@erclx/aitk 0.8.0

package/tooling/base/configs/.husky/pre-commit

@@ -0,0 +1 @@
+bunx lint-staged

package/tooling/base/configs/.husky/pre-push

@@ -0,0 +1 @@
+bun run check

package/tooling/base/configs/.prettierrc

@@ -0,0 +1,12 @@
+{
+  "semi": false,
+  "singleQuote": true,
+  "overrides": [
+    {
+      "files": "*.mdc",
+      "options": {
+        "parser": "markdown"
+      }
+    }
+  ]
+}

package/tooling/base/configs/.shellcheckrc

@@ -0,0 +1 @@
+external-sources=true

package/tooling/base/configs/.vscode/extensions.json

@@ -0,0 +1,9 @@
+{
+  "recommendations": [
+    "esbenp.prettier-vscode",
+    "streetsidesoftware.code-spell-checker",
+    "mkhl.shfmt",
+    "timonwong.shellcheck",
+    "mads-hartmann.bash-ide-vscode"
+  ]
+}

package/tooling/base/configs/.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+  "shellcheck.customArgs": ["--severity=warning"]
+}

package/tooling/base/configs/commitlint.config.js

@@ -0,0 +1,11 @@
+const config = {
+  extends: ['@commitlint/config-conventional'],
+  rules: {
+    'subject-case': [0],
+    'header-max-length': [2, 'always', 72],
+    'scope-case': [2, 'always', 'lower-case'],
+    'subject-full-stop': [2, 'never', '.'],
+  },
+}
+
+export default config

package/tooling/base/configs/scripts/clean.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+set -e
+set -o pipefail
+
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+WHITE='\033[1;37m'
+GREY='\033[0;90m'
+NC='\033[0m'
+
+log_info() { echo -e "${GREY}│${NC} ${GREEN}✓${NC} $1"; }
+log_error() {
+  echo -e "${GREY}│${NC} ${RED}✗${NC} $1"
+  exit 1
+}
+log_step() { echo -e "${GREY}│${NC}\n${GREY}├${NC} ${WHITE}$1${NC}"; }
+log_rem() { echo -e "${GREY}│${NC} ${RED}-${NC} $1"; }
+
+check_dependencies() {
+  command -v bun >/dev/null 2>&1 || log_error "bun is not installed"
+}
+
+main() {
+  check_dependencies
+
+  echo -e "${GREY}┌${NC}"
+
+  echo -e "${GREY}├${NC} ${WHITE}Cleaning artifacts${NC}"
+  rm -rf node_modules
+
+  log_rem "node_modules/"
+
+  log_step "Cleaning cache"
+  bun pm cache rm
+  log_info "Package manager cache cleared"
+
+  log_step "Rehydrating project"
+  bun install
+  log_info "Dependencies installed"
+
+  echo -e "${GREY}└${NC}\n"
+  echo -e "${GREEN}✓ Clean complete${NC}"
+}
+
+main "$@"

package/tooling/base/configs/scripts/update.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+set -e
+set -o pipefail
+
+GREEN='\033[0;32m'
+YELLOW='\033[0;33m'
+RED='\033[0;31m'
+WHITE='\033[1;37m'
+GREY='\033[0;90m'
+NC='\033[0m'
+
+log_info() { echo -e "${GREY}│${NC} ${GREEN}✓${NC} $1"; }
+log_warn() { echo -e "${GREY}│${NC} ${YELLOW}!${NC} $1"; }
+log_error() {
+  echo -e "${GREY}│${NC} ${RED}✗${NC} $1"
+  exit 1
+}
+log_step() { echo -e "${GREY}│${NC}\n${GREY}├${NC} ${WHITE}$1${NC}"; }
+
+pipe_output() { while IFS= read -r line; do echo -e "${GREY}│${NC}  $line"; done; }
+
+check_dependencies() {
+  command -v bun >/dev/null 2>&1 || log_error "bun is not installed"
+}
+
+main() {
+  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+  check_dependencies
+
+  echo -e "${GREY}┌${NC}"
+
+  echo -e "${GREY}├${NC} ${WHITE}Interactive dependency update${NC}"
+  echo -e "${GREY}│${NC}"
+  bun update --interactive
+
+  log_step "Verifying project health"
+  if [ -f "$SCRIPT_DIR/verify.sh" ]; then
+    VERIFY_NESTED=true "$SCRIPT_DIR/verify.sh"
+    log_info "All checks passed"
+  else
+    log_warn "Verification script not found, skipping."
+  fi
+
+  echo -e "${GREY}└${NC}\n"
+  echo -e "${GREEN}✓ Update complete${NC}"
+}
+
+main "$@"

