose specs into milestones with dependencies and risk mitigations. Run after /spec.
+allowed-tools: Task, Skill, Read, Write, Glob, Grep
+argument-hint: [spec-output-or-issue-number]
+---
+
+@CLAUDE.md
+
+Plan: $ARGUMENTS
+
+If $ARGUMENTS is empty, check for recent /spec output in the conversation. If none found, ask the user what to plan.
+
+## Process
+
+1. Read the spec or issue
+2. Map sub-problems to existing code (what already exists? use Grep/Glob to verify)
+3. Task(subagent_type="milestone-planner"): You are a project planner. Break the spec into milestones with clear exit criteria. Each milestone is independently shippable. Sequence by dependencies. Flag parallel opportunities.
+4. Task(subagent_type="task-decomposer"): You are a work breakdown specialist. Decompose each milestone into atomic tasks. Each task is independently verifiable with a clear done definition. Size by complexity (S/M/L), not time.
+5. Invoke Skill(skill="execution-plans") to persist the plan as a versioned artifact.
+6. Task(subagent_type="analyst"): You are a risk analyst. Run a pre-mortem on this plan. What fails first? What dependencies are fragile? What assumptions are untested?
+7. Task(subagent_type="critic"): You are a plan reviewer. Validate: is scope complete? Can tasks execute in the stated sequence? Are estimates credible? Is anything missing?
+
+## Evaluation Axes
+
+1. **Scope integrity** - Nothing unnecessary, nothing missing
+2. **Dependency ordering** - Can tasks execute in the stated sequence?
+3. **Risk coverage** - All P0 risks have mitigations
+4. **Estimate confidence** - Complexity-based sizing (S/M/L), not time-based
+5. **Reversibility** - Which steps are hard to undo?
+
+## Principles
+
+- **Programming by Intention**: Each task should read like an intent, not an implementation detail.
+- **OODA Loop**: Observe (read the spec), Orient (map to existing code), Decide (sequence tasks), Act (commit the plan). Faster loops win.
+- **First Principles**: Question the requirement, try to delete the step, then optimize, then speed up, then automate. Never automate something that should not exist.
+
+## Output
+
+Structured plan:
+
+- **Milestones** (numbered, with exit criteria)
+- **Tasks per milestone** (atomic, with acceptance criteria and S/M/L sizing)
+- **Dependency graph** (what blocks what, what can run in parallel)
+- **Risk register** (risk, likelihood, impact, mitigation)
+- **Deferred items** (explicitly out of scope for this plan)

diff --git a/.claude/commands/review.md b/.claude/commands/review.md
new file mode 100644
--- /dev/null
+++ b/.claude/commands/review.md
@@ -1,0 +1,80 @@
+---
+description: Review before merge. Five-axis code review across architecture, security, quality, tests, and standards. Run after /test.
+allowed-tools: Task, Skill, Read, Glob, Grep, Bash(git diff:*), Bash(git log:*), Bash(git status:*), Bash(gh:*)
+argument-hint: [branch-or-pr-number]
+---
+
+@CLAUDE.md
+
+Review: $ARGUMENTS
+
+If no argument, review the current branch diff against the base branch. Detect the base branch from `gh pr view --json baseRefName` or fall back to `main`.
+
+## Process
+
+Run axes sequentially. Each axis produces findings categorized as Critical, Important, or Suggestion.
+
+1. Read the diff (git diff against detected base branch)
+2. **Architecture pass**: Task(subagent_type="architect")
+3. **Security pass**: Task(subagent_type="security")
+4. **Quality pass**: Invoke Skill(skill="code-qualities-assessment")
+5. **Test pass**: Task(subagent_type="qa")
+6. **Standards pass**: Invoke Skill(skill="golden-principles") and Skill(skill="taste-lints")
+7. Synthesize findings across all axes
+
+## Axis 1: Architecture
+
+Task(subagent_type="architect"): You are a software architect reviewing for structural integrity. Check ADR conformance in .agents/architecture/. Evaluate from the consumer perspective, not the implementer perspective. Findings must cite file:line.
