@cleocode/skills 2026.10.6 → 2026.10.7

package/README.md

@@ -43,6 +43,7 @@ installability and every documented `cleo` command honest.
 | **ct-cleo** | CLEO task management protocol - session, task, and workflow guidance. |
 | **ct-dev-workflow** | Development workflow orchestration for task-driven development with atomic commits, conventional commit messag… |
 | **ct-documentor** | Documentation coordinator with CLEO style guide compliance. |
+| **ct-lean** | Lean change discipline for CLEO work: the smallest change that fully solves the task, and a reply a busy … |
 | **ct-lead** | Phase Lead orchestration playbook for spawning and supervising a parallel worker swarm in one wave. |
 | **ct-orchestrator** | Pipeline-aware orchestration skill for managing complex workflows through subagent delegation. |
 | **ct-task-executor** | General implementation task execution for completing assigned CLEO tasks by following instructions and produci… |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/skills",
-  "version": "2026.10.6",
+  "version": "2026.10.7",
   "description": "CLEO skill definitions - bundled with CLEO monorepo",
   "main": "index.js",
   "types": "index.d.ts",

package/profiles/core.json

@@ -1,12 +1,13 @@
 {
   "name": "core",
-  "description": "The six core skills (D11157): CLEO protocol, orchestration, phase leads, task execution, dev workflow and documentation",
+  "description": "The seven core skills (D11157, T13422): CLEO protocol, orchestration, phase leads, task execution, dev workflow, documentation and lean change",
   "extends": "minimal",
   "skills": [
     "ct-orchestrator",
     "ct-lead",
     "ct-dev-workflow",
-    "ct-documentor"
+    "ct-documentor",
+    "ct-lean"
   ],
   "includeProtocols": [
     "agent-protocol"

package/skills/ct-cleo/SKILL.md

@@ -2,7 +2,7 @@
 name: ct-cleo
 description: CLEO task management protocol - session, task, and workflow guidance. Use when managing tasks, sessions, or multi-agent workflows with the CLEO CLI protocol.
 metadata:
-  version: 2.24.8
+  version: 2.24.10
   tier: core
   install: harness
   covers:
@@ -33,12 +33,13 @@ instruction checks do not establish live Codex, Claude, or Kimi behavior.
 
 ## Asking the owner (HITL ask tool)
 
-Whenever you need the owner to answer, decide, approve or choose ANYTHING, use the
-ask tool (`AskUserQuestion` in Claude Code, or the provider equivalent listed in
-CAAMP's `PROVIDER_ASK_TOOLS`) with concrete, detailed, selectable options. Never
-ask inside a response, and never bury a question or decision in prose. Each option
-states what happens and its trade-offs; put the recommended option first. Do not
-send routine status chatter: report only when done or when a decision is needed.
+Whenever you need the owner to answer, decide, approve or choose ANYTHING, use the ask
+tool (`AskUserQuestion` in Claude Code, or the provider equivalent listed in CAAMP's
+`PROVIDER_ASK_TOOLS`) with 2-4 concrete, selectable options, recommended first, each stating
+what happens and its trade-offs. Never ask inside a response or bury a question in prose.
+Answer first in every reply: the first line is the result, answer or decision; then only the
+evidence the reader needs and what was skipped or unverified. No preamble, recap or routine
+status chatter: report only when done or when a decision is needed.
 
 - **Subagents never ask the human.** Return the question with its options to your
   orchestrator (`blocked` plus `{question, options[{label, description}], recommended}`
@@ -66,8 +67,6 @@ unreachable, or nexus hits `ENOENT` on an old path, run and report:
    harness CLEO skill install must resolve (a `~/.cleo` link carried by dotfiles from
    Linux dangles on macOS and silences all of them). `--repair` relinks with a receipt.
 
