@ericrisco/rsc 0.1.44 → 0.1.46

package/skills/secure-coding/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: secure-coding
-description: "Use when threat-modeling a feature, reviewing code or a diff for security, hardening authentication/authorization, handling secrets, configuring CORS/CSP/security headers, or fixing OWASP-class vulnerabilities (broken access control, injection, SSRF, auth failures, supply-chain) in FastAPI/Python, Go, Next.js, or Flutter. Triggers: 'security review', 'threat model this', 'is this safe', 'harden auth', 'rotate secrets', 'fix this vuln', 'OWASP', 'why is this endpoint exposed', before merging an endpoint that touches auth/payments/PII/uploads."
+description: "Use when securing application code: threat-modeling a feature, security-reviewing a diff, hardening auth/authz, secrets, CORS/CSP, or fixing OWASP-class bugs (access control, injection, SSRF, supply chain) in FastAPI, Next.js, Go or Flutter. NOT running the scanners (that is security-scan), NOT agent prompt-injection guardrails (that is agent-safety)."
 tags: [security, owasp, stride, auth, review]
 recommends: [deployment]
 origin: risco
@@ -22,23 +22,15 @@ Operating posture:
 - **Every finding ships a fix.** Never "consider sanitizing" — show the
   corrected code for *this* stack.
 
-## When to use / When NOT to use
-
-**Use when:** adding/reviewing an endpoint touching auth, money, PII, file
-uploads, or external URLs; a diff needs a security pass before merge; designing
-a feature (threat-model before code); hardening cookies/tokens/CORS/CSP/TLS/
-rate limits/password hashing/MFA; handling secrets, dependency CVEs, lockfile
-integrity, or CI security gates.
-
-**Do NOT use for:**
-
-- **Agent / Claude-Code config security** (`.claude/`, hooks, MCP, prompt
-  injection, sandboxing) — a *different* concern. This skill is about the
-  **application code the user ships**. Point there (See Also) and stay in lane.
-- Pure infra/network firewalling with no code change — defer.
-- Pentest/bounty PoC against a third party — out of scope (legal); this skill
-  defends code, it does not attack external targets.
-- Trivial non-security refactors — don't gate them through `verify.sh`.
+Stay in lane — this is about **the application code the user ships**. Agent /
+Claude-Code config security (`.claude/`, hooks, MCP, prompt injection,
+sandboxing) is a *different* concern: [`agent-safety`](../agent-safety/SKILL.md),
+[`building-agents`](../building-agents/SKILL.md). Running the scanners and
+triaging their raw output: [`security-scan`](../security-scan/SKILL.md).
+Infra/network firewalling with no code change: [`deployment`](../deployment/SKILL.md).
+A pentest/bounty PoC against a third party is out of scope (legal) — this skill
+defends code, it does not attack external targets. Don't gate trivial
+non-security refactors through `verify.sh`.
 
 ## The 30-second model: lethal trifecta + trust boundaries
 
@@ -48,15 +40,21 @@ integrity, or CI security gates.
 - **Trust-boundary rule:** every untrusted→trusted crossing is a checkpoint with
   one owning defense: HTTP body→SQL, user string→shell/URL/HTML, JWT claim→authz
   decision, filename→fs path, upload→disk/exec.
+- **Least privilege / least agency** for tokens, DB roles, CORS origins and file
+  perms. It is the one control that still caps blast radius *after* one of the
+  defenses below fails, so it is never optional.
 
-| Untrusted source | Dangerous sink | Defense | Reference |
+| Untrusted source | Dangerous sink | Defense | Ref |
 |---|---|---|---|
-| Request body | SQL query | Parameterize (bound params / ORM) | `references/owasp-by-stack.md` A03 |
-| User URL | Outbound fetch | https-only + IP allowlist, block private ranges | `references/owasp-by-stack.md` A10 |
-| User HTML | DOM render | Encode by context / DOMPurify allowlist | `references/owasp-by-stack.md` A03 |
-| Filename | Filesystem path | Canonicalize + base-dir containment | `references/owasp-by-stack.md` A03 |
+| Request body | SQL query | Parameterize (bound params / ORM) | A03 |
+| User URL | Outbound fetch | https-only + IP allowlist, block private ranges | A10 |
+| User HTML | DOM render | Encode by context / DOMPurify allowlist | A03 |
+| Filename | Filesystem path | Canonicalize + base-dir containment | A03 |
 | JWT / claim | Authz decision | Verify signature + pinned alg + `aud`/`iss`/`exp` | `references/authn-authz.md` |
-| Upload | Disk / exec | Type+size, sniff magic bytes, store outside web root | `references/owasp-by-stack.md` A01 |
+| Upload | Disk / exec | Type+size, sniff magic bytes, store outside web root | A01 |
+
+A-numbers index `references/owasp-by-stack.md`: same section, vulnerable→fixed
+code in all three stacks.
 
