# nobrainer-tech-flow 2.7.0: delegation where it pays, owner requests in the goal file

Release date: 2026-10-25.

This release changes workflow guidance and delegation, the optional Claude Code guards,
`nobrainer-team`, `nobrainer-security` and `nobrainer-build`. The setup record and the module set (eighteen) do not change.

## What changes

- **Done is defined and visible.** `skills/nobrainer-tech-flow/SKILL.md` now has the
  agent show the owner what done means before substantial work and set it as the
  host-native goal where supported; `references/delivery.md`, `references/project-start.md`
  and `references/long-run-state.md` replace "create a native goal only when explicitly
  requested" with "set the outcome and DoD as the native goal when the host offers one",
  so the owner can see whether the goal is running, paused or stopped. The Markdown goal
  stays the canonical, portable record. The TODO stays visible: the canonical TODO is
  mirrored in the host's plan or todo tool when it has one, otherwise shown as the
  Progress checklist (`SKILL.md`, `references/delivery.md`, `references/setup.md`).
- **Delegation only where it pays.** `references/delivery.md` "Coordinated team
  execution" now makes one MAIN loop that loads skills on demand the default. A unit
  goes to a native worker only when parallel work, context isolation, independent
  verification or specialization outweighs the cost, and the plan names that condition;
  without one, the unit stays in MAIN. Work is split by context, not by type of work, so
  the worker that changes a feature also writes and runs its tests. The 2.6.0 rules that
  made delegation the default and said a missing measured speedup was no reason to keep
  work in MAIN are removed. An owner or host rule that asks for more delegation still
  controls. `SKILL.md`, `AGENTS.md`, `CLAUDE.md`, `nobrainer-team`,
  `nobrainer-auto-fine-tune`, `references/model-routing.md` (`STANDARD` is now the
  default and `ROUTED` applies only to qualifying units), `references/long-run-state.md`,
  the shared bootstrap, the Copilot instructions, the
  personalization block written by the installers, the README and the workflow diagram
  say the same. The change follows Anthropic's published guidance:
  [when to fold subagents into the main agent loop](https://claude.com/resources/articles/building-agents-when-to-fold-subagents-into-your-main-agent-loop)
  and [when multi-agent systems help](https://www.claude.com/blog/building-multi-agent-systems-when-and-how-to-use-them),
  which reports that multi-agent implementations typically use three to ten times more
  tokens than a single agent for equivalent tasks.
- **Owner requests go into the goal file as they arrive.** In
  `skills/nobrainer-tech-flow/SKILL.md` the detailed-ledger gate has a new condition: the
  owner keeps adding requests mid-run in one long conversation. A new section of
  `references/long-run-state.md`, "New owner requests", sets the rule. While the ledger is
  active, the agent records each new request or idea before it continues any work, even
  when the request is deferred. The row quotes the owner's words (minus any secret) and
  carries the date and the status `PENDING`, or `READY` when nothing blocks it. When the
  gate first passes mid-conversation, earlier unfinished requests are backfilled. Rows are
  reconciled at every checkpoint, after compaction and at closeout, and none is silently
  dropped. At closeout each row is `ACCEPTED`, `STOPPED` with the owner decision that
  stopped it, or visibly open with its next step. In `references/correction-hooks.md`,
  `OWNER_DECISION_CHANGED` now acts as soon as the change arrives, before other work,
  updates the goal-file row when a ledger is active, and keeps other project instruction
  files from carrying the old rule: under `AUTO_SCOPED` it edits the contradicting line,
  under `ASK` it prepares the exact diff and asks once, and under `OFF` it names the stale
  line in the final report. The goal-file block gains `CURRENT_MILESTONE`: one short-term
  goal derived from `OUTCOME` and the open request rows, small enough to finish and verify
  in the current session. The agent works toward it without waiting, sets the next
  milestone from the open rows when it is accepted, and re-derives it at once when the
  owner changes a decision or a new request changes what matters most; accepting a
  milestone never closes `OUTCOME`. `OWNER_DECISION_CHANGED` resumes on that re-derived
  milestone. The default task-local goal file is
  `.nobrainer/goal.md`, which the context inventory already searches; it should not be
  committed to a public repository. The short restatements of the gate in
  `references/routing.md`, `references/setup.md`, `AGENTS.md`, `CLAUDE.md` and the
  README say the same.
- **The guards point back to the goal file after compaction.** The optional Claude Code
  guards gain a fourth hook, SessionStart with the matcher `compact|resume|clear`. It
  tells the agent to re-read up to three active Flow goal files: files with a `GOAL_ID:`
  line and a `STATUS` other than `COMPLETE` in the project root, `tasks/`, `docs/` or
  `.nobrainer/`. It prints only each path and a known `STATUS` word, never other
  goal-file text. It follows no symlink, skips unusual file names, stops after 5,000
  folder entries or 200 files, and prints nothing on any error.
  `scripts/install_guards.py` now reports an install from an earlier version as an
  update. If you already use the guards, update your Git checkout to 2.7.0 first, so the
  hooks' `flow_guard.py` knows the new mode, then preview the change with
  `python3 scripts/install.py --client claude --guards`, apply it with `--apply` and
  restart Claude Code. Until then the three earlier hooks keep working unchanged. The hook
  only finds goal files that already exist; it does not write one.
- **Team uses task-local specialists, not third-party skills.** `nobrainer-team` no
  longer searches for, downloads, installs or runs external skills, and it writes into no
  client's skill folder. When a capability gap remains after curated skills, installed
  skills, project tools and bounded research, MAIN writes a specialist brief (role,
  method from project docs or verified primary sources, allowed actions, write scope,
  acceptance and report) for a native worker. The brief stays in the task plan and is
  discarded afterwards. The module's description now says "task-local specialist briefs".
- **A clean security result needs more than one pass.** In
  `skills/nobrainer-security/SKILL.md` one model pass counts as a sample of the scope, not
  as coverage. Before `CLEAN`, at least one more independent pass starts from a different
  entry point, trust boundary or data-flow direction; the review stops when a pass adds no
  new verified finding and reports how many passes ran. After a fix, when the defect was
  public or reachable before it, the agent checks the available logs or other evidence for
  exploitation during that exposure window, or lists the window under
  `UNTESTED_OR_INACCESSIBLE_SURFACE`. In `references/delivery.md` the security-sensitive
  paths that need an independent review and stay owner-gated, however small the diff, now
  name authentication, permissions, payments and personal data. Work from an untrusted or
  unknown author never takes the low-risk path, and a user-interface change needs rendered
  evidence, a screenshot or recording, before and after where possible; unit tests alone
  do not prove it.
- **Stale conventions are reported, not followed silently.** In
  `skills/nobrainer-build/SKILL.md`, when instruction files or docs describe a coding
  convention that the existing code does not follow, the agent follows the convention the
  code uses, unless the instruction is an explicit owner rule or names a deliberate
  migration, and lists each disagreement in its final report. When the code wins, the
  report includes the exact edit that fixes the stale instruction file, applied only as
  the project's `LEARNING_WRITE_POLICY` allows, so the next run does not inherit the stale
  rule; when an owner rule or migration wins, it names the code change required. Owner
  rules on safety, authority and workflow always apply.
- **Accurate install documentation.** The README lists the free remote MCP server
  (`https://mcp.nobrainer.tech/mcp`, no sign-in, stateless, six read-only tools) as a
  sixth channel and says it does not install the eighteen modules. `docs/CHAT_PLUGINS.md`
  and `docs/INSTALL.md` now say the npm package is published.
- **Test fixes.** The bounded-runner interrupt test waits until the child's pid file
  holds a number, not only until it exists, which removes an intermittent CI failure.
  A duplicate GitHub transport test that shadowed another one was removed.

