Post-refactor cleanup: security fixes, skill restructure, stale reference removal

.github/workflows/ci.yml

@@ -9,14 +9,6 @@ on:
     branches: [main]
 
 jobs:
-  docs-consistency:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Check docs consistency
-        run: ./scripts/check-doc-consistency.sh
-
   lint:
     runs-on: ubuntu-latest
     steps:

AGENTS.md

@@ -16,7 +16,7 @@
 - `make test-quick`: fast local checks during iteration.
 - `make lint`: runs formatting and static analysis (`go fmt`, `go vet`, `staticcheck`, optional `golangci-lint`).
 - `go test ./...`: baseline CI-style test run.
-- `./scripts/check-doc-consistency.sh`: validates Markdown/doc sync rules used by CI.
+
 
 ## Coding Style & Naming Conventions
 
@@ -94,11 +94,8 @@ Brand names and logos are trademarks of their respective owners; usage here indi
 <!-- TASKWING_COMMANDS_START -->
 
 - taskwing bootstrap
-- taskwing goal "<goal>"
 - taskwing ask "<query>"
 - taskwing task
-- taskwing plan status
-- taskwing slash
 - taskwing mcp
 - taskwing doctor
 - taskwing config

CHANGELOG.md

@@ -9,35 +9,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Focused `taskwing goal "<goal>"` command for one-shot clarify -> generate -> activate flow.
-- Hard-break CLI surface reduction to core execution workflow commands.
-- Local-only default server bind and strict CORS allowlist behavior.
-- Workflow contract documentation (`docs/WORKFLOW_CONTRACT_V1.md`) with hard-gate refusal language and KPIs.
-- Workflow operations docs for activation and feedback loops (`docs/WORKFLOW_PACK.md`, `docs/PROMPT_FAILURES_LOG.md`).
-- Prompt reliability tests for slash command contracts and cross-assistant command description parity.
+- `/taskwing:context` slash command for full project knowledge dump.
+- Security hardening: freshness validation, stricter input sanitization.
+- Prompt reliability tests for slash command contracts.
+- Kill tables and operating principles in skill prompts.
+- Workflow contract injection via SessionStart hook.
 
 ### Changed
 
-- Updated product messaging to the focused motto:
-  - "TaskWing helps turn a goal into executed tasks with persistent context across AI sessions."
-- Updated slash and MCP prompt contracts to unified `task` and `plan` action-based interfaces.
-- Purged stale/outdated architecture documentation that no longer matches shipped behavior.
-- Reworked `/taskwing:plan`, `/taskwing:next`, `/taskwing:done`, and `/taskwing:debug` prompts as explicit process contracts with hard gates and refusal fallbacks.
-- Updated slash command descriptions to trigger-focused "Use when ..." phrasing across assistant command generation.
-- Session initialization output now injects TaskWing Workflow Contract v1 for hook-enabled assistants.
+- Consolidated slash commands from 8 to 4: `plan`, `next`, `done`, `context`.
+- Planning is now MCP-tool-only (removed `taskwing plan` and `taskwing goal` CLI commands).
+- Unified context API replaces separate status/ask workflows.
+- Updated slash command and MCP prompt contracts to match reduced surface.
+- Product messaging focused: "TaskWing helps turn a goal into executed tasks with persistent context across AI sessions."
+
+### Removed
+
+- `taskwing goal` and `taskwing plan` CLI commands (use `/taskwing:plan` or `plan` MCP tool).
+- Slash commands: `/taskwing:ask`, `/taskwing:remember`, `/taskwing:status`, `/taskwing:debug`, `/taskwing:explain`, `/taskwing:simplify`.
+- Interactive plan TUI (`internal/ui/plan_tui.go`).
+- Net reduction of ~1,100 lines.
 
