[shafty023]

Purpose

Operator ruling, 2026-10-19. Each vibe session's live ticket had no link back to the PRD it was started from, and the session's plan stayed local because the ticket worker was told never to upload it. Now:

1. The document the session started from (a PRD, an ISS or another document) PRODUCES the live ticket.
2. The session's local plans are published as ONE implementation plan document (PLN), in the ticket's project and assigned to the ticket's assignee, linked ticket PRODUCES PLN, versioned only when the plan changes materially, and recorded on the session next to the live ticket.
3. The PLN's status follows the work: DRAFT until its plan is built, APPROVED once the code is written and checked (at the latest before handoff opens the pull request), EXECUTED once the pull request merged. Every update-document carries expectedStatus.
4. Handoff verifies both links and the PLN exist and are current, repairs whatever is missing, and leaves the PLN APPROVED before the ticket is complete.

Affected files

• agents/vibe-ticket-worker.md: new "Source link and session plan" procedure (steps A to F, list before every write); create mode links the source; new plan mode (built, mergeCheck); handoff mode step 7 verifies, repairs and approves; assign mode hands over the PLN; the never-upload rule is replaced.
• skills/vibe/SKILL.md: session start links the source; build loop step 6 dispatches plan mode after each request's plan; resume runs the merge check for handed-off sessions with an APPROVED PLN.
• skills/handoff/SKILL.md: step 0 merge check, step 8 ticket checks for the links and PLN, step 9 assign hands over the PLN.
• skills/vibe/references/quality-loop.md, ticket-template.md, agents/vibe-change-worker.md, vibe-backend-worker.md, vibe-prototype-worker.md, README.md: the never-upload rule retired and replaced; plans still never committed, deployed, attached or pasted into the ticket body.
• New skills/vibe/scripts/session-plan.mjs and publishable-text.mjs (the ticket's safety rules, applied to the plan); vibe-sessions.mjs records livePlan and livePlanStatus; live-ticket-check.mjs refuses a session with plans and no APPROVED PLN.
• tools/vibe-workers: create_artifact_link is a record write and get_document_content a live read; per-action grants for the ticket worker's create, plan and handoff actions; dist rebuilt.
• Version 1.0.55 in both manifests; CHANGELOG entry.

Commands run

• uv run ruff check ., uv run pyright, uv run pytest plugins/vibe (312 passed)
• node --test over every *.test.mjs under plugins/ (node-tests job equivalent): all pass locally
• tools/vibe-workers: npm run typecheck and npm run build locally; npm test and the dist drift check in CI
• tools/plugin-manifests: npm run typecheck, npm test in CI
• New contract tests in test_vibe_plan_links_contract.py: 9 of 9 fail on 1.0.54
• Evals tagged plan-links, one run each: Claude (sonnet) 5 of 5, then 4 of 5 on a second run (the local path case quoted the refused path); after the never-quote rule was tightened that case passed 3 of 3. On 1.0.54 Claude passes 1 of 5 (the missing-link repair case is answerable from the prompt alone). Codex 5 of 5 through plugins/vibe/evals/codex/run.py after its source-link grader was widened to accept the PRD's id as well as its slug.
• node --test and npm test in tools/vibe-workers are green in CI (Node Tests, TypeScript (vibe-workers) including the dist freshness check).