 ## Review workflow (PR-sized)
 
@@ -65,35 +63,27 @@ integrity, or CI security gates.
 3. **Map sinks to OWASP.** Match each changed sink to a category → `references/owasp-by-stack.md`.
 4. **Rank by exploitability.** Reachable? User-controlled? Meaningful sink? Report the highest-impact reachable findings first, not a checklist.
 5. **Propose fixes as diffs** in the repo's actual stack (Good/Bad, copy-pasteable).
-6. **Run `scripts/verify.sh`** in the repo root; resolve every high/critical before merge.
-
-## Core principles (non-negotiable)
-
-1. Validate at the boundary with a schema (Pydantic v2 / Zod `.strict()` / Go struct+validator) — never trust shape.
-2. Parameterize every query; ORM or driver bind params, never string-built SQL.
-3. Authorize on the **server**, per-object, on **every** request; deny by default.
-4. Encode on output by context (HTML / attribute / JS / URL); never build HTML from user strings.
-5. Secrets only from env/secret-manager — never in repo, logs, or client bundles.
-6. Fail closed: generic errors to the client, detail to logs (no stack traces, no PII).
-7. Pin + lock dependencies; a reachable CVE is a release blocker.
-8. Least privilege / least agency for tokens, DB roles, CORS origins, file perms.
+6. **Run `scripts/verify.sh`** in the repo root; resolve every high/critical before merge — a reachable CVE is a release blocker, not a follow-up ticket.
 
 ## OWASP Top 10 — fastest fix per category
 
-| OWASP 2021 | The mistake you'll actually see | Stack-correct fix in one phrase | Deep ref |
-|---|---|---|---|
-| A01 Broken Access Control | `db.get(id)` returned to any authed user | Ownership-scoped query; 404 (not 403) on miss | `references/owasp-by-stack.md` A01 |
-| A02 Cryptographic Failures | SHA-256 password hash; `random` token | Argon2id + CSPRNG (`secrets`/`crypto/rand`) | `references/owasp-by-stack.md` A02 |
-| A03 Injection | f-string SQL / `shell=True` | Bound params / arg-list, no shell / canonicalize path | `references/owasp-by-stack.md` A03 |
-| A04 Insecure Design | No rate limit, replayable payment | Lockout + idempotency-key `UNIQUE` constraint | `references/owasp-by-stack.md` A04 |
-| A05 Security Misconfiguration | `debug=True`, `*`+credentials CORS | `debug=False`, explicit origin allowlist, headers | `references/owasp-by-stack.md` A05 |
-| A06 Vulnerable Components | Ignored transitive CVE | Audit + upgrade/override/replace | `references/owasp-by-stack.md` A06 |
-| A07 Auth Failures | Reusable session id, user enumeration | Lockout + rotate session id + generic error | `references/owasp-by-stack.md` A07 |
-| A08 Data Integrity | `curl \| bash`, unpinned CDN script | `npm ci`/`go mod verify` + SRI | `references/owasp-by-stack.md` A08 |
-| A09 Logging Failures | No authz-fail log; PII in logs | Structured log on `user_id`, redact secrets | `references/owasp-by-stack.md` A09 |
-| A10 SSRF | Fetch user-supplied URL directly | https-only + IP allowlist + pin dialed IP | `references/owasp-by-stack.md` A10 |
-
-Flagship: **A01 Broken Access Control / IDOR** (the #1, stack-agnostic in shape).
+| OWASP 2021 | The mistake you'll actually see | Stack-correct fix in one phrase |
+|---|---|---|
+| A01 Broken Access Control | `db.get(id)` returned to any authed user | Ownership-scoped query; 404 (not 403) on miss |
+| A02 Cryptographic Failures | SHA-256 password hash; `random` token | Argon2id + CSPRNG (`secrets`/`crypto/rand`) |
+| A03 Injection | f-string SQL / `shell=True` | Bound params / arg-list, no shell / canonicalize path |
+| A04 Insecure Design | No rate limit, replayable payment | Lockout + idempotency-key `UNIQUE` constraint |
+| A05 Security Misconfiguration | `debug=True`, `*`+credentials CORS | `debug=False`, explicit origin allowlist, headers |
+| A06 Vulnerable Components | Ignored transitive CVE | Audit + upgrade/override/replace |
+| A07 Auth Failures | Reusable session id, user enumeration | Lockout + rotate session id + generic error |
+| A08 Data Integrity | `curl \| bash`, unpinned CDN script | `npm ci`/`go mod verify` + SRI |
+| A09 Logging Failures | No authz-fail log; PII in logs | Structured log on `user_id`, redact secrets |
+| A10 SSRF | Fetch user-supplied URL directly | https-only + IP allowlist + pin dialed IP |
+
+Flagship: **A01 Broken Access Control / IDOR** (the #1, stack-agnostic in
+shape). Authorize on the **server**, per object, on **every** request, deny by
+default: the id in the URL is attacker-controlled, so the ownership predicate in
+the query is the only thing standing between a stranger and the row.
 
 ```python
 # Python — FastAPI 3.12 + SQLAlchemy 2.0
@@ -162,6 +152,9 @@ in `references/owasp-by-stack.md`.
 
 ## Input validation & output encoding
 
+Validate at the boundary with a schema and never trust the shape that arrived —
+an unbounded or extra field is how the next sink gets its payload.
+
 ```python
 # BAD — raw body, unbounded, unknown fields silently accepted.
 data = await request.json()
@@ -181,7 +174,9 @@ const data = Schema.parse(await req.json());   // BAD: `body as any`
 
