@dzhechkov/p-replicator 1.6.0 → 1.10.0

package/templates/.claude/hooks/statusline.cjs

@@ -198,10 +198,19 @@ function parsePlans() {
   return safeListDir(dir).filter((f) => f.endsWith('.md')).length;
 }
 
+/**
+ * THREE states, because two were not enough.
+ *
+ * `{count:0}` was returned both for a carrier that does not exist and for one that exists and holds
+ * nothing — so a project that had never recorded an insight rendered identically to one being used
+ * and found empty. That indistinguishability is what let 27 recorded insights become 0 across four
+ * real projects without any surface saying so (MEASURED 2026-08-27).
+ */
 function parseInsights() {
   const p = path.join(CWD, '.claude', 'insights', 'index.md');
   const text = safeReadText(p);
-  if (!text) return { count: 0, lastDate: null };
+  if (text === null || text === undefined) return { count: 0, lastDate: null, started: false };
+  if (!text.trim()) return { count: 0, lastDate: null, started: true };
   const headings = text.match(/^##\s+\d{4}-\d{2}-\d{2}/gm) || [];
   // Last date: extract from last heading
   let lastDate = null;
@@ -210,7 +219,7 @@ function parseInsights() {
     const m = last.match(/\d{4}-\d{2}-\d{2}/);
     if (m) lastDate = m[0];
   }
-  return { count: headings.length, lastDate };
+  return { count: headings.length, lastDate, started: true };
 }
 
 function parseToolkit() {
@@ -236,7 +245,7 @@ function parseExpectedToolkit() {
     commandsExpected: 11,
     agentsExpected: 4,    // pre-shipped only (project agents are extra)
     rulesExpected: 6,     // pre-shipped only (project rules are extra)
-    hooksExpected: 7,     // 4 v1.4.1 hooks + statusline + state-update + check-ports
+    hooksExpected: 9,     // 4 v1.4.1 hooks + statusline + state-update + 3 deliberate checks
   };
 }
 
@@ -467,7 +476,9 @@ function buildToolkit(toolkit, expected) {
 
 function buildStatus(insights, lastTest, mcpServers, settingsStatus, keysarium) {
   const parts = [];
-  parts.push(`💡 ${bold('Insights')} ${insights.count > 0 ? green('●' + insights.count) : '0'}` +
+  // '0' meant two different things: no carrier at all, and a carrier holding nothing. A dash
+  // says the first; a zero says the second. The reader can now tell which one they are looking at.
+  parts.push(`💡 ${bold('Insights')} ${insights.count > 0 ? green('●' + insights.count) : insights.started ? '0' : dim('—')}` +
     (insights.lastDate ? ` ${dim('(' + insights.lastDate + ')')}` : ''));
 
   if (lastTest && typeof lastTest.passed === 'number') {
@@ -498,7 +509,7 @@ function main() {
   const validation = safeRun(() => parseValidationScore(), null);
   const adrs = safeRun(() => parseAdrs(), 0);
   const plans = safeRun(() => parsePlans(), 0);
-  const insights = safeRun(() => parseInsights(), { count: 0, lastDate: null });
+  const insights = safeRun(() => parseInsights(), { count: 0, lastDate: null, started: false });
   const toolkit = safeRun(() => parseToolkit(), { skills: 0, commands: 0, agents: 0, rules: 0, hooks: 0 });
   const expected = parseExpectedToolkit();
   const settingsStatus = safeRun(() => parseSettingsStatus(manifest), null);

package/templates/.claude/rules/replicate-pipeline.md

@@ -32,7 +32,9 @@ absent or its prerequisites are unmet, skip the UI-clone step and log a warning.
 When executing skills during the pipeline:
 
 1. Read the skill's `SKILL.md` file from `.claude/skills/[name]/SKILL.md`
-2. When a skill references `/mnt/skills/user/[name]/` — read from `.claude/skills/[name]/` instead
+2. When a skill references `/mnt/skills/user/[name]/` — read from `.claude/skills/[name]/` instead.
+   *(The ten PRE-SHIPPED skills no longer contain such paths — since 1.8.0 they are pre-baked. This
+   rule is for skills you bring yourself.)*
 3. When a skill references `/mnt/user-data/uploads/` — read from `docs/` instead
 4. When a skill outputs to `/output/` — write to `docs/` or project root instead
 5. `goap-research` skill name maps to `goap-research-ed25519` in this repo
@@ -58,6 +60,7 @@ All generated files go directly into the project. Never create a separate output
 
 | Category | Path |
 |----------|------|
+| Product Discovery Brief (Phase 0) | `docs/product-discovery-brief.md` |
 | SPARC documentation | `docs/` |
 | Validation report | `docs/validation-report.md` |
 | BDD scenarios | `docs/test-scenarios.md` |
@@ -154,9 +157,16 @@ are project-agnostic and can be enhanced (read by Phase 3) but never recreated.
 **Rules (6):** `replicate-pipeline`, `skill-interface-protocol`, `git-workflow`,
 `insights-capture`, `feature-lifecycle`, `docker-ports`
 
