chore(deps-dev): bump @commitlint/cli from 21.0.2 to 21.2.0

.claude-plugin/marketplace.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-marketplace.json",
   "name": "aidd-framework",
-  "version": "5.0.2",
+  "version": "5.0.3",
   "description": "Official plugin marketplace for the AI-Driven Development framework",
   "owner": {
     "name": "AI-Driven Dev"
@@ -31,7 +31,7 @@
     {
       "name": "aidd-pm",
       "source": "./plugins/aidd-pm",
-      "description": "Product management: ticket-info, user-stories-create, prd, spec",
+      "description": "Product management: ticket-info, user-stories, prd, spec",
       "strict": true,
       "recommended": true
     },
@@ -48,6 +48,13 @@
       "description": "Meta-cognition: refine input through brainstorming, refine output through challenge and condensed communication mode.",
       "strict": true,
       "recommended": true
+    },
+    {
+      "name": "aidd-ui",
+      "source": "./plugins/aidd-ui",
+      "description": "ALPHA, not ready for use. UI and UX concern: design, review, and improve frontend interfaces.",
+      "strict": true,
+      "recommended": false
     }
   ]
 }

.github/dependabot.yml

@@ -2,6 +2,10 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    # Target `next`, not `main`. `main` only takes the weekly promotion PR and
+    # the Release PR (see RELEASE.md); dep updates batch on `next` and ship in
+    # the weekly release instead of cutting off-cycle releases.
+    target-branch: "next"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -11,10 +15,10 @@ updates:
       include: "scope"
     labels:
       - "dependencies"
-      - "github-actions"
 
   - package-ecosystem: "npm"
     directory: "/"
+    target-branch: "next"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -24,4 +28,3 @@ updates:
       include: "scope"
     labels:
       - "dependencies"
-      - "npm"

.github/labels.yml

@@ -1,5 +1,9 @@
 # Canonical issue and PR label list for ai-driven-dev/framework.
 #
+# Labels are TRIAGE ONLY: they categorize an issue or PR. They never decide
+# where a PR targets — routing is by branch prefix (see aidd_docs/memory/vcs.md).
+# Keep one triage label per change.
+#
 # This file is the source of truth. When the GitHub label set drifts from
 # this file, sync manually with:
 #
@@ -24,31 +28,19 @@
   color: 0075ca
 
 - name: security
-  description: Security-sensitive issue or fix
+  description: Security-sensitive issue or fix (cross-cutting, add to any kind)
   color: B60205
 
 - name: good first issue
   description: Good for newcomers
   color: 7057ff
 
-- name: help wanted
-  description: Extra attention is needed
-  color: 008672
-
 # --- Dependencies --------------------------------------------------------
 
 - name: dependencies
   description: Dependency update (dependabot)
   color: 0366d6
 
-- name: github-actions
-  description: GitHub Actions workflow change
-  color: "000000"
-
-- name: npm
-  description: npm dependency update
-  color: cb3837
-
 # --- Release tooling -----------------------------------------------------
 
 - name: "autorelease: pending"

.github/workflows/back-merge.yml

@@ -25,7 +25,7 @@ jobs:
           app-id: ${{ secrets.AIDD_BOT_APP_ID }}
           private-key: ${{ secrets.AIDD_BOT_PRIVATE_KEY }}
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: next
           fetch-depth: 0

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
@@ -94,7 +94,7 @@ jobs:
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Build clean marketplace bundle
         # A self-contained marketplace a user can extract and register with
@@ -141,7 +141,7 @@ jobs:
           - { tool: codex, mode: flat, flag: "--flat" }
           - { tool: opencode, mode: flat, flag: "--flat" }
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -193,7 +193,7 @@ jobs:
             echo "released=false" >> $GITHUB_OUTPUT
           fi
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         if: steps.check.outputs.released == 'true'
 
       - name: Get plugin version

.github/workflows/codeql.yml

@@ -28,7 +28,7 @@ jobs:
         language: [javascript-typescript]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/validate.yml

