@erclx/aitk 3.48.1 → 3.50.0

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "aitk",
   "description": "Automated governance, versioning, and discovery tools for Claude Code.",
-  "version": "3.48.1",
+  "version": "3.50.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/claude-autoship/SKILL.md

@@ -97,12 +97,30 @@ If all UI changes are covered by e2e tests, continue.
 
 ## Step 5: review
 
-Classify the diff first. Take the union of `git diff --name-only <base>` and `git ls-files --others --exclude-standard`, resolving `<base>` per Diff baseline. The classifier reads names only.
+Classify the diff first. Take the union of `git diff --name-only <base>` and `git ls-files --others --exclude-standard`, resolving `<base>` per Diff baseline, then hand that set to the verb rather than reading it against the list below yourself:
+
+```bash
+aitk autoship classify --json <path>...
+```
+
+The verb reads names only and touches git not at all, so the set stays the one this step already computed and no second baseline resolves to disagree with the first. Branch on the record's `decision` rather than on the exit code, which a shell function wrapping `aitk` can flatten to zero.
+
+- `skip`. Every path reads as prose and none states agent behavior. Skip review entirely and continue to Step 7.
+- `review`. Invoke `aitk:claude-review`. The record names the `file` that decided it and the `test` it failed, `extension` for a path that is not prose and `behavior-path` for prose that states what an agent does.
+- `refused`, carrying reason `no-changes`. The changed set was empty, so take the stop below.
+
+Say in the run which of the two decided, the verb or the written fallback, since a reader otherwise cannot tell a classification from a judgment.
 
 An empty list stops the chain: `❌ No changed files to classify. Re-run when the plan has yet to produce its output. When the output is gitignored by design, autoship cannot ship it, so take the work out of the chain.` An empty list satisfies the prose-only test vacuously, so reading it as prose-only routes the branch past review instead of through it.
 
 The two causes want different responses. A plan that has yet to produce its output is a re-run once it has. A plan whose output is gitignored by design, such as a read pass writing to `.claude/.tmp/`, is work the chain cannot carry at all, since `git-stage` finds nothing to commit six steps later. Never advise removing the output from `.gitignore`, which trades a stopped run for scratch committed into the repository.
 
+### When the verb is absent
+
+The verb ships with the CLI and this body ships with the plugin, so a target holding an older binary meets a missing subcommand. Apply the written test by hand there, and say the fallback decided it.
+
+Never read an absent subcommand as a skip. Failing open is the exact defect the verb closes, and a shell that answers `command not found` reaching a body that skips on anything other than a `skip` record would ship every branch unreviewed.
+
 The skip needs both tests to pass: every changed file matches `*.md` or `*.txt`, and no changed file sits under a behavior path. On a pass, skip review entirely and continue to Step 7. Otherwise invoke `aitk:claude-review`.
 
 Behavior paths carry two spellings, the one a surface authors at and the one it reaches a session at, so the rule reads the same in a toolkit and in a project that consumed one:
@@ -120,6 +138,8 @@ Informational prose is already gated by `docs-sync`, `claude-standards-audit`, a
 
 The list covers this toolkit's authoring layout and the layout it installs, which is not every layout. A project keeping executable prose where neither spelling reaches adds the path, and until it does every branch touching it skips review silently.
 
+The verb reads the same set from `src/autoship/paths.ts`, so a path added here belongs there too and a path added there belongs here. Two copies is what the fallback costs, and it stands until a release retires the written half.
+
 ## Step 6: evaluate findings
 
 Skip this step when Step 5 skipped review. Otherwise read `.claude/review/branch/review-<slug>.md` at the main worktree root. Split every finding by origin before parsing the summary line (`X critical, Y should-fix, Z minor`), since the stop exists for a defect the branch inherited rather than for one this run introduced.

