feat: add forcing-question interrogation to plan_review, impl_review, close

plan_review (10 forcing questions):
- Premise Challenge (4Q): right problem, do-nothing test, existing code, non-goals
- Architecture Interrogation (6Q): data flow 4-paths, coupling, scaling,
  rollback, security, task sizing
- Scoring /30: ≥25 SHIP, 18-24 fix then SHIP, <18 MAJOR_RETHINK

impl_review (10 forcing questions):
- Correctness (5Q): spec fidelity per-criterion, error paths, edge cases,
  regression, impact verification
- Quality (5Q): dead code, naming, performance, security, consistency
- Scoring /30: ≥25 SHIP, 18-24 NEEDS_WORK, <18 MAJOR_RETHINK
- Then 3-layer parallel review (Blind/Edge/Acceptance) for external view

close (7 forcing questions):
- Ship-readiness: code quality, security grep, regression, impact,
  non-goals+ADR compliance, documentation, rollback plan
- Scoring /21: ≥18 SHIP, 14-17 fix first, <14 DO NOT SHIP

All phases fully auto-compatible (self-interrogation in zero-interaction mode).
Total: brainstorm 20Q + plan_review 10Q + impl_review 10Q + close 7Q = 47 questions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: z23cc

skills/flow-code-run/SKILL.md

@@ -127,11 +127,35 @@ When auto-skipped: create epic + single task directly, skip to plan phase.
 4. Validate: $FLOWCTL validate --epic $EPIC_ID --json
 
 ### Plan Review (plan_review)
-1. Detect review backend: `$FLOWCTL review-backend` (returns "rp", "codex", "none", or "ASK")
-2. If backend is "none" or "ASK", skip review and advance with `$FLOWCTL phase done`
-3. Otherwise run review via RP context_builder or Codex
-4. Fix issues until SHIP verdict (max 3 iterations)
-5. Verify plan does not propose anything listed in Non-Goals or contradict Architecture Decisions from `.flow/project-context.md`.
+
+**Self-review first** (always runs, even if external review is "none"):
+
+#### Premise Challenge (4 forcing questions)
+1. **Right problem?** — Could a different framing yield a simpler/more impactful solution?
+   - Reject: "The spec says X" (spec might be wrong). Accept: Evidence the problem is correctly framed.
+2. **Do-nothing test** — What SPECIFICALLY breaks in 30 days if we ship nothing?
+   - Reject: "Tech debt grows." Accept: Measurable degradation or blocked feature.
+3. **Existing code** — Does the plan reuse what already exists? Run `flowctl graph map --json` and check.
+   - Reject: "We checked." Accept: Specific files/functions cited as reused or ruled out.
+4. **Non-Goals compliance** — Read `.flow/project-context.md` Non-Goals and ADRs. Does the plan violate any?
+   - If yes: flag and fix before proceeding.
+
+#### Architecture Interrogation (6 forcing questions)
+5. **Data flow completeness** — For every data path: what happens on happy / nil / empty / error?
+   - Reject: Only happy path described. Accept: All 4 paths addressed.
+6. **Coupling analysis** — What components become coupled that weren't before?
+7. **Scaling characteristics** — What breaks first at 10x load?
+8. **Rollback posture** — If this breaks production, how do we undo? (git revert? feature flag? migration rollback?)
+9. **Security surface** — New auth boundaries, API surfaces, data access patterns?
+10. **Task sizing** — Is every task M-sized (3-5 files)? Any L tasks that should be split?
+
+#### Verdict
+Score each question 1-3 (1=concern, 2=acceptable, 3=solid). Total /30.
+- **25-30**: SHIP the plan
+- **18-24**: Fix flagged issues, then SHIP
+- **<18**: MAJOR_RETHINK — plan needs significant revision
+
+Then, if external review backend is configured (rp/codex), also run that. Max 3 iterations total.
 
 ### Work (work)
 1. Find ready tasks: `$FLOWCTL ready $EPIC_ID --json`
@@ -146,36 +170,78 @@ When auto-skipped: create epic + single task directly, skip to plan phase.
 8. Repeat waves until no ready tasks remain
 