@@ -6,9 +6,9 @@ name: Validate
 
 on:
   push:
-    branches: [main]
+    branches: [main, next]
   pull_request:
-    branches: [main]
+    branches: [main, next]
 
 permissions:
   contents: read
@@ -22,7 +22,7 @@ jobs:
       CI: "true"
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.release-please-manifest.json

@@ -1,9 +1,10 @@
 {
-  ".": "5.0.2",
+  ".": "5.0.3",
   "plugins/aidd-context": "2.0.1",
   "plugins/aidd-dev": "2.0.0",
   "plugins/aidd-vcs": "2.0.0",
   "plugins/aidd-pm": "2.0.0",
   "plugins/aidd-orchestrator": "2.0.0",
-  "plugins/aidd-refine": "2.0.0"
+  "plugins/aidd-refine": "2.0.0",
+  "plugins/aidd-ui": "0.1.0-alpha.0"
 }

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [5.0.3](https://github.com/ai-driven-dev/framework/compare/v5.0.2...v5.0.3) (2026-06-23)
+
+
+### Miscellaneous
+
+* **deps-dev:** bump js-yaml from 4.2.0 to 5.0.0 ([#322](https://github.com/ai-driven-dev/framework/issues/322)) ([f71bdd2](https://github.com/ai-driven-dev/framework/commit/f71bdd2be31c34aa43e5280659432fb3a9f1cdab))
+
 ## [5.0.2](https://github.com/ai-driven-dev/framework/compare/v5.0.1...v5.0.2) (2026-06-22)
 
 

CLAUDE.md

@@ -1,33 +1,41 @@
 # CLAUDE.md
 
-> IMPORTANT: On first conversation message:
->
-> - say "AI-Driven Development ON - Date: {current_date}, TZ: {current_timezone}." to User.
-
-## Behavior Guidelines
-
-All instructions and information above are willing to be up to date, but always remind yourself that USER can be wrong, be critical of the information provided, and verify it against the project's actual state.
-
-- Be anti-sycophantic - don't fold arguments just because I push back
-- Stop excessive validation - challenge my reasoning instead
-- Avoid flattery that feels like unnecessary praise
-- Don't anthropomorphize yourself
-
-## Technical guidelines
-
-- Do not commit or push yourself unless I ask you to.
-- For every plugin change, think hard about where responsibility belongs; follow the placement and orchestration rules in `docs/ARCHITECTURE.md`.
-- Never duplicate across docs - link to the canonical home.
-
-### Answering Guidelines
-
-- Don't assume your knowledge is up to date.
-- Be 100% sure of your answers.
-- If unsure, say "I don't know" or ask for clarification.
-- Never say "you are right!", prefer anticipating mistakes.
+> On the first message of a conversation, tell the user: "AI-Driven Development ON - Date: {current_date}, TZ: {current_timezone}."
+
+## Behavior
+
+- **Stay critical.** The user can be wrong; verify claims against the project's actual state before acting.
+- **Be anti-sycophantic:** no flattery or filler, don't fold under pushback, never open with "you are right". Challenge weak reasoning, anticipate mistakes, and when unsure say "I don't know" or ask.
+- **Surface tradeoffs and evaluate their impact** instead of hiding them.
+
+## Communication
+
+- **Answer first:** result before reason. Drop pleasantries (sure, of course, happy to) and hedging.
+- **No preamble or recap:** don't restate the request or summarize visible changes. Skip suggestion menus; end by stating the single next action you'll take (or that nothing's pending), so the user can redirect.
+- **Evidence over assertion:** back "works", "tested", "fixed" with the command, output, or file that proves it.
+- **Quote the shortest decisive line** of an error or log, not the whole dump.
+- **No tool-call narration.** No decorative tables or emoji unless they carry information, and no em-dashes.
+- **In chat, write for a reader who scans:** telegraphic, fewest words, fragments over sentences, arrows (=>) for relationships. Cut any word that doesn't change meaning. Normal prose in authored docs and code. Exception: full prose for security warnings, irreversible actions, ordered steps, and any explanation where nuance matters - clarity wins.
+
+## Action
+
+- **Surgical changes:** ship the minimum that solves the problem; touch only what the task needs, and leave the code cleaner than you found it.
+- **Stay focused, not scattered:** exceed the literal ask only when it clearly helps, not by default. When you spot an unrelated issue, note it in one line and keep going; detour only if it blocks the task.
+- **Solve your own issues first:** genuinely try to resolve it yourself before escalating to the human.
+- **Do not commit or push** unless the user asks.
+- **Don't assume your knowledge is current.**
+- **Placement discipline:** for every plugin change, think hard about where responsibility belongs; follow `docs/ARCHITECTURE.md`.
+- **Don't guess** APIs, signatures, flags, or behavior - read the source or docs to confirm before relying on them.
+- **Ambiguous or expensive task:** ask one sharp question to pin down scope before building, rather than guess.
+- **Batch independent operations** in one pass, not one at a time.
+- **Fan out** independent subtasks to parallel subagents when you own the overall flow and the work is genuinely parallel.
+- **Before adding any instruction, finding, or rule, check whether an existing one already covers or contradicts it.** If so, don't add a parallel: delete it, merge it into the stronger one, or rewrite with explicit scope and priority.
+- **Name by intention, not mechanism:** describe the goal or responsibility, not the tool or file format.
 