package/docs/agents/commands.md

@@ -55,10 +55,12 @@ Full help: `aitk <command> --help`. Behavior notes for the install and sync verb
 | `aitk gov test-order`      | Report where an implementation reached history ahead of the test covering it (`--json`)                                                                               |
 | `aitk gov superseded`      | Report where the tree still asserts a value a changed convention no longer produces, keyed on the value and on the family stem behind a templated citation (`--json`) |
 | `aitk gov restated`        | Report every instruction the always-loaded file or a rule shares with the seed, a shipped skill body, or another rule, classed and with its anchors named (`--json`)  |
+| `aitk gov citations`       | Resolve every path a rule cites and every internal frontmatter glob, failing on one reaching nothing (`--json`)                                                       |
 | `aitk secrets scan`        | Report credential-shaped values in the tree the package ships, keyed on issued values rather than on words (`--json`)                                                 |
 | `aitk deps audit`          | Report published advisories against the resolved dependency set, refusing rather than reporting clean when the index is unreachable (`--json`)                        |
 | `aitk labels audit`        | Report the labels a changed set earns from the pull request label map and the paths no row reaches (`--json`)                                                         |
 | `aitk labels scan`         | Fail a pull request whose title or body carries a phase label, sorting a release pull request's tokens as semver rather than as a leak (`--event`, `--json`)          |
+| `aitk autoship classify`   | Decide whether a changed set needs the review pass, naming the file and the test that decided it (`--json`)                                                           |
 | `aitk census [path]`       | Report tracked file count, a breakdown by extension, and a line total that skips whatever reads as binary (`--json`)                                                  |
 | `aitk audits run`          | Run every audit as one set, report per check under one verdict, and compare each count to the recorded baseline (`--json`, `--record`)                                |
 | `aitk audits list`         | List every audit the set runs, with the corpus each reads and whether it gates (`--json`)                                                                             |
@@ -96,7 +98,7 @@ Each domain exposes a consistent shape where applicable: `list`, `install`, `syn
 | `tooling`   | `list`, `sync`, `ref`, `create`, `verify`, `inject`, `prune-gitignore`                                                                |
 | `snippets`  | `list`, `create`                                                                                                                      |
 | `standards` | `list`, `audit`, `<name>`                                                                                                             |
-| `gov`       | `list`, `install`, `sync`, `build`, `regen`, `test-order`, `superseded`                                                               |
+| `gov`       | `list`, `install`, `sync`, `build`, `regen`, `test-order`, `superseded`, `citations`                                                  |
 | `claude`    | `init`, `sync`, `routing`, `seeds list`, `skills list`, `skills audit`, `skills drift`, `skills reach`, `skills rank`, `setup [dest]` |
 | `demo`      | `compile`, `run`                                                                                                                      |
 | `inventory` | `run`                                                                                                                                 |
@@ -112,6 +114,7 @@ Each domain exposes a consistent shape where applicable: `list`, `install`, `syn
 | `secrets`   | `scan`                                                                                                                                |
 | `deps`      | `audit`                                                                                                                               |
 | `labels`    | `audit`                                                                                                                               |
+| `autoship`  | `classify`                                                                                                                            |
 | `audits`    | `run`, `list`                                                                                                                         |
 
 Common patterns:

package/docs/agents/index.md

@@ -27,7 +27,9 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [Overview](overview.md): What this folder covers, the invocation rules every command inherits, and where domain behavior is documented instead
 - [Records](records.md): Validating the session records under .claude/ and the standards corpus, the per-kind checks, the refusal reasons, migrating a record a frontmatter change orphaned, reading each folder's size and growth, backing the folders to a private remote, and which root each kind defaults to
 - [Restated instructions](restated.md): Counting the instructions the always-loaded file and every path-scoped rule share with the seed, the shipped skill bodies, and each other, how a match is decided, the three classes, which surface a later edit starts from, and why the sweep reports rather than gates
+- [Review classification](review-classification.md): Deciding whether a changed set needs the review pass, the two tests it runs, why an empty set refuses rather than skipping, and the written fallback a target on an older binary falls back to
 - [Routing report](routing.md): Reading per CLAUDE.md section how many bullets name a path, what counts as naming one, when a rule counts as covering it, the two refusals, and why the verb reports rather than gates
+- [Rule citations](rule-citations.md): Resolving every path a governance rule cites and every frontmatter glob the internal corpus declares, the three forms a citation is written in, the shapes that look like citations and are not, the two classes where an absent path is correct, why the glob half reads one corpus, and why this one gates
 - [Sandbox](sandbox.md): Scenario routing, the expectation scoring surface, and the coverage census over scenarios and skills
 - [Scripting](scripting.md): The runtime catalogs that replace hardcoded names, what each carries, and a headless invocation per domain
 - [Sessions](sessions.md): Resolving live peer sessions to the worktree and branch each holds, reading which row is the caller, the liveness confidence field, and what each session surface can see

