Conditional branches: a qualifier the parser reads as a step

cicd-pipeline-security-audit/techniques/execute-sub-agent.md

@@ -56,7 +56,7 @@ per-file, per-pattern scan confirmation
 ### 1. Bootstrap
 
 - Inherit the dispatched session and load the assigned activity definition with its steps.
-  - If the workflow-server is unavailable or the activity cannot be loaded, fall back to the prompt instructions provided by the orchestrator and note that in the output.
+  > If the workflow-server is unavailable or the activity cannot be loaded, fall back to the prompt instructions provided by the orchestrator and note that in the output.
 
 ### 2. Execute Steps
 

meta/techniques/github-cli-protocol/assign-issue.md

@@ -27,4 +27,4 @@ Assignee login, or the literal `@me` for the authenticated user.
 
 1. Apply [resolve-repo-coordinates](./resolve-repo-coordinates.md).
 2. `gh api repos/{owner}/{repo}/issues/{issue_number}/assignees -f "assignees[]={$assignee_login}"`.
-   - When the issue is already assigned to `{$assignee_login}`, this is a no-op — skip silently.
+   > When the issue is already assigned to `{$assignee_login}`, this is a no-op — skip silently.

meta/techniques/github-cli-protocol/post-pr-review.md

@@ -45,11 +45,11 @@ The body the API holds for `{review_id}` as it stood before this call's write. U
 
 1. Apply [resolve-repo-coordinates](./resolve-repo-coordinates.md).
 2. Emit `{live_review_body}` as the body the API currently holds, so a caller can reconcile against it before it is replaced. A body read after the write is the write.
-   > When `{review_id}` is supplied: `gh api repos/{owner}/{repo}/pulls/{pr_number}/reviews/{review_id} --jq .body`.
-   > Otherwise there is no review to read; leave `{live_review_body}` unset.
+   > - When `{review_id}` is supplied: `gh api repos/{owner}/{repo}/pulls/{pr_number}/reviews/{review_id} --jq .body`.
+   > - Otherwise there is no review to read; leave `{live_review_body}` unset.
 
 ### 2. Post or Replace the Review
 
 - Send the body and emit `{review_posted}` true with `{posted_review_id}` naming the review the API accepted.
-  > Without `{review_id}`: `gh api repos/{owner}/{repo}/pulls/{pr_number}/reviews -F body=@<file-or-body> -f event={review_event}` (use `-f body="{body}"` when the body is a single-line string).
-  > With `{review_id}`: `gh api --method PUT repos/{owner}/{repo}/pulls/{pr_number}/reviews/{review_id} -F body=@<file-or-body>`, which keeps the review's id, state and comment thread. A second POST leaves two verdicts on one pull request.
+  > - Without `{review_id}`: `gh api repos/{owner}/{repo}/pulls/{pr_number}/reviews -F body=@<file-or-body> -f event={review_event}` (use `-f body="{body}"` when the body is a single-line string).
+  > - With `{review_id}`: `gh api --method PUT repos/{owner}/{repo}/pulls/{pr_number}/reviews/{review_id} -F body=@<file-or-body>`, which keeps the review's id, state and comment thread. A second POST leaves two verdicts on one pull request.

meta/techniques/gitnexus-operations/analyze.md

@@ -32,9 +32,9 @@ Post-analyze symbol / relationship / process counts emitted by the CLI
 
 ### 2. Run Analyze
 
-- Otherwise run `npx gitnexus analyze` (or `npx gitnexus analyze --force` when `{force_rebuild}` is true) inside `{repo_path}`. The CLI exits non-zero on failure; surface its stderr.
-  - If `npx gitnexus` resolves to no binary (the gitnexus package is not installed), install it via `npm install -g gitnexus` (or the project-local equivalent), then retry.
-  - If the analyze CLI returns non-zero — typically a parser error inside the target codebase or an unsupported language — read the stderr; if it identifies a single offending file, exclude or fix it. For corrupted index state, retry with `force_rebuild=true`.
+- Otherwise run `npx gitnexus analyze` (or `npx gitnexus analyze --force` when `{force_rebuild}` is true) inside `{repo_path}`. The CLI exits non-zero on failure; surface its stderr.  
+  > - If `npx gitnexus` resolves to no binary (the gitnexus package is not installed), install it via `npm install -g gitnexus` (or the project-local equivalent), then retry.
+  > - If the analyze CLI returns non-zero — typically a parser error inside the target codebase or an unsupported language — read the stderr; if it identifies a single offending file, exclude or fix it. For corrupted index state, retry with `force_rebuild=true`.
 