 **XSS:** React auto-escapes — the bug is `dangerouslySetInnerHTML`. **Stored**
 (persisted then served), **reflected** (echoed from the request), and **DOM**
-(client writes user data into the DOM) XSS all need encoding/sanitizing.
+(client writes user data into the DOM) XSS all need encoding/sanitizing. Encode
+on output *by context* (HTML / attribute / JS / URL); never build HTML by
+concatenating user strings.
 
 ```tsx
 // BAD — raw user HTML into the DOM.
@@ -272,6 +267,8 @@ export default { async headers() { return [{ source: "/:path*", headers }]; } };
 
 - **Rate limiting:** per-IP **and** per-identity, stricter on auth/OTP/search.
   In-memory limiters are **not** multi-instance safe — use Redis behind >1 replica.
+- **Fail closed:** generic error to the client, detail to the logs. A stack
+  trace or DB message in a response is free reconnaissance for the attacker.
 - **Logging without PII:** redact tokens/passwords/PAN/email; log `user_id`,
   not email; structured (`slog`/`structlog`); never log auth-route bodies.
 
@@ -279,18 +276,24 @@ export default { async headers() { return [{ source: "/:path*", headers }]; } };
 
 - Env/secret-manager, never repo; `.env` gitignored. Only `NEXT_PUBLIC_*` is
   public — **BAD: a secret read in a Client Component ships to the browser.**
+  In a [`harness`](../harness/SKILL.md) project they live in
+  `01-TOOLS/<PROVIDER>/.env` (gitignored) — same rule, never in the repo.
 - Pin + commit the lockfile; install with `npm ci` / `pnpm i --frozen-lockfile`
   / `go mod verify` / `pip install --require-hashes`.
-- Audit per stack: `pip-audit`, `npm audit --omit=dev` / `osv-scanner`,
-  `govulncheck`, `dart pub outdated`.
-- On exposure: **rotate the credential first, then scrub history** (`gitleaks`
-  to confirm). SBOM via `syft`; provenance via `cosign`/SLSA.
+- Audit per stack: `pip-audit`, `npm audit --omit=dev --audit-level=high` or
+  `osv-scanner scan source -L pnpm-lock.yaml` (lockfile-aware, multi-ecosystem,
+  v2 CLI), `govulncheck ./...` (reachability-aware — only vulns you call),
+  `dart pub outdated`. Fix by upgrading to the fixed version; constrain or
+  override transitive pins.
+- On exposure: **rotate the credential first, then scrub history** (`gitleaks
+  dir . --redact` for the working tree, `gitleaks git .` for history, to
+  confirm). SBOM via `syft`; provenance via `cosign`/SLSA.
 
 Full runbook: `references/secrets-and-supply-chain.md`.
 
-## Anti-patterns / rationalizations → STOP
+## Anti-patterns
 
-| Rationalization | Reality |
+| What gets said | Reality |
 |---|---|
 | "It's behind auth, so IDOR doesn't matter." | Authenticated ≠ authorized. Check object ownership on every request. |
 | "The frontend already validates / hides the button." | Client checks are UX. Re-authorize and re-validate on the server. Server Actions and API routes are public. |
@@ -300,66 +303,34 @@ Full runbook: `references/secrets-and-supply-chain.md`.
 | "npm audit shows criticals but they're transitive." | Transitive is still in your bundle. Pin/override or replace. |
 | "I'll log the payload to debug, remove it later." | "Later" never comes; PII/secrets leak to logs. Redact now. |
 | "We'll add rate limiting after launch." | Auth/OTP endpoints get brute-forced on day one. |
-| "It's an internal URL fetch, SSRF isn't a risk." | Internal is exactly the SSRF target (metadata, RDS). Allowlist hosts, block private IPs. |
+| "It's an internal URL fetch, SSRF isn't a risk." | Internal is exactly the SSRF target (metadata, RDS). Allowlist hosts and block `169.254.169.254`, `10/8`, `172.16/12`, `192.168/16`, `127/8`, `::1`, `fc00::/7`, `fe80::/10`. |
 | "Error stack to the client speeds debugging." | It leaks internals to attackers. Generic to client, detail to logs. |
 | "Secrets in `.env.example` are placeholders; real ones in CI YAML are fine." | Use the secret store; never inline real secrets in CI files. |
 | "Argon2 is overkill, SHA-256 is fast." | Fast = brute-forceable. Use Argon2id (or bcrypt cost≥12). |
 
 ## verify.sh — the gate
 
-`scripts/verify.sh` runs gitleaks + semgrep + the per-stack CVE audit
+`scripts/verify.sh` runs gitleaks + semgrep (`--config=auto --severity ERROR`
+gates; WARNING is informational) + the per-stack CVE audit
 (pip-audit/osv-scanner/govulncheck). It is **the user's to run in their own repo