+
+- Follows existing patterns? Clean boundaries? Right abstraction level?
+- Coupling intentional? Cohesion strong?
+- ADR conformance? Any decisions that need a new ADR?
+
+## Axis 2: Security
+
+Invoke Skill(skill="security-scan") for CWE pattern detection.
+
+Task(subagent_type="security"): You are a security auditor. Assume every input is malicious. Reference CWE numbers. Evaluate:
+
+- Input validated? Secrets safe? Auth checked?
+- OWASP top 10? STRIDE threats?
+- New permissions, scopes, or access? Challenge each one (Principle of Least Privilege).
+
+## Axis 3: Code Quality
+
+Invoke Skill(skill="code-qualities-assessment") to score all 5 qualities: cohesion, coupling, encapsulation, testability, non-redundancy.
+
+- Cyclomatic complexity <=10? Methods <=60 lines?
+- DRY violations? Premature abstractions?
+
+## Axis 4: Test Completeness
+
+Task(subagent_type="qa"): You are a QA engineer verifying coverage. For every new code path in the diff, verify a corresponding test exists. Flag gaps with specific file:line references.
+
+- Every new code path has a test? Failure paths covered?
+- Acceptance criteria verified?
+
+## Axis 5: Standards
+
+Invoke Skill(skill="golden-principles") and Skill(skill="taste-lints").
+
+- Golden principle violations? Naming conventions?
+- Style enforcement? Consistency with existing patterns?
+
+## Principles
+
+- **Design to interfaces**: Review signatures from the consumer perspective. Hidden implementation details should stay hidden.
+- **Encapsulate what varies**: If the diff introduces variation, is it encapsulated? Or scattered?
+- **Chesterton's Fence**: Before removing code, verify you understand why it existed.
+- **Principle of Least Privilege**: New permissions, scopes, or access? Challenge each one.
+
+## Output
+
+Categorize each finding as **Critical**, **Important**, or **Suggestion**.
+
+Per-finding format:
+
+- Finding (what is wrong)
+- Location (file:line)
+- Severity (Critical/Important/Suggestion)
+- Fix (specific recommendation)

diff --git a/.claude/commands/ship.md b/.claude/commands/ship.md
new file mode 100644
--- /dev/null
+++ b/.claude/commands/ship.md
@@ -1,0 +1,53 @@
+---
+description: Ship it. Pre-flight validation, CI check, and PR creation. Run after /review.
+allowed-tools: Task, Skill, Read, Glob, Grep, Bash(git diff:*), Bash(git log:*), Bash(git status:*), Bash(git push:*), Bash(gh:*), Bash(python3:*)
+argument-hint: [target-branch]
+---
+
+@CLAUDE.md
+
+Ship: $ARGUMENTS
+
+Default target is main unless specified. If $ARGUMENTS names a different branch, use that as the target.
+
+## Pre-flight Checks
+
+Task(subagent_type="devops"): You are a release engineer. Run all 5 pre-flight checks below. Report pass/fail for each with specific evidence. Any failure blocks shipping.
+
+1. **Pipeline health** - Invoke Skill(skill="pipeline-validator"). All CI checks green? No suppressed failures?
+2. **Security posture** - Invoke Skill(skill="security-scan"). No new CWE findings? No secrets in diff?
+3. **Review complete** - Has /review been run on this branch? Any unresolved Critical findings? Check review logs.
+4. **Tests passing** - All tests green? No skipped tests without justification?
+5. **Standards clean** - Invoke Skill(skill="golden-principles") and Skill(skill="taste-lints"). Both pass?
+
+## Process
+
+1. Run all 5 pre-flight checks
+2. If any check fails: report what failed, why, and how to fix. Stop.
+3. If all pass: invoke Skill(skill="validate-pr-description") to validate PR metadata
+4. Create PR: invoke Skill(skill="push-pr") to commit, push, and open PR
+5. Report: what shipped, PR link, any warnings
+
+## Principles
+
+- **Faster is safer**: Small, frequent shipments reduce blast radius. Ship early.
