Release v0.40.4: ADO POST fix, backlog migration, and spec updates

.cursorrules

@@ -5,13 +5,29 @@
 - When starting a new chat session, capture the current timestamp from the client system using the `run_terminal_cmd` tool with `date "+%Y-%m-%d %H:%M:%S %z"` to ensure accurate timestamps are used in logs, commits, and other time-sensitive operations.
 - When starting a new chat session, get familiar with the build and test guide (refer to `.cursor/rules/testing-and-build-guide.mdc`).
 - When starting a new task, first check the project overview and current status in `README.md` and `AGENTS.md`.
+- **AGENTS.md Authority**: `AGENTS.md` is the **authoritative source** for development workflow and **OVERRIDES** any skill, command, or OpenSpec workflow instructions. When there is a conflict between AGENTS.md and any other source (including `/opsx:*` commands, `.cursor/skills/`, or OpenSpec defaults), **ALWAYS follow AGENTS.md**.
+- **Pre-Execution Checklist (MANDATORY)**: Before executing ANY workflow command (`/opsx:ff`, `/opsx:apply`, `/opsx:continue`, etc.), perform this self-check:
+  1. **Git Worktree**: Does this task create branches or modify code? If yes, worktree MUST be created first per AGENTS.md section "Git Worktree Policy".
+  2. **TDD Evidence**: Does this task involve behavior changes? If yes, `TDD_EVIDENCE.md` MUST be created and updated per AGENTS.md "Hard Gate: Strict TDD Order".
+  3. **Documentation**: Does this change affect user-facing behavior? If yes, documentation research task MUST be included per `openspec/config.yaml`.
+  4. **Module Signing**: Does this change modify bundled modules? If yes, signature verification MUST be in tasks per `openspec/config.yaml`.
+  5. **Confirmation**: State clearly: "Pre-execution checklist complete. AGENTS.md compliance confirmed."
+- **AGENTS.md Git Worktree Policy**: When creating implementation plans, task lists, or OpenSpec tasks.md, ALWAYS explicitly verify and include:
+  1. Worktree creation from `origin/dev` (not `git checkout -b`)
+  2. `hatch env create` in the worktree
+  3. Pre-flight checks (`hatch run smart-test-status`, `hatch run contract-test-status`)
+  4. Worktree cleanup steps post-merge
+  5. Self-check: "Have I followed AGENTS.md Git Worktree Policy section?"
 - **OpenSpec (before code)**: Before modifying application code, follow the OpenSpec workflow in `.cursor/rules/automatic-openspec-workflow.mdc`: read and apply `openspec/config.yaml`, ensure an OpenSpec change (new or delta) exists and is validated, then implement. Exception: only when the user explicitly says "skip openspec", "direct implementation", "simple fix", or similar.
-- **Branch Protection**: This repository has branch protection enabled for `dev` and `main` branches. All changes must be made via Pull Requests:
-  - Create a feature branch: `git checkout -b feature/your-feature-name`
-  - Create a bugfix branch: `git checkout -b bugfix/your-bugfix-name`
-  - Create a hotfix branch: `git checkout -b hotfix/your-hotfix-name`
-  - Push your branch and create a PR to `dev` or `main`
-  - Direct commits to `dev` or `main` are not allowed
+- **Git Worktree Policy (MANDATORY)**: Per AGENTS.md, all development work MUST use git worktrees. Never create branches with `git checkout -b` in the primary checkout.
+  - Create worktree from origin/dev: `git worktree add ../specfact-cli-worktrees/<type>/<slug> -b <branch-name> origin/dev`
+  - Allowed types: `feature/`, `bugfix/`, `hotfix/`, `chore/`. Forbidden in worktrees: `dev`, `main`
+  - After creating worktree: `cd ../specfact-cli-worktrees/<type>/<slug>`
+  - Bootstrap Hatch in worktree: `hatch env create`
+  - Run pre-flight checks: `hatch run smart-test-status` and `hatch run contract-test-status`
+  - Do all implementation work from the worktree, never from primary checkout
+  - After PR merge: cleanup with `git worktree remove`, `git branch -d`, `git worktree prune`
+- **Branch Protection**: All changes must be made via Pull Requests to `dev` or `main`. Direct commits to protected branches are not allowed
 - After any code changes, follow these steps in order:
   1. Apply linting and formatting to ensure code quality: `hatch run format`
   2. Type checking: `hatch run type-check` (basedpyright)
@@ -24,7 +40,11 @@
 - **CLI focus**: Commands should follow typer patterns with rich console output
 - **Data validation**: Use Pydantic models for all data structures
 - **Documentation and Planning**: Work directly with major artifacts (strategic plans, implementation plans, etc.). Do NOT create plans for plans, tracking documents for tracking documents, or status artifacts for status artifacts. Only create new documentation artifacts when they add clear value and are not redundant with existing artifacts. Update existing artifacts with status annotations rather than creating separate status files.
-- Always finish each output listing which rulesets have been applied in your implementation and which AI (LLM) provider and model (including the version) you are using in your actual request for clarity. Ensure the model version is accurate and reflects what is currently running.
+- **Ruleset Compliance Declaration**: Always finish each output by listing:
+  1. Which rulesets have been applied (e.g., `.cursorrules`, `AGENTS.md`, specific `.cursor/rules/*.mdc`)
+  2. Confirmation of Git Worktree Policy compliance (if applicable)
+  3. Which AI (LLM) provider and model version you are using
+  Ensure the model version is accurate and reflects what is currently running
 