package/tooling/base/configs/scripts/verify.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+set -e
+set -o pipefail
+
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+WHITE='\033[1;37m'
+GREY='\033[0;90m'
+NC='\033[0m'
+
+NESTED="${VERIFY_NESTED:-false}"
+
+log_info() { echo -e "${GREY}│${NC} ${GREEN}✓${NC} $1"; }
+log_error() {
+  echo -e "${GREY}│${NC} ${RED}✗${NC} $1"
+  exit 1
+}
+log_step() { echo -e "${GREY}│${NC}\n${GREY}├${NC} ${WHITE}$1${NC}"; }
+
+pipe_output() { while IFS= read -r line; do echo -e "${GREY}│${NC}  $line"; done; }
+
+check_dependencies() {
+  command -v bun >/dev/null 2>&1 || log_error "bun is not installed"
+}
+
+run_check() {
+  local cmd=$1
+  local err_msg=$2
+  local output
+  if ! output=$(eval "$cmd" 2>&1); then
+    echo "$output" | pipe_output
+    log_error "$err_msg"
+  fi
+  echo "$output" | pipe_output
+}
+
+main() {
+  check_dependencies
+
+  if [ "$NESTED" = false ]; then echo -e "${GREY}┌${NC}"; fi
+
+  echo -e "${GREY}├${NC} ${WHITE}Formatting${NC}"
+  run_check "bun run format" "Format failed"
+  log_info "Format applied"
+
+  log_step "Format check"
+  run_check "bun run check:format" "Format check failed"
+  log_info "Format check passed"
+
+  log_step "Spelling"
+  run_check "bun run check:spell" "Spell check failed"
+  log_info "Spell check passed"
+
+  log_step "Shell"
+  run_check "bun run check:shell" "Shell check failed"
+  log_info "Shell check passed"
+
+  if [ "$NESTED" = false ]; then
+    echo -e "${GREY}└${NC}\n"
+    echo -e "${GREEN}✓ Verification passed${NC}"
+  fi
+}
+
+main "$@"

package/tooling/base/manifest.toml

@@ -0,0 +1,32 @@
+[stack]
+name = "base"
+extends = ""
+runtime = "bun"
+scaffold = ""
+
+[sync]
+source = "configs"
+
+[dependencies.dev]
+packages = [
+    "prettier",
+    "cspell",
+    "husky",
+    "@commitlint/cli",
+    "@commitlint/config-conventional",
+]
+
+[scripts]
+"check:spell" = "cspell '**' '.*/**' '.*' --no-progress --color --show-context"
+"check:format" = "prettier --check --log-level warn --ignore-path .gitignore --ignore-path .prettierignore . && shfmt --diff --indent 2 scripts/"
+"check:shell" = "find scripts -name '*.sh' -exec shellcheck --severity=warning {} +"
+"format" = "prettier --write --log-level warn --ignore-path .gitignore --ignore-path .prettierignore . && shfmt --write --indent 2 scripts/"
+"prepare" = "husky"
+"check" = "./scripts/verify.sh"
+"clean" = "./scripts/clean.sh"
+"update" = "./scripts/update.sh"
+
+[gitignore]
+"# System" = [".DS_Store"]
+"# Dependencies" = ["node_modules/"]
+"# Secrets" = [".env", ".env.*", "*.local", "!.env.example"]

