From 443622b2f9a43cc8cd13f222c47ca268055a8d90 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Barrag=C3=A1n=20Merino?= Date: Wed, 16 Sep 2026 18:24:50 +0200 Subject: [PATCH 1/4] :whale: Keep dist-upgrade unattended across the image builds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: David Barragán Merino --- docker/devenv/Dockerfile | 4 ++-- docker/images/Dockerfile.backend | 4 ++-- docker/images/Dockerfile.exporter | 2 +- docker/images/Dockerfile.media-processor | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docker/devenv/Dockerfile b/docker/devenv/Dockerfile index fb9e54fb63..c2aa3c35e2 100644 --- a/docker/devenv/Dockerfile +++ b/docker/devenv/Dockerfile @@ -6,7 +6,7 @@ ENV LANG='C.UTF-8' \ RUN set -ex; \ apt-get -qq update; \ - apt-get -qq dist-upgrade; \ + apt-get -qq -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade; \ apt-get -qqy --no-install-recommends install \ python3 \ unzip \ @@ -417,7 +417,7 @@ RUN set -ex; \ RUN set -ex; \ apt-get -qq update; \ - apt-get -qq dist-upgrade; \ + apt-get -qq -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade; \ apt-get -qqy --no-install-recommends install init-system-helpers; \ apt-get -qqy install --no-install-recommends \ redis-tools \ diff --git a/docker/images/Dockerfile.backend b/docker/images/Dockerfile.backend index 98b3e02ab8..19c2198ce8 100644 --- a/docker/images/Dockerfile.backend +++ b/docker/images/Dockerfile.backend @@ -9,7 +9,7 @@ ENV LANG='C.UTF-8' \ RUN set -ex; \ apt-get -qq update; \ - apt-get -qq dist-upgrade; \ + apt-get -qq -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade; \ apt-get -qqy --no-install-recommends install \ binutils \ ca-certificates \ @@ -63,7 +63,7 @@ RUN set -ex; \ apt-get -qq update; \ apt-get -qqy --no-install-recommends install passwd; \ useradd -U -M -u 1001 -s /bin/false -d /opt/penpot penpot; \ - apt-get -qq dist-upgrade; \ + apt-get -qq -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade; \ apt-get -qqy --no-install-recommends install \ ca-certificates \ curl \ diff --git a/docker/images/Dockerfile.exporter b/docker/images/Dockerfile.exporter index 46fbb0041d..362b107ad9 100644 --- a/docker/images/Dockerfile.exporter +++ b/docker/images/Dockerfile.exporter @@ -11,7 +11,7 @@ RUN set -ex; \ apt-get -qq update; \ apt-get -qqy --no-install-recommends install passwd; \ useradd -U -M -u 1001 -s /bin/false -d /opt/penpot penpot; \ - apt-get -qq dist-upgrade; \ + apt-get -qq -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade; \ apt-get -qqy --no-install-recommends install \ curl \ tzdata \ diff --git a/docker/images/Dockerfile.media-processor b/docker/images/Dockerfile.media-processor index 3a1c15e9ae..9e30b0f3d4 100644 --- a/docker/images/Dockerfile.media-processor +++ b/docker/images/Dockerfile.media-processor @@ -12,7 +12,7 @@ RUN set -ex; \ mkdir -p /etc/resolvconf/resolv.conf.d; \ echo "nameserver 127.0.0.11" > /etc/resolvconf/resolv.conf.d/tail; \ apt-get -qq update; \ - apt-get -qq dist-upgrade; \ + apt-get -qq -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade; \ apt-get -qqy --no-install-recommends install \ curl \ tzdata \ From 30e52af22e9adb0765a10c5f7f9edc5a1ad74abe Mon Sep 17 00:00:00 2001 From: Andrey Antukh Date: Wed, 16 Sep 2026 19:48:50 +0200 Subject: [PATCH 2/4] :paperclip: Backport creating-issue serena memories from develop --- .serena/memories/workflow/creating-issues.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.serena/memories/workflow/creating-issues.md b/.serena/memories/workflow/creating-issues.md index f698c5031c..b1b4e9ade4 100644 --- a/.serena/memories/workflow/creating-issues.md +++ b/.serena/memories/workflow/creating-issues.md @@ -112,11 +112,13 @@ Output: `https://github.com/penpot/penpot/issues/` | Task | `IT_kwDOAcyBPM4AX5NY` | | Question | `IT_kwDOAcyBPM4B_IQj` | | Docs | `IT_kwDOAcyBPM4B_IQz` | +| EPIC | `IT_kwDOAcyBPM4CEMzF` | **Map:** - Bug report (steps to reproduce, expected vs. actual) → Bug - Enhancement / new feature → Enhancement - Feature/epic → Feature +- Umbrella/EPIC tracking issue that groups sub-issues → EPIC - Docs → Docs - None of the above → Task From ebba70ad2be3163a9dc96f5b2a2f2fac6d1b255d Mon Sep 17 00:00:00 2001 From: Andrey Antukh Date: Wed, 16 Sep 2026 18:00:55 +0000 Subject: [PATCH 3/4] :books: Normalize plan followup and sub-plan naming Define derived plan naming for .agents/plans/. Parent basename stays intact and derivatives append --review-NN for review