feat(gcp-to-aws): post-Estimate Decision gate — Generate becomes opt-in

[herosjourney]

Summary

The problem, in plain English: Most startups come to this plugin with one question — "should we migrate, and roughly what would it cost?" — but the pipeline treats that as a waypoint on the road to Terraform. The verdict already exists at the end of Estimate (recommendation.outcome, since #173), yet the flow's default motion is onward: workshop offer, feedback prompt, then Generate writes 20 Terraform files and a fill-in TODO list for a user who never said yes to executing. The decision is the product for the startup ICP; execution artifacts are a second product that today isn't opt-in.

What this PR does: makes the post-Estimate fork the product. One pipeline, two exit ramps — no mode picker at the door, no new phase status, no second report engine.

Changes:

• Decision gate (estimate.md): the workshop offer becomes a three-option gate presented after outer-Estimate HANDOFF_OK: [A] Done for now (decision-complete), [B] Explore what-ifs (existing workshop, benefit-first wording and the data-justified scenario hint preserved), [C] Generate Terraform and migration scripts. The gate leads with the decision pack — verdict (outcome_label), Balanced-tier AWS estimate beside the GCP baseline with its baseline-quality label and the feat(gcp-to-aws): Design summary card + cost baseline-quality labels #175 not-comparable rule, a timeline band from migration-complexity.md, and deferred-specialist items. A/B/C never auto-resolves.
• Generate is opt-in (SKILL.md hard rule + state machine): generate.md loads only on gate choice C, an accepted resume offer, or an explicit ask for Terraform/scripts. The generate state-machine row now requires that consent; a new decide-complete row (current_phase: "complete" + run_mode: "decide" + generate: "pending") defines resume behavior — offer Execute, never re-run Estimate, never auto-run Generate. Ordered (no-current_phase) evaluation respects the same consent.
• Workshop returns to the gate (workshop-assemble.md, workshop.md, workshop-sheet.md): exiting the workshop re-presents the gate (A/C, verdict lines refreshed from the active scenario) instead of advancing to Generate. The canonical workshop-invariants.md exit rule is generalized — "advances per the skill's post-Estimate flow; generate by default, or the skill's decision gate when one is defined" — so heroku/vercel behavior is unchanged; vendored trees resynced via shared:sync.
• Feedback re-anchored (SKILL.md step 8): the post-Estimate feedback checkpoint now fires after the gate resolves, and the gate owns the post-Estimate sequence (no prompt stacking). Side benefit: feat(gcp-to-aws): benefit-first workshop offer, outcome flips in compare, feedback decision check #176's "could you make your migrate/stay decision?" questions now land immediately after the user actually made one.
• run_mode (schema-phase-status.md): optional field, "decide" | "decide_and_execute", set only by the gate (or resume acceptance) — durable cross-session evidence of Generate consent. Deliberately no "skipped" status: generate stays "pending", and decide-complete is documented as terminal-unless-asked, not failure. Flow state, not a design constraint — never written to preferences.json.

What this deliberately does NOT do (v1 scope, agreed in design review)

• No mode question at the door — asking Decide-vs-Execute before the user has seen any value is the anti-pattern feat(gcp-to-aws): journey orientation at start + answer recap before design #183's orientation removes; the gate captures intent at the moment it's real. One orientation line lands with feat(gcp-to-aws): journey orientation at start + answer recap before design #183 instead ("at the end you choose whether to also generate Terraform").
• No generate: "skipped" enum — a new status touches never-goes-backward, resume, gates, and heroku parity mid-feat(heroku-to-aws): clarify extraction + assumption sheet, decision outcomes, breadcrumbs (gcp parity) #180. pending + run_mode carries the meaning; revisit only if the ambiguity bites.
• No durable decision artifact yet — that's PR 2 (extract report Sections 0–8 into a shared decision core rendered by both the Decide path and Generate's full report; --mode decision validator subset; replace-never-patch on upgrade). Until then, option A's decision pack lives in chat plus the existing estimate/design JSON.
• Clarify, Design, Estimate untouched — an honest verdict needs all three; the waste was never Design, it was Terraform-before-yes.

Test plan

• dprint check — clean
• mise run lint:md — 0 errors
• mise run lint:frontmatter — OK (both skills)
• shared:sync + vendored check — OK (3 vendored trees; canonical edit synced, no hand-edited vendored files)
• fixtures:assert — PASS (6 asserters incl. both workshop goldens)
• Inner workshop reprice path untouched (no HANDOFF_OK, no status writes — diff-verified)
• AI-only / billing-only routes get the gate without option B
• Manual: full run to Estimate → gate appears with verdict/cost/timeline lines → A ends with decide-complete state and resume offers Execute without re-running Estimate
• Manual: workshop entry → exit → gate re-presents with active-scenario numbers → C proceeds to Generate with run_mode: decide_and_execute

Follow-ups (tracked)

• PR 2 — decision core: shared report-decision-core.md (Sections 0–8) loaded by Estimate's Decide path and Generate's report; decision-report.html + DECISION.md; validator --mode decision. Extraction keeps one source of truth for feat(gcp-to-aws): Design summary card + cost baseline-quality labels #175 rules/verdict typography (the vendored-drift lesson).
• feat(heroku-to-aws): clarify extraction + assumption sheet, decision outcomes, breadcrumbs (gcp parity) #180 coordination: heroku parity should adopt run_mode + gate semantics rather than a status enum — flagged so the enums don't fork.
• feat(gcp-to-aws): journey orientation at start + answer recap before design #183 coordination: add the one orientation line when it lands.
• Success metric to watch via feedback traces: % of runs that resolve at gate A without ever loading Generate (target: majority of startup ICP runs).

