feat(aidd-ui): scaffold the UI recipe skeleton (structure only)

.claude-plugin/marketplace.json

@@ -48,6 +48,13 @@
       "description": "Meta-cognition: refine input through brainstorming, refine output through challenge and condensed communication mode.",
       "strict": true,
       "recommended": true
+    },
+    {
+      "name": "aidd-ui",
+      "source": "./plugins/aidd-ui",
+      "description": "ALPHA, not ready for use. UI and UX concern: a top-to-bottom recipe (product, wireframe, design-system, build, review, polish) to generate a high-quality frontend.",
+      "strict": true,
+      "recommended": false
     }
   ]
 }

.github/dependabot.yml

@@ -2,6 +2,10 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    # Target `next`, not `main`. `main` only takes the weekly promotion PR and
+    # the Release PR (see RELEASE.md); dep updates batch on `next` and ship in
+    # the weekly release instead of cutting off-cycle releases.
+    target-branch: "next"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -11,10 +15,10 @@ updates:
       include: "scope"
     labels:
       - "dependencies"
-      - "github-actions"
 
   - package-ecosystem: "npm"
     directory: "/"
+    target-branch: "next"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -24,4 +28,3 @@ updates:
       include: "scope"
     labels:
       - "dependencies"
-      - "npm"

.github/labels.yml

@@ -1,5 +1,9 @@
 # Canonical issue and PR label list for ai-driven-dev/framework.
 #
+# Labels are TRIAGE ONLY: they categorize an issue or PR. They never decide
+# where a PR targets — routing is by branch prefix (see aidd_docs/memory/vcs.md).
+# Keep one triage label per change.
+#
 # This file is the source of truth. When the GitHub label set drifts from
 # this file, sync manually with:
 #
@@ -24,31 +28,19 @@
   color: 0075ca
 
 - name: security
-  description: Security-sensitive issue or fix
+  description: Security-sensitive issue or fix (cross-cutting, add to any kind)
   color: B60205
 
 - name: good first issue
   description: Good for newcomers
   color: 7057ff
 
-- name: help wanted
-  description: Extra attention is needed
-  color: 008672
-
 # --- Dependencies --------------------------------------------------------
 
 - name: dependencies
   description: Dependency update (dependabot)
   color: 0366d6
 
-- name: github-actions
-  description: GitHub Actions workflow change
-  color: "000000"
-
-- name: npm
-  description: npm dependency update
-  color: cb3837
-
 # --- Release tooling -----------------------------------------------------
 
 - name: "autorelease: pending"

.github/workflows/back-merge.yml

@@ -25,7 +25,7 @@ jobs:
           app-id: ${{ secrets.AIDD_BOT_APP_ID }}
           private-key: ${{ secrets.AIDD_BOT_PRIVATE_KEY }}
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: next
           fetch-depth: 0

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
@@ -94,7 +94,7 @@ jobs:
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Build clean marketplace bundle
         # A self-contained marketplace a user can extract and register with
@@ -141,7 +141,7 @@ jobs:
           - { tool: codex, mode: flat, flag: "--flat" }
           - { tool: opencode, mode: flat, flag: "--flat" }
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -193,7 +193,7 @@ jobs:
             echo "released=false" >> $GITHUB_OUTPUT
           fi
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: steps.check.outputs.released == 'true'
 
       - name: Get plugin version

.github/workflows/codeql.yml

@@ -28,7 +28,7 @@ jobs:
         language: [javascript-typescript]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/validate.yml

@@ -6,9 +6,9 @@ name: Validate
 
 on:
   push:
-    branches: [main]
+    branches: [main, next]
   pull_request:
-    branches: [main]
+    branches: [main, next]
 
 permissions:
   contents: read
@@ -22,7 +22,7 @@ jobs:
       CI: "true"
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.release-please-manifest.json