-**Hooks:** `.claude/settings.json` (SessionStart + Stop) + cross-platform Node
-scripts in `.claude/hooks/` (`session-insights.cjs`, `autocommit-roadmap.cjs`,
-`autocommit-insights.cjs`, `autocommit-plans.cjs`)
+**Hooks (8 files in `.claude/hooks/`, cross-platform Node).** Only four are wired to an
+event in `.claude/settings.json`; the rest are utilities you invoke deliberately, and the
+difference matters — a hook of this package is NON-BLOCKING by contract and can only print.
+
+*Wired to an event:* `session-insights.cjs` (SessionStart) · `autocommit-roadmap.cjs`,
+`autocommit-insights.cjs`, `autocommit-plans.cjs` (Stop)
+
+*Invoked deliberately, wired to nothing:* `statusline.cjs` (a statusLine, not a hook) ·
+`state-update.cjs` (argv utility) · `check-ports.cjs` (docker-ports Правило №0, exits 0/1/2) ·
+`check-growth-trace.cjs` (did the M5 growth seed reach `docs/Specification.md`, exits 0/1/2)
 
 ### Generated by /replicate Phase 3 (project-specific — create new)
 

package/templates/.claude/rules/skill-interface-protocol.md

@@ -39,6 +39,15 @@ view() .claude/skills/[skill-name]/references/[file].md
 
 Skills originating from claude.ai use `/mnt/` paths. Apply these rewrites in order:
 
+> **The ten skills this package ships no longer need this.** Since p-replicator 1.8.0 their paths are
+> pre-baked: `.claude/skills/<name>/` resolves directly, with no rewrite step. The table below stays
+> because a skill YOU bring from claude.ai still needs it — and because the toolkit generator's own
+> output-scanning instructions describe this transform.
+>
+> One case the table cannot express: a skill referenced but NOT installed. Rewriting its path yields
+> a local-looking path that resolves to nothing, which is worse than an obviously foreign one. Declare
+> it OPTIONAL with a fallback (§6) instead.
+
 | Source Pattern | Target Pattern | Notes |
 |----------------|----------------|-------|
 | `/mnt/skills/user/[name]/` | `.claude/skills/[name]/` | Skill root directories |

package/templates/.claude/skills/brutal-honesty-review/scripts/assess-code.sh

@@ -15,12 +15,34 @@ echo ""
 
 # Check if file argument provided
 if [ -z "$1" ]; then
+    echo "⚠️  check did NOT run: no argument given"
     echo "Usage: $0 <file-or-directory>"
-    exit 1
+    exit 2
 fi
 
 TARGET="$1"
 
+# ── Findings counter ─────────────────────────────────────────────────────────
+#
+# This script DETECTED correctly and could not FAIL. MEASURED 2026-08-27: deliberately awful input
+# produced red verdicts on screen and exit 0, while a nonexistent path exited 1 — "I could not
+# check" was louder than "I found violations", so any gate reading 1 could not tell them apart.
+#
+# Nothing about the detection changed. What was missing is that nobody counted.
+#
+#   0  ran, found nothing
+#   1  ran, found violations — the count is printed
+#   2  COULD NOT CHECK: no argument, or a target that does not exist
+FINDINGS=0
+finding() { FINDINGS=$((FINDINGS + 1)); }
+
+if [ ! -e "$TARGET" ]; then
+    echo "⚠️  check did NOT run: '$TARGET' does not exist"
+    echo "   → This is NOT a clean bill: nothing was examined."
+    exit 2
+fi
+
+
 # Function to assess correctness
 assess_correctness() {
     echo "📊 CORRECTNESS CHECK"
@@ -28,7 +50,7 @@ assess_correctness() {
 