package/docs/agents/review-classification.md

@@ -0,0 +1,77 @@
+---
+title: Review classification
+description: Deciding whether a changed set needs the review pass, the two tests it runs, why an empty set refuses rather than skipping, and the written fallback a target on an older binary falls back to
+---
+
+# Review classification
+
+`aitk autoship classify` answers the one decision the ship chain used to make by reading a bulleted list out of a skill body. It takes the names a branch changed and returns whether the review pass can be skipped, which file decided it, and which of the two tests that file failed.
+
+```bash
+aitk autoship classify docs/index.md README.md
+aitk autoship classify --json .claude/skills/deploy-check/SKILL.md
+```
+
+| Option   | Behavior                                                   |
+| -------- | ---------------------------------------------------------- |
+| `--json` | Add a machine-readable record on stdout, keeping the frame |
+
+Positional paths are the whole input. The verb never touches git, so it reads no baseline of its own and the caller hands over the set it already computed. A second read here could resolve a different range than the one the chain measured, which is the stale-baseline failure a prior row closed.
+
+Under `--json` the record holds stdout alone and the frame still renders on stderr, refusals included, which is the split `output-shape.md` fixes for every mode.
+
+## The two tests
+
+A branch skips review only when both hold across every changed name:
+
+- **Every path reads as prose.** The extension is `.md` or `.txt`, compared lowercased. Anything else is code, a config, or an asset.
+- **No path sits under a behavior path.** Markdown under one of those surfaces states what an agent does, so a change there is a behavior change wearing a prose extension.
+
+One failing file sends the whole branch to review. Documentation shipped beside a behavior change does not cancel it.
+
+The record names the first file to fail, tested in the caller's own order, and each file is read for its extension before its path. A set failing both tests reports one file and one test, which is all a caller needs to route.
+
+## The behavior paths
+
+Most carry two spellings, the one a surface authors at and the one it reaches a session at, so the rule reads the same in this toolkit and in a project that consumed one.
+
+| Surface           | Spellings                             |
+| ----------------- | ------------------------------------- |
+| Plugin skills     | `claude/skills/`, `.claude/skills/`   |
+| Governance rules  | `governance/rules/`, `.claude/rules/` |
+| Standards         | `standards/`                          |
+| Snippets          | `snippets/`                           |
+| Internal and seed | `internal/`, `tooling/`               |
+| Root instructions | `CLAUDE.md`                           |
+
+`standards/` and `snippets/` carry one spelling apiece. Neither installs into a project, reaching a reader by resolution and through the `claude/snippets` symlink respectively, so there is no consumed copy to name.
+
+`CLAUDE.md` is matched as a whole path rather than as a prefix, because a prefix reaches nothing that sits in no folder. A nested `docs/CLAUDE.md` stays informational.
+
+The set is data at `src/autoship/paths.ts`. That makes it permanently exempt from any later design that folds a machine-parsed list back into the surface citing it, per the machine-parsed clause in `.claude/ARCHITECTURE.md`.
+
+## Exit codes and refusals
+
+| Code | Meaning                                                      |
+| ---- | ------------------------------------------------------------ |
+| `0`  | prose-only, so the review pass can be skipped                |
+| `1`  | refused, with `reason` naming the cause                      |
+| `2`  | review is needed, with `file` and `test` naming what decided |
+
+Branch on the record's `decision` rather than on the exit code. A shell function wrapping `aitk` takes its status from whatever it runs last, so every non-zero exit can reach a caller as zero.
+
+An empty set refuses with `no-changes` rather than skipping. Both tests are universally quantified, so an empty set satisfies them vacuously, and reading that as prose-only would route a branch past review for having produced no output at all.
+
+## Why it is a verb
+
+The decision was three sentences in `claude-autoship` Step 5, applied by a session reading a bulleted list of paths. It failed three times. A driven arm on 2026-08-30 staged `.claude/skills/deploy-check/SKILL.md`, which that list names, and the chain skipped review and opened a draft pull request anyway. The rule was correct and the session did not apply it, and the two fixes before that one were each a rewrite of the same prose.
+
+A rule a session can talk itself out of moves into a verb. That is the same argument the quiz-order draw in `aitk teach lesson` was decided on: an instruction is a hope where a verb is a check.
+
+## The written fallback
+
+The verb ships with the CLI and Step 5 ships with the plugin, so a target holding an older binary meets a missing subcommand. The skill body keeps the written list and applies it by hand there, naming which of the two decided the run.
+
+The fallback is never a skip. Failing open is the exact defect the verb closes, so a body that skips on anything other than a `skip` record would ship every branch unreviewed the moment the subcommand went absent.
+
+Two copies of the path set is what the fallback costs, and it stands until a release retires the written half.