-Never delete registry rows for projects that may have moved.
-
 ## Guarded knowledge repair
 
 Use `cleo doctor knowledge --dry-run` to inspect findings and sourced proposals.

package/skills/ct-dev-workflow/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ct-dev-workflow
 description: Development workflow orchestration for task-driven development with atomic commits, conventional commit messages, and systematic release processes. Enforces task traceability, branch discipline, smart test scope selection, and GitHub Actions integration. Use when committing code, creating releases, managing branches, or following contribution protocols. Triggers on commit operations, release preparation, or workflow compliance needs.
-version: 3.1.7
+version: 3.1.9
 protocol: contribution
 dependencies: []
 sharedResources:
@@ -14,12 +14,18 @@ compatibility:
   - gemini-cli
 license: MIT
 metadata:
-  version: 3.1.7
+  version: 3.1.9
   tier: core
   install: harness
   covers:
     - .github/workflows/release-prepare.yml
-  lastReviewed: 2026-10-04
+    - packages/core/src/init.ts
+    - packages/cleo/src/cli/commands/init.ts
+    - packages/core/src/hooks.ts
+    - packages/core/src/git/hooks-install.ts
+    - packages/core/templates/git-hooks/**
+    - packages/contracts/src/git-hooks.ts
+  lastReviewed: 2026-10-10
   stability: stable
 ---
 
@@ -68,6 +74,29 @@ Every commit MUST be traceable to a CLEO task. This ensures:
 
 ---
 
+## Git Hook Delivery (T13349)
+
+Init, upgrade and explicit Git hook installation share the ownership-aware installer.
+Resolve the effective hook directory through Git, including `core.hooksPath` and
+linked worktrees. Preserve foreign hooks and customized managed hooks; a CLEO
+marker alone never authorizes replacement. Refresh only exact shipped legacy
+bodies or receipt-owned content, using locked atomic writes and hash-guarded
+rollback. Report conflicts with the suggested integration snippet.
+
+Receipts and locks stay in Git-private common metadata, including when
+`core.hooksPath` selects tracked files. Default installation preserves hook
+paths inside the checkout. Use `cleo init --git-hooks-only --allow-tracked-hooks-path` only after
+reviewing the tracked destination; this opt-in still preserves foreign and
+customized hooks. Init warnings carry the exact opt-in command.
+
+The standalone pre-push template enforces task IDs from Git ref-update stdin.
+Shared project-runner integration belongs to the unified hooks feature and must
+ship with its implemented CLI verb. Verify nested checkout paths, linked
+worktrees, custom hook paths, historical release bodies and corrupt receipts
+with focused Git fixtures before changing this delivery path.
+
+---
+
 ## Task Tracking Integration
 
 ### Before Any Work

package/skills/ct-documentor/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ct-documentor
 description: Documentation coordinator with CLEO style guide compliance. Routes every canonical-doc write (spec, adr, research, handoff, note, llm-readme) through the docs SSoT via `cleo docs add` / `cleo docs publish` / `cleo docs fetch` — never raw filesystem writes. Carries the CLEO writing and review guides as references and coordinates ct-spec-writer and ct-adr-recorder. Use when creating or updating documentation files, consolidating scattered documentation, or validating documentation against style standards. Triggers on documentation tasks, doc update requests, or style guide compliance checks.
-version: 3.17.6
+version: 3.17.7
 protocol: null
 dependencies:
   - ct-spec-writer
@@ -16,7 +16,7 @@ compatibility:
   - gemini-cli
 license: MIT
 metadata:
-  version: 3.17.6
+  version: 3.17.7
   tier: core
   install: harness
   covers:
@@ -53,7 +53,13 @@ surfaces** — do not present them as the default path to agents.
 `supersede`, `find --similar`, `graph`, `versions`, `sync`, `search`,
 `merge`, `rank`, `generate`, `export`, `schema`, `list-types`,
 `serve`/`open`/`stop`/`viewer-status`, `status`/`gap-check`, `import`,
-`publish-pr`.
+`publish-pr`, `doctor`.
+
+`cleo docs doctor` (T13447) audits the docs store — dangling `local-file`
+pointers, docVersion skew vs the audit log, empty topics/related_tasks,
+`docs_wikilinks` drift, legacy store surfaces, stale drafts — and with
+`--apply` repairs them after creating a backup automatically. Use it for
+store hygiene checks; it never edits doc content.
 