     # Check for common bug patterns
     if grep -r "TODO\|FIXME\|BUG\|HACK" "$TARGET" 2>/dev/null; then
-        echo -e "${RED}🔴 FAILING: Found TODO/FIXME/BUG/HACK comments${NC}"
+        echo -e "${RED}🔴 FAILING: Found TODO/FIXME/BUG/HACK comments${NC}"; finding
         echo "   → This code admits it's broken. Fix it before review."
         return 0
     fi
@@ -51,14 +73,14 @@ assess_performance() {
     # Check for nested loops (potential O(n²))
     nested_loops=$(grep -r "for.*{" "$TARGET" | wc -l)
     if [ "$nested_loops" -gt 5 ]; then
-        echo -e "${RED}🔴 FAILING: Found $nested_loops loops${NC}"
+        echo -e "${RED}🔴 FAILING: Found $nested_loops loops${NC}"; finding
         echo "   → Are you creating O(n²) complexity where O(n) exists?"
         echo "   → Use hash maps, sets, or better algorithms."
     fi
 
     # Check for synchronous I/O in hot paths
     if grep -r "readFileSync\|writeFileSync" "$TARGET" 2>/dev/null; then
-        echo -e "${RED}🔴 FAILING: Synchronous file I/O detected${NC}"
+        echo -e "${RED}🔴 FAILING: Synchronous file I/O detected${NC}"; finding
         echo "   → You're blocking the event loop. Use async operations."
     fi
 
@@ -74,7 +96,7 @@ assess_error_handling() {
     # Check for try/catch usage
     try_count=$(grep -r "try\|catch" "$TARGET" 2>/dev/null | wc -l)
     if [ "$try_count" -eq 0 ]; then
-        echo -e "${RED}🔴 FAILING: No error handling found${NC}"
+        echo -e "${RED}🔴 FAILING: No error handling found${NC}"; finding
         echo "   → What happens when this code fails? It crashes."
     else
         echo -e "${GREEN}✓ Found error handling (verify it's sufficient)${NC}"
@@ -82,7 +104,7 @@ assess_error_handling() {
 
     # Check for empty catch blocks
     if grep -A 1 "catch" "$TARGET" 2>/dev/null | grep -q "^\s*}"; then
-        echo -e "${RED}🔴 FAILING: Empty catch blocks detected${NC}"
+        echo -e "${RED}🔴 FAILING: Empty catch blocks detected${NC}"; finding
         echo "   → Swallowing errors silently is worse than crashing."
     fi
 }
@@ -118,7 +140,7 @@ assess_testability() {
     if [ -d "tests" ] || [ -d "test" ] || [ -d "__tests__" ]; then
         echo -e "${GREEN}✓ Test directory exists${NC}"
     else
-        echo -e "${RED}🔴 FAILING: No test directory found${NC}"
+        echo -e "${RED}🔴 FAILING: No test directory found${NC}"; finding
         echo "   → Where are the tests? Did you even test this?"
     fi
 
@@ -177,3 +199,14 @@ echo "  - Tests exist and pass"
 echo "  - Code is clear and maintainable"
 echo ""
 echo "If you wouldn't deploy this to production, don't submit it for review."
+
+# ── Verdict ──────────────────────────────────────────────────────────────────
+# ADDED, never substituted: the closing prose above is this skill's character and a reader wants it.
+# What follows is the same answer in a form a gate can act on.
+echo ""
+if [ "$FINDINGS" -gt 0 ]; then
+    echo "VERDICT: $FINDINGS finding(s). Not ready."
+    exit 1
+fi
+echo "VERDICT: 0 findings."
+exit 0

package/templates/.claude/skills/brutal-honesty-review/scripts/assess-tests.sh

@@ -15,17 +15,33 @@ echo ""
 
 # Check if test directory argument provided
 if [ -z "$1" ]; then
+    echo "⚠️  check did NOT run: no argument given"
     echo "Usage: $0 <test-directory>"
-    exit 1
+    exit 2
 fi
 
 TEST_DIR="$1"
 
+# ── Findings counter ─────────────────────────────────────────────────────────
+#
+# This script DETECTED correctly and could not FAIL. MEASURED 2026-08-27: deliberately awful input
+# produced red verdicts on screen and exit 0, while a nonexistent path exited 1 — "I could not
+# check" was louder than "I found violations", so any gate reading 1 could not tell them apart.
+#
+# Nothing about the detection changed. What was missing is that nobody counted.
+#
+#   0  ran, found nothing
+#   1  ran, found violations — the count is printed
+#   2  COULD NOT CHECK: no argument, or a target that does not exist
+FINDINGS=0
+finding() { FINDINGS=$((FINDINGS + 1)); }
+
+
 # Check if test directory exists
 if [ ! -d "$TEST_DIR" ]; then
-    echo -e "${RED}🔴 FAILING: Test directory '$TEST_DIR' doesn't exist${NC}"
-    echo "   → Where are the tests? Did you even write any?"
-    exit 1
+    echo "⚠️  check did NOT run: test directory '$TEST_DIR' does not exist"
+    echo "   → This is NOT a clean bill: nothing was examined."
+    exit 2
 fi
 
