## Write and verify the bootstrap

4. **Write the adapted scaffold.** Fill the `AGENTS.md` placeholders (commands,
   the documentation map rows, architecture); write the **adaptive lane
   conventions** (unit document, triage, catalog steps, guards, evidence rows,
   dated progress log, closed commit format `type(scope): description`); keep
   the `features/_TEMPLATE` + `ROADMAP`, the `fix/_TEMPLATE` + `README`, and
   the `.github/` templates; keep `.agentic-workflow/hooks/` and activate only
   the adapters explicitly accepted in the interview; prune unused doc folders
   and map rows. Leave honest placeholders where the user hasn't decided — never
   invent values.
5. **Seed Normalized Repository State.** Copy
   `template/docs/workflow/REPOSITORY_STATE.md` to
   `docs/workflow/REPOSITORY_STATE.md` when it is absent. If the target already
   has one, leave it unchanged and report that discovery should refresh it.
   Explain that discovery freezes evidence before planning and only
   `resolve-repository-state` updates frozen facts.
6. **Offer architectural invariants.** Keep
   `docs/architecture/ARCHITECTURAL_INVARIANTS.md` from the template only when
   the project has long-lived architectural constraints. Explain that it is
   optional: an absent document means no project invariants are declared, not
   that the scaffold failed. If retained, add its documentation-map row and
   name the project's explicit architectural-decision authority.
7. **Propagate the unit doc template.** Ensure
   `docs/features/_TEMPLATE/SPEC.md` exists with all 14 sections sections.
   This is the template used when creating new unit documents.
8. **Provision Serena — one consented question, then write.** Load
   [SERENA](SERENA.md) and ask its single consent question; one yes covers the
   tool install, the detected platform's MCP registration and the global trust
   append, and a refusal installs, registers and writes **nothing**. On yes:
   (a) append the `.gitignore` block additively (skip when already present);
   (b) write `.serena/project.yml` with the `language_servers` list for every
   detected language (never overwrite an existing file — report it); (c) run the
   health check and render the fixed provisioning report. When no installer is
   available, offer only what the machine can perform and record the residual
   with its reason — the run completes either way.
9. **Offer Engram provisioning.** Load [ENGRAM](ENGRAM.md), detect the binary
   and ask consent: register the `engram` MCP server (absolute path, exact
   `mcp --tools=agent` argv) when the host has one, leave an existing
   declaration untouched, and report exactly what was written. An absent binary
   becomes a residual with the documented install route — never a failed run.
   Skip this step when the pi package provisions the host itself.
10. **Install accepted agent safety hooks.** Keep the canonical policy and
   fullauto wrapper at `.agentic-workflow/hooks/`. Seed the shipped
   path-protection policy at `.agentic-workflow/path-policy.json` and its doc
   page at `.agentic-workflow/path-protection.md`, beside the hooks — the
   `path-policy.json` seed is byte-identical to the producer crate's canonical
   default, so a fresh install gets the guard with zero config. Leave an
   existing owner-written `.agentic-workflow/path-policy.json` untouched and
   report it as a residual. For each accepted platform,
   activate only its repository config/example as documented in the hook pack.
   Run `bash .agentic-workflow/hooks/tests/test-command-guard.sh`; missing `jq`,
   an unknown payload, or an existing customized hook file becomes a residual,
   never a silent overwrite. Direct merges remain blocked; do not create a
   `.automerge` exception.
11. **Offer the workflow skills.** Propose installing them:
   `npx skills add gtrabanco/agentic-workflow` (note the SSH/local-path variant if
   the source is private). Don't install without a yes.
12. **State that reviews are self-contained; offer optional extras.** The
   workflow ships its **own internal review pack** (`review-code`,
   `review-security`, `review-verify`, `review-debt`, `review-design`,
   `review-a11y`, `review-brand`, `review-perf`, `review-seo`) — it installs
   with the skills and covers every review axis, so **no external review skill
   is required on any agent**. If the user wants platform-specific extras (a
   framework skill, a stack-specific security skill), record them in `AGENTS.md`
   under a short "Optional review extras" note so `review-change` and
   `product-audit` run them **in addition** — never as a dependency. Don't
   install anything without a yes.
13. **Seed the urgency labels (feature 15, injection-safe urgency).** Create the
   two capability-gated GitHub labels `triage-issue` owns and applies
   (`skills/triage-issue/SKILL.md` is the sole owner of the name/color
   vocabulary — this step only seeds it, never redefines it):
   `gh label create urgent --color B60205 --description "Evaluate for
   interrupt-now — reaches the pause-vs-finish judge"` and
   `gh label create fix-next --color D93F0B --description "Head of the fix
   queue — never interrupts the in-flight unit"`. Create-if-missing: an
   "already exists" error from `gh label create` is treated as success, not a
   failure. Requires the forge remote/auth Step 0 already detected — if the
   forge is unavailable or the user declines forge setup, skip this step and
   list the two labels as a residual for the user to create manually later
   (never fail the whole scaffold on it).
14. **Report.** List what was created, which placeholders still need human input,
   the companion skills recorded/installed, the urgency labels seeded (or
   skipped, with reason), and the next step:
   `discover-repository-state` → `/unit-lane` (or `workflow-status`) → catalog
   steps → `execute-phase`.