package/tooling/base/reference.md

@@ -0,0 +1,114 @@
+# Tooling base reference
+
+## Runtime
+
+- Use `bun` as package manager and script runner.
+- Use `bunx` instead of `npx` for one-off executables.
+
+## Prettier
+
+- Config: `.prettierrc` (JSON) at root.
+- Rules: `semi: false`, `singleQuote: true`.
+- Add parser overrides for non-standard extensions (e.g., `.mdx` → `markdown`).
+- Ignore paths via `.gitignore` and `.prettierignore`. Pass both as `--ignore-path` on all prettier invocations.
+- `.prettierignore` is a user-owned seed. It is created empty on install. Projects add their own entries.
+- Use `--log-level warn` on all prettier invocations to suppress per-file `(unchanged)` output.
+
+## Dev Dependencies
+
+- `prettier`, `cspell`, `husky`, `@commitlint/cli`, `@commitlint/config-conventional`.
+- Install via `bun add -D`.
+- Ensure `.gitignore` contains `node_modules/`.
+
+## CSpell
+
+- `cspell.json` is a user-owned seed at root. Sync drops it once on first install and never overwrites it. Projects extend it with extra `import` and `dictionaryDefinitions` entries.
+- The seeded baseline includes `version: "0.2"`, `language: "en"`, `useGitignore: true`, `gitignoreRoot: ["."]`, dictionary definitions for `project-terms` and `tech-stack`, and `ignorePaths: [".cspell/**", ".git/**"]` to skip dictionary self-checks and git object files. Both dictionary definitions set `addWords: true`.
+- `gitignoreRoot: ["."]` pins the `.gitignore` search to the project root. Without it, cspell run from inside a linked worktree under `.claude/worktrees/` walks up into the parent repo's `.gitignore`, resolves every worktree file as living under the ignored worktree path, and checks zero files. New words then pass locally and fail in CI. `gitignoreRoot` stops the walk at the root while the worktree's own `.gitignore` still excludes `node_modules` and build output.
+- Dictionary files in `.cspell/`: `project-terms.txt`, `tech-stack.txt`.
+- Include dotfolders in the spell glob: `cspell '**' '.*/**' '.*' ...`. The default `**` skips dot-prefixed folders, so `.claude/`, `.github/`, and `.husky/` go unchecked without explicit globs.
+- Keep dictionary entries sorted alphabetically, one word per line.
+
+## Shell Tooling
+
+- Format: `shfmt --indent 2 scripts/`. shfmt supports directory args natively, no `find` needed.
+- Lint: `find scripts -name '*.sh' -exec shellcheck --severity=warning {} +`. shellcheck has no directory mode, `find` is required.
+- Config: `.shellcheckrc` with `external-sources=true`. Required for shellcheck to follow `source` directives. Keep even with EditorConfig present.
+- All shell scripts live in `scripts/`. Do not place `.sh` files outside `scripts/`.
+- EditorConfig: `.editorconfig` at root with `[*.sh]` block enforcing `indent_style = space`, `indent_size = 2`. Prevents editor/shfmt conflicts that produce spurious git diffs.
+
+## Commit Lint
+
+- Config: `commitlint.config.js` (ESM default export).
+- Extends: `@commitlint/config-conventional`.
+- Rules: `header-max-length: 72`, `scope-case: lower-case`, `subject-full-stop: never`, `subject-case: disabled`.
+- Format: `<type>(<scope>): <subject>` (imperative mood, no trailing period).
+
+## Husky + Lint-Staged
+
+- `.lintstagedrc` is a user-owned seed at root. Sync drops it once on first install and never overwrites it. Projects extend it with extra glob → command entries (e.g. `aitk indexes regen`).
+- Seeded baseline globs:
+  - `**/*.{json,md,mdc}` → `["prettier --write --ignore-path .gitignore --ignore-path .prettierignore", "cspell --no-must-find-files"]`
+  - `**/*.md` → `["aitk indexes regen"]`
+  - `**/*.sh` → `["shfmt --write --indent 2", "shellcheck --severity=warning"]`
+- Hooks in `.husky/`:
+  - `pre-commit` → `bunx lint-staged`
+  - `commit-msg` → `bunx commitlint --edit "$1"`
+  - `pre-push` → `bun run check`
+  - `post-merge` → names `.claude/tasks/` archive candidates, silent otherwise and when the board is absent