package/docs/agents/rule-citations.md

@@ -0,0 +1,98 @@
+---
+title: Rule citations
+description: Resolving every path a governance rule cites and every frontmatter glob the internal corpus declares, the three forms a citation is written in, the shapes that look like citations and are not, the two classes where an absent path is correct, why the glob half reads one corpus, and why this one gates
+---
+
+# Rule citations
+
+`aitk gov citations` resolves every path a rule cites and every frontmatter glob the internal corpus declares, naming the ones reaching nothing. It answers a failure no other stage sees: a rule points a reader at a file, the file moves, and nothing reports it until a session opens the path and finds an absence.
+
+A glob fails the same way and more quietly. A rule scoped at a directory that moved stops matching, so it never loads again, and a rule that never fires looks exactly like a rule nobody violated.
+
+```bash
+aitk gov citations
+aitk gov citations --json
+aitk gov citations --root ../my-app
+```
+
+| Option          | Behavior                                                   |
+| --------------- | ---------------------------------------------------------- |
+| `--root <path>` | Tree to read, defaulting to the current directory          |
+| `--json`        | Add a machine-readable record on stdout, keeping the frame |
+
+Under `--json` the record holds stdout alone and the frame still renders on stderr, refusals included, which is the split `output-shape.md` fixes for every mode.
+
+## What the drift check cannot see
+
+`bun run check` asserts that an authored rule and its consumed copy agree, and a dead citation passes that assertion because both copies carry it. `governance/rules/claude/561-teach.md` told its reader to open a `references/glossary.md` inside the teach skill that had never existed at that path. The rule shipped, survived a release, and fired during a real teach run before anyone noticed.
+
+Two files agreeing is what a drift check measures. Whether either one is right about the tree is a different question, and this is the stage that asks it.
+
+## The three forms
+
+A citation reaches a reader in one of three shapes, and each resolves against a different root.
+
+| Form       | Shape                    | Resolves against                   |
+| ---------- | ------------------------ | ---------------------------------- |
+| `standard` | `aitk standards <name>`  | `standards/<name>.md`              |
+| `path`     | a backticked path        | the root                           |
+| `sibling`  | a bare `<nnn>-<slug>.md` | the folder the citing rule sits in |
+
+`standard` is the live form and carries most of the corpus, which is what makes scoping this check to the two path shapes a check over almost nothing.
+
+A standard name resolves against the authoring root and nowhere else, matching `standardRoots` in `src/standards/read.ts`, which reads `standards/` at the working root and then the package corpus. The stage refuses a tree holding no rule corpus, so it runs only where those two roots are one directory. `internal/standards/` is deliberately not tried: `aitk standards <name>` never reaches it, so admitting it would pass a citation that refuses for the session opening it, which is a gate failing open.
+
+A `path` is anchored on the whole backticked span rather than on a trailing pattern inside it. Cutting `standards/tooling-reference.md` out of `internal/standards/tooling-reference.md` and resolving that against the standards root reports a file that exists as missing, which is a mistake made by hand while measuring this corpus before the stage was written.
+
+## What is not a citation
+
+A rule body is full of backticked spans carrying a slash, and almost none of them names a file in this tree. The stage declines four shapes outright.
+
+- A placeholder or glob segment describes a shape rather than naming a file: `.claude/context/<domain>.md`, `standards/<name>.md`, `app/**/route.ts`, `${CLAUDE_SKILL_DIR}/../../standards/<name>.md`.
+- A bare filename names a convention: `route.ts`, `manifest.toml`, `components.json`, `playwright.config.ts`. A bare name is read as a citation only when it matches a rule filename, which is how `562-session.md` points at `555-tasks.md`.
+- A span carrying no file extension is a folder or a module specifier: `src/pages/`, `next/font`, `try/except`, `react-hooks/set-state-in-effect`, `oven-sh/setup-bun@v2`, `@/lib/utils`.
+- A fenced block displays a path rather than pointing at one.
+
+The extension test is what carries most of the separation, and it costs one real path: `claude/standards` is a symlink this stage declines to check because nothing in the span says it is a file. Declining is the right direction for a gate, where a guess that goes wrong fails a push over prose.
+
+## Where an absent path is correct
+
+Two classes resolve to nothing and are right to. Both are reported by name rather than dropped, so a reader can see what the verdict declined to judge.