 # Function to assess coverage
@@ -42,7 +58,7 @@ assess_coverage() {
         coverage=$(npm run test:coverage 2>&1 | grep -oP '\d+\.\d+(?=%)' | head -1 || echo "0")
 
         if (( $(echo "$coverage < 50" | bc -l) )); then
-            echo -e "${RED}🔴 RAW: ${coverage}% coverage${NC}"
+            echo -e "${RED}🔴 RAW: ${coverage}% coverage${NC}"; finding
             echo "   → This is embarrassing. You're barely testing anything."
         elif (( $(echo "$coverage < 80" | bc -l) )); then
             echo -e "${YELLOW}🟡 ACCEPTABLE: ${coverage}% coverage${NC}"
@@ -83,7 +99,7 @@ assess_edge_cases() {
     done
 
     if [ "$found_count" -eq 0 ]; then
-        echo -e "${RED}🔴 RAW: No edge cases tested${NC}"
+        echo -e "${RED}🔴 RAW: No edge cases tested${NC}"; finding
         echo "   → You're only testing the happy path. That's not testing."
     elif [ "$found_count" -lt 3 ]; then
         echo -e "${YELLOW}🟡 ACCEPTABLE: Found $found_count edge case patterns${NC}"
@@ -102,7 +118,7 @@ assess_clarity() {
     # Check for descriptive test names
     unclear_tests=$(grep -r "test('test" "$TEST_DIR" 2>/dev/null | wc -l)
     if [ "$unclear_tests" -gt 0 ]; then
-        echo -e "${RED}🔴 RAW: Found $unclear_tests unclear test names${NC}"
+        echo -e "${RED}🔴 RAW: Found $unclear_tests unclear test names${NC}"; finding
         echo "   → 'test1', 'test2' - What are you testing? Use descriptive names."
     fi
 
@@ -129,7 +145,7 @@ assess_speed() {
         duration=$((end_time - start_time))
 
         if [ "$duration" -gt 60 ]; then
-            echo -e "${RED}🔴 RAW: Tests took ${duration}s${NC}"
+            echo -e "${RED}🔴 RAW: Tests took ${duration}s${NC}"; finding
             echo "   → Unit tests should run in seconds, not minutes."
             echo "   → Are you calling real databases/networks?"
         elif [ "$duration" -gt 10 ]; then
@@ -139,7 +155,7 @@ assess_speed() {
             echo -e "${GREEN}🟢 MICHELIN STAR: Tests took ${duration}s${NC}"
         fi
     else
-        echo -e "${RED}🔴 FAILING: Tests don't even pass${NC}"
+        echo -e "${RED}🔴 FAILING: Tests don't even pass${NC}"; finding
         echo "   → Fix your broken tests before worrying about speed."
     fi
 }
@@ -152,7 +168,7 @@ assess_stability() {
 
     # Check for flaky patterns
     if grep -ri "setTimeout\|sleep\|wait" "$TEST_DIR" > /dev/null 2>&1; then
-        echo -e "${RED}🔴 RAW: Timing-based tests detected${NC}"
+        echo -e "${RED}🔴 RAW: Timing-based tests detected${NC}"; finding
         echo "   → You're creating flaky tests. Use proper async/await."
     fi
 
@@ -166,7 +182,7 @@ assess_stability() {
     done
 
     if [ "$failures" -gt 0 ]; then
-        echo -e "${RED}🔴 RAW: Tests failed $failures/3 times${NC}"
+        echo -e "${RED}🔴 RAW: Tests failed $failures/3 times${NC}"; finding
         echo "   → FLAKY TESTS. These are worse than no tests."
         echo "   → Fix the non-determinism before merging."
     else
@@ -221,3 +237,14 @@ echo "  - 0% flaky"
 echo "  - Independent tests"
 echo ""
 echo "You know what good tests look like. Why aren't you writing them?"
+
+# ── Verdict ──────────────────────────────────────────────────────────────────
+# ADDED, never substituted: the closing prose above is this skill's character and a reader wants it.
+# What follows is the same answer in a form a gate can act on.
+echo ""
+if [ "$FINDINGS" -gt 0 ]; then
+    echo "VERDICT: $FINDINGS finding(s). Not ready."
+    exit 1
+fi
+echo "VERDICT: 0 findings."
+exit 0

package/templates/.claude/skills/cc-toolkit-generator-enhanced/modules/03-generate-p0.md