+- **No deliberate debt**: If it is not ready, do not ship it. Fix it or defer it.
+- **Observability first**: If you cannot measure it, you cannot ship it safely.
+
+## Output
+
+Ship report:
+
+```text
+PRE-FLIGHT:
+  Pipeline:  PASS|FAIL (evidence)
+  Security:  PASS|FAIL (evidence)
+  Review:    PASS|FAIL (evidence)
+  Tests:     PASS|FAIL (evidence)
+  Standards: PASS|FAIL (evidence)
+
+RESULT: SHIPPED|BLOCKED
+PR: [link if created]
+WARNINGS: [non-blocking concerns]
+NEXT: [monitoring, follow-up items]
+```

diff --git a/.claude/commands/spec.md b/.claude/commands/spec.md
new file mode 100644
--- /dev/null
+++ b/.claude/commands/spec.md
@@ -1,0 +1,45 @@
+---
+description: Define what to build. Transform a problem into testable requirements with acceptance criteria.
+allowed-tools: Task, Skill, Read, Write, Glob, Grep
+argument-hint: [problem-statement-or-issue-number]
+---
+
+@CLAUDE.md
+
+Spec: $ARGUMENTS
+
+If $ARGUMENTS is empty, ask the user what problem to solve. Do not proceed without a problem statement.
+
+## Process
+
+1. Clarify the problem (what, who, why, constraints)
+2. Search for existing solutions in the codebase (grep for related patterns)
+3. Invoke Skill(skill="cva-analysis"): identify commonalities across use cases, then variabilities, then relationships
+4. Write requirements as testable acceptance criteria
+5. Task(subagent_type="analyst"): You are a requirements analyst. Your job is to find gaps, ambiguities, and untestable requirements. For each requirement, ask: can this be verified pass/fail? Flag anything vague.
+6. Invoke Skill(skill="decision-critic"): challenge assumptions before committing
+7. Task(subagent_type="critic"): You are a skeptical reviewer. Run a pre-mortem: assume this spec ships and fails. What broke first? What was missing?
+
+## Evaluation Axes
+
+1. **Problem clarity** - Is the right problem being solved? Could a reframing yield 10x impact?
+2. **Requirement testability** - Can each requirement be verified pass/fail?
+3. **Completeness** - No gaps between problem statement and acceptance criteria?
+4. **Traceability** - REQ to DESIGN to TASK linkage established?
+5. **Feasibility** - Buildable within constraints? Existing code to leverage?
+
+## Principles
+
+- **CVA**: Identify commonalities first, then variabilities, then relationships. Greatest risk is the wrong abstraction.
+- **YAGNI**: Only specify what is needed now. Speculative requirements create waste.
+- **Separation of Concerns**: Each requirement addresses one concern. Mixed concerns signal a missing decomposition.
+
+## Output
+
+Structured requirements document:
+
+- **Problem statement** (1-2 sentences)
+- **Acceptance criteria** (numbered, each independently testable as pass/fail)
+- **Out of scope** (explicit exclusions to prevent creep)
+- **Open questions** (unresolved unknowns with owners)
+- **CVA summary** (what is common, what varies, what relationships exist)

diff --git a/.claude/commands/test.md b/.claude/commands/test.md
new file mode 100644
--- /dev/null
+++ b/.claude/commands/test.md
@@ -1,0 +1,144 @@
+---
+description: Prove it works. Multi-dimensional quality validation across functional, non-functional, security, DevOps, DX, and observability. Run after /build.
+allowed-tools: Task, Skill, Read, Glob, Grep, Bash(git diff:*), Bash(git status:*), Bash(git log:*), Bash(gh:*), Bash(python3:*), Bash(pytest:*), Bash(npm test:*), Bash(uv:*), Bash(pester:*)
+argument-hint: [component-or-failure-description]
+---
+
+@CLAUDE.md
+
+Test: $ARGUMENTS
+
+If $ARGUMENTS is empty, test the current branch diff against the base branch.