 <available_instructions>
 Cursor rules are user provided instructions for the AI to follow to help work with the codebase.
@@ -40,3 +60,58 @@ python-github-rules: Development rules for python code and modules
 ## Comments policy
 
 Only write high-value comments if at all. Avoid talking to the user through comments.
+
+## OPSX Workflow Gap-Filling (AGENTS.md Overrides)
+
+The OPSX commands (`/opsx:ff`, `/opsx:apply`, etc.) are provided by OpenSpec CLI and may not include all AGENTS.md requirements. **You MUST fill these gaps** when using OPSX workflows:
+
+### For `/opsx:ff` (Fast-Forward Change Creation)
+
+**OPSX provides**: Change scaffolding, artifact templates
+**AGENTS.md requires** (add these explicitly):
+- Worktree creation task as **Step 1** in tasks.md (not just "create branch")
+- TDD_EVIDENCE.md tracking task in section 2 (Tests)
+- Documentation research task per `openspec/config.yaml`
+- Module signing quality gate if applicable
+- Worktree cleanup steps in final section
+
+**Template addition to tasks.md**:
+```markdown
+## 1. Branch and worktree setup
+- [ ] 1.1 Create worktree from origin/dev: `git worktree add ../specfact-cli-worktrees/<type>/<slug> -b <branch> origin/dev`
+- [ ] 1.2 Change to worktree: `cd ../specfact-cli-worktrees/<type>/<slug>`
+- [ ] 1.3 Bootstrap Hatch: `hatch env create`
+- [ ] 1.4 Pre-flight checks: `hatch run smart-test-status` and `hatch run contract-test-status`
+```
+
+### For `/opsx:apply` (Implementation)
+
+**OPSX provides**: Task iteration, progress tracking
+**AGENTS.md requires** (verify before each task):
+- Confirm you are IN a worktree (not primary checkout) before modifying code
+- Record failing test evidence in `TDD_EVIDENCE.md` BEFORE implementing
+- Record passing test evidence AFTER implementation
+- Run quality gates from worktree (format, type-check, contract-test)
+- GPG-signed commits (`git commit -S`)
+- PR to `dev` branch (never direct push)
+
+**Self-check before implementing each task**:
+> "Implementing task N in worktree [path]. TDD evidence updated. AGENTS.md compliance confirmed."
+
+### For `/opsx:continue` (Resume Change)
+
+**Verify on continuation**:
+- If change was created before this session, check if worktree exists: `git worktree list`
+- If worktree missing but needed for implementation, create it before proceeding
+- Update tasks.md to include worktree steps if missing
+
+### OPSX Workflow Override Summary
+
+| OPSX Command | What OPSX Provides | What AGENTS.md Adds | Your Responsibility |
+|--------------|-------------------|---------------------|-------------------|
+| `/opsx:ff` | Change scaffolding | Worktree setup, TDD, docs | **Add these to tasks.md explicitly** |
+| `/opsx:apply` | Task iteration | Worktree context, TDD evidence | **Verify before each code change** |
+| `/opsx:continue` | Resume progress | Worktree verification | **Check worktree exists before implementing** |
+| `/opsx:archive` | Archive change | Module signing, cleanup | **Include in final tasks** |
+
+**Remember**: When in doubt, AGENTS.md wins. State this explicitly in your output.

