Capablio agent instructions

Mission

Upgrade and maintain Capablio as an enterprise-grade adaptive feedback and development platform. Preserve development, privacy, tenant isolation, source lineage, and role-appropriate visibility.

Repository commands

cd workbench/feedback-360
python3 -m venv .venv && .venv/bin/pip install -r requirements.txt
git submodule update --init --recursive
./scripts/start-mock-lab.sh                    # Mock Lab :8920
./scripts/run-mock-lab-acceptance.sh           # pre-production gate
./scripts/capablio-uplift/pdca-run-phase.sh 00 plan   # uplift PDCA

Uplift prompts: docs/prompts/capablio-enterprise-uplift/. PDCA runs: scripts/capablio-uplift/runs/.

Mandatory context

Before changing a material feature, read:

• wiki/shared/feature-index.md
• wiki/shared/traceability-matrix.md
• wiki/shared/glossary.md
• wiki/shared/role-permission-matrix.md
• The linked page in wiki/external/
• The linked specification in wiki/internal/
• Existing handbook sources under docs/ (synced to capablio-website handbook)

Dual-wiki rule

Every user-visible or operational change must update both representations when applicable:

• External Experience Wiki (wiki/external/): what users can do, see, buy, and learn.
• Internal System Wiki (wiki/internal/): behavior, permissions, data, APIs, failures, tests, operations.
• Handbook (docs/): published via capablio-website; map feature IDs in wiki/shared/.

Update the shared feature index and traceability matrix before declaring work complete.

Non-negotiable product rules

• Treat feedback as development by default, not automated performance judgment.
• Never fabricate marketing proof, customers, metrics, certifications, or benchmarks.
• Imported assessment data retains source and instrument lineage.
• Never blend incomparable instruments into one trend without an approved bridge.
• Enforce tenant, scope, resource, action, and data-class authorization server-side.
• Global operators do not receive plaintext tenant feedback through ordinary administration.
• Never expose raw JSON, internal IDs, bearer tokens, secrets, or encryption-envelope jargon in normal UI.
• All screens require loading, empty, filtered-empty, error, partial, and permission states.
• Meet WCAG 2.2 AA and provide accessible alternatives for charts.
• Use shared KS tokens and components; do not create page-specific visual systems.
• No zero-knowledge or "server cannot read answers" claims until Prompt 02A exit gate is green.

Work protocol

Before editing, report relevant feature IDs, wiki pages, assumptions, expected files, authorization impact, ADR need, and tests. After editing, report code, tests, accessibility, privacy/security, both wiki updates, traceability, and remaining risks.

See docs/prompts/capablio-enterprise-uplift/prompts/MASTER-ORCHESTRATOR.md for phase conductor rules.