+
+## Step 0: Classify PR Type
+
+Detect the base branch from `gh pr view --json baseRefName` or fall back to `main`. Run `git diff origin/<base-branch> --name-only` and classify changed files:
+
+| Type | Patterns | Gates to Run |
+|------|----------|--------------|
+| CODE | *.py, *.ps1, *.ts, *.js, *.cs | All 6 gates |
+| WORKFLOW | *.yml in .github/workflows/ | Gates 1, 3, 4 |
+| CONFIG | *.json, *.yaml (non-workflow) | Gates 3, 4 |
+| DOCS | *.md, *.txt, *.rst | Gate 5 only |
+| MIXED | Combination | Apply per-file rules |
+
+Print: `PR TYPE: [type]. Running gates: [list].`
+
+Skip non-applicable gates. Do not waste agent invocations on irrelevant dimensions.
+
+## Gate 1: Functional Testing
+
+Invoke Skill(skill="code-qualities-assessment") for quality baseline.
+
+Task(subagent_type="qa"): You are a senior QA engineer. Your job is to catch issues that will cause production incidents. Be skeptical. Cite specific file:line evidence for every finding. Evaluate:
+
+1. **Unit coverage** - Each method in isolation, dependencies injected. Every new function has at least 1 test.
+2. **Integration coverage** - Contracts between components verified. Cross-module boundaries exercised.
+3. **Acceptance coverage** - Each requirement has a passing test. Map to acceptance criteria from /spec output.
+4. **Edge cases** - Null/empty/boundary values, invalid types, concurrent access where applicable.
+5. **Error paths** - Every catch/error branch tested. No silent swallowing. Resources cleaned up on failure.
+6. **Regression risk** - High-risk areas (auth, data persistence, payments) require full coverage regardless of change size.
+
+Output: `VERDICT: PASS|WARN|CRITICAL_FAIL` with findings array.
+
+## Gate 2: Non-Functional Testing
+
+Task(subagent_type="analyst"): You are a performance and reliability engineer. Focus on failure modes, not the happy path. Use measurable criteria, not subjective judgments. Evaluate:
+
+1. **Performance** - No N+1 queries, no O(n*m) in hot paths, no blocking calls in async context.
+2. **Scalability** - Will this bottleneck under load? Connection pooling, caching strategy, pagination.
+3. **Reliability** - Retry logic, circuit breakers, graceful degradation. Failure modes tested.
+4. **Complexity** - Cyclomatic complexity <=10. Methods <=60 lines. No deep nesting.
+5. **Maintainability** - Readability, naming clarity, consistency with existing patterns.
+
+Output: `VERDICT: PASS|WARN|CRITICAL_FAIL` with findings array.
+
+## Gate 3: Security Testing
+
+Invoke Skill(skill="security-scan") for CWE pattern detection.
+
+Task(subagent_type="security"): You are a security auditor performing OWASP Top 10 review. Assume every input is malicious. Reference CWE numbers for every finding. Evaluate:
+
+1. **Injection** - Shell (CWE-78), XSS (CWE-79), SQL (CWE-89). No string interpolation in queries.
+2. **Authentication** - Session handling, credential storage, token validation.
+3. **Secrets** - No hardcoded API keys, passwords, tokens in diff. Secrets via environment only.
+4. **Input validation** - All user-facing inputs validated. LLM output treated as untrusted.
+5. **Dependencies** - New packages reviewed for known vulnerabilities. Versions pinned.
+
+Output: `VERDICT: PASS|WARN|CRITICAL_FAIL` with findings array including CWE references.
+
+## Gate 4: DevOps Testing
+
+Task(subagent_type="devops"): You are a build and release engineer. Focus on pipeline safety, reproducibility, and supply chain security. Evaluate:
+
+1. **Pipeline impact** - Do changes affect CI/CD? Are workflow files valid YAML?
+2. **Actions security** - Pinned to SHA? Permissions scoped minimally? No secrets in logs?
+3. **Shell quality** - Input sanitization, exit code handling, error propagation.
+4. **Build reproducibility** - Deterministic builds, locked dependencies, no floating versions.