 root** — it auto-detects the stack, skips (does not fail) when a tool is
 missing, and exits non-zero **only** on real high/critical findings. The CI
 equivalent is in `references/secrets-and-supply-chain.md`.
 
-## Quick reference
-
-| Concern | Tool / flag | One-liner |
-|---|---|---|
-| Secret scan | `gitleaks dir . --redact` | Working tree; add `gitleaks git .` for history; rotate-then-scrub on a hit |
-| SAST | `semgrep --config=auto --severity ERROR` | ERROR gates; WARNING informational |
-| Python CVEs | `pip-audit` | Upgrade to fix version; constraints for transitive |
-| Node CVEs | `npm audit --omit=dev --audit-level=high` | Or `osv-scanner scan source -L …` (multi-ecosystem) |
-| Node CVEs (lockfile) | `osv-scanner scan source -L pnpm-lock.yaml` | Lockfile-aware, broad ecosystem coverage (v2 CLI) |
-| Go CVEs | `govulncheck ./...` | Reachability-aware (only vulns you call) |
-| Password hash | Argon2id | `time_cost=3, memory_cost=65536, parallelism=4` |
-| Cookie flags | `Set-Cookie` | `__Host-name; HttpOnly; Secure; SameSite=Lax; Path=/` |
-| CSP starter | header | `default-src 'self'; object-src 'none'; frame-ancestors 'none'` |
-| CORS rule | allowlist | Explicit origins; never `*` with credentials |
-| SSRF blocklist | IP ranges | `169.254.169.254`, `10/8`, `172.16/12`, `192.168/16`, `127/8`, `::1`, `fc00::/7`, `fe80::/10` |
-
-## Project grounding (02-DOCS + CLAUDE.md)
-
-When this skill runs in a project with a `02-DOCS/` layer (the
-[`harness`](../harness/SKILL.md) Karpathy wiki), record this
-project's security decisions there and index them from the root `CLAUDE.md`, so the next
-agent inherits the conventions instead of re-deriving them.
-
-1. **Find the article** `02-DOCS/wiki/stack/security.md`, indexed in `02-DOCS/wiki/index.md` (the
-   Knowledge map index; root `CLAUDE.md` points to it).
-2. **If missing or stale**, create/update it with the project's real choices — the threat model, the auth model, the secrets backend, the CI security gates, and any accepted risks —
-   then index it in `02-DOCS/wiki/index.md` (the Knowledge map; root `CLAUDE.md` keeps only a
-   short pointer to it).
-3. **Read it first on every use** and stay consistent; when a convention changes, update the
-   article (bump its `Updated` date) in the same change.
-
-No `02-DOCS/` layer? Skip silently (optionally suggest `harness`). Unlike the
-brand study, technical conventions are *recorded, not gated* — never block the task on this.
-
-## See Also
-
-- **Stack skills** — `../fastapi/SKILL.md`, `../nextjs/SKILL.md`, `../go/SKILL.md`,
-  `../flutter/SKILL.md`, `../postgresdb/SKILL.md` (and `../design/SKILL.md`,
-  `../deployment/SKILL.md`): they defer security to this skill. If a stack skill
-  doesn't exist yet, treat this as the canonical security reference it points to.
-- **Agent / Claude-Code config security** — a separate concern (`.claude/`,
-  hooks, MCP, prompt injection, sandboxing). Covered by `../building-agents/SKILL.md`
-  and agent-config-security tooling; explicitly **out of scope** here.
-- **`../harness/SKILL.md`** — secrets land in
-  `01-TOOLS/<PROVIDER>/.env` (gitignored); reinforces never-in-repo.
-- **References** — go to `references/threat-modeling.md` to model a feature before
-  coding; `references/owasp-by-stack.md` for vulnerable→fixed code in any of the
-  three stacks; `references/authn-authz.md` to design login/sessions/tokens/MFA;
-  `references/secrets-and-supply-chain.md` for secret handling, dependency
-  pinning, and the CI gate.
+## Project grounding
+
+In a project with a `02-DOCS/` layer ([`harness`](../harness/SKILL.md)), this
+project's security decisions live in `02-DOCS/wiki/stack/security.md`, indexed
+from `02-DOCS/wiki/index.md` (the Knowledge map; root `CLAUDE.md` keeps only a
+pointer to it). Read it first and stay consistent; if it is missing or stale,
+create/update it with the real choices — threat model, auth model, secrets
+backend, CI security gates, accepted risks — index it, and bump its `Updated`
+date in the same change. No `02-DOCS/` layer? Skip silently (optionally suggest
+`harness`): technical conventions are *recorded, not gated* — never block the
+task on this.
+
+Stack skills ([`fastapi`](../fastapi/SKILL.md), [`nextjs`](../nextjs/SKILL.md),
+[`go`](../go/SKILL.md), [`flutter`](../flutter/SKILL.md),