followups and --task-NN for roadmap sub-plans, with no new date so ls groups them. Document the rule in the planner skill, the in-place vs new-file policy in make-a-plan, and examples in the agents README. AI-assisted-by: muse-spark-1.3-contributor --- .agents/README.md | 19 ++++++++++++++ .agents/skills/make-a-plan/SKILL.md | 16 +++++++++--- .agents/skills/planner/SKILL.md | 39 +++++++++++++++++++++++++++++ 3 files changed, 70 insertions(+), 4 deletions(-) diff --git a/.agents/README.md b/.agents/README.md index e4abf7ae64..25c59b5bc4 100644 --- a/.agents/README.md +++ b/.agents/README.md @@ -344,6 +344,25 @@ delegating when it helps), review it when the task is complex (`/review-plan`), implement it (`/implement-plan`), and mark progress on the roadmap as you land each piece. +### Plan file naming (base + derivatives) + +Base plans live in `.agents/plans/` as `YYYY-MM-DD-.md`. +Derived plans reuse the parent basename verbatim and append one +suffix per level with `--`, with no new date — the parent prefix +keeps everything adjacent in `ls`: + +- Review followup on implemented work: + `2026-09-14-paste-before-init-crash.md` → + `2026-09-14-paste-before-init-crash--review-01.md` +- Roadmap sub-plan (task number from the roadmap): + `2026-09-20-upload-pipeline-roadmap.md` → + `2026-09-20-upload-pipeline-roadmap--task-01-chunk-upload.md` +- Chained: `...--task-02-gc--review-01.md` + +While a plan is still unimplemented, `/make-a-plan` revises it in +place. Once implemented and reviewed, it writes a new followup file. +Full rules live in the `planner` skill. + ## 7. Connecting `gh` CLI with a token The `create-issue` and `create-pr` flows need an authenticated `gh` diff --git a/.agents/skills/make-a-plan/SKILL.md b/.agents/skills/make-a-plan/SKILL.md index cd9129f85b..6b5ea09005 100644 --- a/.agents/skills/make-a-plan/SKILL.md +++ b/.agents/skills/make-a-plan/SKILL.md @@ -16,8 +16,13 @@ stop — this skill needs the build agent to save the plan. - The user asks to plan, design, or break down a task, in any phrasing: "make a plan", "how would we build X", "design an approach for Y" — or runs `/make-a-plan`. -- The user asks to rework or extend an existing plan (for example, after - review findings) — revise the saved plan file in place. +- The user asks to rework or extend an existing plan. While the plan is + still unimplemented (pre-`implement-plan` iteration, e.g. after + `/review-plan` findings or user feedback), revise the saved plan file + in place. Once the plan has been implemented and reviewed (post + `/review-code` findings on committed work), write a new derived plan + file instead — never rewrite the executed plan. The `planner` skill + defines the derived naming (`--review-NN`, `--task-NN`). Do not use it to execute a plan — that is the `implement-plan` flow. @@ -34,8 +39,11 @@ Do not use it to execute a plan — that is the `implement-plan` flow. 3. Once all decisions are answered and the plan is final, save it verbatim to the announced path under `.agents/plans/` (create the directory if it does not exist). This step is the flow's explicit authorization to write the plan - file — the only write allowed here. If I later ask for changes, update the - saved file directly. + file — the only write allowed here. A fresh plan uses + `.agents/plans/YYYY-MM-DD-.md`; a derived plan uses the parent + basename plus the `planner` suffix (`--review-NN`, `--task-NN`) in its + own new file. If I later ask for changes to a still-unimplemented plan, + update the saved file directly. 4. Present me with a clear, self-contained summary of the plan's most relevant points only after all required decisions have been answered. Write it for someone who knows only the project's high-level goal and may not know the plan's low-level context. diff --git a/.agents/skills/planner/SKILL.md b/.agents/skills/planner/SKILL.md index 4595dbc242..aa77b6397f 100644 --- a/.agents/skills/planner/SKILL.md +++ b/.agents/skills/planner/SKILL.md @@ -153,6 +153,45 @@ Announce the save path `.agents/plans/YYYY-MM-DD-.md` (today's date, lowercase hyphen-separated slug, e.g. `2026-09-10-add-batch-get-profiles`; an explicit user path wins). +### Derived plans + +Never invent a fresh slug when the plan derives from an existing one. +The derived name is `` plus one suffix per level, +joined with `--` (double hyphen; single hyphens already separate +slug words, so `--` marks where the derivation starts). The parent +name is never edited, and no new date is added — the parent prefix +already carries its date, which keeps parent and derivatives adjacent +in `ls`. Record the real creation date inside the plan (`Created:`). + +Valid names match: + +``` +^\d{4}-\d{2}-\d{2}-[a-z0-9-]+(--(review-\d{2}|task-\d{2})(-[a-z0-9-]+)?)