+  - `post-rewrite` → delegates to `post-merge` on `rebase`, so a `pull.rebase=true` machine still gets the check
+- Husky runs hooks as `sh -e`, so a hook carrying logic is POSIX sh under errexit no matter what its shebang says.
+- Note: lint-staged handles its own glob expansion and passes matched files as arguments. `**/*.sh` is safe here, unlike in package.json scripts.
+
+## GitHub
+
+- PR template: `.github/pull_request_template.md`.
+- Sections: `## Summary`, `## Key Changes`, `## Technical Context`, `## Testing`.
+- Visuals: HTML comment only, never a visible section header.
+- Imperative mood, no "This PR" opener, no buzzwords, name specific files and functions.
+- CI workflow: `.github/workflows/verify.yml`. Runs on pull requests targeting `main` and on `workflow_dispatch`.
+- Workflow steps: checkout, setup Bun (latest), `bun install --frozen-lockfile`, install `shfmt` and `shellcheck` via apt, then `check:format`, `check:spell`, `check:shell`.
+- Does not run `format` before asserting. CI asserts only. Format must be clean before push.
+
+## Gitignore
+
+- `# System`: `.DS_Store`
+- `# Dependencies`: `node_modules/`
+- `# Secrets`: `.env`, `.env.*`, `*.local`, `!.env.example`
+
+## Scripts
+
+- Entry: `scripts/` directory with `verify.sh`, `clean.sh`, `update.sh`.
+- All scripts use logging functions from the bash script reference.
+- `verify.sh`: self-healing: runs `format` first to auto-fix AI-generated or drifted code, then asserts with `check:format`. Supports `VERIFY_NESTED=true` to suppress timeline boundaries when called by other scripts.
+- `clean.sh`: removes `node_modules/`, clears bun cache, reinstalls dependencies fresh.
+- `update.sh`: runs `bun update --interactive` then calls `verify.sh` with `VERIFY_NESTED=true` to confirm project health after updates.
+
+## EditorConfig
+
+- Config: `.editorconfig` at root, `root = true`.
+- `[*.sh]`: `indent_style = space`, `indent_size = 2`.
+- Ensures consistent shell script indentation across editors, preventing shfmt vs editor conflicts that produce spurious git diffs.
+
+## VS Code
+
+- Extensions: `esbenp.prettier-vscode`, `streetsidesoftware.code-spell-checker`, `mkhl.shfmt`, `timonwong.shellcheck`, `mads-hartmann.bash-ide-vscode`.
+- Settings: `shellcheck.customArgs: ["--severity=warning"]`.
+
+## Context
+
+- Seeded at `.claude/context/development.md` and `.claude/context/ci.md` on install. User-owned, never overwritten by sync.
+- Each carries `title` and `description` frontmatter so the files slot into `.claude/context/index.md` if the project adopts the `indexes` system. Indexes stay opt-in.
+- Extend freely with project-specific commands, workflows, or deploy steps. Canonical rationale stays in this reference.
+- The `.claude/context/` location matches the three-tier context model: project-wide invariants in `CLAUDE.md` and `.claude/REQUIREMENTS.md`/`.claude/ARCHITECTURE.md`, path-scoped rules in `.claude/rules/`, and on-demand domain narrative in `.claude/context/`.
+
+## Package Scripts
+
+- `check:spell`: runs cspell across all files, shows context on failures.
+- `check:format`: checks prettier and shfmt formatting without writing. shfmt targets `scripts/` directory directly. Uses `--log-level warn` and both `--ignore-path .gitignore --ignore-path .prettierignore`.
+- `check:shell`: runs shellcheck at warning severity via `find scripts -name '*.sh'` (shellcheck has no directory mode).
+- `format`: writes prettier and shfmt formatting in place. shfmt targets `scripts/` directory directly. Uses `--log-level warn` and both `--ignore-path .gitignore --ignore-path .prettierignore`.
+- `prepare`: initializes husky hooks (runs automatically on `bun install`).
+- `check`: runs `scripts/verify.sh`, the full verification suite. Auto-formats before asserting.
+- `clean`: runs `scripts/clean.sh`, wipes and reinstalls dependencies.
+- `update`: runs `scripts/update.sh`, interactive dependency update with verification.