 ### 3. Signal and Verify
 

meta/techniques/workflow-engine/commit-and-persist.md

@@ -25,9 +25,9 @@ Activity that just completed.
 3. If the README already matches after steps 1–2, leave content equivalent — still include the file in the engineering commit below so a prior local-only edit is pushed.
 4. If `{host_repo_path}/{component_path}` has uncommitted changes (`git status --porcelain` non-empty), apply [version-control](../version-control/TECHNIQUE.md)::[commit-submodule](../version-control/commit-submodule.md)(*paths*=changed files, *submodule_message*=`'<type>(<workflow-id>): <activity-id> source changes'` with the Conventional Commits type that fits the activity — feat for implement, fix for post-impl-review fixes, refactor for cleanup, *parent_branch*=current parent branch). Skip when the working tree is clean.
 5. **Engineering commit + push:** Commit ALL changes under `.engineering/artifacts/` within `{planning_folder_path}`, including `README.md`, `session.json` and `.session-token`, with *message*=`docs(<workflow-id>): <activity-id> artifacts`. The primitive follows the layout, classified by `version-control.infrastructure-submodule-paths`. This post-activity hook **is** the commit request — do not wait for a separate user confirmation. Push must succeed before this operation returns: Engineering links and resume assume the remote holds the commit, so a local-only README or artifact update does not satisfy this step.  
-   > When `.engineering` is a checkout of its own, apply [commit-submodule](../version-control/commit-submodule.md)(*submodule_path*=`.engineering`) — its own branch and remote carry the artifacts.  
-   > Otherwise apply [commit-regular-files](../version-control/commit-regular-files.md) — the artifacts are ordinary files of the host checkout.  
-   > Where the host branch accepts changes only through pull requests, the parent's submodule-pointer bump lands in a PR; a direct push to that branch is refused, and the engineering push above already satisfies this step without it.
+   > - When `.engineering` is a checkout of its own, apply [commit-submodule](../version-control/commit-submodule.md)(*submodule_path*=`.engineering`) — its own branch and remote carry the artifacts.
+   > - Otherwise apply [commit-regular-files](../version-control/commit-regular-files.md) — the artifacts are ordinary files of the host checkout.
+   > - Where the host branch accepts changes only through pull requests, the parent's submodule-pointer bump lands in a PR; a direct push to that branch is refused, and the engineering push above already satisfies this step without it.
 6. Confirm the engineering push landed (remote tracking branch includes the new commit). If push failed, retry once; if still failing, surface the error and do not advance to the next activity.
 7. Emit the run status in the shape [run-status-shape](./TECHNIQUE.md#run-status-shape) declares. This is the last phase, after the push is confirmed, so every link the emission publishes points at an artifact the remote already holds.
 

meta/techniques/workflow-engine/dispatch-activity.md

@@ -46,20 +46,20 @@ Opaque HMAC-signed trace token from the `next_activity` response `_meta.trace_to
 ## Protocol
 