+5. **Artifact integrity** - Correct upload/download, retention policy, no sensitive data in artifacts.
+
+Output: `VERDICT: PASS|WARN|CRITICAL_FAIL` with findings array.
+
+## Gate 5: Developer Experience (DX)
+
+Task(subagent_type="critic"): You are a developer advocate reviewing from the consumer perspective. Would a new contributor understand this code? Would the API frustrate or delight? Evaluate:
+
+1. **API ergonomics** - Consumer perspective. Are signatures intuitive? Error messages helpful?
+2. **Documentation** - Is changed behavior documented? Are code comments accurate (not stale)?
+3. **Debuggability** - Can a developer diagnose failures from logs alone? Stack traces preserved?
+4. **Onboarding** - Would a new contributor understand this code? Are conventions followed?
+5. **Tooling** - Does this work with existing linters, formatters, IDE support?
+
+Output: `VERDICT: PASS|WARN|CRITICAL_FAIL` with findings array.
+
+## Gate 6: Observability and Monitoring
+
+Task(subagent_type="architect"): You are an SRE reviewing production readiness. If this code fails at 3am, can oncall diagnose it without reading the source? Evaluate:
+
+1. **Logging** - Are meaningful events logged? Structured logging with correlation IDs?
+2. **Metrics** - Are SLIs defined for new features? Latency, error rate, throughput tracked?
+3. **Alerting** - Would failures trigger alerts? Are thresholds appropriate?
+4. **Tracing** - Are distributed traces propagated? Span context preserved across boundaries?
+5. **Health checks** - New services have liveness/readiness probes? Degradation detectable?
+
+Output: `VERDICT: PASS|WARN|CRITICAL_FAIL` with findings array.
+
+## Principles
+
+- **Testability is design feedback**: Hard to test means poor encapsulation, tight coupling, Law of Demeter violation, weak cohesion, or procedural code.
+- **Tests are proof**: A passing test is evidence. A missing test is a gap in knowledge.
+- **Hypothesis-driven debugging**: When a test fails, form a hypothesis before changing code. Verify the hypothesis. Then fix.
+- **Defense in depth**: Assume the happy path works. Focus on failure modes.
+
+## Process
+
+1. Identify what changed (git diff against base branch)
+2. Classify PR type (Step 0). Skip non-applicable gates.
+3. Run applicable gates sequentially. Each gate dispatches its own agent.
+4. If any gate produces CRITICAL_FAIL: continue remaining gates (findings are additive). Mark overall verdict as CRITICAL_FAIL immediately.
+5. For test failures: hypothesis, verify, fix (never change code without understanding why)
+6. Invoke Skill(skill="quality-grades") to synthesize gate verdicts into overall quality score.
+
+## Output
+
+Each gate MUST produce a verdict line and findings array:
+
+```text
+GATE: [name]
+VERDICT: PASS|WARN|CRITICAL_FAIL
+FINDINGS:
+- [SEVERITY] (file:line) description — recommendation
+```
+
+Synthesize into overall report:
+
+| Gate | Verdict | Findings | Evidence |
+|------|---------|----------|----------|
+| Functional | PASS/WARN/CRITICAL_FAIL | Count | file:line citations |
+| Non-Functional | PASS/WARN/CRITICAL_FAIL | Count | file:line citations |
+| Security | PASS/WARN/CRITICAL_FAIL | Count | CWE references |
+| DevOps | PASS/WARN/CRITICAL_FAIL | Count | file:line citations |
+| DX | PASS/WARN/CRITICAL_FAIL | Count | file:line citations |
+| Observability | PASS/WARN/CRITICAL_FAIL | Count | file:line citations |
+
+**Overall verdict**: CRITICAL_FAIL if any gate fails. WARN if any gate warns. PASS if all gates pass.

diff --git a/.claude/commands/workflow/0-init.md b/.claude/commands/workflow/0-init.md
deleted file mode 100644
--- a/.claude/commands/workflow/0-init.md
+++ /dev/null
@@ -1,48 +1,0 @@
----
-description: Session initialization - enforce ADR-007 memory-first architecture at session start. Loads project context, creates session log, and declares current branch via Invoke-Init.ps1.