 ### Fixed
 
-- **RootPath resolution**: Reject `MarkerNone` contexts in `GetMemoryBasePath` to prevent accidental writes to `~/.taskwing/memory.db`. Also reject `.taskwing` markers above multi-repo workspaces during detection walk-up. (`TestRootPathResolution`, `TestBootstrapRepro_RootPathResolvesToHome`)
-- **FK constraint failures**: `LinkNodes` now pre-checks node existence before INSERT to avoid SQLite error 787. Duplicate edges handled gracefully. (`TestKnowledgeLinking_NoFK`)
-- **IsMonorepo misclassification**: `Detect()` now checks `hasNestedProjects()` in the `MarkerNone` fallback, so multi-repo workspaces are correctly classified. Resolves disagreement between `Detect()` and `DetectWorkspace()`. (`TestIsMonorepoDetection`, `TestBootstrapRepro_IsMonorepoMisclassification`)
-- **Zero docs loaded**: Added `LoadForServices` to `DocLoader` for multi-repo workspaces. Wired into `RunDeterministicBootstrap` via workspace auto-detection. (`TestDocIngestion`, `TestSubrepoMetadataExtraction`)
-- **Sub-repo metadata**: Verified per-repo workspace context in node storage with proper isolation and cross-workspace linking. (`TestSubrepoMetadataPresent`)
-- **Claude MCP drift**: Added filesystem-based drift detection tests with evidence traceability and Gate 3 consent enforcement for global mutations. (`TestClaudeDriftDetection`)
-- **Hallucinated findings**: Gate 3 enforcement in `NewFindingWithEvidence` — findings without evidence start as "skipped". Added `HasEvidence()` and `NeedsHumanVerification()` to `Finding`. (`TestGate3_Enforcement`, `TestParseJSONResponse_Hallucination`)
-- Priority scheduling semantics corrected (lower numeric priority executes first).
-- Unknown slash subcommands now fail explicitly instead of silently falling back.
-- MCP plan action descriptions aligned with implemented behavior.
+- RootPath resolution: reject `MarkerNone` contexts to prevent writes to `~/.taskwing/memory.db`.
+- FK constraint failures: `LinkNodes` pre-checks node existence before INSERT.
+- IsMonorepo misclassification in `MarkerNone` fallback.
+- Zero docs loaded for multi-repo workspaces.
+- Claude MCP drift detection with evidence traceability.
+- Hallucinated findings: Gate 3 enforcement requires evidence.
+- Priority scheduling semantics (lower numeric = execute first).
+- Unknown slash subcommands fail explicitly instead of silent fallback.
 
 ## [0.9.2] - 2025-08-30
 

CLAUDE.md

@@ -83,15 +83,11 @@ TaskWing is a local-first AI knowledge layer. It extracts architectural decision
 cmd/                          # Cobra CLI commands
 ├── root.go                   # Base command, global flags (--json, --verbose, --preview, --quiet)
 ├── bootstrap.go              # Auto-generate knowledge from repo
-├── goal.go                   # Goal-first flow: clarify -> generate -> activate
 ├── knowledge.go              # View stored project knowledge nodes
-├── plan.go                   # Plan lifecycle management
 ├── task.go                   # Task lifecycle management
-├── slash.go                  # Slash command content for assistants
 ├── mcp_server.go             # MCP server for AI tool integration
 ├── doctor.go                 # Diagnostics and integration repair
 ├── config.go                 # Provider and runtime configuration
-├── start.go                  # Local API/dashboard runtime
 ├── hook.go                   # Hook handlers used by assistant integrations
 └── version.go                # Version output
 
@@ -235,7 +231,7 @@ Increment when:
 
 **NOT MINOR**: Internal refactors, new internal modules, code reorganization
 
-Examples: new `taskwing goal` command, new `--format` flag, adding Gemini provider
+Examples: new `taskwing config` subcommand, new `--format` flag, adding Gemini provider
 
 ### MAJOR (X.0.0) - Breaking changes only
 
@@ -353,11 +349,8 @@ Brand names and logos are trademarks of their respective owners; usage here indi
 