package/tooling/base/seeds/.claude/context/ci.md

@@ -0,0 +1,27 @@
+---
+title: CI
+description: GitHub Actions workflow triggers and checks
+---
+
+# CI
+
+GitHub Actions workflow for this project.
+
+## Triggers
+
+- Pull requests targeting `main`
+- `workflow_dispatch` (manual run from the Actions tab)
+
+## Checks
+
+Defined in `.github/workflows/verify.yml`. All jobs must pass before merge.
+
+| Check  | Command                | What it asserts                    |
+| ------ | ---------------------- | ---------------------------------- |
+| Format | `bun run check:format` | prettier and shfmt are clean       |
+| Spell  | `bun run check:spell`  | cspell passes against dictionaries |
+| Shell  | `bun run check:shell`  | shellcheck passes at warning level |
+
+## Running CI locally
+
+`bun run check` runs the same three asserts plus auto-formats first. If CI fails on format, run `bun run check` locally and commit the diff.

package/tooling/base/seeds/.claude/context/development.md

@@ -0,0 +1,32 @@
+---
+title: Development
+description: Local dev workflow, scripts, and husky hooks
+---
+
+# Development
+
+Local dev workflow for this project.
+
+## Setup
+
+- Install [Bun](https://bun.sh): `curl -fsSL https://bun.sh/install | bash`
+- Install dependencies: `bun install`
+
+## Scripts
+
+| Command          | Purpose                                              |
+| ---------------- | ---------------------------------------------------- |
+| `bun run check`  | Full verification. Auto-formats, then asserts clean. |
+| `bun run format` | Auto-fix prettier and shfmt formatting.              |
+| `bun run clean`  | Wipe `node_modules/`, clear bun cache, reinstall.    |
+| `bun run update` | Interactive `bun update` followed by verification.   |
+
+## Shell scripts
+
+All `.sh` files live under `scripts/`. Do not place shell scripts outside `scripts/`.
+
+## Husky hooks
+
+- `pre-commit` runs `lint-staged` (prettier, cspell, shfmt, shellcheck on staged files).
+- `commit-msg` runs `commitlint` against the conventional commit format.
+- `pre-push` runs `bun run check`. After pushing, run `git status`. If files changed, commit the diff as `style(<scope>):` and push again.

package/tooling/base/seeds/.cspell/tech-stack.txt

@@ -0,0 +1,19 @@
+aitk
+bradlc
+bunx
+commitlint
+dbaeumer
+dotfolders
+esbenp
+frontmatter
+lintstagedrc
+mkhl
+parallelizable
+scannability
+shellcheck
+shfmt
+timonwong
+wireframe
+wireframes
+worktree
+worktrees

package/tooling/base/seeds/.lintstagedrc

@@ -0,0 +1,8 @@
+{
+  "**/*.{json,md,mdc}": [
+    "prettier --write --ignore-path .gitignore --ignore-path .prettierignore",
+    "cspell --no-must-find-files"
+  ],
+  "**/*.md": ["aitk indexes regen"],
+  "**/*.sh": ["shfmt --write --indent 2", "shellcheck --severity=warning"]
+}

package/tooling/base/seeds/cspell.json

@@ -0,0 +1,20 @@
+{
+  "version": "0.2",
+  "language": "en",
+  "useGitignore": true,
+  "gitignoreRoot": ["."],
+  "dictionaryDefinitions": [
+    {
+      "name": "project-terms",
+      "path": ".cspell/project-terms.txt",
+      "addWords": true
+    },
+    {
+      "name": "tech-stack",
+      "path": ".cspell/tech-stack.txt",
+      "addWords": true
+    }
+  ],
+  "dictionaries": ["project-terms", "tech-stack"],
+  "ignorePaths": [".cspell/**", ".git/**"]
+}

