@antoneeo/mkt-agentic-sdlc-skill 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## [0.11.0] - 2026-09-12
+
+### Added
+- **F-052: the Hybrid seam leaves the mandatory read.** The devPNT ownership
+  matrix and its neighbours move to a triggered `hybrid.md`; `SKILL.md` keeps a
+  pointer carrying the trigger and what is lost by skipping it. Conservation is
+  guarded by a `moved-block-sha256` digest computed from the PRE-MOVE source —
+  never from the artifact under test, after a first attempt recorded the digest
+  of a mojibake-corrupted file and would have frozen the corruption permanently.
+- **The shared spine gains the capability floor, the delegation boundary and
+  `benefit`** (F-048, F-049, F-050 — see the code lens's changelog; the files
+  are byte-identical across the three packages).
+- **F-053: the authoring-floor pointer**, before this lens's instruction to
+  draft the MKT-VISION.
+
+### Fixed
+- **F-053: a probe in this lens's own harness could not fail.** Its conservation
+  check accepted the word `ownership` after the filename, and the pointer's own
+  content inventory contains it — so deleting the entire consequence paragraph
+  left the harness green. That is the defect the previous unit's review had
+  already blocked once, re-introduced in the next unit's probe with a comment
+  claiming the opposite. Anchored on the consequence alone, and
+  mutation-verified red.
+- **F-053: figures that reproduced under no ruler.** This lens's read-diet
+  numbers omitted the 94-byte stamp line that its own review-driven correction
+  had added, so the corrected figure was invalidated by the correction beside
+  it. Re-measured on one declared ruler: Standalone 22,880 -> 20,995 B
+  (**-8.2%**), Hybrid 24,527 B (**+7.2%**).
+
+### Read cost
+- `SKILL.md` **-4.9%** (22,648 -> 21,541 B) Standalone. A Hybrid session reads
+  **+10.7%**, proportionally the largest surcharge of the three lenses, because
+  a pointer costs about the same in a contract half the size.
+
+## [0.10.1] - 2026-09-06
+
+### Fixed
+- **F-046 shipped a hook that wired nowhere.** `wireRemindHookInto` used the
+  ORIENT hook's opt-out marker (`orient-hook-wired`) as its own. That file is
+  present on every machine that ever installed the skill, so the installer read
+  it as "the user opted out of the per-turn reminder" and never wrote the hook —
+  for everyone. Two smaller faults in the same function: the marker was checked
+  BEFORE testing whether the hook was already present, and no marker was ever
+  written after a successful wire, so the real opt-out could never arm. The hook
+  now has its own `remind-hook-wired` marker, checked after the presence test and
+  written only on success. Regression pinned in `scripts/test_clients.js` (red
+  against 1.32.0: an orient-marked machine got no hook).
+
+## [0.10.0] - 2026-09-06
+
+### Added
+- **F-046: the protocol reaches every turn (`remind`, UserPromptSubmit, wired by
+  default).** `orient` fires once at session start and decays; a session that
+  never loads the skill never had the protocol at all. Measured 2026-09-06: a
+  release ran against a `GUIDE_release.md` the session never consulted, because
+  `SKILL.md` -- where the duty is written -- had not been read. `remind` prints
+  ONE constant line at every prompt, and its first duty is that one: decide
+  whether the skill governs the work in front of you and, if it does, LOAD it
+  once. The carrier is kb's F-041 item B, LIFTED into the shared spine rather
+  than duplicated, so all three lenses share one machine; each lens declares its
+  own line in `set_profile(remind_line=...)`. Installing the package wires it
+  machine-wide on Claude Code alongside the orientation hook, never instead of
+  it; removing the hook entry is a standing opt-out. Per-turn cost disclosed and
+  accepted by the owner (`vision/rulings.md` r19, the "no ceremony ratchet"
+  Non-Goal's second door), and bounded to stay flat by a contract the new shared
+  `scripts/test_remind.py` guards: constant text, zero reads, one line under 500
+  characters, argv ignored whole, always exit 0.
+
+### Changed
+- **`guides.md` said something false about code guides.** It claimed `stale`
+  works unchanged for `source_kind: code` because "the code-excerpt snapshot
+  drifts when the code changes". A snapshot is a frozen copy and never drifts:
+  freshness is NOT mechanized there, and the duty is the author's twice -- when
+  you MODIFY code a comprehension guide describes, and when you merely READ one
+  before trusting it. Measured 2026-09-06: the guided module had gained 388
+  lines and lost 71 across four commits with `stale` silent.
+
 ## [0.9.0] - 2026-09-05
 
