santidev21 · santidev21 · Sep 30, 2026 · Sep 30, 2026
diff --git a/.opencode/agent/repo-auditor.md b/.opencode/agent/repo-auditor.md
@@ -22,7 +22,7 @@ You audit the **entire SplitIt repository** and report on code quality, architec
 
 ## Method
 
-1. **Map the repo.** Read `AGENTS.md` and `docs/specs/` first — they are the source of truth. Then read the prior reports (`docs/PRODUCTION_AUDIT.md`, `docs/SECURITY.md`, `docs/REMEDIATION_REPORT_PHASE_0.5.md`) so you don't re-report already-remediated findings — verify them instead. Inventory `SplitIt.API/` (API, Application, Domain, Infrastructure, Shared) and `split-it-ui/src/app`.
+1. **Map the repo.** Read `AGENTS.md` and `docs/specs/` first — they are the source of truth. Then read the prior reports (`docs/PRODUCTION_AUDIT.md`, `docs/SECURITY.md`) so you don't re-report already-remediated findings — verify them instead. Inventory `SplitIt.API/` (API, Application, Domain, Infrastructure, Shared) and `split-it-ui/src/app`.
 2. **Load the relevant skills** before judging an area: `dotnet-best-practices`, `aspnet-core`, `csharp-async`, `dotnet-design-pattern-review`, `api-contract`, `angular-best-practices`, `security-review`, `data-integrity-audit`, `i18n`, `accessibility`, `db-migrations`.
 3. **Read the real code** — controllers, services, entities, `AppDbContext`, migrations, Angular components/services/guards/interceptors, specs, configs, Dockerfiles and CI. Don't judge from file names or from the docs alone.
 4. **Verify, don't guess.** Run `npm run build`, `npm run test` (or per side) when useful, and report the actual result. If you can't run something, say so.

diff --git a/.opencode/skills/containerize-aspnetcore/SKILL.md b/.opencode/skills/containerize-aspnetcore/SKILL.md
@@ -110,8 +110,7 @@ Any settings that are not specified will be set to default values. The default v
 ## Execution Process
 
 1. Review the containerization settings above to understand the containerization requirements
-2. Create a `progress.md` file to track changes with check marks
-3. Determine the .NET version from the project's .csproj file by checking the `TargetFramework` element
+2. Determine the .NET version from the project's .csproj file by checking the `TargetFramework` element
 4. Select the appropriate Linux container image based on:
    - The .NET version detected from the project
    - The Linux distribution specified in containerization settings (Alpine, Ubuntu, Chiseled, or Azure Linux (Mariner))
@@ -175,36 +174,11 @@ docker build -t aspnetcore-app:latest .
 
 If the build fails, review the error messages and make necessary adjustments to the Dockerfile or project configuration. Report success/failure.
 
-## Progress Tracking
-
-Maintain a `progress.md` file with the following structure:
-```markdown
-# Containerization Progress
-
-## Environment Detection
-- [ ] .NET version detection (version: ___)
-- [ ] Linux distribution selection (distribution: ___)
-
-## Configuration Changes
-- [ ] Application configuration verification for environment variable support
-- [ ] NuGet package source configuration (if applicable)
-
-## Containerization
-- [ ] Dockerfile creation
-- [ ] .dockerignore file creation
-- [ ] Build stage created with SDK image
-- [ ] csproj file(s) copied for package restore
-- [ ] NuGet.config copied if applicable
-- [ ] Runtime stage created with runtime image
-- [ ] Non-root user configuration
-- [ ] Dependency handling (system packages, native libraries, tools, etc.)
-- [ ] Health check configuration (if applicable)
-- [ ] Special requirements implementation
-
-## Verification
-- [ ] Review containerization settings and make sure that all requirements are met
-- [ ] Docker build success
-```
+## Reporting
+
+Do not create progress or report files. When the work is done, reply with a short summary:
+environment detected, files created, and the actual `docker build` result. Durable decisions belong
+in the project's docs (`AGENTS.md`, `docs/specs/`, ADRs) — never in a per-task `progress.md`.
 