 ### Impl Review (impl_review)
-1. Detect review backend: `$FLOWCTL review-backend` (same as plan_review)
-2. If backend is "none" or "ASK", skip review and advance with `$FLOWCTL phase done`
-3. Generate diff: `git diff main...HEAD`
-4. Spawn 3-layer parallel review (see flow-code-code-review skill):
-   - Blind Hunter (diff only, no context)
-   - Edge Case Hunter (diff + project access)
-   - Acceptance Auditor (diff + spec + project-context.md)
-5. Merge findings, apply zero-findings rule
-6. Fix Critical/Important issues until SHIP (max 2 iterations)
-   When a review returns NEEDS_WORK, auto-capture the key findings as memory pitfalls:
-   ```bash
-   $FLOWCTL memory add pitfall "Review finding: <summary of what was wrong and how it was fixed>"
-   ```
+
+**Self-review first** (always runs):
+
+#### Correctness Interrogation (5 forcing questions)
+1. **Spec fidelity** — Re-read every acceptance criterion. For each: is it MET, PARTIAL, or NOT_MET? Evidence?
+   - Reject: "All criteria met." Accept: Each criterion cited with specific file:line proof.
+2. **Error path coverage** — For every new function/endpoint: what happens when input is nil? empty? malformed? unauthorized?
+   - Reject: "Errors are handled." Accept: Specific error type → response code → user message mapped.
+3. **Edge cases** — What are the 3 inputs that would break this code? (empty string, max int, concurrent access, Unicode, null)
+   - Must be specific to THIS diff, not generic.
+4. **Regression risk** — Did any existing test break? Run `$FLOWCTL guard`. Any new code paths without tests?
+5. **Impact verification** — `flowctl graph impact <changed-files>` — are all impacted files still working?
+
+#### Quality Interrogation (5 forcing questions)
+6. **Dead code** — Any commented-out code, unused imports, TODO without ticket?
+7. **Naming & readability** — Would a new developer understand each function name and variable without the PR context?
+8. **Performance** — Any N+1 queries, unbounded loops, missing pagination, large allocations in hot paths?
+9. **Security** — Input validated at boundaries? Secrets not in code? SQL parameterized? Auth checked?
+10. **Consistency** — Does the code follow project-context.md Critical Rules and existing patterns? (`flowctl find "<pattern>" --json`)
+
+#### Verdict
+Score each question 1-3. Total /30.
+- **25-30**: SHIP
+- **18-24**: NEEDS_WORK — fix flagged issues
+- **<18**: MAJOR_RETHINK
+
+Then, spawn 3-layer parallel review (Blind Hunter + Edge Case Hunter + Acceptance Auditor) for external perspective. Apply zero-findings rule. Max 2 iterations.
+
+When NEEDS_WORK, auto-capture pitfalls:
+```bash
+$FLOWCTL memory add --type pitfall --epic $EPIC_ID "Review finding: <what was wrong and how fixed>"
+```
 
 ### Close (close)
-1. Validate: $FLOWCTL validate --epic $EPIC_ID --json
-2. Run final guard: `$FLOWCTL guard` (lint + type + test must pass)
-3. **Run Quick Commands** from epic spec: `$FLOWCTL cat $EPIC_ID | grep -A20 "## Quick commands"` — execute each listed smoke test. If any fails, fix before shipping.
-4. **Verify all task checklists**: For each task in the epic, run `$FLOWCTL checklist verify --task <TASK_ID> --json`. All items must be checked.
-5. **Pre-launch checklist** — verify all six dimensions before shipping:
-   - **Code quality**: guard passes, no Critical/Important review findings open
-   - **Security**: no secrets in code (`grep -rn password\|secret\|api_key`), input validated at boundaries
-   - **Performance**: no N+1 queries, list endpoints paginated, images optimized
-   - **Accessibility**: keyboard navigable, screen reader compatible, contrast ratios met (frontend changes only)
-   - **Infrastructure**: environment variables documented, migrations reversible, feature flags configured
-   - **Documentation**: README/CHANGELOG updated if user-facing, API docs match implementation
-   - **Non-Goals compliance**: verify changes don't introduce anything listed in `.flow/project-context.md` Non-Goals
-   Any failing dimension: fix before proceeding. Skip dimensions not applicable to the change (e.g., skip accessibility for backend-only epics).
-6. Mark complete: $FLOWCTL epic completion $EPIC_ID ship --json
-7. Push branch and create draft PR (unless --no-pr)
+
+1. Validate: `$FLOWCTL validate --epic $EPIC_ID --json`
+2. Run final guard: `$FLOWCTL guard`
+3. Run Quick Commands from epic spec: `$FLOWCTL cat $EPIC_ID | grep -A20 "## Quick commands"`
+4. Verify all task checklists: `$FLOWCTL checklist verify --task <TASK_ID> --json` for each task.
+
+#### Ship-Readiness Interrogation (7 forcing questions)
+
+5. **Code quality** — Does `$FLOWCTL guard` pass? Any Critical/Important review findings still open?
+   - Reject: "Guard passed" without running it. Accept: Guard output showing pass/skip/0 fail.
+
+6. **Security** — `grep -rn 'password\|secret\|api_key\|token' <changed-files>` — any secrets in code?
+   - Reject: "No secrets." Accept: Grep output confirming clean, or justified exceptions documented.
+
+7. **Regression** — Did the FULL test suite pass? Any existing tests modified or deleted?
+   - Reject: "Tests pass." Accept: Specific test count and any modifications explained.
+
+8. **Impact verification** — `flowctl graph impact <changed-files> --json` — are all dependent files still functional?
+   - If impact list is non-empty: verify each affected module still works.
+
+9. **Non-Goals compliance** — Read `.flow/project-context.md` Non-Goals. Does the diff introduce anything explicitly excluded?
+   - Check ADRs: `ls docs/decisions/ADR-*.md` — does the change violate any accepted ADR?
+
+10. **Documentation** — If user-facing changes: README/CHANGELOG/API docs updated?
+    - If no user-facing changes: confirm and skip.
+
+11. **Rollback plan** — If this breaks production, how do we undo?
+    - Accept: "git revert" / "feature flag" / "migration has down step"
+    - Reject: "We'll fix forward" without a concrete plan.
+
+#### Verdict
+Score each question 1-3. Total /21.
+- **18-21**: SHIP — proceed to push + PR
+- **14-17**: Fix flagged items first
+- **<14**: Do NOT ship. Fix critical issues.
+
+12. Mark complete: `$FLOWCTL epic completion $EPIC_ID ship --json`
+13. Push branch and create draft PR (unless --no-pr)
 
 ## Recovery