 Spine-only release: `review.md` updated byte-identical across the family

package/README.md

@@ -7,7 +7,7 @@ Evidence-First marketing planning protocol for AI coding agents (Claude Code, Ge
 Turns an AI agent into a disciplined marketing strategist that produces a professional, professionally-recognized marketing plan (SOSTAC structure) with three engineered guarantees:
 
 1. **Evidence ledger** — every market number is classified FACT / BENCHMARK / ASSUMPTION and carries an `[EV-nn]` reference to its source. No invented numbers.
-2. **Mechanical validator** (`mkt_check.py` + `sdlc_core.py` — the entry point plus the family's shared spine; copy both, or neither) — budget sums (±1%), funnel math recomputed cell by cell (±5%) and the objective→tactic→KPI chain are checked mechanically, not rhetorically: `check`, `validate`, `ledger`, `budget`, `funnel`, `trace`, `index`, plus the spine's `stale`/`mark`/`gate`/`plan`/`orient`/`migrate`.
+2. **Mechanical validator** (`mkt_check.py` + `sdlc_core.py` — the entry point plus the family's shared spine; copy both, or neither) — budget sums (±1%), funnel math recomputed cell by cell (±5%) and the objective→tactic→KPI chain are checked mechanically, not rhetorically: `check`, `validate`, `ledger`, `budget`, `funnel`, `trace`, `index`, plus the spine's `stale`/`mark`/`benefit`/`gate`/`plan`/`orient`/`migrate`. `benefit` reports what the review gates have already caught, beside what the doctrine costs to read; it always exits 0 and carries no verdict.
 3. **Adversarial CMO review** — an independent, fresh-context reviewer attacks the strategy before the user sees it (generic-positioning swap test, untraced claims, orphan tactics).
 
 The agent asks the user only for facts the user uniquely owns (product, price, budget, capacity); everything else — market sizing, competitor analysis, channel benchmarks — is derived from real web research.
@@ -69,6 +69,11 @@ The workstream registry (`audit/handoff.md`) is **generated** from one file per
 - **Standalone** — everything on the filesystem under `mkt_docs/`.
 - **Hybrid with devPNT** — plans and strategy artifacts governed as versioned devPNT documents (MKT-VISION, ICP/Personas, Threat Map, Strategy, Tactical Plan, Measurement Plan), with proposal/approval workflow and independent review gates.
 
+The Hybrid seam ships as its own file, `hybrid.md` — the authoritative
+hierarchy and the ownership matrix naming which artifact is mastered where.
+A Standalone engagement never reads it, which is why it is not in the
+operating contract every session loads.
+
 Installing or updating the npm package wires the session-orientation hook
 machine-wide (user-level Claude Code settings; removal is a standing opt-out
 that no update overrides -- ENFORCEMENT.md par.4).
@@ -83,6 +88,35 @@ that no update overrides -- ENFORCEMENT.md par.4).
 
 Triage, the Vision Gate, the review gates, the guide router, question discipline and the validator spine are byte-identical across the three; only the fidelity discipline and the vocabulary change. When two live in the same project, `routing.md` decides which lens owns a given piece of work — with the market-facing override: anything whose purpose is to persuade the market is this lens's, whatever its source.
 
+## Which model to run it on
+
+The skill names **capability tiers**, never providers — a model name in doctrine
+rots at the next release. The binding is yours to make, and the rule is one line:
+
+> **A session's floor is the highest floor among the roles it performs itself.**
+
+Authoring a governed artifact — the vision, the analysis, the use cases, the
+threat model — is a **deep-tier** role: its output is judgement, and nothing
+downstream scores it. So a session that will DESIGN wants your strongest model.
+A session that only executes an already-approved plan, or does small maintenance,
+can sit a tier lower. The cheapest tier is the wrong choice for the main session
+whatever the task, because the failure there is not a wrong answer — it is
+**silently not applying the process**: a triage never run, a router verdict
+declared without the lookup, a gate nobody noticed. That failure is invisible to
+every check in here.
+
+**The reviewer's tier is not automatically yours.** On some clients a subagent
+inherits the session's model; on others it takes one from its own definition, so
+a strong session can be reviewed by a weak one — and a weak session can buy a
+strong review. Set it deliberately; the
+`model` column in the review log is where the choice becomes visible.
+
+**Avoid one combination**: authoring below the floor AND reviewing below the floor
+on the same unit. One disclosed weakness is a disclosed weakness; two is an
+artifact nobody competent ever read. Where your client offers nothing better, the
+review still runs and both facts are recorded — a disclosed worst case beats
+skipping the review.
+
 ## License
 