 Do not pause for confirmation between steps. Continue methodically until the application has been containerized and Docker build succeeds.
 

diff --git a/AGENTS.md b/AGENTS.md
@@ -20,7 +20,7 @@ SplitIt/
 ├─ SplitIt.Tests/   # Backend tests (referenced from SplitIt.API/SplitIt.Back.sln)
 ├─ split-it-ui/     # Angular application (src/app, e2e)
 ├─ docker/          # Docker configs (backend, frontend, proxy, sqlserver)
-├─ docs/            # Guides, reports, screenshots, specs (docs/specs/)
+├─ docs/            # Guides, runbooks, specs, ADRs (docs/specs/, docs/adr/)
 ├─ scripts/         # Deploy, helper and local-dev orchestration scripts (run-splitit.mjs)
 ├─ package.json     # Root orchestration scripts (dev, db:*, docker:dev, build, test)
 ├─ .opencode/       # AI home: agent/, command/, skills/ (tracked; local plugin scaffold ignored)
@@ -59,7 +59,19 @@ Angular 21 app in `split-it-ui/src/app`. Protected routes via JWT, admin panel b
 - Skills: `api-contract`, `i18n`, `db-migrations`, `backend-test`, `frontend-test`, `run-e2e`, `docker-dev`, `security-review`, `angular-best-practices`, `dotnet-best-practices`, `data-integrity-audit`, plus imported generic ones.
 - Two review modes: `/review <diff>` → **reviewer** agent (per-change); `/review repo` → **repo-auditor** agent (whole-repo graded report, read-only).
 - `opencode.json` holds instructions, MCP servers and permissions. Skills, agents and commands need no config — opencode auto-discovers `.opencode/`.
-- `AGENTS.md` is the single source of truth; `docs/specs/` holds details and `docs/AUDIT_*.md` holds audit reports.
+- `AGENTS.md` is the single source of truth; `docs/specs/` holds details, `docs/adr/` holds decisions and `docs/AUDIT_*.md` holds the current audit.
+
+## Documentation Policy
+
+Docs capture decisions and current state, never session narration.
+
+- **Allowed:** `README` (how to run), `docs/adr/NNN-*.md` (one decision: context, options, decision,
+  consequences), `docs/specs/*.md` (current design and business rules), runbooks
+  (`DEPLOYMENT`, `BACKUPS`, `CICD`, `DOCKER`, `HTTPS`, `NGINX`, `TESTING`), and the current
+  `docs/AUDIT_*.md` / `docs/PRODUCTION_AUDIT.md` / `docs/SECURITY.md`.
+- **Forbidden:** phase reports, progress logs, "what I did" narration and per-session summaries.
+  When a change needs a durable record, update the relevant spec or add an ADR — do not create a
+  report file. This applies to AI output too.
 
 ## Working Rules For This Repo
 - Language: all code, comments, XML docs, tests, commit messages, PR titles/descriptions, docs (`README`, `docs/`, `AGENTS.md`), and AI output must be in English. Only user-facing UI strings may be in Spanish (via i18n files), never hardcoded Spanish in code/comments.

diff --git a/docs/AUDIT_2026-09.md b/docs/AUDIT_2026-09.md
@@ -4,7 +4,7 @@
 > **Alcance:** repo completo en `main` @ `d5c4939`, read-only
 > **Método:** `repo-auditor` + skills `security-review`, `data-integrity-audit`, `dotnet-best-practices`, `angular-best-practices`
 > **Contexto:** app a punto de usarse por usuarios reales (amigos). Foco: no perder/corromper data y cumplimiento Ley 1581.
-> **Reportes previos verificados:** `docs/PRODUCTION_AUDIT.md`, `docs/SECURITY.md`, `docs/REMEDIATION_REPORT_PHASE_0.5.md` (los hallazgos ya remediados NO se re-reportan; este documento se enfoca en lo abierto).
+> **Reportes previos verificados:** `docs/PRODUCTION_AUDIT.md`, `docs/SECURITY.md` (los hallazgos ya remediados NO se re-reportan; este documento se enfoca en lo abierto).
 
 ---
 

diff --git a/docs/CICD.md b/docs/CICD.md
@@ -293,6 +293,5 @@ CI/CD does not include monitoring. Future phases may add:
 scripts/
 └── deploy.sh                 # VPS deployment script
 docs/
-├── CICD.md                   # This file
-└── PHASE_13_REPORT.md        # Phase report
+└── CICD.md                   # This file
 ```
diff --git a/docs/PHASE_11_REPORT.md b/docs/PHASE_11_REPORT.md