 <!-- TASKWING_COMMANDS_START -->
 - `taskwing bootstrap`
-- `taskwing goal "<goal>"`
 - `taskwing ask "<query>"`
 - `taskwing task`
-- `taskwing plan status`
-- `taskwing slash`
 - `taskwing mcp`
 - `taskwing doctor`
 - `taskwing config`

GEMINI.md

@@ -77,11 +77,9 @@ The system is composed of a CLI tool with an embedded MCP server and a web dashb
 | Command              | Description                               |
 | :------------------- | :---------------------------------------- |
 | `taskwing bootstrap` | Initialize project memory                 |
-| `taskwing goal`      | Create and activate a plan                |
 | `taskwing plan`      | Manage development plans                  |
 | `taskwing task`      | Manage execution tasks                    |
 | `taskwing start`     | Start API/watch/dashboard services        |
-| `taskwing slash`     | Output slash command prompts for AI tools |
 
 ### Frontend (`dashboard/`)
 
@@ -232,11 +230,8 @@ Brand names and logos are trademarks of their respective owners; usage here indi
 
 <!-- TASKWING_COMMANDS_START -->
 - `taskwing bootstrap`
-- `taskwing goal "<goal>"`
 - `taskwing ask "<query>"`
 - `taskwing task`
-- `taskwing plan status`
-- `taskwing slash`
 - `taskwing mcp`
 - `taskwing doctor`
 - `taskwing config`

README.md

@@ -66,11 +66,8 @@ taskwing bootstrap
 # 2. Connect to your AI tool
 taskwing mcp install claude    # or: cursor, gemini, codex, copilot, opencode
 
-# 3. Set a goal and go
-taskwing goal "Add Stripe billing"
-# -> Plan decomposed into 5 executable tasks
-
-# 4. Execute with your AI assistant
+# 3. Plan and execute with your AI assistant
+/taskwing:plan       # Create a plan via MCP
 /taskwing:next       # Get next task with full context
 # ...work...
 /taskwing:done       # Mark complete, advance to next
@@ -156,7 +153,7 @@ Brand names and logos are trademarks of their respective owners; usage here indi
 | Capability | Description |
 |:-----------|:------------|
 | **Local knowledge** | Extracts decisions, patterns, and constraints into local SQLite |
-| **Goal to tasks** | Turns a goal into an executable plan with decomposed tasks |
+| **Plan to tasks** | Turns a plan into decomposed tasks with architecture context |
 | **AI-driven lifecycle** | Task execution -- next, start, complete, verify |
 | **Code analysis** | Symbol search, call graphs, impact analysis, simplification |
 | **Root cause first** | AI-powered diagnosis before proposing fixes |
@@ -168,15 +165,10 @@ Use these from your AI assistant once connected:
 
 | Command | When to use |
 |:--------|:------------|
-| `/taskwing:ask` | Search project knowledge (decisions, patterns, constraints) |
-| `/taskwing:remember` | Persist a decision, pattern, or insight to project memory |
+| `/taskwing:plan` | Clarify a goal and build an approved execution plan |
 | `/taskwing:next` | Start the next approved task with full context |
 | `/taskwing:done` | Complete the current task after verification |
-| `/taskwing:status` | Check current task progress and acceptance criteria |
-| `/taskwing:plan` | Clarify a goal and build an approved execution plan |
-| `/taskwing:debug` | Root-cause-first debugging before proposing fixes |
-| `/taskwing:explain` | Deep explanation of a code symbol and its call graph |
-| `/taskwing:simplify` | Simplify code while preserving behavior |
+| `/taskwing:context` | Get full project knowledge dump for complete architectural context |
 
 <details>
 <summary>MCP setup (manual)</summary>
@@ -252,11 +244,8 @@ Or configure interactively: `taskwing config`
 
 <!-- TASKWING_COMMANDS_START -->
 - `taskwing bootstrap`
-- `taskwing goal "<goal>"`
 - `taskwing ask "<query>"`
 - `taskwing task`
-- `taskwing plan status`
-- `taskwing slash`
 - `taskwing mcp`
 - `taskwing doctor`
 - `taskwing config`