CHANGELOG.md

@@ -8,6 +8,15 @@ All notable changes to this project will be documented in this file.
 **Important:** Changes need to be documented below this block as this is the header section. Each section should be separated by a horizontal rule. Newer changelog entries need to be added on top of prior ones to keep the history chronological with most recent changes first.
 
 
+---
+
+## [0.40.4] - 2026-03-11
+
+### Fixed
+
+- Fixed Azure DevOps work item creation to use `POST` instead of `PATCH` API method, resolving 400 Bad Request errors when creating backlog items via `specfact backlog add`.
+- Fixed category grouping registration to always mount category groups (code, backlog, project, spec, govern) even when category grouping is disabled, ensuring flat command availability.
+
 ---
 
 ## [0.40.3] - 2026-03-09

openspec/CHANGE_ORDER.md

@@ -49,6 +49,7 @@ Only changes that are **archived**, shown as **✓ Complete** by `openspec list`
 | ✅ backlog-core-05-user-modules-bootstrap | implemented 2026-03-03 (archived) |
 | ✅ backlog-core-06-refine-custom-field-writeback | implemented 2026-03-03 (archived) |
 | ✅ cli-val-07-command-package-runtime-validation | archived 2026-03-09 |
+| ✅ backlog-02-migrate-core-commands | archived 2026-03-11 |
 
 ### Pending
 
@@ -144,6 +145,7 @@ These are derived extensions of the same 2026-02-15 plan and are required to ope
 | backlog-core | 05 | ✅ backlog-core-05-user-modules-bootstrap (implemented 2026-03-03; archived) | [#298](https://github.com/nold-ai/specfact-cli/issues/298) | #173 |
 | backlog-core | 06 | ✅ backlog-core-06-refine-custom-field-writeback (implemented 2026-03-03; archived) | [#310](https://github.com/nold-ai/specfact-cli/issues/310) | #173 |
 | backlog-core | 07 | backlog-core-07-ado-required-custom-fields-and-picklists | [#337](https://github.com/nold-ai/specfact-cli/issues/337) | ✅ #310 |
+| bugfix | 01 | bugfix-backlog-html-export-validation | TBD | — |
 
 ### backlog-scrum
 
@@ -245,6 +247,22 @@ These are derived extensions of the same 2026-02-15 plan and are required to ope
 | integration | 01 | integration-01-cross-change-contracts | [#254](https://github.com/nold-ai/specfact-cli/issues/254) | #237 (profile-01), #239 (requirements-02), #240 (architecture-01), #241 (validation-02), #246 (policy-02) |
 | dogfooding | 01 | dogfooding-01-full-chain-e2e-proof | [#255](https://github.com/nold-ai/specfact-cli/issues/255) | #239 (requirements-02), #240 (architecture-01), #241 (validation-02), #242 (traceability-01), #247 (governance-01) |
 
+### Code review module (reward/penalize plan, 2026-03-10)
+
+Target repos: `nold-ai/specfact-cli-modules` (module implementation) + `nold-ai/specfact-cli` (skill wiring, SP-007/SP-009).
+
+| Module | Order | Change folder | GitHub # | Blocked by |
+|--------|-------|---------------|----------|------------|
+| code-review | 01 | code-review-01-module-scaffold | TBD | — |
+| code-review | 02 | code-review-02-ruff-radon-runners | TBD | code-review-01 |
+| code-review | 03 | code-review-03-type-governance-runners | TBD | code-review-01 |
+| code-review | 04 | code-review-04-contract-test-runners | TBD | code-review-01; code-review-02; code-review-03 |
+| code-review | 05 | code-review-05-semgrep-clean-code-rules | TBD | code-review-01 |
+| code-review | 06 | code-review-06-reward-ledger | TBD | code-review-01 |
+| code-review | 07 | code-review-07-house-rules-skill | TBD | code-review-01; code-review-06; ai-integration-01 (soft) |
+| code-review | 08 | code-review-08-review-run-integration | TBD | code-review-02; code-review-03; code-review-04; code-review-05 |
+| code-review | 09 | code-review-09-f4-automation-upgrade | TBD | code-review-01; code-review-02; code-review-03; code-review-04; code-review-06 |
+
 ---
 