+
+**Governed.** A rule spelling a path in its own frontmatter `paths:` is naming an artifact a target holds rather than a file here. `governance/rules/claude/560-diagrams.md` declares `.claude/DIAGRAMS.md` and then tells its reader to convert one an older install left behind, so the file is correctly absent from this tree and correctly named in the rule.
+
+Only an exact declaration exempts, never a glob match against one. A glob declares a shape, so a body path sitting inside it is still a citation and a stale one is still a defect. A rule scoped at `docs/**` citing a `docs/agents/renamed.md` that moved is exactly the class this stage exists to catch, and matching the glob would excuse it.
+
+**Ignored.** A path git ignores is session scratch no clone is expected to hold. `governance/rules/claude/555-tasks.md` cites `.claude/tasks/index.md`, which is real in a live project and absent from a fresh clone and from every linked worktree. Resolving against the filesystem alone would make the verdict depend on which tree the stage ran in, so the unresolved paths go to one batched `git check-ignore` and an ignored one is excused. A read git cannot answer refuses rather than reporting those paths dead.
+
+## Why the glob half reads one corpus
+
+Bodies are read across both corpora and frontmatter globs across `internal/rules/` alone.
+
+A rule under `governance/rules/` installs into a target, and its `paths:` entries name the shape that project holds rather than anything here. Measured over that corpus, 32 of its 72 globs match nothing in this tree and every one of them is correct. `src/pages/**` in the Astro rule cannot be told by pattern from a path this repository might hold, so a check cannot separate the two, and gating them would ship an exemption list the length of the corpus. Nothing reads the shipped globs, and the measurement is the reason rather than a gap left for someone to close.
+
+`internal/rules/` ships nowhere. The tree it governs is the tree present, which makes the question answerable, and all 14 of its globs across 7 rules match at the commit this shipped on.
+
+What that leaves unreached is a glob that matches real files and still reaches none of the work it was scoped at. `governance/rules/lib/305-e2e-reliability.md` scopes itself at `e2e/*.ts` and `e2e/**/*.ts`, and no probe in this repository is written under `e2e/`, so the rule asking a session to watch a new guard fail never fired for the session writing guards. Resolution is mechanical and reach is a judgment about where the work happens, so only the first is here.
+
+## The exemption marker
+
+Everything the classifier can separate mechanically is separated there. For the residue, a line carries `aitk-allow-citation: <reason>` on itself or the one directly above, which moves it into the report's `Exempt` section. Only a marker naming a reason counts, since a bare token is a line that meant to say something and did not. This is the `aitk-allow-superseded` shape, and both read the same placement rule through one helper.
+
+## The blind spots
+
+A citation that resolves and points at the wrong file passes. Resolution is mechanical and correctness is a reading, and only the first is a gate's business.
+
+A path written into running prose without backticks is not read at all. Matching one would report every sentence that happens to name a file, and the backticks are what separate a reference a reader follows from a name in a sentence.
+
+A folder or a path carrying no extension is declined rather than guessed at, which is stated above as the cost of the test that carries the separation.
+
+A glob under `governance/rules/` is not read, and a glob that resolves while reaching none of the work it was scoped at is a reading rather than a resolution. Both are stated above.
+
+## Exit codes
+
+Exit codes are `0` when every citation resolves or is excused and every glob read matches, `1` for a refusal, and `2` for at least one cited path reaching nothing or one glob matching nothing. It refuses a tree holding neither rule corpus, since a tree with no rules passes each of its zero rules, and a `git check-ignore` read that fails.
+
+This gates, and `bun run check` runs it as the `Rule citations` stage. The sibling sweeps report rather than gate because a value appears for reasons unrelated to the convention, so their output is a reading. A path resolving to nothing carries no judgment: either the file is there or the citation is stale, and the two classes where absence is correct are separated before the verdict rather than left for a reader to settle. The corpus is clean at the commit this shipped on, so the gate starts green and stays that way until something breaks.
+
+An exit code says nothing about a call made from a session, since a shell profile may wrap the binary in a function taking its status from a later command. Read the JSON record's `citations` array and filter on `status` rather than the exit when a skill consumes this.