 MIT — Antonio Pinto

package/gemini-extension.json

@@ -1,6 +1,6 @@
-{
-  "name": "mkt-agentic-sdlc",
-  "version": "0.9.0",
-  "description": "Evidence-First marketing planning protocol with engagement triage, SOSTAC workflow, evidence ledger and optional devPNT integration.",
-  "author": "Antonio Pinto (https://github.com/Antoneeo)"
-}
+{
+  "name": "mkt-agentic-sdlc",
+  "version": "0.11.0",
+  "description": "Evidence-First marketing planning protocol with engagement triage, SOSTAC workflow, evidence ledger and optional devPNT integration.",
+  "author": "Antonio Pinto (https://github.com/Antoneeo)"
+}

package/package.json

@@ -1,50 +1,51 @@
-{
-  "name": "@antoneeo/mkt-agentic-sdlc-skill",
-  "version": "0.9.0",
-  "description": "Evidence-First marketing planning protocol for Claude Code, Gemini CLI, Google Antigravity and Codex: engagement triage, SOSTAC workflow, evidence ledger, mechanical validator and optional devPNT integration.",
-  "keywords": [
-    "claude-code",
-    "claude-skill",
-    "gemini-cli",
-    "skill",
-    "marketing",
-    "marketing-plan",
-    "sostac",
-    "ai-agent"
-  ],
-  "author": "Antonio Pinto (https://github.com/Antoneeo)",
-  "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  },
-  "bin": {
-    "mkt-sdlc-init": "scripts/init.js",
-    "mkt-sdlc-install-skill": "scripts/postinstall.js"
-  },
-  "scripts": {
-    "postinstall": "node scripts/postinstall.js",
-    "preuninstall": "node scripts/preuninstall.js"
-  },
-  "files": [
-    "skills/mkt-agentic-sdlc/SKILL.md",
-    "skills/mkt-agentic-sdlc/frameworks.md",
-    "skills/mkt-agentic-sdlc/elicitation.md",
-    "skills/mkt-agentic-sdlc/research.md",
-    "skills/mkt-agentic-sdlc/templates.md",
-    "skills/mkt-agentic-sdlc/review.md",
-    "skills/mkt-agentic-sdlc/scripts/sdlc_core.py",
-    "skills/mkt-agentic-sdlc/routing.md",
-    "skills/mkt-agentic-sdlc/guides.md",
-    "skills/mkt-agentic-sdlc/vision.md",
-    "skills/mkt-agentic-sdlc/dispatch.md",
-    "skills/mkt-agentic-sdlc/ENFORCEMENT.md",
-    "skills/mkt-agentic-sdlc/scripts/mkt_check.py",
-    "gemini-extension.json",
-    "README.md",
-    "CHANGELOG.md",
-    "scripts/lib.js",
-    "scripts/init.js",
-    "scripts/postinstall.js",
-    "scripts/preuninstall.js"
-  ]
-}
+{
+  "name": "@antoneeo/mkt-agentic-sdlc-skill",
+  "version": "0.11.0",
+  "description": "Evidence-First marketing planning protocol for Claude Code, Gemini CLI, Google Antigravity and Codex: engagement triage, SOSTAC workflow, evidence ledger, mechanical validator and optional devPNT integration.",
+  "keywords": [
+    "claude-code",
+    "claude-skill",
+    "gemini-cli",
+    "skill",
+    "marketing",
+    "marketing-plan",
+    "sostac",
+    "ai-agent"
+  ],
+  "author": "Antonio Pinto (https://github.com/Antoneeo)",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "mkt-sdlc-init": "scripts/init.js",
+    "mkt-sdlc-install-skill": "scripts/postinstall.js"
+  },
+  "scripts": {
+    "postinstall": "node scripts/postinstall.js",
+    "preuninstall": "node scripts/preuninstall.js"
+  },
+  "files": [
+    "skills/mkt-agentic-sdlc/SKILL.md",
+    "skills/mkt-agentic-sdlc/frameworks.md",
+    "skills/mkt-agentic-sdlc/elicitation.md",
+    "skills/mkt-agentic-sdlc/research.md",
+    "skills/mkt-agentic-sdlc/templates.md",
+    "skills/mkt-agentic-sdlc/review.md",
+    "skills/mkt-agentic-sdlc/scripts/sdlc_core.py",
+    "skills/mkt-agentic-sdlc/routing.md",
+    "skills/mkt-agentic-sdlc/guides.md",
+    "skills/mkt-agentic-sdlc/vision.md",
+    "skills/mkt-agentic-sdlc/dispatch.md",
+    "skills/mkt-agentic-sdlc/hybrid.md",
+    "skills/mkt-agentic-sdlc/ENFORCEMENT.md",
+    "skills/mkt-agentic-sdlc/scripts/mkt_check.py",
+    "gemini-extension.json",
+    "README.md",
+    "CHANGELOG.md",
+    "scripts/lib.js",
+    "scripts/init.js",
+    "scripts/postinstall.js",
+    "scripts/preuninstall.js"
+  ]
+}