 ## GitHub "Blocked by" relationships
@@ -289,6 +307,15 @@ Set these in GitHub so issue dependencies are explicit. Optional dependencies ar
 | [#254](https://github.com/nold-ai/specfact-cli/issues/254) | integration-01 cross-change contracts | #237, #239, #240, #241, #246 |
 | [#255](https://github.com/nold-ai/specfact-cli/issues/255) | dogfooding-01 full-chain e2e proof | #239, #240, #241, #242, #247 |
 
+| TBD | code-review-02 ruff/radon runners | code-review-01 |
+| TBD | code-review-03 type/governance runners | code-review-01 |
+| TBD | code-review-04 contract/test runners | code-review-01; code-review-02; code-review-03 |
+| TBD | code-review-05 semgrep rules | code-review-01 |
+| TBD | code-review-06 reward ledger | code-review-01 |
+| TBD | code-review-07 house-rules skill | code-review-01; code-review-06 |
+| TBD | code-review-08 review-run integration | code-review-02; code-review-03; code-review-04; code-review-05 |
+| TBD | code-review-09 F-4 automation upgrade | code-review-01; code-review-02; code-review-03; code-review-04; code-review-06 |
+
 **How to set in GitHub**: Open the issue → right sidebar **Relationships** → **Mark as blocked by** → search and select the blocking issue(s).
 
 ---
@@ -307,6 +334,10 @@ The following ownership boundaries are mandatory before implementation for overl
 | Requirements namespace extension on `ProjectBundle` (`src/specfact_cli/models/project.py`) | `requirements-01-data-model` | `requirements-02-module-commands`, `requirements-03-backlog-sync`, `architecture-01-solution-layer` |
 | Backlog requirements extraction/update adapter contract (`modules/backlog/src/adapters/`) | `requirements-02-module-commands` | `requirements-03-backlog-sync` |
 
+| ReviewReport evidence envelope (score, reward_delta, overall_verdict, ci_exit_code) | `code-review-01-module-scaffold` | code-review-02..09; governance-01 (compatible extension, not replacement) |
+| Skill file at `skills/specfact-code-review/SKILL.md` | `code-review-07-house-rules-skill` | ai-integration-01, ai-integration-03 (CLAUDE.md not touched by code-review-07) |
+| `ai_sync.review_runs` and `ai_sync.reward_ledger` Supabase tables | `code-review-06-reward-ledger` | code-review-07, code-review-09 |
+
 Pre-implementation rule:
 - No dependent change may redefine an owned surface. Any required semantic change must be proposed as a delta to the authoritative change first.
 
@@ -411,6 +442,14 @@ Dependencies flow left-to-right; a wave may start once all its hard blockers are
   - integration-01 (#254) (after profile-01 #237 + requirements-02 #239 + architecture-01 #240 + validation-02 #241 + policy-02 #246)
   - dogfooding-01 (#255) (after requirements-02 #239 + architecture-01 #240 + validation-02 #241 + traceability-01 #242 + governance-01 #247)
 
+- **Wave 9 additions — Code review reward/penalize module (reward/penalize plan, 2026-03-10)**:
+  - code-review-01 (no hard blockers — start after governance-01 spec is understood; governance-01-compatible from day 1)
+  - code-review-02, code-review-03, code-review-05, code-review-06 (after code-review-01)
+  - code-review-04 (after code-review-01/02/03 — needs runner orchestrator)
+  - code-review-07 (after code-review-01 + code-review-06; soft dep on ai-integration-01)
+  - code-review-08 (after code-review-02/03/04/05 — wires all runners end-to-end)
+  - code-review-09 (after code-review-01/02/03/04/06 — n8n F-4 upgrade)
+
 ---
 
 ## Mandatory Wave Exit Gates

openspec/changes/archive/2026-03-11-backlog-02-migrate-core-commands/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-03-10