@@ -422,7 +422,7 @@ Copy these 6 skills from the user's skill set into `.claude/skills/`:
 |---|-------|-------------|-------------|
 | 11 | sparc-prd-mini | `/mnt/skills/user/sparc-prd-mini/` | `.claude/skills/sparc-prd-mini/` |
 | 12 | explore | `/mnt/skills/user/explore/` | `.claude/skills/explore/` |
-| 13 | goap-research | `/mnt/skills/user/goap-research/` | `.claude/skills/goap-research/` |
+| 13 | goap-research | `/mnt/skills/user/goap-research/` | `.claude/skills/goap-research-ed25519/` |
 | 14 | problem-solver-enhanced | `/mnt/skills/user/problem-solver-enhanced/` | `.claude/skills/problem-solver-enhanced/` |
 | 15 | requirements-validator | `/mnt/skills/user/requirements-validator/` | `.claude/skills/requirements-validator/` |
 | 16 | brutal-honesty-review | `/mnt/skills/user/brutal-honesty-review/` | `.claude/skills/brutal-honesty-review/` |
@@ -438,7 +438,7 @@ After copying, rewrite ALL `view()` paths in `sparc-prd-mini/SKILL.md`:
 External skill paths (3 rewrites):
 ```
 /mnt/skills/user/explore/SKILL.md                    -> .claude/skills/explore/SKILL.md
-/mnt/skills/user/goap-research/SKILL.md               -> .claude/skills/goap-research/SKILL.md
+/mnt/skills/user/goap-research/SKILL.md               -> .claude/skills/goap-research-ed25519/SKILL.md
 /mnt/skills/user/problem-solver-enhanced/SKILL.md     -> .claude/skills/problem-solver-enhanced/SKILL.md
 ```
 
@@ -458,10 +458,12 @@ Lines 951-953: Dependency Version Note -- update paths to .claude/skills/
 
 **Note on `goap-research` name mapping:** The skill name `goap-research` in the
 lifecycle context maps to `goap-research-ed25519` in this repository. Ensure the
-correct directory name is used when copying.
+correct directory name is used when copying — the **Output paths** below therefore name
+`goap-research-ed25519`, not `goap-research`. Until 2026-08-27 they named the short form, which is
+the alias and never a real directory: the list contradicted the note directly above it.
 
 **Output paths:** `.claude/skills/sparc-prd-mini/`, `.claude/skills/explore/`,
-`.claude/skills/goap-research/`, `.claude/skills/problem-solver-enhanced/`,
+`.claude/skills/goap-research-ed25519/`, `.claude/skills/problem-solver-enhanced/`,
 `.claude/skills/requirements-validator/`, `.claude/skills/brutal-honesty-review/`
 
 ---

package/templates/.claude/skills/cc-toolkit-generator-enhanced/modules/08-skill-composition.md

@@ -201,8 +201,8 @@ FOR each copied_file IN target_skill_directory:
 
 ```
 # Before (claude.ai format):
-Read `/mnt/skills/user/explore/SKILL.md` for clarification protocol.
-Scan `/mnt/user-data/uploads/` for documents.
+Read `.claude/skills/explore/SKILL.md` for clarification protocol.
+Scan `docs/` for documents.
 Write output to `/output/validation-report.md`.
 
 # After (Claude Code local format):

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/ddd-hooks-commands.md

@@ -70,13 +70,43 @@ Enhanced hooks and commands for DDD-aware Claude Code instruments.
 #!/bin/bash
 # Validates aggregate doesn't exceed size limits
 # Source: Fitness Function FF-02
+#
+# THREE exit codes, and the third is the point:
+#   0  within limits
+#   1  over the limit — the count and the limit are both reported
+#   2  THE CHECK DID NOT RUN — unreadable file, or an unsubstituted threshold
+#
+# A guard that answers "OK" when it could not look turns an unknown into a reassurance. MEASURED
+# before this contract existed: four declarations minified onto ONE line reported OK against a limit
+# of two, a missing file reported OK, and an unsubstituted {{...}} placeholder reported OK FOREVER —
+# `[ 4 -gt "{{MAX_ENTITIES_FROM_FITNESS}}" ]` is an invalid comparison, so the `if` is simply false.
 
 FILE="$1"
 MAX_ENTITIES={{MAX_ENTITIES_FROM_FITNESS}}
 MAX_METHODS={{MAX_METHODS_FROM_FITNESS}}
 
-# Count entities (rough heuristic)
-ENTITY_COUNT=$(grep -c "class.*Entity" "$FILE" 2>/dev/null || echo 0)
+if [ -z "$FILE" ]; then
+    echo "⚠️  check did NOT run: no file given (usage: $0 <file>)"
+    exit 2
+fi
+if [ ! -r "$FILE" ]; then
+    echo "⚠️  check did NOT run: cannot read $FILE"
+    exit 2
+fi
+# An unsubstituted placeholder must REFUSE, not pass. Otherwise a generator that failed to
+# substitute ships a guard that can never say no, and says nothing about it.
+case "$MAX_ENTITIES" in
+    ''|*[!0-9]*)
+        echo "⚠️  check did NOT run: MAX_ENTITIES is not a number ('$MAX_ENTITIES')."
+        echo "    The generator did not substitute {{MAX_ENTITIES_FROM_FITNESS}}."
+        exit 2
+        ;;
+esac
+
+# OCCURRENCES, not lines: `grep -c` counts matching LINES, so four declarations on one line count
+# as one. `|| true` because grep exits 1 when nothing matches, which is a legitimate count of zero.
+ENTITY_COUNT=$(grep -oE "class[A-Za-z0-9_ ]*Entity" "$FILE" | wc -l | tr -d ' ')
+[ -z "$ENTITY_COUNT" ] && ENTITY_COUNT=0
 
 if [ "$ENTITY_COUNT" -gt "$MAX_ENTITIES" ]; then
     echo "❌ VIOLATION: Aggregate has $ENTITY_COUNT entities (max: $MAX_ENTITIES)"
@@ -84,7 +114,7 @@ if [ "$ENTITY_COUNT" -gt "$MAX_ENTITIES" ]; then
     exit 1
 fi
 
-echo "✅ Aggregate size OK"
+echo "✅ Aggregate size OK ($ENTITY_COUNT entities, max $MAX_ENTITIES)"
 exit 0
 ```
 