 For discovery (`find`, `search`, `schema`, `list-types`), prefer `cleo docs list`
 first — it returns slug + owner + type without forcing a filesystem walk. Use

package/{LICENSE → skills/ct-lean/LICENSE-ponytail}

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 CLEO Contributors
+Copyright (c) 2026 DietrichGebert
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/skills/ct-lean/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: ct-lean
+description: >-
+  Lean change discipline for CLEO work: the smallest change that fully solves the task, and
+  a reply a busy owner understands in one read. Use on every coding task (writing, fixing,
+  refactoring, reviewing, choosing dependencies) and when the owner asks for the simplest
+  solution, YAGNI, or complains about over-engineering or bloat. Never trades away evidence
+  gates, package boundaries, validation, data safety or anything the task asked for.
+license: MIT
+metadata:
+  version: 1.0.0
+  tier: core
+  install: harness
+  covers:
+    - packages/core/src/orchestration/lean-change.ts
+  lastReviewed: 2026-10-10
+  stability: stable
+  attribution: Adapted from Ponytail 5.1.0 by DietrichGebert (MIT) — https://github.com/DietrichGebert/ponytail
+---
+
+# ct-lean — the smallest complete change
+
+The best code is the code never written. Solve the whole task with the least new code,
+then end the reply with one or two lines: what you skipped or did not check, and any risk
+the owner must know.
+
+## Before you write
+
+Read the task (`cleo show <id> --full`) and the code it touches. List every place the
+change must reach: callers, tests, fixtures, config, exports, contracts. Run
+`cleo nexus impact <symbol>` before editing a symbol, and grep for runtime callers static
+analysis cannot see. Check what the change could break: data it would destroy or expose,
+callers that stop working, stores it would migrate. That is scope. Extra features are not.
+
+## Take the first option that fully works
+
+1. **Does it need to exist?** Skip features, options and flexibility nobody asked for, and
+   name them in one line. A vague request gets the smallest version that does the core job.
+2. **Already in this codebase?** A helper, accessor, contract or pattern: use it the way the
+   surrounding code does. Search `packages/core/src` and `packages/contracts/src` first.
+3. **Standard library or platform feature?** Use it, unless the repo has its own (a house
+   chokepoint such as `openDualScopeDb` or `cleo run` beats a raw primitive).
+4. **An installed dependency?** Use it. Never add a dependency for a few lines.
+5. **One line a reader gets at a glance?** One line.
+6. **Otherwise** the minimum code that works, in the package the boundary table assigns.
+
+## Rules
+
+- Lazy about the solution, never about the change: finish every part the task needs,
+  including the callers, tests, fixtures and docs the change breaks.
+- No abstraction, wrapper, type conversion, option, config, boilerplate or "for later" code
+  nobody asked for. Deletion beats addition. Keep the layers, contracts and conventions the
+  repo already has.
+- The shortest working diff wins once you know everything it must touch. A one-liner that
+  needs decoding is not short.
+- Comment only the why the code cannot show, in one line. Exported symbols still get TSDoc.
+- Bug fix: grep every caller of the function you touch, then fix the root cause once in the
+  shared code. No workaround at a call site.
+- Code you move or merge keeps its error handling and validation.
+- Between options of equal size, take the one that is correct on edge cases.
+- New non-trivial logic (a branch, a loop, a parser, a store write, security) leaves one
+  small test. Trivial changes need none. Run single test files through `cleo run --wait`.
+- A shortcut with a known limit gets a comment: `shortcut: <the limit>, <when to upgrade>`.
+
+## Never cut
+
+- Validation at trust boundaries, error handling that prevents data loss, security,
+  accessibility, and anything the task or owner asked for.
+- CLEO evidence: every gate gets programmatic evidence (`cleo verify`), never self-attested.
+- Type safety: no `any`, no `as unknown as X`; shared types live in `packages/contracts/`.
+- The package boundary and the `cleo check arch` gates; a smaller diff in the wrong package
+  is not smaller.
+- Store safety: the DB chokepoint, migrations, backups, and the tracked identity files.
+
+## Replies
+
+Answer first: the first line is the result, answer or decision. Then only the evidence the
+reader needs (bullets or a small table), then the skipped/unchecked line. No preamble,
+recap or restated request. Owner questions go through the ask tool with populated options,
+never in the reply (CLEO-INJECTION.md universal protocol step 7).
+
+## References
+
+- `references/examples.md` — worked CLEO examples, over-built vs lean.
+- `references/never-cut.md` — the never-cut list with the gate that enforces each row.
+- `references/reviewing.md` — a lean review checklist for PRs and your own diff.
+
+---
+
+Adapted from [Ponytail](https://github.com/DietrichGebert/ponytail) 5.1.0, Copyright (c) 2026
+DietrichGebert, MIT License. Levels, statusline and plugin hooks are not carried over.