@@ -5,5 +5,6 @@
   "plugins/aidd-vcs": "2.0.0",
   "plugins/aidd-pm": "2.0.0",
   "plugins/aidd-orchestrator": "2.0.0",
-  "plugins/aidd-refine": "2.0.0"
+  "plugins/aidd-refine": "2.0.0",
+  "plugins/aidd-ui": "0.1.0-alpha.0"
 }

CLAUDE.md

@@ -18,6 +18,8 @@ All instructions and information above are willing to be up to date, but always
 - Do not commit or push yourself unless I ask you to.
 - For every plugin change, think hard about where responsibility belongs; follow the placement and orchestration rules in `docs/ARCHITECTURE.md`.
 - Never duplicate across docs - link to the canonical home.
+- Before adding any instruction, criterion, finding, documentation sentence, or code rule, check whether an existing element already covers, overrides, contradicts, or makes it impossible. If so, do not add a parallel element: delete it, merge it into the stronger element, or rewrite the set with explicit scope, priority, and exception.
+- When naming anything, prefer intention-revealing names over technical ones: describe the goal or responsibility, not the mechanism, tool, or file format.
 
 ### Answering Guidelines
 

CONTRIBUTING.md

@@ -43,6 +43,16 @@ make setup
 
 `make` lists every target; `make doctor` / `make check` verify the environment and run the pre-commit checks.
 
+### Markdown links
+
+Lefthook runs the Markdown link checker during pre-commit. `make setup` installs the hooks; if dependencies are already installed and you only need the hook wiring, run:
+
+```bash
+pnpm exec lefthook install --force
+```
+
+Run `node scripts/check-markdown-links.js` to scan the repository. Detailed usage, supported forms, exclusions, and fix guidance live in `node scripts/check-markdown-links.js --help`.
+
 ### Test your changes locally
 
 Exercise the skills you touched before opening a PR. Neither tool hot-reloads the checkout (both serve a copied cache), so after editing:
@@ -68,16 +78,9 @@ One scope per commit (split cross-plugin changes). The types, the scopes, and th
 
 ## 3. Open a pull request
 
-- Branch off `next` and target `next` (the integration branch); `hotfix/*` branches off `main` for urgent production fixes. See [`RELEASE.md`](./RELEASE.md).
+- Branch off `next` and target `next` (the integration branch); only `hotfix/*` branches off `main` for urgent production fixes. The branch prefix alone decides the target — the full prefix → label → target table is in [`aidd_docs/memory/vcs.md`](aidd_docs/memory/vcs.md#types).
 - **Fill the PR template** (applied automatically): explain *what* changed and *how* you resolved it technically - that narrative is the point of the PR. The conventional title and pre-commit hooks are already enforced by CI, so don't spend the description re-asserting them.
-- **Label the PR** so reviewers and the [Roadmap board](https://github.com/orgs/ai-driven-dev/projects/8) triage at a glance:
-
-  | Label | When to use |
-  | ----- | ----------- |
-  | `bug` | A fix for broken behaviour. |
-  | `enhancement` | A new skill, agent, rule, or feature. |
-  | `documentation` | A docs-only change (README, CONTRIBUTING, skill docs). |
-  | `security` | A security-sensitive change or fix. |
+- **Label the PR** so reviewers and the [Roadmap board](https://github.com/orgs/ai-driven-dev/projects/8) triage at a glance. The triage label follows your branch kind and the PR skill applies it automatically; the label per kind is in that same [routing table](aidd_docs/memory/vcs.md#types) (`security` is cross-cutting — add it to any kind).
 - The PR title follows the same conventional format (the **Commitlint** CI job enforces it); PRs are squash-merged using that title.
 - A **Habilité** review gates every merge ([`CODEOWNERS`](./.github/CODEOWNERS)); Certifié contributors cannot self-merge.
 - Decision rules (lazy consensus, explicit consensus for cross-plugin/contract changes, the quality veto) live in [`GOVERNANCE.md`](./GOVERNANCE.md#code-decisions-merging).