package/tooling/claude/manifest.toml

@@ -0,0 +1,11 @@
+# Consumed only by `aitk claude init`. Claude is not a discoverable tooling stack
+# and is excluded from `aitk tooling` discovery via scripts/lib/tooling.sh.
+
+[stack]
+name = "claude"
+extends = ""
+runtime = ""
+scaffold = ""
+
+[gitignore]
+"# Claude" = [".claude/.tmp/", ".claude/memory/", ".claude/plans/", ".claude/review/", ".claude/worktrees/", ".claude/tasks/"]

package/tooling/claude/reference.md

@@ -0,0 +1,62 @@
+# Tooling Claude reference
+
+## Overview
+
+The claude stack installs the `.claude/` workflow directory into a project. State docs are seeds, written once and never overwritten by tooling. `CLAUDE.md` is a seed, filled in per project after init.
+
+## Structure
+
+```plaintext
+.claude/
+├── CLAUDE.md          ← seeded. Project context and rules, auto-loaded by Claude Code each session
+├── tasks/             ← seeded then gitignored. One file per task plus a generated index.md, local scratch only
+├── REQUIREMENTS.md    ← seeded. Project goals, non-goals, MVP scope
+├── ARCHITECTURE.md    ← seeded. Technical design decisions and open questions
+├── DESIGN.md          ← seeded. Visual intent and the decisions behind it
+├── wireframes/        ← seeded. Per-surface ASCII layouts. `index.md` is the discovery anchor; `<surface>.md` files hold the sketches and behavior bullets.
+├── GOV.md             ← retired. Removed by `aitk gov sync` if present from a prior install
+├── settings.json      ← seeded. Project-level Claude Code config (PreToolUse and PostToolUse hooks). User-level config installed separately via `aitk claude setup`.
+├── plans/             ← execution detail for multi-step tasks, gitignored. `feature-*.md` entries swept by claude-docs.
+├── review/            ← scratch for claude-review and claude-ui-test output, gitignored
+├── .tmp/              ← ephemeral scratch space, gitignored
+└── memory/            ← session memory files, gitignored
+```
+
+## Upgrading from a single-file board
+
+A project installed before the board became a folder still holds `.claude/TASKS.md`. Nothing migrates it. `aitk claude init` seeds an empty `.claude/tasks/index.md` beside it and leaves the old file untouched, so every skill reads the empty catalog while the real board sits unreferenced.
+
+Convert by hand, once per project:
+
+1. Split each `###` block into `.claude/tasks/vXX.Y-<slug>.md`, adding the `title` and `description` frontmatter that `.claude/standards/tasks.md` requires. Compare each new file against the block it came from rather than checking that every block landed somewhere.
+2. Run `aitk indexes regen --no-stage --root . .claude/tasks/<any-task>.md` to build the catalog.
+3. Delete `.claude/TASKS.md`, and swap its `.gitignore` entry for `.claude/tasks/`.
+
+## Gitignore
+
+- `# Claude`: `.claude/.tmp/`, `.claude/memory/`, `.claude/plans/`, `.claude/review/`, `.claude/worktrees/`, `.claude/tasks/`
+
+## CLI
+
+| Command             | What it does                                                                                                                |
+| ------------------- | --------------------------------------------------------------------------------------------------------------------------- |
+| `aitk claude init`  | Seeds `.claude/` workflow docs, updates `.gitignore`                                                                        |
+| `aitk claude sync`  | Reconciles `.gitignore` against the manifest. Reports seeded file status.                                                   |
+| `aitk claude setup` | Installs user-level config to `~/.claude/`: statusline, attribution, and permission allows or denies. Run once per machine. |
+
+## CLAUDE.md
+
+- Ships as a seed with placeholder project name, description, and key paths. Fill these in after init.
+- Section layout: `Context`, `Indexes`, `Markdown`, `Key paths`, `Spelling`, `Snippets`, `Tasks`, `Memory`. Each section groups rules that share a surface so skills can detect, extend, or skip by heading.
+- The memory rules favor signal over volume. Saving only after a second occurrence or an explicit user correction keeps entries focused on patterns worth preventing, not first-occurrence slips. The 3-line cap stops the built-in auto-memory from drifting into narrative writeups that bury the rule underneath the recovery story.
+- The `Context` section points at `.claude/` state docs one line. `claude-feature` does the parallel read when invoked. The seed intentionally does not re-list every file.
+
+## Seed docs
+
+- Seed docs ship with a guidelines preamble above the first H2. These are instructions Claude internalizes before filling in the sections below. They are not sections to populate.
+
+## settings.json
+
+- Project seed at `tooling/claude/seeds/.claude/settings.json` ships two PreToolUse hooks (pairing with `.claude/hooks/index-reminder.sh` and `.claude/hooks/scratch-guard.sh`) and a PostToolUse hook (pairs with `.claude/hooks/standards-audit.sh`). Project settings layer over user settings, so per-project files only carry what is genuinely project-specific.
+- User-level template at `tooling/claude/user/settings.template.json` carries `attribution.commit` and `attribution.pr` (empty strings to suppress co-author tags), `permissions.allow` with `Bash(bun run *)`, and `permissions.deny` with `Read(**/.env)` and `Read(**/.env.*)` to block accidental secret exposure across any project. Installed once per machine via `aitk claude setup`.
+- The deprecated `includeCoAuthoredBy` key is not used.