-argument-hint: [--session-number N] [--objective "text"]
-allowed-tools:
-  - Bash(pwsh .claude/skills/workflow/scripts/*)
-  - Bash(pwsh .claude/skills/session-init/scripts/*)
-  - Bash(git:*)
-  - Bash(ls:*)
-  - Read
-model: sonnet
----
-
-# /0-init — Session Initialization
-
-Enforce ADR-007 memory-first architecture at session start.
-
-## Context
-
-Recent sessions: !`ls -1 .agents/sessions/ | tail -5`
-
-Current branch: !`git branch --show-current`
-
-## Invocation
-
-```bash
-pwsh .claude/skills/workflow/scripts/Invoke-Init.ps1 $ARGUMENTS
-```
-
-## What This Command Does
-
-1. **Load project context** — initializes session state via Agent Orchestration MCP (graceful fallback if unavailable)
-2. **Load initial instructions** — read AGENTS.md for current project rules
-3. **Read HANDOFF.md** — load prior session context (read-only)
-4. **Surface prior context** — retrieves relevant session history via Agent Orchestration MCP (graceful fallback if unavailable)
-5. **Create session log** — via `New-SessionLog.ps1`
-6. **Declare current branch** — output git branch for orientation
-7. **Record evidence** — persist session state (graceful fallback if unavailable)
-
-## Arguments
-
-- `--session-number N`: Optional. Auto-detected from `.agents/sessions/`.
-- `--objective "text"`: Optional. Derived from branch name if omitted.
-
-## Related
-
-- Protocol: `.agents/SESSION-PROTOCOL.md`
-- ADR-007: `.agents/architecture/ADR-007-memory-first-architecture.md`
-- Session Init Skill: `.claude/skills/session-init/SKILL.md`
\ No newline at end of file

diff --git a/.claude/commands/workflow/1-plan.md b/.claude/commands/workflow/1-plan.md
deleted file mode 100644
--- a/.claude/commands/workflow/1-plan.md
+++ /dev/null
@@ -1,54 +1,0 @@
----
-description: Planning phase - route task to planner (default), architect (--arch), or roadmap→high-level-advisor chain (--strategic).
-argument-hint: [--arch] [--strategic] <task-description>
-allowed-tools:
-  - Bash(pwsh .claude/skills/workflow/scripts/*)
-  - Bash(git:*)
-  - Bash(ls:*)
-  - Read
-  - mcp__agent_orchestration__invoke_agent
-  - mcp__agent_orchestration__track_handoff
-  - mcp__agent_orchestration__get_routing_recommendation
-model: sonnet
----
-
-# /1-plan — Planning Phase
-
-Route a planning task to the appropriate agent.
-
-## Context
-
-Current branch: !`git branch --show-current`
-
-Recent commits: !`git log --oneline -5`
-
-Planning artifacts: !`ls -1 .agents/planning/ 2>/dev/null | tail -10`
-
-## Invocation
-
-```bash
-pwsh .claude/skills/workflow/scripts/Invoke-Plan.ps1 $ARGUMENTS
-```
-
-## Variants
-
-| Flag | Agent | Use When |
-|------|-------|----------|
-| *(none)* | `planner` | Standard feature/task planning |
-| `--arch` | `architect` | Design decisions, ADR-worthy choices |
-| `--strategic` | `roadmap → high-level-advisor` | Roadmap, epics, strategic alignment |
-
-## Arguments
-
-- `--arch`: Use architect agent instead of planner.
-- `--strategic`: Chain roadmap agent → high-level-advisor.
-- Remaining text: Task description passed to agent.
-
-## Output
-
-Planning artifacts stored in `.agents/planning/`.