+[`postgresdb`](../postgresdb/SKILL.md), [`deployment`](../deployment/SKILL.md))
+defer security to this skill; where one doesn't exist yet, this is the canonical
+reference it would point to.

package/skills/ship/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ship
-description: "Use when the work is complete and verified and it is time to CLOSE the development branch — the final phase of the rsc SDD chain, after review approves the diff. Triggers: 'ship it', 'close the branch', 'open the PR', 'merge this', 'merge into main', 'create the pull request', 'how do I land this work', 'finish this feature', 'haz el merge', 'abre el PR', 'cierra la rama', 'súbelo a main', 'clean up the branch', 'I'm done, what now'. HARD RULE it enforces: git authorship is ALWAYS Eric — never a Co-Authored-By or 'generated with' footer in any commit or PR. NOT running lint/type/test (that is `verify`), NOT reading the diff adversarially (that is `review`), NOT deploy/release mechanics to a server (that is `deployment`). Honors the harness accompaniment dial."
+description: "Use when a verified, review-approved branch has to land — the close of the rsc SDD chain: safety checks, then three landing options (merge, PR, park/discard), authorship always Eric and never an AI trailer. NOT running the gates (that is `verify`), NOT reading the diff for defects (that is `review`), NOT shipping to a server (that is `deployment`)."
 tags: [sdd, ship, release, pr]
 recommends: []
 profiles: [core, full]
@@ -11,22 +11,21 @@ origin: risco
 
 Ship is the **last gate** of the rsc SDD chain: `constitution → specify → clarify → plan → tasks → analyze → implement → verify → review → **ship**`. Everything upstream proved the work is *correct* and *green*; ship is the act of **landing it** — turning an approved branch into merged history, a pull request, or a clean parked branch — without breaking the trunk and without ever forging the author.
 
-This skill owns one decision and its safe execution: **how does this work integrate?** It does not write code, run test gates, or read the diff for defects — those phases already happened. It takes a diff that *earned* its verdict and gets it home.
+This skill owns one decision and its safe execution: **how does this work integrate?** It does not write code, run test gates, or read the diff for defects — those phases already happened. It is the **close, not the open**: creating the isolated branch or worktree is `../worktrees/SKILL.md`, taking the gates green is `../verify/SKILL.md`, reading the diff adversarially is `../review/SKILL.md`, and putting merged code onto a server is `../deployment/SKILL.md`.
 
 ## The hard rule: git authorship is Eric, never Claude
 
 > **Every commit and every PR ships under Eric's name. No `Co-Authored-By: Claude`. No `Co-Authored-By` for any AI. No "🤖 Generated with Claude Code" footer. No "made by an agent" line in the PR body. Nothing that attributes the work to a tool.**
 
-This is non-negotiable and it is the reason this skill exists as its own phase. The work is Eric's; the agent is a tool he used, like an editor or a compiler. You do not credit the compiler in the commit message.
+This is absolute — not a preference to weigh against convenience — because a commit is a permanent, published claim about who wrote something. The work is Eric's; the agent is a tool he used, like an editor or a compiler, and you do not credit the compiler in the commit message. Once a forged trailer is pushed it is in everyone's history and only a rewrite removes it.
 
 Concretely, before any commit or PR:
 
-- **Never** append a trailer, footer, or body line crediting Claude, an AI, an agent, or "Claude Code".
 - **Never** pass `--author` to set a non-Eric author. The repo's configured `user.name` / `user.email` (Eric's) is the author and committer.
 - If `git config user.email` is unset or clearly not Eric's, **stop and ask** which identity to commit under — do not guess, and do not substitute an agent identity.
 - If you find a Claude/AI trailer in a commit you are about to push (e.g. left over from an upstream tool), **strip it** before the branch lands.
 
-Verify it after writing the commit:
+Verify it after writing the commit. A non-empty match is a blocker: amend and re-check before the branch goes anywhere.
 
