@ericrisco/rsc 1.4.1 → 2.0.1

package/README.md

@@ -6,7 +6,7 @@
 
 [![npm](https://img.shields.io/npm/v/@ericrisco/rsc?color=63d68a&labelColor=12161c&label=npm)](https://www.npmjs.com/package/@ericrisco/rsc)
 [![downloads](https://img.shields.io/npm/dm/@ericrisco/rsc?color=63d68a&labelColor=12161c&label=downloads)](https://www.npmjs.com/package/@ericrisco/rsc)
-[![skills](https://img.shields.io/badge/skills-272-63d68a?labelColor=12161c)](#the-catalog)
+[![skills](https://img.shields.io/badge/skills-273-63d68a?labelColor=12161c)](#the-catalog)
 [![license](https://img.shields.io/badge/license-MIT-63d68a?labelColor=12161c)](LICENSE)
 [![stars](https://img.shields.io/github/stars/ericrisco/rsc-harness?color=63d68a&labelColor=12161c)](https://github.com/ericrisco/rsc-harness/stargazers)
 
@@ -90,8 +90,41 @@ npx @ericrisco/rsc@latest onboard --technical-level mixed --accompaniment L1 \
 - **Add one skill by id:** `rsc add <id>` · **browse the catalog:** `rsc consult "<what you want>"` or `rsc list`.
 
 From then on it's self-driving: `rsc-suggest` proposes the next skill as tasks appear, and in
-Claude Code a hook re-asserts the spec-first **new-feature gate** on every turn — so a feature
-request routes through `specify` before any skill writes code.
+Claude Code a hook re-asserts the **lane decisor** on every turn — so every request is classified
+before anything is written.
+
+---
+
+## 🛣️ Three lanes, and the harness never picks the expensive one for you
+
+<img src="https://raw.githubusercontent.com/ericrisco/rsc-harness/main/site/lanes.svg" alt="The rsc lane decisor: a request is classified into answer (read-only), FTD (the default lane, one feature document) or SDD (the ten-phase chain, which only the user selects)." width="960">
+
+Every turn takes exactly one lane, and your agent names the one it took in a line.
+
+1. **Answer.** The request asks for information — explain, compare, investigate, audit, review,
+   propose. It is **read-only**: nothing is written, no artifact is created, no writer is delegated.
+   Asking your agent to *think about* building something is still this lane. When intent is
+   ambiguous it asks one question and stays here; ambiguity slows the lane down, it never raises it.
+2. **FTD — Fast-Track Development.** The request authorises a change. This is the default for
+   ordinary work and needs no ceremony. One feature document per feature holds intent, scope, a
+   checklist, the evidence and the next step. Tasks are checked off against observed proof, never
+   against intention. A branch if the work writes code; nothing if it only touches docs or config.
+3. **SDD — the ten-phase chain.** Unchanged, and **the harness never enters it alone.** It proposes
+   the chain only when a durable spec, plan and task list would remove a *substantial* ambiguity —
+   a test of usefulness, not of size — and enters it only when you ask for it or accept that
+   proposal. Size, file count and perceived risk never select it on their own.
+
+**Isolation cleans itself up.** When a lane opens a branch or a worktree, you no longer have to
+remember to retire it: a `post-merge` hook does it the moment the work lands on the trunk, on both
+landing paths — a local merge and the pull after a forge merge. It removes only what is provably
+landed and holds nothing unsaved; anything it refuses tells you why. The previous version asked an
+agent to run the cleanup at the end of a long phase, and that step was skipped on both features that
+reached it.
+
+Earlier versions routed everything that sounded like building into the chain. That contradicted the
+project's own first rule — friction is proportional to risk — and a harness that interrupts the 80%
+that is harmless gets switched off, which protects nothing. Both lanes are still here; what changed
+is which one you land in by default, and who decides.
 
 ---
 
@@ -199,7 +232,7 @@ $ rsc onboard
  ██████╗ ███████╗ ██████╗     ← animated gradient wordmark
  ██╔══██╗██╔════╝██╔════╝
  ██████╔╝███████╗██║
-  272 skills · one CLI · zero bloat
+  273 skills · one CLI · zero bloat
 
 How technical should the conversation be?
 How much accompaniment do you want?
@@ -226,7 +259,7 @@ report success with three markdown files.
 
 ## The CLI
 
-Fresh projects enter through `rsc onboard`. The direct `add` and `install --profile` forms below
+Fresh projects enter through `rsc onboard`. The direct `add` and `install` forms below
 are maintenance controls for projects that already carry an `.rsc.json` declaration; they cannot
 bypass onboarding in a new folder.
 
