definition-of-done

# Definition of Done ## Doctrine The order is load-bearing. The integrity manifest must hash the settled tree, so `asset-integrity:write` always runs last, on its own, from the repo root — never folded into a parallel generator batch, never run from a subdirectory. ## Trigger - Before declaring any change in this repo finished. - Whenever the stop hook reports uncommitted or untracked changes. ## Input The list of paths you touched in this change. ## Decision matrix Pick the steps that apply based on what changed — most changes trigger more than one row. - **catalog / agents / skills / roles / providers changed** → `npm run manifest:write:all`, then re-run asset-integrity LAST on its own (the parallel-generator ordering caveat in `CLAUDE.md`). - **`skills/**` changed** → `npm run manifest:write`. - **`catalog/model-policy.json` or `model-registry.json` changed** → `npm run model-policy:check` (and `model-policy:apply` if the projection changed). - **`tools/vfa-tui/**` changed** → `cd tools/vfa-tui && cargo fmt --check && cargo clippy --all-targets -- -D warnings && cargo test`. Return to the repo root afterwards — a persisted `cd` has broken integrity runs before. - **any root file / `agents/` / `plugins/` / `package.json` changed** → asset-integrity refresh required. ## The invariant sequence Always, in this order: 1. Applicable generators from the decision matrix above. 2. `python3 tests/validate-asset-integrity.py --write` from the REPO ROOT, last, ...