 ## Memory Management
 
+Project docs, memory, specs, and plans live in `aidd_docs/`.
+
 ### Project memory
 
 <aidd_project_memory>
@@ -41,6 +49,6 @@ All instructions and information above are willing to be up to date, but always
 @aidd_docs/memory/vcs.md
 </aidd_project_memory>
 
-- If memory is not loaded above: run `ls -1tr aidd_docs/memory/` then read each file
-- If needed: load files from `aidd_docs/memory/external/*` when user request it
-- If needed: load files from `aidd_docs/memory/internal/*`, you have to think about it
+- If the block above is empty, run `ls -1tr aidd_docs/memory/` and read each file.
+- Load `aidd_docs/memory/external/*` when the user asks.
+- Load `aidd_docs/memory/internal/*` when the task needs it.

CONTRIBUTING.md

@@ -43,6 +43,16 @@ make setup
 
 `make` lists every target; `make doctor` / `make check` verify the environment and run the pre-commit checks.
 
+### Markdown links
+
+Lefthook runs the Markdown link checker during pre-commit. `make setup` installs the hooks; if dependencies are already installed and you only need the hook wiring, run:
+
+```bash
+pnpm exec lefthook install --force
+```
+
+Run `node scripts/check-markdown-links.js` to scan the repository. Detailed usage, supported forms, exclusions, and fix guidance live in `node scripts/check-markdown-links.js --help`.
+
 ### Test your changes locally
 
 Exercise the skills you touched before opening a PR. Neither tool hot-reloads the checkout (both serve a copied cache), so after editing:
@@ -68,16 +78,9 @@ One scope per commit (split cross-plugin changes). The types, the scopes, and th
 