 1. **Progress in-progress:** Apply [sync-progress-status](./sync-progress-status.md) with `{planning_folder_path}` for the dispatch moment in [Progress Status call sites](../../../meta/resources/planning-readme.md#progress-status-call-sites) (`activity_id={activity_id}`; `{target_status}` from that row / [Status vocabulary](../../../meta/resources/planning-readme.md#status-vocabulary)). Transitions follow [Status transition policy](../../../meta/resources/planning-readme.md#status-transition-policy).
-   > When `{planning_folder_path}` is unset, skip this phase.
-   > Publish the mark before the worker spawns, per [dispatch-mark-reaches-the-remote](#dispatch-mark-reaches-the-remote): apply [version-control::commit-regular-files](../version-control/commit-regular-files.md) with `paths` naming the planning folder `README.md` alone, a message stating which activity is entering progress, and `branch` = current.
+   > - When `{planning_folder_path}` is unset, skip this phase.
+   > - Publish the mark before the worker spawns, per [dispatch-mark-reaches-the-remote](#dispatch-mark-reaches-the-remote): apply [version-control::commit-regular-files](../version-control/commit-regular-files.md) with `paths` naming the planning folder `README.md` alone, a message stating which activity is entering progress, and `branch` = current.
 2. Call `next_activity { session_index, activity_id, step_manifest }`; capture `_meta.trace_token`.
    - **`step_manifest`:** a dispatch whose activity ran steps carries one manifest entry per completed step — the server validates step completion against it, and reports a gap when it is absent. A first dispatch has no prior worker context to attribute it to, so `agent_id` is omitted here; a continuation names one ([continue-batch](./continue-batch.md)).
    - **Trace accumulate (required):** when `_meta.trace_token` is present, append it to `trace_tokens[]`. Tokens stay opaque — no routine per-activity `get_trace`. Live `_meta.validation` self-correct remains; do not resolve tokens mid-run (close-out resolve is [resolve-trace-at-close-out](#resolve-trace-at-close-out)).
 3. Mint `{worker_agent_id}` for this dispatch per [delivery-keys-on-agent-context](#delivery-keys-on-agent-context), then apply [compose-prompt](./compose-prompt.md) with `{agent_technique}`, `holds_prior_deliveries: false` (a minted identity holds nothing), and `{state}` as substitutions (include `session_index`, `workflow_id`, `activity_id`, and `{worker_agent_id}` as `agent_id`).
 4. Apply [harness-compat](../harness-compat/TECHNIQUE.md)::[spawn-agent](../harness-compat/spawn-agent.md) with the composed prompt; await the worker's envelope and return it unchanged as `{worker_result}`.
-   > When the harness reports the worker ended without returning an envelope, dispatch a fresh worker for the same `{activity_id}`, which mints its own identity.
-   > When the harness still reports the worker live and what came back is not an accepted result ([reject-partial-worker-result](#reject-partial-worker-result)), apply [harness-compat](../harness-compat/TECHNIQUE.md)::[continue-agent](../harness-compat/continue-agent.md) under `{worker_agent_id}` with explicit instructions to finish what the result left undone and return the envelope.
+   > - When the harness reports the worker ended without returning an envelope, dispatch a fresh worker for the same `{activity_id}`, which mints its own identity.
+   > - When the harness still reports the worker live and what came back is not an accepted result ([reject-partial-worker-result](#reject-partial-worker-result)), apply [harness-compat](../harness-compat/TECHNIQUE.md)::[continue-agent](../harness-compat/continue-agent.md) under `{worker_agent_id}` with explicit instructions to finish what the result left undone and return the envelope.
 5. Account for this activity, and for any replacement worker dispatched for the same `{activity_id}`, per [account-every-activity](#account-every-activity).
 6. Reconcile any critical routing or path variable an orchestrator decision depends on: compare the session record against the just-completed worker's `activity_complete` envelope, and against planning-folder evidence when the two still leave it uncertain ([distrust-then-reconcile](#distrust-then-reconcile)).
 7. On `activity_complete`, read `{worker_result.next_activity_id}` and `{worker_result.activity_exit}` as the authoritative next-activity routing, and pass the exit to `next_activity` — the worker resolved both against the activity's exits and the workflow graph via [finalize-activity](./finalize-activity.md).
-   > On a **blocked** signal from the worker or the harness, apply [sync-progress-status](./sync-progress-status.md) for the blocked moment in [Progress Status call sites](../../../meta/resources/planning-readme.md#progress-status-call-sites) for `{activity_id}` before surfacing or retrying.
-   > When the path **skips / cancels** an activity without running it, apply [sync-progress-status](./sync-progress-status.md) for the path-skip / cancel moment in [Progress Status call sites](../../../meta/resources/planning-readme.md#progress-status-call-sites) for that activity's rows.
+   > - On a **blocked** signal from the worker or the harness, apply [sync-progress-status](./sync-progress-status.md) for the blocked moment in [Progress Status call sites](../../../meta/resources/planning-readme.md#progress-status-call-sites) for `{activity_id}` before surfacing or retrying.
+   > - When the path **skips / cancels** an activity without running it, apply [sync-progress-status](./sync-progress-status.md) for the path-skip / cancel moment in [Progress Status call sites](../../../meta/resources/planning-readme.md#progress-status-call-sites) for that activity's rows.
 
 ## Rules
 

meta/techniques/workflow-engine/start-session.md

@@ -54,8 +54,8 @@ Slug the session is keyed on — minted transitionally when no planning folder w
 ## Protocol
 
 1. Call `start_session` with `{workflow_id}`, `{agent_id}`, `{repo}`, `{user_request}`, and optional `{planning_folder}`, per the [bootstrap protocol](../../../meta/resources/bootstrap-protocol.md). Omit `context_mode` (or pass `"fresh"`).
-   > `{repo}` is required on every call, including transient meta when `{planning_folder}` is omitted.
-   > Pass `{user_request}` verbatim — the server seeds it into the bag and children inherit it, so it reaches downstream agents as state rather than as prose in a spawn prompt.
+   > - `{repo}` is required on every call, including transient meta when `{planning_folder}` is omitted.
+   > - Pass `{user_request}` verbatim — the server seeds it into the bag and children inherit it, so it reaches downstream agents as state rather than as prose in a spawn prompt.
 2. Save `{session_index}` and `{planning_folder_path}` from the response. Record `{repo}` as bag `{target_repo}` (response echo when present, otherwise the value passed). Do not compose or reconcile the planning path yourself.
 3. Call `get_workflow { session_index }` and follow the returned operations bundle. After summarization, re-fetch with the escapes in `workflow-engine.force-full-after-summarization`.
 

