feat(gcp-to-aws): AI-only flow asks compliance + Activate credits

[herosjourney]

Summary

The standalone AI-only clarify flow (clarify-ai-only.md, Q1–Q10) asked no compliance question and no Activate credits question. Compliance gates Bedrock regions, models, and logging even when infrastructure stays on GCP — customer prompts and completions flow to AWS the moment model calls do, so skipping it is a correctness gap (a GDPR or HIPAA customer could get a design that can't be deployed). And skipping the credits question means AI-only customers — the leads Activate credits most directly help, since Bedrock usage is credit-eligible — never hear about $5K–$200K. This PR adds both questions using the house suffix/append numbering convention (like Q3.5/Q11b in the full flow) so no existing question renumbers.

Changes

clarify-ai-only.md:

• Q1.5 — Compliance (new, Batch 1): same options and decision logic as clarify-global.md Q2, with a Bedrock-specific impact table for this path: BAA-eligible models + the Guardrails-doesn't-mask-CloudWatch-logs warning for HIPAA, GovCloud-only catalog for FedRAMP, eu. geographic inference profiles (not global.) for GDPR, retention/deletion workflow for CCPA. Interprets to design_constraints.compliance (same field as full flow). Default "none" + report caveat, matching the full-flow default rule.
• Q11 — Activate credits (new, Batch 2 end): mirrors full-flow Q27 exactly — same options, same startup_constraints.startup_program_status field and enum, never inferred from spend, neutral copy on default. Escalations adapted to AI-only signals: Credits for AI Startups at >$10K spend; GenAI Accelerator at ≥$2K spend + agentic (Q1 includes D/E/F or Q10 = F).
• Fast path grows from 3 to 5 questions (Q1.5, Q2, Q3, Q4, Q11) with an explicit rule that compliance and Activate are never dropped from the fast path. Deliberate trade: two extra questions on the speed path, but one gates deployability and the other is the 30-second credits unlock.
• Wiring: header scope line, Step 2 heading, batch headings and counts, Step 3 schema table (+2 rows), batch-2 intro copy.

clarify.md: routing table row updated (Q1–Q10 → Q1–Q11 + Q1.5).

Relationship to other PRs

Independent — based on current main (post-#162). Touches clarify-ai-only.md (no open PR touches it) and one routing-table line of clarify.md (no conflict with #161's clarify.md trigger-table lines, different rows).

Test plan

• Full mise run build green (160/160 checks)
• Field names verified against full-flow schema (design_constraints.compliance, startup_constraints.startup_program_status per clarify.md §schema)
• Q27 parity check: options, enum values, escalation programs and thresholds match clarify-ai.md Q27
• Fresh-agent AI-only replays: fast path (5 questions, HIPAA + Founders land with user provenance) and full path ("use defaults for the rest" → none+caveat / unknown+neutral, disjoint lists) — both REPLAY_OK, artifacts verified on disk

[herosjourney]

Applied the Cursor review (commit 5fa7711) — all five points. Note on provenance: when I opened the worktree, uncommitted drafts for points 1–4 were already present (Cursor working in the same tree). I reviewed them line-by-line, verified their two nontrivial contract claims against the specs before adopting (the ≥0.8 extraction threshold is real — clarify.md L201; the disjoint question-lists rule is real — clarify.md L829 gate check), and folded them in with one refinement.

1. Clarify → Design wiring — closed in this PR. New design-ai.md Step 0.7 "Apply Compliance Constraints": reads design_constraints.compliance, applies hard filters before Part 1 model selection (BAA-eligible-only + the CloudWatch-logs-keep-original-content KMS/IAM requirement for hipaa; GovCloud region + re-run of Step 0.5 regional validation for fedramp; EU regions + eu.-profile-only/global.-forbidden for gdpr; Part 5 plan lines for pci/soc2/ccpa), and requires the Present Summary to name the regime(s). Validation Checklist gains a compliance-reflected item, so ignoring a declared regime is a checklist failure. generate-artifacts-ai.md setup script carries the constraints through (region env var, eu. model IDs, hipaa log warning).

2. "Never drop" vs "use defaults" — disambiguated. The fast-path rule now states: "never dropped" means always presented; an explicit "use defaults for the rest" is the sanctioned default path (compliance → none + report caveat, Activate → unknown + neutral copy), same as full-flow Q27. Also specified: that path skips the Batch 1 draft save (assembly happens same-turn), and presented-but-defaulted questions go in questions_defaulted only, keeping the three metadata lists disjoint per clarify.md's gate check.

3. Q11 disambiguation — added ("AI-only Q11 ≡ full-flow Q27; unrelated to full-flow Q11/Q11b — the flows number independently").

4. schema-preferences.md — synced (compliance: "Q2 (AI-only: Q1.5)" + Step 0.7 pointer; startup_program_status: "Q27 (AI-only: Q11)").