README.md

@@ -18,7 +18,7 @@
 <p><b>🇫🇷 The first French open-source framework for AI-driven development.</b></p>
 
 <p>
-  <!--counts:start--><kbd>6 plugins</kbd> · <kbd>38 skills</kbd> · <kbd>3 agents</kbd><!--counts:end--> · <kbd>MIT</kbd>
+  <!--counts:start--><kbd>7 plugins</kbd> · <kbd>45 skills</kbd> · <kbd>4 agents</kbd><!--counts:end--> · <kbd>MIT</kbd>
 </p>
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
@@ -152,7 +152,7 @@ flowchart TD
 
 ## 🧩 Plugins
 
-Six plugins covering the whole SDLC — **install all of them**; they're designed to work together.
+Seven plugins covering the whole SDLC — **install all of them**; they're designed to work together. (`aidd-ui` is 🚧 **alpha — not ready for use**, off the curated install path.)
 
 <table>
 <tr>
@@ -178,7 +178,7 @@ SDLC loop: sdlc, plan, implement, assert, audit, review, test, refactor, debug,
 
 ### 🌿 [aidd-vcs](plugins/aidd-vcs/README.md)
 
-`4 skills` · stable
+`5 skills` · stable
 
 Commits, pull / merge requests, release tags, issue creation.
 
@@ -211,6 +211,17 @@ Meta-cognition: brainstorm, challenge, condense, shadow-areas, fact-check.
 
 Label an issue, get a PR; re-label, get the review applied.
 
+</td>
+</tr>
+<tr>
+<td width="33%" valign="top">
+
+### 🎨 [aidd-ui](plugins/aidd-ui/README.md) 🚧
+
+`6 skills` · **alpha — not ready**
+
+UI and UX: design, review, and improve frontend interfaces. ⚠️ Alpha (`0.1.0-alpha.0`), smoke-test only — do not rely on it yet.
+
 </td>
 </tr>
 </table>

RELEASE.md

@@ -21,7 +21,9 @@ For who may merge and release, see [`GOVERNANCE.md`](GOVERNANCE.md).
 ## Where your change goes
 