ponytail/techniques/apply-ladder.md

@@ -34,9 +34,9 @@ The minimal change that solves the problem at the highest reachable [rung](../re
 - When `{lean_brief}` is present, start from its traced flow, reachable rungs, and safety-floor obligations rather than re-deriving them.
 - Walk the [rungs](../resources/the-ladder.md#rungs) from the laziest down and take the highest one that solves the understood problem.
 - Let `{lazy_intensity}` govern how the code is built.  
-  > At `lite`, build what was asked and record the lazier alternative in one line beside it.  
-  > At `full`, hold the ladder as written: highest reachable rung, shortest working diff, shortest explanation.  
-  > At `ultra`, build the minimal version and trim the over-built part of the requirement itself, recording what it trimmed as an open question rather than waiting on an answer that can be defaulted.
+  > - At `lite`, build what was asked and record the lazier alternative in one line beside it.
+  > - At `full`, hold the ladder as written: highest reachable rung, shortest working diff, shortest explanation.
+  > - At `ultra`, build the minimal version and trim the over-built part of the requirement itself, recording what it trimmed as an open question rather than waiting on an answer that can be defaulted.
 
 ### 2. Hold the safety floor
 

prism-audit/techniques/audit-finalize/create-detailed-findings.md

@@ -26,8 +26,8 @@ Filesystem path to the written DETAILED-FINDINGS.md (the detailed-findings docum
 ### 1. Consolidate Definitive Findings
 
 - Read each scope's DEFINITIVE-FINDINGS.md at the `definitive_findings_path` in `{completed_analyses}` into the working set.  
-  > For a single-scope audit, that scope's findings are the working set as they stand.  
-  > For a multi-scope audit, merge them: deduplicate findings reported in more than one scope, keeping the highest severity and citing every scope it appeared in, and surface patterns recurring across scopes as systemic findings.
+  > - For a single-scope audit, that scope's findings are the working set as they stand.
+  > - For a multi-scope audit, merge them: deduplicate findings reported in more than one scope, keeping the highest severity and citing every scope it appeared in, and surface patterns recurring across scopes as systemic findings.
 
 ### 2. Create Detailed Findings
 

prism-audit/techniques/audit-finalize/split-report.md

@@ -26,6 +26,6 @@ Filesystem path to the written AUDIT-REPORT.md (the summary report).
 ### 1. Split Report
 
 - Locate the source reports from the `report_path` in `{completed_analyses}`.  
-  > For a single-scope audit, that one report is the source.  
-  > For a multi-scope audit, merge the per-scope executive summaries, domain tables and systemic patterns into one.
+  > - For a single-scope audit, that one report is the source.
+  > - For a multi-scope audit, merge the per-scope executive summaries, domain tables and systemic patterns into one.
 - Write the summary report to `{audit_report_path}` per [audit-report](../../resources/audit-report.md#template) and its [Rules](../../resources/audit-report.md#rules), which own the reference line that replaces the lifted section and the renumbering it forces.

prism-audit/techniques/compose-audit-prompt/survey-structure.md

@@ -31,5 +31,5 @@ Total lines of code across the surveyed modules, excluding tests, docs, and gene
 ### 2. Inventory the Modules
 
 - Record `{module_inventory}` from the layout the build configuration declares, with each module's line count excluding tests, docs and generated files, and `{total_loc}` as their sum. Note the test directories and the file patterns they follow.  
-  > Where the codebase is indexed, apply `gitnexus-operations::query` for functional areas, execution flows and community clusters, which bound modules better than directory layout alone, and `gitnexus-operations::context` on the high-risk ones for a caller count.  
-  > Where `{target_path}` holds no analysable source files, report the path as unsurveyable and whether submodules appear uninitialised, rather than an empty inventory.
+  > - Where the codebase is indexed, apply `gitnexus-operations::query` for functional areas, execution flows and community clusters, which bound modules better than directory layout alone, and `gitnexus-operations::context` on the high-risk ones for a caller count.
+  > - Where `{target_path}` holds no analysable source files, report the path as unsurveyable and whether submodules appear uninitialised, rather than an empty inventory.

prism-evaluate/techniques/compose-evaluation-report/extract-findings.md

@@ -20,5 +20,5 @@ Draws each dimension's findings out of its analysis run and into the report's pe
 ### 3. Record the Per-Dimension Sections
 
 - Record `{evaluation_report.dimension_findings}`: per dimension, its name, finding count, count by severity, and the findings with their IDs.  
-  > A run whose status is `partial` or `error` keeps its dimension in the report, noted as incomplete coverage.  
-  > A dimension whose run found nothing keeps its section, noted as no significant findings.
+  > - A run whose status is `partial` or `error` keeps its dimension in the report, noted as incomplete coverage.
+  > - A dimension whose run found nothing keeps its section, noted as no significant findings.