-
-## Related
-
-- ADR-013: `.agents/architecture/ADR-013-agent-orchestration-mcp.md`
-- Agent Orchestration Spec: `.agents/specs/agent-orchestration-mcp-spec.md`
\ No newline at end of file

diff --git a/.claude/commands/workflow/2-impl.md b/.claude/commands/workflow/2-impl.md
deleted file mode 100644
--- a/.claude/commands/workflow/2-impl.md
+++ /dev/null
@@ -1,49 +1,0 @@
----
-description: Implementation phase - invoke implementer agent (default), or run full sequential chain (--full), or parallel execution of implementer+qa+security (--parallel).
-argument-hint: [--full] [--parallel] <implementation-task>
-allowed-tools:
-  - Bash(pwsh .claude/skills/workflow/scripts/*)
-  - Bash(git:*)
-  - Bash(ls:*)
-  - Read
-  - mcp__agent_orchestration__invoke_agent
-  - mcp__agent_orchestration__track_handoff
-  - mcp__agent_orchestration__start_parallel_execution
-  - mcp__agent_orchestration__aggregate_parallel_results
-  - mcp__agent_orchestration__resolve_conflict
-model: sonnet
----
-
-# /2-impl — Implementation Phase
-
-Invoke the implementer agent, optionally chaining QA and security.
-
-## Context
-
-Planning artifacts: !`ls -1 .agents/planning/ 2>/dev/null | tail -10`
-
-Current branch: !`git branch --show-current`
-
-## Invocation
-
-```bash
-pwsh .claude/skills/workflow/scripts/Invoke-Impl.ps1 $ARGUMENTS
-```
-
-## Execution Modes
-
-| Flag | Mode | Description |
-|------|------|-------------|
-| *(none)* | Default | Implementer agent only |
-| `--full` | Sequential | implementer → qa → security |
-| `--parallel` | Parallel | implementer + parallel(qa, security) |
-
-## Arguments
-
-- `--full`: Run full sequential chain after implementation.
-- `--parallel`: Run QA and security in parallel after implementation.
-- Remaining text: Implementation task description.
-
-## Related
-
-- ADR-013: `.agents/architecture/ADR-013-agent-orchestration-mcp.md`
\ No newline at end of file

diff --git a/.claude/commands/workflow/3-qa.md b/.claude/commands/workflow/3-qa.md
deleted file mode 100644
--- a/.claude/commands/workflow/3-qa.md
+++ /dev/null
@@ -1,45 +1,0 @@
----
-description: Quality assurance - invoke QA agent, validate test coverage, check acceptance criteria, and report results.
-argument-hint: [--coverage-threshold N] <verification-scope>
-allowed-tools:
-  - Bash(pwsh .claude/skills/workflow/scripts/*)
-  - Bash(git:*)
-  - Bash(ls:*)
-  - Read
-  - mcp__agent_orchestration__invoke_agent
-  - mcp__agent_orchestration__track_handoff
-model: sonnet
----
-
-# /3-qa — Quality Assurance
-
-Invoke the QA agent and validate implementation quality.
-
-## Context
-
-Implementation artifacts: !`ls -1 .agents/sessions/ | tail -3`
-
-Current branch: !`git branch --show-current`
-
-## Invocation
-
-```bash
-pwsh .claude/skills/workflow/scripts/Invoke-QA.ps1 $ARGUMENTS
-```
-
-## What This Command Does
-
-1. Invoke `qa` agent via Agent Orchestration MCP
-2. Validate test coverage against threshold (default: 80%)
-3. Check acceptance criteria from planning artifacts
-4. Report pass/fail with details
-5. Track handoff back to orchestrator
-
-## Arguments
-
-- `--coverage-threshold N`: Minimum coverage percentage (default: 80).
-- Remaining text: Verification scope.
-
-## Related
-
-- ADR-006: `.agents/architecture/ADR-006-thin-workflows-testable-modules.md`
\ No newline at end of file

diff --git a/.claude/commands/workflow/4-security.md b/.claude/commands/workflow/4-security.md
deleted file mode 100644
--- a/.claude/commands/workflow/4-security.md
+++ /dev/null
@@ -1,46 +1,0 @@
----
-description: Security review - invoke security agent with OWASP Top 10 check, secret detection, and dependency audit.