package/docs/ai-workflow.md

@@ -144,6 +144,10 @@ Markdown under one states what an agent does, so a branch touching it reaches re
 
 An empty changed-file list stops the chain rather than counting as prose-only. The filename test passes vacuously on an empty set, which routed a branch past review instead of through it.
 
+`aitk autoship classify` answers that decision now, and the chain branches on the record it returns rather than on a session applying the list above. Three runs read past the list while it was prose, the last of them a driven arm that staged a file the list names and shipped a draft pull request with no review. The verb takes the names the chain already computed, so no second diff baseline resolves, and it names the file and the test that decided. [Review classification](agents/review-classification.md) carries the record shape and the exit codes.
+
+The list stays written in the skill body as the fallback for a target whose installed CLI predates the verb, since the two ship at different speeds. That fallback is never a skip: failing open is the defect the verb closes, so an absent subcommand routes to review rather than past it.
+
 #### Memory in the chain
 
 `git-ship` runs its verify gate and then opens on `claude-memory-capture`, which sends what the session learned to the surface that owns it. `autoship` reaches the same step by invoking that skill at its Step 7 rather than restating the order. A fact about a domain carrying an entry in `.claude/context/index.md` is routed to that entry, and `claude-docs` folds it in on the next step, so it ships in the same pull request. Anything no entry owns stays a file in `.claude/memory/`.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/aitk",
   "type": "module",
-  "version": "3.48.1",
+  "version": "3.50.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/scripts/core/verify.sh

@@ -387,6 +387,22 @@ main() {
   run_check "cd $PROJECT_ROOT && bun src/cli.ts context audit --citations-only" "A cited context path does not resolve. Run bun src/cli.ts context audit."
   log_info "Context citations resolve"
 
+  # A rule citing a file that moved fails silently. The consumed-copy drift
+  # stage passes an authored rule and its copy that are wrong together, and
+  # nothing else resolves the path until a session opens it, which is how
+  # `561-teach.md` shipped a `references/glossary.md` that had never existed. A
+  # rule whose frontmatter glob names a directory that moved fails the same way,
+  # by never firing again.
+  #
+  # This gates for the reason the stage above gates: a path resolving to
+  # nothing carries no judgment. The classes where absence is correct, a path
+  # the rule declares in its own frontmatter and one git ignores, are separated
+  # inside the verb rather than left as a threshold here. Globs are read under
+  # `internal/rules/` alone, since a shipped rule's glob names a target's shape.
+  log_step "Rule citations"
+  run_check "cd $PROJECT_ROOT && bun src/cli.ts gov citations" "A path a rule cites, or an internal frontmatter glob, does not resolve. Run bun src/cli.ts gov citations."
+  log_info "Rule citations resolve"
+
   # A banned character, word, or spelling is a fact rather than a threshold, so
   # it fails the push while bullet, paragraph, and depth weight stay advisory
   # for the reason the stage above leaves its own thresholds so.

package/src/autoship/classify.ts

@@ -0,0 +1,75 @@
+import {
+  BEHAVIOR_FILES,
+  BEHAVIOR_PREFIXES,
+  PROSE_EXTENSIONS,
+} from '@/autoship/paths'
+
+/**
+ * Which of the two tests a file failed.
+ *
+ * Named apart rather than folded into one boolean, because the repair differs.
+ * A non-prose extension means the branch carries code and review is ordinary. A
+ * behavior path means prose that states what an agent does, which is the half
+ * three sessions read past.
+ */
+export type FailedTest = 'extension' | 'behavior-path'
+
+/** Why a classification produced no reading. */
+export type ClassifyRefusal = 'no-changes'
+
+export type Classification =
+  | { readonly kind: 'skip' }
+  | {
+      readonly kind: 'review'
+      readonly test: FailedTest
+      readonly file: string
+    }
+  | { readonly kind: 'refused'; readonly reason: ClassifyRefusal }
+
+/**
+ * Prefix-anchored against the folders, matching how `resolveCoverage` reads the
+ * label map, and equality against the whole paths a prefix cannot reach.
+ */
+function underBehaviorPath(path: string): boolean {
+  if (BEHAVIOR_FILES.some((file) => file === path)) return true
+  return BEHAVIOR_PREFIXES.some((prefix) => path.startsWith(prefix))
+}
+
+function readsAsProse(path: string): boolean {
+  const lowered = path.toLowerCase()
+  return PROSE_EXTENSIONS.some((extension) => lowered.endsWith(extension))
+}
+
+/**
+ * Decides whether a branch's changed set skips the review pass.
+ *
+ * The skip needs both tests to pass: every name reads as prose, and no name
+ * sits under a behavior path. One behavior file sends the whole branch to
+ * review, since documentation shipped beside a behavior change does not cancel
+ * it.
+ *
+ * An empty set refuses rather than skipping. Both tests are universally
+ * quantified, so an empty set satisfies them vacuously, and reading that as
+ * prose-only would route a branch past review for having produced no output at
+ * all.
+ *
+ * Names only. The caller hands the set the ship chain already computed, so no
+ * second baseline is read here and the stale-baseline half stays closed.
+ */
+export function classifyChanges(paths: readonly string[]): Classification {
+  if (paths.length === 0) return { kind: 'refused', reason: 'no-changes' }
+
+  // First failure in the caller's order wins, and each file is tested for its
+  // extension before its path. A set failing both tests reports one file and
+  // one test, which is all the branch needs to route.
+  for (const path of paths) {
+    if (!readsAsProse(path)) {
+      return { kind: 'review', test: 'extension', file: path }
+    }
+    if (underBehaviorPath(path)) {
+      return { kind: 'review', test: 'behavior-path', file: path }
+    }
+  }
+
+  return { kind: 'skip' }
+}