@@ -236,10 +269,6 @@ rsc reassess                        # check persisted deferral triggers; never i
 rsc add fastapi postgresdb           # install specific skills, by name
 rsc add youtube-api remotion-video   # …grow a channel, edit with Remotion
 rsc add fastapi --target claude,codex   # install into several assistants at once
-rsc install --profile minimal        # the base: orient + suggest + bro + unslop + show-me + eli5 + harness + init
-rsc install --profile core           # floor + the full SDD workflow
-rsc install --profile full           # everything (all 272 skills)
-rsc install --profile full --without go
 rsc consult "I want to launch a SaaS"  # recommend only, no install
 rsc registry refresh                 # write .rsc/skill-registry.{json,md}
 rsc list                             # installed skills, agents and commands
@@ -313,9 +342,11 @@ When someone changes the harness and you `git pull`, `rsc doctor` tells you what
 matches. **Nothing is ever written to your machine by a pull** — you are told, and you decide.
 
 **Own skills.** A skill your team wrote lives in the repo and already works for whoever clones,
-with no command at all. Declare it in `.rsc.json` under `ownSkills` and `doctor` will also say
-when someone is missing it — that is all declaring does. rsc never installs, updates or
-overwrites it: its version is the commit.
+with no command at all. rsc never installs, updates or overwrites it: its version is the commit.
+Installing a catalog skill of the same name is refused rather than silently winning, and `doctor`
+lists what is yours by reading the files themselves — no list to keep in `.rsc.json`, because a
+list somebody has to remember to update is a list that goes quietly stale. Declaring a skill under
+`ownSkills` still works and still reports when someone is missing it.
 
 
 ## 🩹 Something's off? One command
@@ -400,7 +431,7 @@ just asks in plain language.
 
 ## The catalog
 
-272 skills, grouped by what you're trying to do. Click any skill to read its
+273 skills, grouped by what you're trying to do. Click any skill to read its
 `SKILL.md`. It fires on its own when a task matches.
 
 ### 🧭 Core & control plane
@@ -415,6 +446,12 @@ The front door and the workspace brain.
 > **bro** is installed with every profile and rewrites any answer in plain, natural
 > language when the user asks — without making its full body always-on.
 
+<img src="https://raw.githubusercontent.com/ericrisco/rsc-harness/main/site/company-brain.svg" alt="The rsc company brain as a 3D knowledge graph: loose material drifts in from the inbox on the left and is absorbed into the bright green wiki cluster, whose brightest hubs are its .base views; dim clusters behind are raw sources and the agent's own captured worklog; an amber cluster is gaps.md, what the wiki knows it is missing." width="960">
+
+Anything you drop in goes to `inbox/` and is ingested; the wiki consolidates it as plain markdown you can open as an
+Obsidian vault; and every skill reads it before acting, so the next session starts where the last one stopped. Raw
+sources and the agent's own worklog stay underneath — present, never deleted, out of the way.
+
 > #### 📦 The `02-DOCS/` brain is now 100% Open Knowledge Format (OKF v0.1) conformant
 >
 > Google Cloud published the [**Open Knowledge Format**](https://github.com/GoogleCloudPlatform/knowledge-catalog/tree/main/okf)
@@ -436,9 +473,9 @@ The front door and the workspace brain.
 > root, anything in `inbox/`) is *moved* into `raw/`, never left as clutter.
 
 ### 📐 Spec-Driven Development
-Take a fuzzy intent to a shipped, verified change — phase by phase. `npx @ericrisco/rsc install --profile core`.
+Two lanes for change: `ftd` for ordinary work — one feature document, evidence, done — and the ten-phase chain when durable artifacts would settle a real ambiguity. Both ship with the harness.
 
-[sdd](skills/sdd/) · [constitution](skills/constitution/) · [idea-refinement](skills/idea-refinement/) · [specify](skills/specify/) · [clarify](skills/clarify/) · [plan](skills/plan/) · [tasks](skills/tasks/) · [analyze](skills/analyze/) · [decision-challenge](skills/decision-challenge/) · [implement](skills/implement/) · [source-grounded-development](skills/source-grounded-development/) · [verify](skills/verify/) · [review](skills/review/) · [simplify-code](skills/simplify-code/) · [ship](skills/ship/) · [debug](skills/debug/) · [worktrees](skills/worktrees/) · [parallel](skills/parallel/)
+[ftd](skills/ftd/) · [sdd](skills/sdd/) · [constitution](skills/constitution/) · [idea-refinement](skills/idea-refinement/) · [specify](skills/specify/) · [clarify](skills/clarify/) · [plan](skills/plan/) · [tasks](skills/tasks/) · [analyze](skills/analyze/) · [decision-challenge](skills/decision-challenge/) · [implement](skills/implement/) · [source-grounded-development](skills/source-grounded-development/) · [verify](skills/verify/) · [review](skills/review/) · [simplify-code](skills/simplify-code/) · [ship](skills/ship/) · [debug](skills/debug/) · [worktrees](skills/worktrees/) · [parallel](skills/parallel/)
 