*\.md$ +``` + +- `review-NN` — a new plan addressing findings of a `review-code` or + `review-plan` on already-implemented work. `NN` counts reviews of + that parent from `01`. Example: parent + `2026-09-14-paste-before-init-crash.md` → + `2026-09-14-paste-before-init-crash--review-01.md`, + then `--review-02.md`. +- `task-NN-` — sub-plan for task `NN` of a high-level + roadmap plan. `NN` is the roadmap task number. Example: parent + `2026-09-20-upload-pipeline-roadmap.md` → + `2026-09-20-upload-pipeline-roadmap--task-01-chunk-upload.md`. + Levels chain: `...--task-02-gc--review-01.md`. + +Never use `v2`, `final`, `new`, or `fix2` as suffixes. Keep the +optional short slug to 3-4 lowercase hyphen-separated words. + +Every derived plan opens its `Context` with: + +```markdown +Parent: `.md` +Source: review-code over `` (branch ``) | task `NN` of roadmap `.md` +Created: YYYY-MM-DD +``` + End the response by suggesting the next steps: `/review-plan` to get a second opinion on the plan and `/implement-plan` to execute it. From 9ae967c6218f62f1fc42b62d44d6517448516709 Mon Sep 17 00:00:00 2001 From: Andrey Antukh Date: Wed, 16 Sep 2026 18:12:12 +0000 Subject: [PATCH 4/4] :books: Add plan status lifecycle and review log Give every plan a write-restricted Status (draft, reviewed, done) and an append-only Review Log with UTC ISO 8601 lines. Make-a-plan creates plans as draft and is the only flow writing reviewed, on explicit user apply. Review-plan stays read-only. Implement-plan closes the plan to done with the issue URL when one exists, in the same commit as the code. Document the lifecycle in the agents README. AI-assisted-by: muse-spark-1.3-contributor --- .agents/README.md | 14 ++++++++++++++ .agents/skills/implement-plan/SKILL.md | 13 +++++++++++-- .agents/skills/make-a-plan/SKILL.md | 12 +++++++++--- .agents/skills/planner/SKILL.md | 23 ++++++++++++++++++++++- 4 files changed, 56 insertions(+), 6 deletions(-) diff --git a/.agents/README.md b/.agents/README.md index 25c59b5bc4..7a8631170e 100644 --- a/.agents/README.md +++ b/.agents/README.md @@ -363,6 +363,20 @@ While a plan is still unimplemented, `/make-a-plan` revises it in place. Once implemented and reviewed, it writes a new followup file. Full rules live in the `planner` skill. +### Plan status lifecycle + +Every plan carries `Status: draft | reviewed | done` plus an +append-only `Review Log` (UTC ISO 8601, one line per entry): + +- `draft` — fresh from `/make-a-plan`. +- `reviewed` — review feedback incorporated. `/review-plan` stays + read-only; only your explicit "apply" makes `/make-a-plan` apply + the changes, flip the status, and log one line. +- `done` — `/implement-plan` closes it on completion, logging the + issue URL when one exists (never commit hashes). + +A plan approved with no changes goes `draft` → `done` directly. + ## 7. Connecting `gh` CLI with a token The `create-issue` and `create-pr` flows need an authenticated `gh` diff --git a/.agents/skills/implement-plan/SKILL.md b/.agents/skills/implement-plan/SKILL.md index 807b60064c..9d99e48a6d 100644 --- a/.agents/skills/implement-plan/SKILL.md +++ b/.agents/skills/implement-plan/SKILL.md @@ -102,8 +102,14 @@ Implement every task in one go. Work methodically, keeping changes focused on what the issue requires. Respect the plan's proposed parallelization when it applies. -When the implementation is complete, load the **`create-commit`** skill -and follow its workflow to commit the changes. Provide a brief summary +When the implementation is complete, close the plan file first: flip its +`Status` to `done` and append one UTC ISO 8601 line to its `Review Log` +with the issue URL when one exists (standalone mode, e.g. +`https://github.com/penpot/penpot/issues/NNNN`); in continue/direct +mode with no issue, just `done` with no invented identifier. Never +record commit hashes. Then load the **`create-commit`** skill +and follow its workflow to commit the changes together with the +closed plan file, so plan and code land in the same commit. Provide a brief summary of what was implemented and why, the issue reference (`issue-NNNN`) when there is one, and the model