package/skills/ct-lean/references/examples.md

@@ -0,0 +1,47 @@
+# ct-lean worked examples
+
+Each example names the request, the over-built answer agents tend to write, and the lean
+answer. The lean answer is complete: it touches every place the change must reach.
+
+## 1. "Add a `--json` flag to a CLI command"
+
+- **Over-built:** a new formatter module, an `OutputMode` enum, a config key for the default.
+- **Lean:** none of it. Every `cleo` command already emits one LAFS envelope and supports
+  `--output`/`--field` (ADR-086). Answer with the existing flag. If one is truly missing, wire
+  the command through `defineCommand` so it inherits the flag; never hand-roll JSON.
+
+## 2. "The import fails when the file has a BOM"
+
+- **Over-built:** a try/catch at the one failing call site that strips ``.
+- **Lean:** grep every caller of the shared reader, then strip the BOM once inside it. Add one
+  test with a BOM fixture. The call-site patch is a workaround that the next caller repeats.
+
+## 3. "Cache the provider lookup, it is slow"
+
+- **Over-built:** an LRU class with TTL, size options and invalidation hooks.
+- **Lean:** measure first. If the lookup is a pure function of static data, a module-level
+  `Map` (or computing the table once) is enough. Add the TTL only when a test shows stale
+  data. Leave `shortcut: no invalidation, data is static per process; add TTL if it becomes
+  config-driven`.
+
+## 4. "Write rows to a new table"
+
+- **Over-built:** a raw `new DatabaseSync(...)` with hand-written `INSERT OR REPLACE`.
+- **Lean, and the only correct option:** go through `openDualScopeDb` and the canonical
+  accessor, and use `INSERT … ON CONFLICT … DO UPDATE`. Gates 3 and 28 reject the short
+  version. A smaller diff that breaks a gate is not smaller.
+
+## 5. "Fix the flaky test"
+
+- **Over-built:** a retry wrapper, or a larger timeout.
+- **Lean:** find the race (shared temp dir, unawaited promise, real clock) and fix it at the
+  source. Never edit the expectation to match broken behaviour.
+
+## 6. Reply shape
+
+```
+Fixed: the BOM is stripped once in readJsonFile (packages/core/src/store/json.ts).
+- 1 new test (json.test.ts > strips a UTF-8 BOM); 14/14 pass
+- tsc -b and biome clean
+Skipped: did not audit the two callers in studio (they read via the same function).
+```