 Almost everything flows through `next` and ships in the weekly release. Only an
-urgent production fix takes the fast lane straight to `main`.
+urgent production fix takes the fast lane straight to `main`. The branch prefix
+decides the target; the canonical prefix → target table lives in
+[`aidd_docs/memory/vcs.md`](aidd_docs/memory/vcs.md#types).
 
 ```mermaid
 flowchart LR

aidd_docs/memory/vcs.md

@@ -16,15 +16,33 @@ type/ticket-short-description
 
 ### Types
 
-| Prefix | Usage | Branch from | PR target |
-| --- | --- | --- | --- |
-| `feat/` | New feature | `next` | `next` |
-| `fix/` | Bug fix | `next` | `next` |
-| `docs/` | Documentation only | `next` | `next` |
-| `refactor/` | Code change (no feat/fix) | `next` | `next` |
-| `chore/` | Build, config, deps | `next` | `next` |
-| `test/` | Add/update tests | `next` | `next` |
-| `hotfix/` | Urgent production fix | `main` | `main` |
+The single source of truth: find your row, read left to right — it tells you the
+branch to create, the label that applies, and where the PR goes. The branch
+**prefix** alone decides the target (not a label, not a board field); the
+`aidd-vcs:02-pull-request` skill reads this table to set the base automatically.
+
+| I want to… | Issue template | Branch | Commit | Label (auto) | PR targets |
+| ---------- | -------------- | ------ | ------ | ------------ | ---------- |
+| ship a feature | ✨ Feature | `feat/…` | `feat:` | `enhancement` | `next` |
+| fix a bug | 🐛 Bug | `fix/…` | `fix:` | `bug` | `next` |
+| change docs only | ✨ Feature | `docs/…` | `docs:` | `documentation` | `next` |
+| refactor (no behaviour change) | — | `refactor/…` | `refactor:` | — | `next` |
+| build / config / deps | — | `chore/…` | `chore:` | `dependencies` | `next` |
+| add or update tests | — | `test/…` | `test:` | — | `next` |
+| 🚨 urgent production fix | 🐛 Bug | `hotfix/…` | `fix:` | `bug` | **`main`** |
+
+#### Routing rule (strict)
+
+- Everything batches on `next` and ships in the weekly release.
+- **Only `hotfix/*` targets `main`** — an urgent production fix, out of cycle.
+
+Once the PR is open, the board advances on its own:
+`Todo → In review` (PR opened) `→ Ready` (review approved) `→ Done` (merged).
+
+Labels are **triage only**: they categorize, they never route. `security` is
+cross-cutting — add it to any kind when the change is security-sensitive. The
+"Commit" column shows the conventional type; the authoritative type list is the
+[Commit Convention](#commit-convention) below (mirrors `commitlint.config.cjs`).
 
 ### Examples
 

aidd_docs/plans/2026_06_23-unify-taxonomy/phase-1.md

@@ -0,0 +1,55 @@
+---
+status: done
+---
+
+# Instruction: Canonical routing table
+
+Part of [`plan.md`](./plan.md). Dependency root — author before all other phases.
+
+## Architecture projection
+
+```txt
+aidd_docs/memory/
+└── vcs.md   🔁  Branch-Naming "Types" table gains 2 columns (triage label,
+                 routing ✓/-) + a strict routing callout + a triage-only note.
+```
+
+## Tasks to do
+
+### `1)` Replace the branch "Types" table with the dense canonical table
+
+> One grid that maps kind → prefix → commit type → triage label → destination.
+
+1. Under `## Branch Naming Convention` → `### Types`, replace the current 4-column table with:
+
+   | Kind | Branch prefix | Commit type | Triage label | `next` | `main` |
+   | ---- | ------------- | ----------- | ------------ | :----: | :----: |
+   | Feature | `feat/` | `feat` | `enhancement` | ✓ | – |
+   | Fix | `fix/` | `fix` | `bug` | ✓ | – |
+   | Docs | `docs/` | `docs` | `documentation` | ✓ | – |
+   | Refactor | `refactor/` | `refactor` | – | ✓ | – |
+   | Chore | `chore/` | `chore` | `dependencies` | ✓ | – |
+   | Test | `test/` | `test` | – | ✓ | – |
+   | Hotfix | `hotfix/` | `fix` | `bug` | – | ✓ |
+
+2. Keep the existing `### Format` and `### Examples` blocks unchanged.
+
+### `2)` Add the strict routing callout + triage-only note
+
+> Make the rule unmissable and kill the label/route confusion.
+
+1. Immediately under the table, add a short callout, in substance:
+   - The branch **prefix alone** decides the PR target — not a label, not a board field.
+   - Everything batches on `next`; **only `hotfix/*` targets `main`** (urgent production fix, out of cycle).
+   - The `aidd-vcs:02-pull-request` skill reads this table to set the base branch automatically.
+2. Add the triage-only note: labels categorize, they never route; `security` is cross-cutting — add it to any kind when the change is security-sensitive.
+3. Confirm the commit-type and changelog definitions are untouched (the `## Commit Convention` section stays as-is; the table's "commit type" column is illustrative, not a redefinition).
+
+## Test acceptance criteria
+
+| Task | Acceptance criteria |
+| ---- | ------------------- |
+| 1 | The dense 6-column table renders in `vcs.md`; exactly one row routes to `main` (`hotfix`); all others to `next`. |
+| 1 | The table is the only place in the repo with the kind·prefix·label·✓/- grid (`grep -rl` for a unique cell string returns only `vcs.md`). |
+| 2 | A "routing rule (strict)" callout states prefix-decides-target and the single `hotfix→main` exception; a triage-only note is present. |
+| 2 | `## Commit Convention` section is byte-identical to before (no commit-type or scope changes). |