@@ -114,7 +144,13 @@ if [ "$VIOLATIONS" -gt 0 ]; then
     echo "Found $VIOLATIONS potential DDD violations"
 fi
 
-exit 0  # Warnings only, don't block
+# ADVISORY, by design and stated out loud. This reporter never blocks: it prints what it noticed
+# and exits 0 whatever it found. That is a legitimate shape — but a reader must not mistake a
+# reporter for a gate, so it says so in its OWN OUTPUT rather than only in a comment nobody reads.
+echo ""
+echo "ℹ️  advisory only — this reporter never blocks (exit 0 regardless of findings)."
+echo "    For a check that can refuse, see validate-aggregate-size.sh (exit 0/1/2)."
+exit 0
 ```
 
 ---

package/templates/.claude/skills/cc-toolkit-generator-enhanced/references/templates/feature-lifecycle.md

@@ -12,7 +12,7 @@ When generating the toolkit, **copy these skills from the user's skill set** int
 # Source paths (Claude.ai user skills)
 /mnt/skills/user/sparc-prd-mini/          → .claude/skills/sparc-prd-mini/
 /mnt/skills/user/explore/                  → .claude/skills/explore/
-/mnt/skills/user/goap-research/            → .claude/skills/goap-research/
+/mnt/skills/user/goap-research/            → .claude/skills/goap-research-ed25519/
 /mnt/skills/user/problem-solver-enhanced/  → .claude/skills/problem-solver-enhanced/
 /mnt/skills/user/requirements-validator/   → .claude/skills/requirements-validator/
 /mnt/skills/user/brutal-honesty-review/    → .claude/skills/brutal-honesty-review/
@@ -26,7 +26,7 @@ After copying, rewrite ALL `view()` paths in `sparc-prd-mini/SKILL.md`:
 External skill paths (3):
 ```
 /mnt/skills/user/explore/SKILL.md            → .claude/skills/explore/SKILL.md
-/mnt/skills/user/goap-research/SKILL.md      → .claude/skills/goap-research/SKILL.md
+/mnt/skills/user/goap-research/SKILL.md      → .claude/skills/goap-research-ed25519/SKILL.md
 /mnt/skills/user/problem-solver-enhanced/SKILL.md → .claude/skills/problem-solver-enhanced/SKILL.md
 ```
 

package/templates/.claude/skills/requirements-validator/SKILL.md

@@ -134,6 +134,58 @@ apply additional security validation:
 - Cross-tenant access attempt (if multi-tenant)
 - Rate limiting / brute force scenario (if auth endpoint)
 
+### Growth Traceability (scoring: +5 present / +0 not applicable / -10 applicable but absent)
+
+Phase 0's M5 module analyses how a competitor grows and emits a `Growth Requirements Seed` table of
+`FR-GROWTH-<nnn>` draft obligations into `docs/product-discovery-brief.md`. This criterion asks one
+question: **did those obligations survive into `docs/Specification.md`, or were they analysed and
+dropped?**
+
+**APPLICABILITY — decide this FIRST, and it is not about project type.** The criterion applies when
+**acquisition or adoption is in scope** — the same condition `/replicate` already gates M5 on
+("If acquisition/adoption in scope (incl. B2B)"). Concretely:
+
+| Situation | Applicable? | Score |
+|---|:---:|---|
+| `docs/product-discovery-brief.md` exists and its seed table has ≥1 `FR-GROWTH-nnn` row | YES | +5 traced · -10 not traced |
+| The brief exists and its seed table says `нет` / is empty | no | +0 |
+| No acquisition or adoption objective (internal tool, on-prem, replacement of an existing internal system) | no | +0 |
+| `docs/product-discovery-brief.md` is ABSENT | no | +0 — see below |
+
+**An absent brief is +0, never -10.** Absence means Phase 0 did not run (the `--from-docs` entry