 ```bash
 git log -1 --format='%an <%ae>%n%n%b' | grep -iE 'co-authored-by.*(claude|anthropic|ai)|generated with|claude code' \
@@ -34,40 +33,21 @@ git log -1 --format='%an <%ae>%n%n%b' | grep -iE 'co-authored-by.*(claude|anthro
   || echo "authorship clean"
 ```
 
-A non-empty match is a blocker. Amend the commit and re-check before the branch goes anywhere.
-
 ## Read these first
 
-1. `02-DOCS/wiki/harness/user-profile.md` — the **accompaniment dial** (L0..L3). It sets how much you narrate and how you frame the three options, never whether you run the safety checklist. See "Accompaniment dial" below.
-2. The **review verdict** for this branch — ship runs only on `APPROVE` or `APPROVE WITH NITS`. If the last verdict was `CHANGES REQUESTED`, the loop goes back to `implement`, not forward to ship.
+1. `02-DOCS/wiki/harness/user-profile.md` — the accompaniment dial (L0..L3). It sets narration only, never whether you run the safety checklist.
+2. The **review verdict** for this branch — ship runs only on `APPROVE` or `APPROVE WITH NITS`. `CHANGES REQUESTED` loops back to `implement`, not forward to ship. If there is no verdict on record, say so and treat it as a red flag: do not ship a diff that skipped `../review/SKILL.md` — offer to run it first.
 3. `02-DOCS/wiki/sdd/decisions.md` and the spec/plan slug — so the commit message and PR body describe *what shipped against which spec*, not a vague "various changes".
 
-If there is no review verdict on record, say so and treat it as a red flag — do not ship a diff that skipped the `review` phase. Offer to run review first.
-
-## When to use / When NOT to use
-
-Use when:
-
-- A branch has passed `verify` (green gates) and `review` (approved), and the work needs to land.
-- The user says "ship it", "merge this", "open the PR", "close the branch", "I'm done" — and the code is actually ready.
-- A finished branch needs to be parked or discarded cleanly (abandoned spike, superseded approach).
-
-Do NOT use when (route elsewhere):
-
-- Lint / type-check / tests / audit still need to run and go green → that is the **verify** phase (`../verify/SKILL.md`). Ship assumes green.
-- The diff hasn't been read for defects, or a review comment needs processing → that is **review** (`../review/SKILL.md`).
-- The merge is clean but now it must reach a *server* — provisioning, release pipeline, environment promotion, rollback → that is **deployment** (`../deployment/SKILL.md`). Ship lands the code in the repo; deployment puts it in production.
-- You need to *create* the isolated branch/worktree to start work → that is **worktrees** (`../worktrees/SKILL.md`). Ship is the close, not the open.
-
 ## The pre-ship safety checklist
 
 Run this before presenting the landing options. Any unchecked item is a stop — surface it, don't ship around it.
 
 - [ ] **Review verdict is APPROVE / APPROVE WITH NITS** (not CHANGES REQUESTED, not absent).
 - [ ] **Working tree is clean** — `git status --short` is empty. No stray edits sneaking into the merge.
-- [ ] **On a feature branch, not the trunk** — `git rev-parse --abbrev-ref HEAD` is not `main`/`master`. If work landed directly on the trunk, that is its own problem; flag it.
+- [ ] **On a feature branch, not the trunk** — `git rev-parse --abbrev-ref HEAD` is not `main`/`master`. If work landed directly on the trunk, that is its own problem; flag it, don't paper over it.
 - [ ] **Rebased / up to date with the base** — branch is on top of latest `main`; conflicts resolved locally, not punted to the merge.
-- [ ] **No secrets in the diff** — scan the staged/branch diff for keys, tokens, `.env` values (`git diff main... | grep -iE 'api[_-]?key|secret|password|token|BEGIN .*PRIVATE KEY'`). A hit is a blocker.
+- [ ] **No secrets in the diff** — scan the staged/branch diff for keys, tokens, `.env` values (`git diff main... | grep -iE 'api[_-]?key|secret|password|token|BEGIN .*PRIVATE KEY'`). A hit is a blocker; remove it, and rotate it if it was ever pushed.
 - [ ] **Authorship is Eric** — `git config user.email` is Eric's; no AI trailer in any commit on the branch (run the grep above across `main..HEAD`).
 - [ ] **Commit history is intelligible** — squashed or organized so the history reads as deliberate, not "wip wip fix fix".
 
@@ -87,9 +67,10 @@ When rsc is installed for Claude Code, a `PreToolUse` hook (`.rsc/ship-guard.mjs
 phase at the one deterministic moment it matters: it **denies** any Bash command that switches to
 `main`/`master` or merges while the current feature branch has **uncommitted changes** or **commits
 that were never pushed**. The denial reason names the branch and routes you here. The guard is
-local-only (no network), **fail-open** (any ambiguity allows the command), and can be disabled per
-project with `.rsc/.no-ship-guard`. It guarantees the commit → push step; opening the PR is still
-this skill's job (and its hard rule). If the guard blocks you, do not work around it — run ship.
+local-only (no network), **fail-open** (any ambiguity — detached HEAD, no repo, git error — allows
+the command), and can be disabled per project with `.rsc/.no-ship-guard`. It guarantees the
+commit → push step; opening the PR is still this skill's job (and its hard rule). If the guard
+blocks you, do not work around it — run ship.
 
 ## The three landing options — always present exactly three
 
@@ -116,6 +97,8 @@ Stacked PR / feature-track support still fits inside the three landing options:
 
 ## Executing each option
 
+**Nothing below runs before the user picks an option.** Merging, pushing, opening a PR and deleting a branch are outward or irreversible — they change shared history or publish to a forge, and no later phase undoes them. A recommendation is not a yes; wait for one.
+
 ### Option 1 — direct merge
 