package/skills/mkt-agentic-sdlc/ENFORCEMENT.md

@@ -57,7 +57,7 @@ Semantics: exit code 2 + message on stderr ⇒ the write is blocked and the mess
 - The paths in `--protected` are prefixes relative to the project root, separated by `;`.
 - `ai_docs/`, `tests/` and `test/` are always excluded from blocking.
 - The hook assumes the working directory is the project root (standard behavior of Claude Code hooks).
-- **Hybrid/devPNT projects**: add `--hybrid` to the gate command. Governed designs live in the devPNT DB, so the gate also unlocks when an approved E-TDD shadow (`ai_docs/solutions/SHADOW_*tdd*.md`, exported before implementation — see the SKILL.md shadow discipline) is present. Without the flag the gate would block legitimate governed work. The flag is deliberately explicit: never auto-detected.
+- **Hybrid/devPNT projects**: add `--hybrid` to the gate command. Governed designs live in the devPNT DB, so the gate also unlocks when an approved E-TDD shadow (`ai_docs/solutions/SHADOW_*tdd*.md`, exported before implementation — see `hybrid.md` §Ownership matrix) is present. Without the flag the gate would block legitimate governed work. The flag is deliberately explicit: never auto-detected.
 
 ## 4. SessionStart hook (orientation, recommended default)
 
@@ -157,6 +157,46 @@ Gemini CLI — wire the same command into its startup-hook mechanism if present;
 - **Hybrid/devPNT projects**: add `--hybrid` — the hook then appends a one-line pointer to run `devpnt_mcp_get_bootstrap` for the Master Plan / Knowledge Layer and does not replicate them; the filesystem orientation (router + handoff + README) still emits.
 - Like the CI gate (§2), if you copied the validator into the repo, the hook references that copy — keep both files current when you update the skill.
 
+### Per-turn reminder: `remind` (UserPromptSubmit -- wired by default)
+
+`orient` fires once, at session start; a long session drifts after it, and a session
+that never loads the skill never had the protocol at all. Measured (F-046, 2026-09-06):
+a release ran against a `GUIDE_release.md` the session never consulted, because
+`SKILL.md` -- where the duty is written -- had not been read. `mkt_check.py remind` prints
+ONE constant line at every prompt, and its first duty is that one: decide whether the
+skill governs the work in front of you and, if it does, load it once.
+
+Cost: 437 characters, ~74 tokens per prompt, paid on every turn including
+trivial ones. That is admissible only because the owner accepted it explicitly
+(`ai_docs/vision/rulings.md` r19, the "no ceremony ratchet" Non-Goal's second door) --
+and the acceptance was for a FLAT cost. Hence the contract, guarded by
+`scripts/test_remind.py`: the line is **constant and reads nothing** (so nothing repo-
+or session-controlled rides into the agent's context through it, and the cost cannot
+grow with the session), it is **one line under 500 characters**, and it **can never
+break a prompt** (argv ignored whole, always exit 0). A trivial turn pays a yes/no
+judgement, never a load.
+
+Installing the package wires it machine-wide on Claude Code, alongside the orientation
+hook and never instead of it; **removing that hook entry is a standing opt-out.** To
+wire it by hand:
+
+```json
+{
+  "hooks": {
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python \"C:\Users\<user>\.claude\skills\mkt-agentic-sdlc\scripts\mkt_check.py\" remind"
+          }
+        ]
+      }
+    ]
+  }
+}
+```
+
 ## 5. Skill eval battery (release gate)
 
 **Skill development only.** `test_*.py` and `evals/` are deliberately absent from the npm `files` allowlist — they never reach an installed consumer, so this section applies to whoever builds the skill, not to a project that uses it. (Consumers get `mkt_check.py` + `sdlc_core.py`; §1–§4 are theirs.)
@@ -176,3 +216,12 @@ It aggregates the test files (`test_plan.py` + `test_session_start.py` + `test_s
 **Optional CI** (same shape as §2, not mandatory): add a `run:` step invoking the `unittest discover` command above.
 
 **T10 note:** if you copied the validator (both files) and the `test_*.py` battery into the repo for CI, that copy is authoritative — keep it current when you update the skill.
+
+## `benefit` is a report, never a CI gate
+
+`mkt_check.py benefit` reports what the review gates caught and what the
+doctrine costs to read. It always exits 0 and emits no warning: **never wire
+it into CI**. It is the criterion by which future units are judged, and a
+measurement that can fail a build becomes a target -- a targeted measurement
+stops measuring. Run it when deciding whether a proposed rule is worth its
+ceremony, not on every push.