Type of Change

• Enhancement to existing content

Team Folder

• migrate/

[herosjourney]

Review fixes landed in 28f46ef — all six improvements plus the soft suggestion:

1. State-machine workshop row now says "present the Decision gate from estimate.md" — agreed this was the most regression-prone leftover; good catch.
2. Estimate scope boundary carves out the gate's one-line timeline band explicitly; full schedules/runbooks remain Generate-only.
3. All Execute paths set run_mode: "decide_and_execute" before loading generate.md — including the explicit-ask path, so a session dying mid-Generate resumes as an Execute run.
4. Consent guard at the top of generate.md: loaded cold without consent → refuse, re-present the gate; loaded on an explicit ask → set run_mode, proceed.
5. Canonical invariants tightened to "skills that DEFINE a decision gate re-present that gate — never auto-advance to Generate"; vendored trees resynced (shared:check green, 3 trees).
6. handoff-gates.md documents decide-complete as a valid terminal state — "not an incomplete run to repair; do not 'fix' it by advancing to Generate."
7. Feedback after gate A folds into the closing line as a one-line "Quick feedback before you go? [Yes] [No]" — separate prompt kept only for the C path where the user is continuing anyway.

Re-verified after the changes: dprint, markdownlint (0 errors), frontmatter validator, vendored-shared check, and fixtures:assert (6 asserters incl. both workshop goldens) all pass.

On the chat-only decision pack UX hole: agreed and holding the line — PR 2 (shared decision core + durable decision-report.html) is queued, nothing report-shaped added here.

[leon1418]

[🤖 AI review 🤖]

Reviewed all 11 changed files end-to-end against mainline and sibling PRs #180–#186.

Design: Sound — the core insight ("the decision is the product; Terraform is a second product") is well-executed as a single-pipeline two-exit-ramp model. run_mode as durable cross-session consent, decide-complete as a terminal-unless-asked state, and the consent guard at the top of generate.md form a defence-in-depth against auto-chaining. State machine, schema, invariants, and handoff-gates all mutually consistent.

Functionality: Workshop → gate return, gate choice handling, resume offers, feedback re-anchoring, and ordered evaluation logic all trace correctly. Vendored trees are byte-identical (verified). The AI-only/billing-only path correctly omits option B.

No blocking findings. Two nits below — both are about documentation clarity rather than correctness. The existing mickylindsay comment (line 141, heading parenthetical noise) is a fair point worth addressing but is not a code-health regression.

Recommend merge once the open reviewer thread is resolved.

[herosjourney]

Validity check + fixes

Assessed each open thread before changing code:

Thread	Valid?	Action
mickylindsay / leon1418 — heading “(replaces auto-advance…)”	Yes — changelog noise in a live agent-facing heading	Removed; heading is now ### Outer Estimate — Decision gate
leon1418 — looseness of “explicitly asked for Terraform/scripts”	Yes — table was weaker than the HARD RULE and could match mere mentions	Table + HARD RULE now require a current-turn explicit request to produce Terraform/migration scripts
az-zhu — current_phase: generate + absent run_mode hangs	Yes — real gap for in-flight/old auto-advance runs; no row matched	Added legacy-generate state-machine row + mandatory resume step: present the decide-complete resume offer (Yes → set run_mode: decide_and_execute and continue; No → decide-complete). Chose re-confirm over silent grandfathering so opt-in semantics stay intact
az-zhu — Update Protocol “complete after generate” only	Yes — contradicts gate A setting complete after Estimate	Protocol step 4 now documents gate-A complete + run_mode: decide

No disagreements — all four were correctness/clarity issues worth landing before merge.

[leon1418]

Merge-readiness check

Verified bc46ccd against all five open review threads:

• Heading changelog parenthetical (mickylindsay + AI nit) — dropped
• Generate-row natural-language consent clause (AI nit) — tightened to "current-turn message is an explicit request to produce Terraform/migration scripts", HARD RULE aligned ("not merely mentioning Terraform")
• In-flight run at current_phase: generate with no run_mode matching no row (az-zhu) — new legacy-generate back-compat row + mandatory step 3 in the resume protocol
• Update-protocol contradiction with the new terminal state (az-zhu) — step 4 now covers "complete after Estimate when gate A sets run_mode: decide"

All five threads look resolvable as-is.

One remaining blocker — the failing build check is drift:check (job): #206 landed after this branch's last review and the advisor plugin now vendors twins of every file this PR touches. All 11 are flagged (e.g. advisor SKILL.md still has auto-advance, zero run_mode/Decision-gate content). Per the tool's own message: re-copy + re-apply prefix rewrites. One mechanical sync commit unblocks this.

#186 contains these commits and inherits the same sync requirement — this PR should land first.

[leon1418]

Pushed a307579 to unblock drift:check — a mechanical sync of this branch's 11 changed files into their advisor twins (re-copy + the prefix/path/$id rewrites the tool normalizes). No changes to your content; verified locally that cross-plugin-drift and both plugins' vendored-shared checks pass. @herosjourney shout if you'd rather do this differently.