package/tooling/claude/seeds/.claude/ARCHITECTURE.md

@@ -0,0 +1,13 @@
+# Architecture
+
+Authoring guidance: `.claude/standards/architecture.md`.
+
+## Overview
+
+## Key technical decisions
+
+### Decision name
+
+Reasoning and tradeoffs.
+
+## Risks / open questions

package/tooling/claude/seeds/.claude/DESIGN.md

@@ -0,0 +1,62 @@
+# Design
+
+Authoring guidance: `.claude/standards/design.md`.
+
+## Personality
+
+One paragraph. Voice, tone, and the feeling a user should have. The same content a design intake form asks for.
+
+## Color
+
+One row per role. Intent is a short phrase a human can picture. Value is a hex or a named system token.
+
+| Role       | Intent                        | Value |
+| ---------- | ----------------------------- | ----- |
+| background | page canvas                   |       |
+| surface    | cards, panels, raised blocks  |       |
+| text       | primary body text             |       |
+| muted      | secondary text, captions      |       |
+| accent     | links, primary action         |       |
+| success    | confirmations, positive state |       |
+| warning    | cautions, pending state       |       |
+| error      | failures, destructive action  |       |
+
+## Typography
+
+One row per role. Size and line height in pixels or rem. Family names use their product casing.
+
+| Role    | Family | Weight | Size | Line height |
+| ------- | ------ | ------ | ---- | ----------- |
+| display |        |        |      |             |
+| heading |        |        |      |             |
+| body    |        |        |      |             |
+| label   |        |        |      |             |
+| code    |        |        |      |             |
+
+## Spacing
+
+Base unit and scale. The renderer draws a swatch per step.
+
+| Step | Multiplier | Value |
+| ---- | ---------- | ----- |
+| xs   | 0.5        |       |
+| sm   | 1          |       |
+| md   | 2          |       |
+| lg   | 3          |       |
+| xl   | 5          |       |
+
+## Borders
+
+| Role    | Radius | Width | When used             |
+| ------- | ------ | ----- | --------------------- |
+| default |        |       | cards, inputs         |
+| pill    |        |       | tags, status chips    |
+| none    | 0      | 0     | edge-to-edge surfaces |
+
+## Motion
+
+One line. State whether motion is used at all, and if so, the default duration and easing.
+
+## Iconography
+
+One line. Style (outline, filled, duotone), source library, and whether custom icons are allowed.

package/tooling/claude/seeds/.claude/REQUIREMENTS.md

@@ -0,0 +1,18 @@
+# Requirements
+
+Authoring guidance: `.claude/standards/requirements.md`.
+
+## Problem
+
+## Goals
+
+## Non-goals
+
+## MVP features
+
+1. Feature: description
+2. Feature: description
+
+## Tech stack
+
+## Constraints

package/tooling/claude/seeds/.claude/context/index.md

@@ -0,0 +1,8 @@
+---
+title: Context
+subtitle: Per-domain narrative loaded on demand
+---
+
+# Context
+
+Per-domain narrative loaded on demand