package/src/autoship/paths.ts

@@ -0,0 +1,51 @@
+/**
+ * The surfaces where markdown states what an agent does, and the extensions
+ * that read as prose, held as data one command parses.
+ *
+ * Lifted verbatim in content from the list `claude-autoship/SKILL.md` Step 5
+ * carried, which a session was asked to apply by hand. It failed that
+ * application three times, so the set moved here and the body now calls a verb
+ * that reads it. Being machine-parsed makes it permanently exempt from any
+ * later design that folds a standard back into the surface citing it, per the
+ * machine-parsed clause in `.claude/ARCHITECTURE.md`.
+ */
+
+/**
+ * Path prefixes under which a markdown change is a behavior change.
+ *
+ * Most carry two spellings, the one a surface authors at and the one it reaches
+ * a session at, so the rule reads the same in this toolkit and in a project
+ * that consumed one. `standards/` and `snippets/` carry one apiece: neither
+ * installs into a project, reaching a reader by resolution and through the
+ * `claude/snippets` symlink respectively, so no `.claude/` spelling exists to
+ * name.
+ */
+export const BEHAVIOR_PREFIXES = [
+  'claude/skills/',
+  '.claude/skills/',
+  'governance/rules/',
+  '.claude/rules/',
+  'standards/',
+  'snippets/',
+  'internal/',
+  'tooling/',
+] as const
+
+/**
+ * Behavior surfaces named as whole paths rather than as prefixes.
+ *
+ * A path prefix reaches nothing that sits in no folder, which is what the root
+ * instruction file is. Matching is equality rather than a suffix test, so a
+ * nested `docs/CLAUDE.md` stays informational the way the body's "at the
+ * repository root" qualifier says it should.
+ */
+export const BEHAVIOR_FILES = ['CLAUDE.md'] as const
+
+/**
+ * Extensions a changed file may carry for the branch to read as prose-only.
+ *
+ * Compared lowercased, so a `README.MD` is not routed to review for its
+ * spelling. Everything else is code, a config, or an asset, and one of them
+ * sends the whole branch to review.
+ */
+export const PROSE_EXTENSIONS = ['.md', '.txt'] as const

package/src/cli.ts

@@ -33,6 +33,7 @@ import { register as audits } from '@/commands/audits'
 import { register as secrets } from '@/commands/secrets'
 import { register as deps } from '@/commands/deps'
 import { register as labels } from '@/commands/labels'
+import { register as autoship } from '@/commands/autoship'
 import { register as census } from '@/commands/census'
 import { register as targets } from '@/commands/targets'
 import { register as upgrade } from '@/commands/upgrade'
@@ -80,6 +81,7 @@ function showHelp(): void {
     `${GREY}│${NC}    secrets [cmd]      ${GREY}# Read the shipped tree for credential-shaped values (scan)${NC}`,
     `${GREY}│${NC}    deps [cmd]         ${GREY}# Read the resolved dependency set for advisories (audit)${NC}`,
     `${GREY}│${NC}    labels [cmd]       ${GREY}# Read a changed set against the pull request label map (audit)${NC}`,
+    `${GREY}│${NC}    autoship [cmd]     ${GREY}# Decide whether a changed set needs the review pass (classify)${NC}`,
     `${GREY}│${NC}    census [path]      ${GREY}# Report tracked file count, extension breakdown, and line totals${NC}`,
     `${GREY}│${NC}    audits [cmd]       ${GREY}# Run every health check as one set (run, list)${NC}`,
     `${GREY}│${NC}    upgrade            ${GREY}# Reinstall the CLI globally with the manager that installed it${NC}`,
@@ -181,6 +183,7 @@ worktrees(program)
 secrets(program)
 deps(program)
 labels(program)
+autoship(program)
 census(program)
 audits(program)
 upgrade(program)