+skips it). Penalising a project for not running an optional phase would send every `--from-docs`
+project into a permanent NEEDS WORK loop, which is the exact trap already closed for the Measurable
+criterion. "Phase 0 did not run" is not "the growth requirements are missing".
+
+**What TRACED means.** For each `FR-GROWTH-nnn` row in the brief, one of two things is true in
+`docs/Specification.md`:
+
+- the id `FR-GROWTH-nnn` appears (case-sensitive, the exact token — not a title, not a paraphrase), **or**
+- the requirement was consciously rejected, and the rejection is written down with its reason.
+
+A silently dropped row is the defect. A row rejected on the record is not.
+
+| Check | Red Flags |
+|-------|-----------|
+| Every non-SPECULATIVE seed row is traced or rejected on the record | ids present in the brief, absent from the Specification, no rejection noted |
+| Rejections carry a reason | "не берём" with no reason — indistinguishable from forgetting |
+| `SPECULATIVE` rows were not promoted silently | a `[H]`-sourced row promoted to a firm requirement with no human decision recorded |
+
+**Scoring Bonus:** +5 if every applicable seed row is traced or rejected on the record, +0 if not
+applicable per the table above, -10 if the seed table carries rows and the Specification traces none
+of them (BLOCKED if the score drops below 50).
+
+**This criterion scores OUTSIDE the 100-point INVEST/SMART table**, exactly like Security. It adds no
+weight to any existing criterion — the weight table and everything derived from it are unchanged.
+
+**Honest limit.** This proves an obligation was CARRIED FORWARD, not that it was built, and not that
+copying the competitor's growth move is lawful. Legality is not assessed anywhere in this pipeline.
+
+**Deterministic counterpart.** `node .claude/hooks/check-growth-trace.cjs .` answers the same
+question mechanically (0 traced · 1 rows present and none traced · 2 the check did not run). This
+section is a prose gate read by a model; the utility is the deterministic one. Run it when the answer
+has to be more than a judgement.
+
 ### BDD Scenario Generation
 
 For each requirement, generate scenarios covering:

package/templates/.claude/skills/reverse-engineering-unicorn/modules/01-intelligence.md

@@ -38,7 +38,7 @@
 
 ### 🔵 Режим DEEP
 
-> ⚙️ **Перед началом:** `view(/mnt/skills/user/goap-research-ed25519/SKILL.md)`
+> ⚙️ **Перед началом:** `view(.claude/skills/goap-research-ed25519/SKILL.md)`
 > Примени GOAP-методологию вместо статического списка.
 
 **Phase 1 — State Assessment:**
@@ -110,7 +110,7 @@ confidence = base_reliability × recency_factor
 ### 🟣 Режим VERIFIED (Ed25519)
 
 > ⚙️ **Перед началом:** 
-> 1. `view(/mnt/skills/user/goap-research-ed25519/SKILL.md)`
+> 1. `view(.claude/skills/goap-research-ed25519/SKILL.md)`
 > 2. Установи зависимости:
 > ```bash
 > python3 -m venv .venv
@@ -120,8 +120,8 @@ confidence = base_reliability × recency_factor
 > 3. Запусти инициализацию:
 > ```python
 > # Скопируй и запусти скрипт из:
-> # /mnt/skills/user/goap-research-ed25519/scripts/ed25519_verifier.py
-> # /mnt/skills/user/goap-research-ed25519/scripts/goap_planner.py
+> # .claude/skills/goap-research-ed25519/scripts/ed25519_verifier.py
+> # .claude/skills/goap-research-ed25519/scripts/goap_planner.py
 > ```
 
 **Всё из режима DEEP, плюс:**

package/templates/.claude/skills/reverse-engineering-unicorn/modules/02-product-customers.md

@@ -37,7 +37,7 @@
 ### 🔵 Режим DEEP
 
 > ⚙️ **Загрузи:**