 ```bash
@@ -176,7 +159,7 @@ Never stack to hide review risk. Stack because each slice is independently revie
 ### Option 3 — park or discard
 
 - **Park:** leave the branch, push it so it's not lost (`git push -u origin feature/<slug>`), and log *why it's parked* to `02-DOCS/wiki/sdd/decisions.md`. Do not merge.
-- **Discard:** deletion is **destructive** — require an explicit confirmation that quotes the branch name (e.g. the literal `yes, delete feature/<slug>`) before `git branch -D`. Anything ambiguous means keep it. Log the discard and the reason so the dead-end is remembered, not re-attempted.
+- **Discard:** deletion is **destructive and unrecoverable** once the branch is gone from both sides, so it takes an explicit confirmation that quotes the branch name (the literal `yes, delete feature/<slug>`) before `git branch -D`. Anything ambiguous means keep it. Log the discard and the reason so the dead-end is remembered, not re-attempted.
 
 **If the work lived in a worktree, clean it up provenance-aware.** After the merge/park/discard, only
 remove a worktree **rsc created** (under `.worktrees/`/`worktrees/` or the `../<repo>-<slug>` dir),
@@ -196,25 +179,24 @@ The commit is the durable record. Make it describe the change and tie it to the
 
 ## Model tier — `light` (opt-in routing)
 
-This phase's default model tier is **`light`** — closing the branch (PR / merge / cleanup) is mechanical. Routing is **off** unless `models.enabled: true` in `02-DOCS/wiki/sdd/config.yaml`. When on: resolve this phase's tier (`models.overrides` wins over `models.phases`), map it to a model via `models.tiers`, and apply per `../sdd/references/model-routing.md` — announce the switch per the accompaniment dial when it differs from the session model, and dispatch any `Task`/`parallel` subagents on that model. Routing off or no profile → honor the session model silently. Never fake a switch a tool can't make; skip routing on a one-line change. The Eric-only authorship rule is independent of the model and never relaxes.
+Closing the branch (PR / merge / cleanup) is mechanical, so this phase's default tier is **`light`**. Routing is **off** unless `models.enabled: true` in `02-DOCS/wiki/sdd/config.yaml`; when it is on, follow `../sdd/references/model-routing.md` for resolving and announcing the switch rather than from memory. Routing off or no profile → honor the session model silently, and skip routing on a one-line change. The Eric-only authorship rule is independent of the model and never relaxes.
 