package/src/commands/autoship.ts

@@ -0,0 +1,129 @@
+import type { Command } from 'commander'
+import {
+  type ClassifyRefusal,
+  type FailedTest,
+  classifyChanges,
+} from '@/autoship/classify'
+import { intro, logInfo, logStep, logWarn, outro, plural } from '@/ui'
+
+interface ClassifyOptions {
+  readonly json?: boolean
+}
+
+/** What a reader does about the one way the classification produced no reading. */
+const REFUSALS: Record<ClassifyRefusal, string> = {
+  'no-changes':
+    'No changed files were supplied, so there is no set to classify. Pass the set the ship chain already computed.',
+}
+
+/** Why each failed test sends the branch to review, in the reader's terms. */
+const TESTS: Record<FailedTest, string> = {
+  extension: 'is not prose, so this branch carries a change review reads',
+  'behavior-path':
+    'sits under a behavior path, so its prose states what an agent does',
+}
+
+export function register(program: Command): void {
+  const autoship = program
+    .command('autoship')
+    .description('Answer the decisions the ship chain used to make in prose')
+    .helpOption('-h, --help', 'Show this help message')
+
+  autoship
+    .command('classify')
+    .description('Decide whether a changed set needs the review pass')
+    .argument('[paths...]', 'Changed set to classify, as names')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--json', 'Add a machine-readable record on stdout')
+    .addHelpText(
+      'after',
+      [
+        '',
+        'Reads names only and never touches git, so the caller hands over the',
+        'set it already computed rather than paying for a second baseline that',
+        'can disagree with the first.',
+        '',
+        'The skip needs both tests to pass. Every name reads as prose, and no',
+        'name sits under a behavior path, which is where markdown states what',
+        'an agent does. One behavior file sends the whole branch to review,',
+        'since documentation shipped beside a behavior change does not cancel',
+        'it.',
+        '',
+        'An empty set refuses rather than skipping. Both tests are universally',
+        'quantified, so an empty set satisfies them vacuously, and reading that',
+        'as prose-only would route a branch past review for producing no output.',
+        '',
+        'Exit codes:',
+        '  0  prose-only, so the review pass can be skipped',
+        '  1  refused, with the reason on stderr or in the JSON record',
+        '  2  review is needed, with the file and the test it failed named',
+        '',
+        'Examples:',
+        '  aitk autoship classify docs/index.md README.md',
+        '  aitk autoship classify --json .claude/skills/deploy-check/SKILL.md',
+        '',
+      ].join('\n'),
+    )
+    .action((paths: string[], opts: ClassifyOptions) => {
+      process.exitCode = runClassify(paths, opts)
+    })
+}
+
+function runClassify(paths: string[], opts: ClassifyOptions): number {
+  const emitJson = opts.json ?? false
+  const result = classifyChanges(paths)
+
+  intro('aitk autoship classify')
+
+  // The frame renders on stderr in both modes and the record goes to stdout
+  // alone, so an operator reading the terminal sees the refusal rather than a
+  // command that appeared to do nothing.
+  if (result.kind === 'refused') {
+    logStep('Refused')
+    logWarn(REFUSALS[result.reason])
+    outro()
+
+    if (emitJson) {
+      process.stdout.write(
+        `${JSON.stringify({
+          decision: 'refused',
+          reason: result.reason,
+          message: REFUSALS[result.reason],
+        })}\n`,
+      )
+    }
+    return 1
+  }
+
+  logStep('Scope')
+  logInfo(`${plural(paths.length, 'path')} supplied by the caller`)
+
+  if (result.kind === 'skip') {
+    logStep('Prose only')
+    logInfo('every path reads as prose and none states agent behavior')
+    outro()
+
+    if (emitJson) {
+      process.stdout.write(
+        `${JSON.stringify({ decision: 'skip', changed: paths })}\n`,
+      )
+    }
+    return 0
+  }
+
+  logStep('Review')
+  logWarn(`${result.file} ${TESTS[result.test]}.`)
+  outro()
+
+  if (emitJson) {
+    process.stdout.write(
+      `${JSON.stringify({
+        decision: 'review',
+        test: result.test,
+        file: result.file,
+        changed: paths,
+      })}\n`,
+    )
+  }
+  return 2
+}