name you are running as so the `AI-assisted-by` trailer is set correctly. @@ -117,6 +123,9 @@ per task" — loop one task at a time: - Commit it now: load the **`create-commit`** skill and follow it — one commit per task, never two tasks in one commit. Same inputs as always: what and why, the issue reference, your model name. +- After the final task, close the plan file (`Status: done`, one + `Review Log` line with the issue URL when one exists) and include + it in that last commit. - Show the user the result (what changed, files touched, how it was verified). - WAIT for the user's confirmation before starting the next task. diff --git a/.agents/skills/make-a-plan/SKILL.md b/.agents/skills/make-a-plan/SKILL.md index 6b5ea09005..01c1850390 100644 --- a/.agents/skills/make-a-plan/SKILL.md +++ b/.agents/skills/make-a-plan/SKILL.md @@ -22,7 +22,12 @@ stop — this skill needs the build agent to save the plan. in place. Once the plan has been implemented and reviewed (post `/review-code` findings on committed work), write a new derived plan file instead — never rewrite the executed plan. The `planner` skill - defines the derived naming (`--review-NN`, `--task-NN`). + defines the derived naming (`--review-NN`, `--task-NN`). +- The user says to apply `review-plan` findings to a still-unimplemented + plan: apply the agreed changes, flip `Status` to `reviewed`, and + append one UTC ISO 8601 line to `Review Log` describing what changed. + This apply step is the only pre-implementation write to those fields — + `review-plan` itself stays read-only and never writes. Do not use it to execute a plan — that is the `implement-plan` flow. @@ -40,9 +45,10 @@ Do not use it to execute a plan — that is the `implement-plan` flow. announced path under `.agents/plans/` (create the directory if it does not exist). This step is the flow's explicit authorization to write the plan file — the only write allowed here. A fresh plan uses - `.agents/plans/YYYY-MM-DD-.md`; a derived plan uses the parent + `.agents/plans/YYYY-MM-DD-.md` with `Status: draft` and an + empty `Review Log`; a derived plan uses the parent basename plus the `planner` suffix (`--review-NN`, `--task-NN`) in its - own new file. If I later ask for changes to a still-unimplemented plan, + own new file, also starting as `draft`. If I later ask for changes to a still-unimplemented plan, update the saved file directly. 4. Present me with a clear, self-contained summary of the plan's most relevant points only after all required decisions have been answered. Write it for someone who knows diff --git a/.agents/skills/planner/SKILL.md b/.agents/skills/planner/SKILL.md index aa77b6397f..a242cf83bd 100644 --- a/.agents/skills/planner/SKILL.md +++ b/.agents/skills/planner/SKILL.md @@ -70,7 +70,7 @@ Skipping this step is the #1 cause of incorrect or incomplete plans. Each task follows this structure: ```markdown -## Task [N]: [Short descriptive title] +### Task [N]: [Short descriptive title] **Description:** One or two paragraphs explaining what this task accomplishes. Should be clear and concise. @@ -202,6 +202,10 @@ Use this document shape: ```markdown # Plan: Title +Status: draft | reviewed | done +Review Log: +- YYYY-MM-DDTHH:MM:SSZ — + ## Context ## Affected Modules ## Architecture Decisions @@ -213,6 +217,23 @@ Use this document shape: ## Open Questions ``` +`Status` and `Review Log` are write-restricted metadata, not free text: + +- `make-a-plan` creates every plan with `Status: draft` and an empty + log. `reviewed` never means "a review was emitted" — it means + "review feedback was incorporated". A plan approved with no changes + goes `draft` → `done` without passing through `reviewed`. +- Only a user-triggered apply step writes them before implementation: + when the user says to apply `review-plan` findings, `make-a-plan` + applies the changes, flips to `reviewed`, and appends one UTC + ISO 8601 line describing what changed. +- `implement-plan` flips to `done` on completion and appends one line + with the issue URL when one exists (standalone mode); otherwise + just `done`. Never record commit hashes — they rot on amend/rebase + and git already links the commit. +- The log is append-only: never rewrite or delete lines. +- `review-plan` and `review-code` never write these fields. + Omit empty sections only when they do not apply. Every implementation task still requires acceptance criteria, verification, dependencies, likely files, and scope.