-> 1. `view(/mnt/skills/user/goap-research-ed25519/SKILL.md)` — адаптивный поиск отзывов
+> 1. `view(.claude/skills/goap-research-ed25519/SKILL.md)` — адаптивный поиск отзывов
 > 2. `view(references/jtbd-canvas.md)` — JTBD framework + примеры
 
 **GOAP State Assessment:**
@@ -73,7 +73,7 @@ sample_size_factor: 1.0 (≥20 reviews), 0.8 (10-19), 0.5 (<10)
 
 ### 🟣 Режим VERIFIED
 
-> ⚙️ **Дополнительно:** `view(/mnt/skills/user/goap-research-ed25519/SKILL.md)`
+> ⚙️ **Дополнительно:** `view(.claude/skills/goap-research-ed25519/SKILL.md)`
 
 Всё из DEEP, плюс:
 - Каждая цитата клиента получает `source_hash` и, где доступно, provenance signature

package/templates/.claude/skills/reverse-engineering-unicorn/modules/025-cjm-prototype.md

@@ -99,7 +99,15 @@ why_now: [из M2 Section E — 4 фактора]
 
 ### Step 3: Generate React Prototype
 
-> ⚙️ `view(/mnt/skills/public/frontend-design/SKILL.md)` — для design quality
+> ⚙️ **`frontend-design` — OPTIONAL, ВНЕШНИЙ.** Этот пакет его не отгружает. Пути вида
+> `.claude/skills/frontend-design/` здесь намеренно НЕТ: он выглядел бы рабочим и не резолвился бы,
+> а путь, который врёт, хуже честно чужого.
+>
+> Если навык установлен — читайте его для design quality. **Fallback, если его нет:** стройте
+> прототип по секции ниже, она самодостаточна; в отчёте пометьте, что оценка design quality не
+> проводилась. Молча пропускать нельзя (см. `.claude/rules/skill-interface-protocol.md` §6).
+>
+> Установить: `dz init --select frontend-design`.
 > ⚙️ `view(examples/noom-cjm-example.md)` — few-shot: структура .jsx
 
 **Создай один .jsx файл** со следующей архитектурой:

package/templates/.claude/skills/reverse-engineering-unicorn/modules/03-market-competition.md

@@ -40,8 +40,8 @@
 ### 🔵 Режим DEEP
 
 > ⚙️ **Загрузи перед началом:**
-> 1. `view(/mnt/skills/user/goap-research-ed25519/SKILL.md)` — для рыночного research
-> 2. `view(/mnt/skills/user/problem-solver-enhanced/SKILL.md)` — Modules 4, 5, 6 — для конкурентного анализа
+> 1. `view(.claude/skills/goap-research-ed25519/SKILL.md)` — для рыночного research
+> 2. `view(.claude/skills/problem-solver-enhanced/SKILL.md)` — Modules 4, 5, 6 — для конкурентного анализа
 
 #### PHASE A: GOAP Market Research
 
@@ -159,7 +159,7 @@ Incumbent  │  (-2, +1)    |  (0, +2)       │  Ценовая война
 
 ### 🟣 Режим VERIFIED (Ed25519)
 
-> ⚙️ **Дополнительно:** `view(/mnt/skills/user/goap-research-ed25519/SKILL.md)`
+> ⚙️ **Дополнительно:** `view(.claude/skills/goap-research-ed25519/SKILL.md)`
 
 Всё из режима DEEP, плюс:
 

package/templates/.claude/skills/reverse-engineering-unicorn/modules/04-business-finance.md

@@ -41,8 +41,8 @@
 ### 🔵 Режим DEEP
 
 > ⚙️ **Загрузи:**
-> 1. `view(/mnt/skills/user/goap-research-ed25519/SKILL.md)` — адаптивный research
-> 2. `view(/mnt/skills/user/problem-solver-enhanced/SKILL.md)` — Modules 1, 6
+> 1. `view(.claude/skills/goap-research-ed25519/SKILL.md)` — адаптивный research
+> 2. `view(.claude/skills/problem-solver-enhanced/SKILL.md)` — Modules 1, 6
 
 #### PHASE A: GOAP Financial Research
 
@@ -111,7 +111,7 @@ Physical: "Команда должна быть БОЛЬШОЙ (для скор
 
 ### 🟣 Режим VERIFIED
 
-> ⚙️ **Дополнительно:** `view(/mnt/skills/user/goap-research-ed25519/SKILL.md)`
+> ⚙️ **Дополнительно:** `view(.claude/skills/goap-research-ed25519/SKILL.md)`
 
 Всё из DEEP, плюс:
 - Все benchmark числа получают source_hash; issuer-grade crypto используется только при valid signature under pinned active key