## The remote MCP server

The MCP server in `mcp/` is deployed separately and is not part of the npm package.
Since 2.6.0 it returns a goal-file block with a renewed contract token when
`get_flow_step` is called with a contract token and `event: "resume"`, and a scheduled, read-only workflow
warns three days before the bundled model-advisor benchmark snapshot expires. Its
guidance cards are still pinned to 2.6.0 and move to this release in a separate change
after the tag.

## Verification record

Local checks (macOS, Python 3.14):

- `python3 scripts/validate_skills.py` and `python3 scripts/validate_skills.py --suite`: OK.
- `skills/nobrainer-tech-flow/SKILL.md` stays within the suite budget (239 lines, 1,748
  words; limits 240 and 1,750); `AGENTS.md` and `CLAUDE.md` stay byte-identical within
  theirs (205 lines, 1,615 words; limits 205 and 1,620).
- `python3 -m unittest tests.test_suite`: 74 tests OK. Every other test module, run
  separately: OK.
- `git diff --check`: clean.
- An independent read-only review of this release preparation found three issues: the
  always-loaded instructions went over their word budget, the guard upgrade steps were
  incomplete, and the release text overstated what the request rule guarantees. All three
  were fixed. Two further independent read-only reviews of the delegation, security and
  conventions changes found four low and two medium issues: README summaries that dropped
  conditions, tests that did not protect the exceptions or the cost gate, and the
  delegation-first default still present in `nobrainer-auto-fine-tune` and
  `references/model-routing.md`. All were fixed, and a test now checks that the retired
  delegation defaults do not return on the active surfaces.

The changes it ships were each reviewed and passed CI in their own pull requests (#98,
#101, #109, #110, #111, #112, #113, #115). The full suite runs in the Validate workflow for the
tagged commit.