release: v1.10.0 — vendored design method, security certification, validation engine - #2

Adds an optional executor daemon to the Telegram extension: a message in
the bound chat can run Claude Code headless on the host machine.

- executor.mjs: consumes `type: "command"` spool events, runs them via
  `claude -p --output-format stream-json` in the project root, streams
  exec_started/exec_progress/exec_result/exec_error back through the
  outbox. Separate process from the adapter — the filesystem spool stays
  the whole contract, so the executor is optional and removable.
- config.mjs: shared `communication.telegram` manifest reader, now the
  single parser for both processes. Adds the `exec` block.
- telegram-plugin.mjs: free text spools as a command event instead of
  being dropped; outbox sends chunked to Telegram's 4096-char limit;
  formatEvent handles exec_* cases; module entry guarded for tests.
- 81 node --test cases across parsing, routing, authorization, session
  lifecycle, single-flight locking, timeout, and cancellation.

Security: remote execution is default-closed on two independent
switches — `exec.enabled: true` and a non-empty `exec.allowed_user_ids`.
Chat identity and sender identity are enforced separately. permission_mode
defaults to acceptEdits; --dangerously-skip-permissions is never passed.
Prompts go as a single argv entry to a shell-less spawn with cwd pinned
to the project root. The executor never consumes approval events — gate
decisions remain the orchestrator's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The 12-state AI Product Design Agent machine, verbatim minus .git/ and
.github/: the state spec, the hardened rule catalogue (B/F/M/G/R/P/W/E
codes), artifact contracts, 12 per-state skills, 22 templates, 10
verification tools, and the signin worked example.

162 files, 90 markdown. VENDORED.md states provenance, the two
overrides, and the no-hand-patch upgrade rule: nothing here is edited in
place, a vendor upgrade re-vendors.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Security stops being review dimension 4, spent after a full QA cycle, and
becomes a machine gate with an artifact: a certificate issued against a
named commit, gating Implementation -> QA and re-checked at Tech Review.

- Workflows/security-certification.md — freeze the sha, run the configured
  evidence with exit codes, verify every S06 mitigation at file:line,
  classify findings, issue certified / not-certified. An unavailable
  scanner is a recorded gap with a closing condition plus its manual
  equivalent, never a silent pass.
- Templates/security-certificate.md — certified_commit, scope stated
  inside the claim, automated-evidence table, threat-model verification
  matrix, waivers carrying user grantor + rider + closing condition.
- Checklists/security.md rewritten as the C_SECURITY validator. Adds
  rotation, not deletion, when a secret reaches a pushed commit.
- Implementation implements each S06 mitigation in the slice that creates
  its surface, appends unplanned surfaces to the threat model as they are
  built, and completes at a certificate rather than at "tests green".
- Backend planning owes a verification method per mitigation; one without
  is a wish, and certification bounces it.
- Code review verifies the certificate is current and spot-checks the
  highest-exposure claims instead of repeating the pass.
- QA treats C_SECURITY as an entry precondition and re-checks it at exit,
  because loop fixes push commits and stale the certificate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Executing a design workflow previously loaded a summary of the vendored
skill, so the hardened method never reached the run and prototype output
showed it. Every design state's skill is now cloned in full.

- Workflows/design-review.md — states 09 USER_REVIEW, 10 REVISION and 11
  FINAL_OUTPUT, which previously had no workflow file at all. Recovers the
  Run Local rule and its player-URL evidence, waivers-with-riders, root-
  cause routing, class-not-instance sweeps, loop counting, the Conflict
  Mini-Gate, freeze-is-a-hash, and completeness checked against the matrix.
- Workflows/ui-workflow.md — skills 06/07/08 in full, including the B7b
  harness contract that makes registry-to-prototype id drift measurable,
  the strict colour allowlist, and the recorded failure-mode catalogues.
- Workflows/ux-workflow.md — skills 04/05: flow shapes, edge-case matrix,
  reachability/recovery/boundary tables.
- Workflows/flow-visualization.md — skill 12: E1-E7, V1-V13, the derived
  navigation map and the Developer Handoff Gate, default off.
- Templates/prototype/ — the Run Local review player actually shipped
  (run-local.sh, serve.py, play.html), which the citation had told state
  07 to use without providing.
- Templates/traceability.md — the seven-table shape state 07 owes.
- Screen contract §4a: bind with get_design_context, never get_metadata
  alone; reading order, chrome/presentation and alignment per bound frame;
  one arrangement test per designed screen. A node-ID inventory is not a
  design mapping.
- Onboarding step 8b bootstraps the design harness; without it states 08
  and 12 cannot run and every rendering-class check exits 2.

Clones carry a "Cloned from: <skill> @ 4081c24" line. On a vendor upgrade,
re-clone — a summarized clone is how this defect happened.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…nt sweep

- Architecture/validation-engine.md — the checker catalogue the toolkit
  was missing: per-tool checks and failure tables, exit-code semantics
  (2 = tool error = unevaluable, not passing — a gate reading exit 2 as
  green ships unchecked bytes), the severity ladder, the false-positive
  catalogue, the waiver rule and its missing clause (a failing check not
  confirmed at source is not eligible for a waiver), and the full-suite
  run order.
- Workflows/business-analysis.md and product-planning.md — skills 01/02
  and 03 cloned in full, including the recovery edges that were missing:
  research revealing a malformed requirement back-transitions, repeated
  fabrication risk downgrades a theme to a logged gap, and unresolved
  contradictions are presented to the gate as unresolved.
- AI/model-routing.md — five stages carried no model tier at all (design
  states 09-12 and security certification). The orchestrator routes per
  stage, so an unlisted stage had none.
- Workflows/design-review.md loop naming: L_REVISION is L_DESIGN. Two
  counters for one loop is the failure R7 was written by.
- AI/orchestrator.md 4b — where a gate's evidence is a tool run, read the
  exit code. "Checks passed" with no exit code is not gate evidence.
- Permission matrix: specialist append rights enumerated per role instead
  of a blanket S05/S06/S10 that the matrix does not actually grant.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Records the four versions this branch lands: vendored design source
(1.7.0), security certification (1.8.0), full skill clones (1.9.0), and
the validation engine plus gap sweep (1.10.0).

Note on history shape: these four versions were developed in a single
working tree and never committed separately, so the commits on this
branch are grouped by area rather than by version — the tree carries one
snapshot, and splitting it by version would mean inventing intermediate
states that never existed. Only v1.10.0 is tagged.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>