package/skills/ct-lean/references/never-cut.md

@@ -0,0 +1,18 @@
+# ct-lean never-cut list (CLEO edition)
+
+Lean means less *unrequested* code. These are always in scope, however small the task.
+
+| Never cut | Why | CLEO enforcement |
+|---|---|---|
+| Validation at trust boundaries | Input from users, agents, harness hooks and synced peers is untrusted | Zod schemas in `packages/contracts`; sync write invariants (gate 38) |
+| Error handling that prevents data loss | A silent catch around a store write loses rows | `catch (err: unknown)` is banned; killed writes have unknown outcome |
+| Security | Secrets, shell quoting, path traversal | `tool:security-scan` evidence; no secrets in output |
+| Evidence | A gate without programmatic proof is self-attestation | `cleo verify --gate … --evidence …` (ADR-051), re-validated at `cleo complete` |
+| Type safety | `any` and cast chains hide the bug the type would have caught | Project rule; shared types live in `packages/contracts/` |
+| Package boundary | Code in the wrong package becomes the next relocation task | AGENTS.md boundary table; `cleo check arch` gates 4, 6, 10, 11 |
+| Store safety | The DB chokepoint, migrations, backups, tracked identity files | Gates 3, 17, 28, 36, 37; never `git add` `.cleo/*.db` |
+| Accessibility | UI that only works for some users is not done | Studio review checks |
+| Anything the task or owner asked for | Lean trims extras, never the request | The task's acceptance criteria |
+
+When a lean option conflicts with a row above, the row wins. Say so in the reply's
+skipped/risk line instead of silently choosing the bigger diff.

package/skills/ct-lean/references/reviewing.md

@@ -0,0 +1,22 @@
+# Reviewing a diff with ct-lean
+
+Use this when reviewing a PR or your own diff before `cleo verify`.
+
+1. **Scope.** Does every changed file serve the task's acceptance criteria? Name anything
+   that does not, such as an unrelated refactor or a speculative option.
+2. **Reuse.** Was there an existing helper, accessor, contract or chokepoint for this? Check
+   `packages/core/src` and `packages/contracts/src`. A new utility that duplicates one is a
+   finding.
+3. **Abstraction.** Count the new interfaces, options, config keys and wrappers. Each one
+   needs a caller today; "for later" is a finding.
+4. **Completeness.** Grep the callers of every changed exported symbol. A caller, fixture or
+   doc left behind is a finding. Lean never means half-done.
+5. **Root cause.** Is a bug fixed in the shared code, or patched at one call site?
+6. **Checks.** New non-trivial logic has one focused test. Test expectations were not edited
+   to match broken code.
+7. **Never-cut list.** Validation, data safety, security, evidence, type safety, package
+   boundary: confirm none were trimmed to shorten the diff.
+8. **Shortcuts.** Each known limit carries `shortcut: <limit>, <when to upgrade>`.
+
+Report findings as the reply format says: verdict first, then one line per finding with its
+file and line, then what you did not check.

package/skills/ct-orchestrator/SKILL.md

@@ -2,13 +2,13 @@
 name: ct-orchestrator
 description: "Pipeline-aware orchestration skill for managing complex workflows through subagent delegation. Use when the user asks to \"orchestrate\", \"orchestrator mode\", \"run as orchestrator\", \"delegate to subagents\", \"coordinate agents\", \"spawn subagents\", \"multi-agent workflow\", \"context-protected workflow\", \"agent farm\", \"HITL orchestration\", \"pipeline management\", or needs to manage complex workflows by delegating work to subagents while protecting the main context window. Enforces ORC-001 through ORC-009 constraints. Provider-neutral — works with any AI agent runtime."
 metadata:
-  version: 4.0.10
+  version: 4.0.12
   tier: core
   install: harness
   covers:
     - packages/cleo/src/cli/commands/orchestrate.ts
     - packages/core/src/orchestration/spawn-prompt.ts
-  lastReviewed: 2026-10-04
+  lastReviewed: 2026-10-10
   stability: stable
 ---
 
@@ -252,14 +252,17 @@ On an idle host every ready task is `admitted` and behaviour is unchanged.
 
 After each wave or on request: what completed, blockers needing HITL, next actions.
 Report only when work is done or a decision is needed; no routine status chatter.
+Answer first: the first line is the result or the decision needed, then only the
+evidence the owner needs (bullets or a small table) and what is unverified.
 