 ## 3. Open a pull request
 
-- Branch off `next` and target `next` (the integration branch); `hotfix/*` branches off `main` for urgent production fixes. See [`RELEASE.md`](./RELEASE.md).
+- Branch off `next` and target `next` (the integration branch); only `hotfix/*` branches off `main` for urgent production fixes. The branch prefix alone decides the target — the full prefix → label → target table is in [`aidd_docs/memory/vcs.md`](aidd_docs/memory/vcs.md#types).
 - **Fill the PR template** (applied automatically): explain *what* changed and *how* you resolved it technically - that narrative is the point of the PR. The conventional title and pre-commit hooks are already enforced by CI, so don't spend the description re-asserting them.
-- **Label the PR** so reviewers and the [Roadmap board](https://github.com/orgs/ai-driven-dev/projects/8) triage at a glance:
-
-  | Label | When to use |
-  | ----- | ----------- |
-  | `bug` | A fix for broken behaviour. |
-  | `enhancement` | A new skill, agent, rule, or feature. |
-  | `documentation` | A docs-only change (README, CONTRIBUTING, skill docs). |
-  | `security` | A security-sensitive change or fix. |
+- **Label the PR** so reviewers and the [Roadmap board](https://github.com/orgs/ai-driven-dev/projects/8) triage at a glance. The triage label follows your branch kind and the PR skill applies it automatically; the label per kind is in that same [routing table](aidd_docs/memory/vcs.md#types) (`security` is cross-cutting — add it to any kind).
 - The PR title follows the same conventional format (the **Commitlint** CI job enforces it); PRs are squash-merged using that title.
 - A **Habilité** review gates every merge ([`CODEOWNERS`](./.github/CODEOWNERS)); Certifié contributors cannot self-merge.
 - Decision rules (lazy consensus, explicit consensus for cross-plugin/contract changes, the quality veto) live in [`GOVERNANCE.md`](./GOVERNANCE.md#code-decisions-merging).

README.md

@@ -18,7 +18,7 @@
 <p><b>🇫🇷 The first French open-source framework for AI-driven development.</b></p>
 
 <p>
-  <!--counts:start--><kbd>6 plugins</kbd> · <kbd>38 skills</kbd> · <kbd>3 agents</kbd><!--counts:end--> · <kbd>MIT</kbd>
+  <!--counts:start--><kbd>7 plugins</kbd> · <kbd>40 skills</kbd> · <kbd>2 agents</kbd><!--counts:end--> · <kbd>MIT</kbd>
 </p>
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
@@ -152,7 +152,7 @@ flowchart TD
 
 ## 🧩 Plugins
 
-Six plugins covering the whole SDLC — **install all of them**; they're designed to work together.
+Seven plugins covering the whole SDLC — **install all of them**; they're designed to work together. (`aidd-ui` is 🚧 **alpha — not ready for use**, off the curated install path.)
 
 <table>
 <tr>
@@ -178,7 +178,7 @@ SDLC loop: sdlc, plan, implement, assert, audit, review, test, refactor, debug,
 
 ### 🌿 [aidd-vcs](plugins/aidd-vcs/README.md)
 
-`4 skills` · stable
+`5 skills` · stable
 
 Commits, pull / merge requests, release tags, issue creation.
 
@@ -211,6 +211,17 @@ Meta-cognition: brainstorm, challenge, condense, shadow-areas, fact-check.
 
 Label an issue, get a PR; re-label, get the review applied.
 
+</td>
+</tr>
+<tr>
+<td width="33%" valign="top">
+
+### 🎨 [aidd-ui](plugins/aidd-ui/README.md) 🚧
+
+`1 skill` · **alpha — not ready**
+
+UI and UX: design, review, and improve frontend interfaces. ⚠️ Alpha (`0.1.0-alpha.0`), smoke-test only — do not rely on it yet.
+
 </td>
 </tr>
 </table>

RELEASE.md

@@ -21,7 +21,9 @@ For who may merge and release, see [`GOVERNANCE.md`](GOVERNANCE.md).
 ## Where your change goes
 
 Almost everything flows through `next` and ships in the weekly release. Only an
-urgent production fix takes the fast lane straight to `main`.
+urgent production fix takes the fast lane straight to `main`. The branch prefix
+decides the target; the canonical prefix → target table lives in
+[`aidd_docs/memory/vcs.md`](aidd_docs/memory/vcs.md#types).
 
 ```mermaid
 flowchart LR

UPGRADE.md

@@ -95,7 +95,7 @@ Invocation in v4 is `plugin:NN-action`. Where a column says "sub-flow", the old
 |---|---|
 | `/brainstorm` | `aidd-refine:01-brainstorm` |
 | `/challenge` | `aidd-refine:02-challenge` |
-| `/create_user_stories` | `aidd-pm:02-user-stories-create` |
+| `/create_user_stories` | `aidd-pm:02-user-stories` |
 | `/ticket_info` | `aidd-pm:01-ticket-info` |
 
 ### plan