 ## Accompaniment dial (L0..L3)
 
-Read the level from `02-DOCS/wiki/harness/user-profile.md`. It changes the narration, **never** the safety checklist or the authorship rule.
-
-- **L0** — run the checklist silently, state the recommended option in one line, execute on a yes. `Clean, rebased, authorship Eric. Recommend PR (main is protected). Open it?`
-- **L1** — the three options as one-liners with the recommendation and its *why*.
-- **L2** — the full options table, the checklist results, and why the recommended option fits this repo's workflow.
-- **L3** — the above plus teaching: what a fast-forward vs `--no-ff` merge does to history, why a protected `main` wants a PR, what squashing trades away — framed for a non-technical owner ("a PR is asking permission before changing the shared copy"). Still never skips a checklist item.
+Read the level from `02-DOCS/wiki/harness/user-profile.md`. It changes what you show, **never** the safety checklist or the authorship rule. No profile → default to L2 and proceed; don't stall the ship to ask for a dial setting.
 
-When no profile exists, default to L2 and proceed — don't stall the ship to ask for a dial setting.
+| Level | What ship shows |
+| --- | --- |
+| **L0** | Checklist run silently, recommended option in one line, execute on a yes: `Clean, rebased, authorship Eric. Recommend PR (main is protected). Open it?` |
+| **L1** | The three options as one-liners, with the recommendation and its *why*. |
+| **L2** | The full options table, the checklist results, and why the recommended option fits this repo's workflow. |
+| **L3** | L2 plus teaching, framed for a non-technical owner: what fast-forward vs `--no-ff` does to history, why a protected `main` wants a PR ("asking permission before changing the shared copy"), what squashing trades away. |
 
 ## Anti-patterns → STOP
 
 | Rationalization | Reality |
 | --- | --- |
-| "I'll add `Co-Authored-By: Claude` to be transparent" | No. The work is Eric's. No AI trailer, ever — this is the whole point of the phase. |
-| "A 'Generated with Claude Code' footer is just polite" | It forges the record. Strip it. The commit credits Eric and only Eric. |
+| "I'll add `Co-Authored-By: Claude` / a 'Generated with Claude Code' footer to be transparent" | It forges the record. The work is Eric's — no AI trailer, ever. Strip it. |
 | "Review didn't formally approve but it's obviously fine" | No verdict = not ready. Ship runs on APPROVE only. Route back to review. |
 | "The tree has a couple of stray edits, they're harmless" | A dirty tree means the merge is not the reviewed diff. Clean it or stash it first. |
 | "`main` is protected but I'll just force-merge, I'm sure" | Protected means PR. Don't bypass the gate the repo deliberately set. |
@@ -223,14 +205,6 @@ When no profile exists, default to L2 and proceed — don't stall the ship to as
 | "Squash everything, history doesn't matter" | Squash noise, preserve meaning. The history is the next reader's spec. |
 | "There's a key in the diff but it's a test key" | A secret in the diff is a blocker regardless. Pull it out before landing. |
 
-## Red flags — abort and re-plan
-
-- Any commit on the branch carries an AI `Co-Authored-By` or "generated with" line → strip it; do not push until clean.
-- `git config user.email` is unset or not Eric's → stop and ask which identity to commit under.
-- No review verdict, or the last verdict was `CHANGES REQUESTED` → not shippable; route to review/implement.
-- The branch is `main`/`master` itself → work landed on the trunk directly; flag it, don't paper over it.
-- A secret matches in the branch diff → blocker; remove it (and rotate it if it was ever pushed).
-
 ## Where this writes
 
 Ship is mostly git actions, but the outcome is recorded so the knowledge model stays whole:
@@ -269,12 +243,8 @@ End with:
 
 ## Next in the chain
 
-Ship is the end of the SDD loop for a feature. Two onward paths:
-
-- The code is merged but must reach a **server / release** — provisioning, pipeline, environment promotion, rollback → hand off to **deployment** (`../deployment/SKILL.md`). Ship lands it in the repo; deployment puts it in front of users.
-- The next feature starts the loop again at **specify** (`../specify/SKILL.md`) — or at **constitution** if the project's principles changed. The `sdd` dispatcher (`../sdd/SKILL.md`) routes whichever comes next.
+Ship is the end of the SDD loop for a feature. Two onward paths: the merged code still has to reach a **server / release** → hand off to **deployment** (`../deployment/SKILL.md`); or the next feature restarts the loop at **specify** (`../specify/SKILL.md`), or at **constitution** if the project's principles changed. The `sdd` dispatcher (`../sdd/SKILL.md`) routes whichever comes next.
 
 ## Orientación (siempre)
 
 Cierra cada turno con el **bloque-brújula** (📍 dónde estás · ✅ qué hiciste · 🧭 por qué · ➡️ siguiente, terminando en pregunta), calibrado al dial de `02-DOCS/wiki/harness/user-profile.md`. **Nunca termines en seco.** Protocolo completo: skill `orient` → `skills/orient/references/orientation-contract.md`. (Defiere a `suggest` el "¿instalo la skill que falta?".)
-