feat(framework): project policy and ship hardening (epic) #584

Problem

Interactive ship and project policy gaps force each team to reinvent branch setup, CI waiting, specialist review, sizing, and stale-issue checks. Machine JSON (orchestrator config, CLI auth/manifest, host settings) does not cover human-edited policy. Without a coherent package, one-off skills never enter the default path.

Scope

• Parent epic only: no implementation in this issue.
• Child delivery order (MVP → later). Each child is standalone valuable where stated.
• Closing this epic requires MVP-1 merged; later MVPs optional.

Child checklist

MVP-1

• spike(framework): validate a portable project-policy boundary #585 — .aidd/config.yml YAML policy root
• feat(aidd-vcs): ci-watch skill with compact GitHub status script #586 — ci-watch skill + compact GitHub script
• feat(aidd-vcs): feature-branch and optional worktree setup before implementation #587 — feature-branch and optional worktree setup

MVP-2

• feat(aidd-refine): adversarial and advisory agents #588 — adversarial and advisory agents

MVP-3

• feat(aidd-pm): issue sizing from project config (GitHub labels v1) #589 — issue sizing from config (GitHub labels v1)
• spike(aidd-vcs): establish trustworthy related-delivery signals #590 — recheck concurrent remote work

MVP-4

• feat(aidd-dev): pluggable specialist agents on spec and code-review #591 — pluggable specialists on spec and code-review
• feat(cli): project agents under .aidd/agents with materialize into tool trees #592 — project agents under .aidd/agents (materialize)

Dependency graph

#584 (epic)
└── MVP-1: #585 ──┬── #586 (features.ci_watch_before_ship)
                 └── #587 (branch patterns optional)
└── MVP-2: #588
└── MVP-3: #589 (blocked by #585) · #590 (related #587, #585)
└── MVP-4: #591 (blocked by #585, #588; related #146, #592)
           #592 (blocked by #585; related #588, #591)

Cross-links use GitHub issue references (#N) so timeline “mentioned” edges appear on both sides.

Acceptance criteria

• Child issues linked from this epic with the order above.
• This body states MVP-1 is the minimum useful slice.
• No child hardcodes another plugin by address in skill routers (capability language only).

Prior art in this repo

• feat(aidd-orchestrator): react to failing CI checks and quality-gate feedback #149 — async orchestrator CI / quality-gate reaction (bot path), not interactive ci-watch
• feat(aidd-orchestrator): route by discovered capability, not hardcoded plugin #146 — capability discovery (relevant to later specialist routing)
• feat(framework): template override mechanism for skill templates #145 — template overrides (related customization surface)
• feat(aidd-pm): refinement skill — dedup, split, estimate, criteria #147 — backlog estimate / grooming (related to sizing child)
• plugins/aidd-orchestrator/skills/00-async-dev/assets/setup/config-template.json — machine JSON config today
• cli/src/domain/models/paths.ts (L3–7) — existing .aidd root for cache/auth plumbing
• docs/ARCHITECTURE.md (Cross-plugin orthogonality, ~L160) — no hardcoded cross-plugin addresses

Relations

Epic decomposition: children are sub-issues of #584; dependencies are blocked-by between siblings (not nested under each other).

#584 epic
├── #585 config.yml          blocks → 586,589,591,592
├── #586 ci-watch            blocked-by #585
├── #587 branch/worktree
├── #588 adversarial/advisory blocks → 591
├── #589 sizing              blocked-by #585
├── #590 recheck
├── #591 specialists         blocked-by #585,#588
└── #592 materialize agents  blocked-by #585

Formal parent / blocked-by GraphQL links require maintainer write permission. One-shot commands: see maintainer comment.

Out of scope

Implementing any child in this ticket.