-argument-hint: [--owasp-only] [--secrets-only] <security-scope>
-allowed-tools:
-  - Bash(pwsh .claude/skills/workflow/scripts/*)
-  - Bash(git:*)
-  - Bash(ls:*)
-  - Read
-  - mcp__agent_orchestration__invoke_agent
-  - mcp__agent_orchestration__track_handoff
-model: opus
----
-
-# /4-security — Security Review
-
-Comprehensive security assessment using the security agent.
-
-## Context
-
-Implementation artifacts: !`ls -1 .agents/sessions/ | tail -3`
-
-Current branch: !`git branch --show-current`
-
-## Invocation
-
-```bash
-pwsh .claude/skills/workflow/scripts/Invoke-Security.ps1 $ARGUMENTS
-```
-
-## What This Command Does
-
-1. Invoke `security` agent via Agent Orchestration MCP (model: opus per ADR-013)
-2. OWASP Top 10 check (skipped with `--secrets-only`)
-3. Secret detection scan (skipped with `--owasp-only`)
-4. Dependency audit for known vulnerabilities
-5. Generate security report with findings
-
-## Arguments
-
-- `--owasp-only`: Run only OWASP Top 10 check.
-- `--secrets-only`: Run only secret detection.
-- Remaining text: Security scope.
-
-## Related
-
-- ADR-013: `.agents/architecture/ADR-013-agent-orchestration-mcp.md`
\ No newline at end of file

diff --git a/.claude/commands/workflow/9-sync.md b/.claude/commands/workflow/9-sync.md
deleted file mode 100644
--- a/.claude/commands/workflow/9-sync.md
+++ /dev/null
@@ -1,116 +1,0 @@
----
-description: Auto-generate session documentation. Queries session history, generates workflow diagrams, updates session logs, and syncs memory. Use at the end of any workflow to capture what happened.
-model: sonnet
-argument-hint: [--dry-run]
-allowed-tools:
-  - Bash(python .claude/skills/workflow/scripts/*)
-  - Bash(git:*)
-  - mcp__serena__*
-  - mcp__forgetful__*
----
-
-# /9-sync — Auto-Documentation & Memory Sync
-
-Generate comprehensive session documentation automatically.
-
-## Overview
-
-This command closes the workflow loop by documenting what happened during a session. It:
-
-1. Collects session history (agents invoked, tools used, files changed)
-2. Generates a workflow sequence diagram (Mermaid)
-3. Extracts key decisions and artifacts
-4. Appends documentation to the session log
-5. Syncs context to Serena memory for cross-session persistence
-6. Suggests retrospective learnings
-
-## Execution Steps
-
-### Step 1: Gather Session Context
-
-Collect the current session state:
-
-```bash
-# Get current branch and recent commits
-git log --oneline -20 --since="$(date -d '8 hours ago' --iso-8601)" 2>/dev/null || git log --oneline -20
-
-# Get files changed in this session
-git diff --stat HEAD~10..HEAD 2>/dev/null || git diff --stat main..HEAD
-
-# Get current session log if it exists
-ls -t .agents/sessions/*.json 2>/dev/null | head -1
-```
-
-### Step 2: Generate Session Documentation
-
-Run the sync script to produce the session documentation:
-
-```bash
-python .claude/skills/workflow/scripts/sync_session_documentation.py $ARGUMENTS
-```
-
-This script will:
-
-- Scan git history for session commits
-- Identify agents referenced in commit messages
-- Generate a Mermaid sequence diagram
-- Produce a structured session summary
-
-### Step 3: Extract Decisions and Artifacts
-
-From the session context, identify:
-
-- **Decisions made**: ADRs created/modified, design choices documented
-- **Artifacts created**: New files, modified scripts, PRs opened
-- **Issues referenced**: GitHub issues addressed or discovered
-- **Risks identified**: Any blockers or concerns raised
-
-### Step 4: Update Session Log
-
-Append the sync output to the current session log in `.agents/sessions/`. The entry MUST include:
-
-| Field | Description |
-|-------|-------------|
... diff truncated: showing 800 of 919 lines