 ## Asking the Owner (HITL ask tool)
 
 Whenever the owner must answer, decide, approve or choose ANYTHING, ask through
 the ask tool (`AskUserQuestion` in Claude Code, or the provider equivalent from
 CAAMP's `PROVIDER_ASK_TOOLS`) with concrete, detailed, selectable options. Never
-ask inside a response, and never bury a question or decision in prose. Each option
-states what happens and its trade-offs, with the recommended option first.
+ask inside a response, and never bury a question or decision in prose. Give 2-4
+options, recommended first, each stating what happens and its trade-offs. A relayed
+subagent question with thin options gets filled in before you ask, never passed on bare.
 
 - **Subagent relay.** Subagents never ask the human (most harnesses deny them the
   ask tool). A subagent that needs a decision returns `blocked` with

package/skills/ct-task-executor/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ct-task-executor
 description: General implementation task execution for completing assigned CLEO tasks by following instructions and producing concrete deliverables. Handles coding, configuration, documentation work with quality verification against acceptance criteria and progress reporting. Use when executing implementation tasks, completing assigned work, or producing task deliverables. Triggers on implementation tasks, general execution needs, or task completion work.
-version: 2.7.8
+version: 2.7.9
 protocol: implementation
 adrRefs:
   - ADR-070
@@ -17,7 +17,7 @@ compatibility:
   - gemini-cli
 license: MIT
 metadata:
-  version: 2.7.8
+  version: 2.7.9
   tier: core
   install: harness
   covers:
@@ -126,7 +126,12 @@ Context injection for implementation tasks spawned via cleo-subagent. Provides d
 
 ### Post-Execution
 
-1. **Verify against criteria** - Check each acceptance criterion
+1. **Verify against criteria** - Check each acceptance criterion. `cleo verify <id> --run`
+   executes the typed gates; `--run --req REQ-A,REQ-B` runs only those gates and leaves
+   the other gates' cached passes as they are. A typed gate whose command is wrong (an
+   absolute path into a removed worktree, say) is fixed in place with
+   `cleo req replace <id> <REQ-ID> --gate '<json>'`. Prefer a repo-relative command and
+   `cwd`; a locked stage also needs `--reason`. Then verify that gate again.
 2. **Document completion** - Write detailed output file
 3. **Update manifest** - Append summary entry
 4. **Complete task** - Mark task done in task system