5. Fresh-agent replays — run, both REPLAY_OK.

• Fast path (seeded profile: gpt-4o @0.92 confidence, direct_api, text-only; likely_simple preview): presented exactly Q1.5/Q2/Q3/Q4/Q11; HIPAA → ["hipaa"]/chosen_by: user and derived us-east-1 via the compliance precedence; Activate B → eligible_founders; lists disjoint; no draft file. All 5 assertions PASS (verified the artifacts on disk myself, not just the agent's report).
• Full path, "use defaults for the rest" at Batch 1: fast path correctly didn't trigger; Q1/Q5/Q6 extracted; compliance → ["none"]/default with caveat; Activate → unknown/default + neutral copy; Q1.5/Q11 in questions_defaulted only; draft save skipped. All 6 assertions PASS.
• One fold-back from the replays: the spec now pins the compliance default to array form (["none"]) and names where the caveat lives (metadata.report_caveats[]) — the full-path agent had to resolve both by judgment.

Full mise run build green (160/160). Test-plan replay boxes now checkable; ready to undraft from my side.

[herosjourney]

Rebased onto main (4725d85) and resolved conflicts — branch is MERGEABLE again. One heads-up for reviewers: the rebase included a semantic alignment, not just conflict resolution.

Conflict resolution (mechanical): both sides had rewritten the schema-preferences.md constraint catalog table; a row-by-row diff showed only two rows actually differed. Resolution = main's table (which carries #171's newer ["unknown"] compliance semantics) + this PR's two AI-only annotations grafted on: Q2 (AI-only: Q1.5) with the Bedrock-gating consequence, and Q27 (AI-only: Q11).

Semantic alignment (new in 7188de8): this branch forked before #171 changed the compliance skip-default from silent ["none"] to ["unknown"] ("never record silent no-requirements"). The new AI-only Q1.5 still carried the pre-#171 behavior. Aligned to full-flow Q2 semantics:

• Q1.5 skip/default now records ["unknown"] with chosen_by: "default", source: "default:Q1.5" — an explicit answer A records ["none"] with chosen_by: "user"; the fast-path "use defaults for the rest" wording updated to match.
• design-ai.md Step 0.7 and its validation checklist treat unknown like none for model/region selection but REQUIRE the compliance-not-confirmed caveat in the summary.

Verified post-rebase: full mise run build exit 0, markdownlint 0 errors, dprint clean.

[leon1418]

[🤖 AI review 🤖]

Scope reviewed: All 5 changed files end-to-end (clarify-ai-only.md, clarify.md, design-ai.md, generate-artifacts-ai.md, schema-preferences.md). Cross-referenced against full-flow Q2 (clarify-global.md), Q14 (clarify-ai.md), Q19 (clarify-ai.md), Q27 (clarify-ai.md), and the main clarify.md gate check. Verified rebase alignment with #171's ["unknown"] semantics and confirmed no supersedure from the 5 commits merged to main since this PR's rebase point.

Summary: This PR closes two correctness gaps in the AI-only clarify flow — missing compliance gating (Q1.5) and missing Activate credits question (Q11). The additions are well-wired: Q1.5 feeds into a new design-ai Step 0.7 with a validation checklist item, the generate script carries compliance through, and schema-preferences.md annotations match. The ["unknown"] vs ["none"] semantics are correctly aligned with post-#171 main. Q11 is faithful to Q27's options, enum, and never-infer-from-spend rule, with the agentic escalation condition correctly adapted from agentic_profile.is_agentic to the AI-only signal proxies (Q1 D/E/F or Q10 = F).

One finding (non-blocking but worth addressing):

1. generate-artifacts-ai.md compliance carry-through condition says not "none" but does not exclude "unknown". design-ai.md Step 0.7 correctly skips for none, unknown, or absent — the generate script should match.

Otherwise: fast-path grows from 3→5 correctly, disjoint-list rule and draft-save-skip are specified, Q1 skip condition is more rigorous than before, Q5 confidence threshold aligns with Q19 (0.8). The PR is not stale — main's 5 newer commits touch only unrelated files (.github template, advisor setup, migrate README). Merge state is BEHIND (trivial rebase, no conflict).

Recommendation: Merge-ready after the generate-artifacts-ai.md unknown exclusion is addressed (a one-word fix).

[leon1418]

[🤖 AI review 🤖]

Nit: The condition here says not "none" but design-ai.md Step 0.7 correctly skips when the value is none, unknown, or absent. Since unknown means "not user-confirmed" and behaves like none for service selection (per both the full-flow Q2 semantics and the new Q1.5 spec), this script should also exclude unknown — otherwise an agent that defaulted compliance would still try to apply GovCloud/EU region constraints.

Suggested: …is set and not "none" or "unknown"…

[herosjourney]

Addressed the review nit on generate-artifacts-ai.md: compliance carry-through now matches design-ai Step 0.7 and skips when the value is none/unknown (same wording as the design validation checklist), so a defaulted compliance answer cannot force GovCloud/EU/HIPAA setup constraints.