package/skills/manifest.json

@@ -62,7 +62,7 @@
   "_meta": {
     "schemaVersion": "2.7.0",
     "lastUpdated": "2026-05-19",
-    "totalSkills": 21,
+    "totalSkills": 22,
     "generatedFrom": "T260 — lifecycle pipeline rework: dedicated skills for ADR, IVT loop, consensus, release, artifact-publish, provenance. T9664/T9665/T9672 (epic T9568) — adds loomStage + adrRefs fields on every LOOM-stage skill entry (underscored canonical form matching `cleo lifecycle` stage names; ADR refs point at .cleo/adrs/). T9672 reconciled dispatch_matrix.by_protocol key 'architecture-decision' → 'architecture_decision' matching the lifecycle CLI source of truth; the dashed form is retained as a keyword alias.",
     "architectureNote": "Universal Subagent Architecture: All spawns use provider-neutral delegation with skill/protocol injection. Pipeline stages and cross-cutting protocols each have a dedicated skill — no overloading.",
     "loomStageContract": "Each of the 10 LOOM lifecycle stages (research, consensus, architecture_decision, specification, decomposition, implementation, validation, testing, release, contribution) MUST have a bound skill whose manifest entry declares loomStage matching the lifecycle CLI stage name. The legacy `protocol` field is retained as an alias; dispatch_matrix.by_protocol is the authoritative routing table. See docs/skills/loom-coverage-matrix.md.",
@@ -226,7 +226,7 @@
     },
     {
       "name": "ct-cleo",
-      "version": "2.24.8",
+      "version": "2.24.10",
       "description": "CLEO task management protocol - session, task, and workflow guidance. Use when managing tasks, sessions, or multi-agent workflows with the CLEO CLI protocol.",
       "path": "skills/ct-cleo",
       "tier": 0,
@@ -566,7 +566,7 @@
     },
     {
       "name": "ct-dev-workflow",
-      "version": "3.1.7",
+      "version": "3.1.9",
       "description": "Development workflow orchestration for task-driven development with atomic commits, conventional commit messages, and systematic release processes. Enforces task traceability, branch discipline, smart test scope selection, and GitHub Actions integration. Use when committing code, creating releases, managing branches, or following contribution protocols. Triggers on commit operations, release preparation, or workflow compliance needs.",
       "path": "skills/ct-dev-workflow",
       "tier": 0,
@@ -642,7 +642,7 @@
     },
     {
       "name": "ct-documentor",
-      "version": "3.17.6",
+      "version": "3.17.7",
       "description": "Documentation coordinator with CLEO style guide compliance. Routes every canonical-doc write (spec, adr, research, handoff, note, llm-readme) through the docs SSoT via `cleo docs add` / `cleo docs publish` / `cleo docs fetch` — never raw filesystem writes. Carries the CLEO writing and review guides as references and coordinates ct-spec-writer and ct-adr-recorder. Use when creating or updating documentation files, consolidating scattered documentation, or validating documentation against style standards. Triggers on documentation tasks, doc update requests, or style guide compliance checks.",
       "path": "skills/ct-documentor",
       "tier": 0,
@@ -981,9 +981,27 @@
       "compatibility": [],
       "license": "MIT"
     },
+    {
+      "name": "ct-lean",
+      "version": "1.0.0",
+      "description": "Lean change discipline for CLEO work: the smallest change that fully solves the task, and a reply a busy owner understands in one read. Use on every coding task (writing, fixing, refactoring, reviewing, choosing dependencies) and when the owner asks for the simplest solution, YAGNI, or complains about over-engineering or bloat. Never trades away evidence gates, package boundaries, validation, data safety or anything the task asked for.",
+      "path": "skills/ct-lean",
+      "tier": 0,
+      "deliveryTier": "core",
+      "install": "harness",
+      "status": "active",
+      "core": true,
+      "category": "core",
+      "dependencies": [],
+      "references": [],
+      "protocol": null,
+      "sharedResources": [],
+      "compatibility": [],
+      "license": "MIT"
+    },
     {
       "name": "ct-orchestrator",
-      "version": "4.0.10",
+      "version": "4.0.12",
       "description": "Pipeline-aware orchestration skill for managing complex workflows through subagent delegation. Use when the user asks to \\\"orchestrate\\\", \\\"orchestrator mode\\\", \\\"run as orchestrator\\\", \\\"delegate to subagents\\\", \\\"coordinate agents\\\", \\\"spawn subagents\\\", \\\"multi-agent workflow\\\", \\\"context-protected workflow\\\", \\\"agent farm\\\", \\\"HITL orchestration\\\", \\\"pipeline management\\\", or needs to manage complex workflows by delegating work to subagents while protecting the main context window. Enforces ORC-001 through ORC-009 constraints. Provider-neutral — works with any AI agent runtime.",
       "path": "skills/ct-orchestrator",
       "tier": 0,
@@ -1472,7 +1490,7 @@
     },
     {
       "name": "ct-task-executor",
-      "version": "2.7.8",
+      "version": "2.7.9",
       "description": "General implementation task execution for completing assigned CLEO tasks by following instructions and producing concrete deliverables. Handles coding, configuration, documentation work with quality verification against acceptance criteria and progress reporting. Use when executing implementation tasks, completing assigned work, or producing task deliverables. Triggers on implementation tasks, general execution needs, or task completion work.",
       "path": "skills/ct-task-executor",
       "tier": 0,