 > Two of those are not phases the chain walks on its own. `idea-refinement` **is** invoked — `specify` runs its FRAME block before the first question round. `decision-challenge` is **on-demand**: it exists, it is good, and no phase calls it yet. Listed so you can reach for it, not because the chain will. And the limit of what FRAME buys you, stated rather than implied: a second reading by the same model breaks correlation of **framing**, not of model — it shares the priors it is checking.
 

package/manifest.json

@@ -1,7 +1,7 @@
 {
-  "version": "1.4.1",
+  "version": "2.0.1",
   "counts": {
-    "skills": 272,
+    "skills": 273,
     "agents": 33,
     "commands": 53,
     "fixedCommands": 20
@@ -1956,6 +1956,27 @@
       ],
       "profiles": []
     },
+    {
+      "id": "ftd",
+      "description": "Use for ordinary authorised change — the default lane once the decisor has ruled out a question and not selected the chain. Keeps one feature document per feature in 02-DOCS holding intent, scope, checklist, evidence and next step, checks tasks off only against observed proof, and branches when the work writes code. NOT the ten-phase chain (that is `sdd`), NOT the classification itself (that is the decisor in `suggest`), NOT a request for information, which writes nothing.",
+      "tags": [
+        "ftd",
+        "lane",
+        "default",
+        "feature-document",
+        "evidence"
+      ],
+      "recommends": [
+        "worktrees",
+        "debug",
+        "verify"
+      ],
+      "profiles": [
+        "minimal",
+        "core",
+        "full"
+      ]
+    },
     {
       "id": "fundraising",
       "description": "Use when planning or running an equity round as a process: sizing the raise to a milestone, choosing post-money SAFE vs priced round, tiering investors by intro path, sequencing outreach for momentum, or reading a term sheet before signing. NOT the slide narrative (that is `pitch-deck`), NOT the cap-table or valuation math (that is `financial-model`).",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "1.4.1",
+  "version": "2.0.1",
   "description": "A guided harness builder that turns your goal into a minimal, verified AI-agent setup using strict best practices.",
   "type": "module",
   "bin": {

package/scripts/doctor.js

@@ -1,10 +1,11 @@
-import { existsSync, readFileSync, statSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { targetPaths, TARGET_IDS } from '../targets/index.js';
 import { readState } from './lib/state.js';
 import { divergence } from './lib/divergence.js';
 import { loadManifest } from './lib/manifest.js';
+import { readManifest as readProjectManifest } from './lib/manifest-file.js';
 import { listBackups } from './lib/backups.js';
 import { SDD_GATE_TEXT } from '../targets/hook-once.mjs';
 import { isEnabled, checkSello, readSello, countFindings, readEffectiveConfig, validateRiskConfig } from '../targets/sello.mjs';
@@ -79,6 +80,62 @@ export function missingHookScripts({ target, home = homedir(), cwd = process.cwd
   return [...seen];
 }
 
+// Is the post-merge trigger actually armed in this clone? Three states, because they need three
+// different answers: armed, absent (repair it), or someone else's (leave it — chaining is our job
+// at install time, and overwriting a husky hook to fix a convenience would be indefensible).
+function worktreeCleanupStatus(root) {
+  const hook = join(root, '.git', 'hooks', 'post-merge');
+  if (!existsSync(join(root, '.git'))) return { state: 'not-a-repo' };
+  if (existsSync(join(root, '.rsc', '.no-worktree-cleanup'))) return { state: 'off-by-choice' };
+  if (!existsSync(hook)) {
+    return { state: 'absent', action: 'Run `npx @ericrisco/rsc repair` to arm the post-merge cleanup in this clone.' };
+  }
+  try {
+    const armed = readFileSync(hook, 'utf8').includes('rsc-managed worktree cleanup');
+    return armed
+      ? { state: 'armed' }
+      : { state: 'foreign', action: 'A post-merge hook from another tool is in place; `npx @ericrisco/rsc repair` chains ours behind it.' };
+  } catch { return { state: 'unreadable' }; }
+}
+
+// Every skill this catalog ships declares `origin: risco` in its own frontmatter — all 272 of them,
+// uniformly. So "is this ours?" is answerable from the file itself, and does not need the list in
+// `.rsc.json` that nobody ever filled: that list is parallel accounting (P3), it has been empty in
+// every project since it was introduced, and `doctor` has been faithfully reporting on the emptiness.
+//
+// Failing towards "the user's" is deliberate. Reading a catalog skill as the user's leaves a file
+// that stops being updated; reading the user's as the catalog's invites something to overwrite it.
+// Only one of those loses work.
+const CATALOG_ORIGIN = 'risco';
+
+function ownSkillsIn(paths, declared = []) {
+  const present = [];
+  let dir;
+  try { dir = dirname(paths.skillDir('_')); } catch { return { present, missing: [], declared }; }
+  let entries = [];
+  try { entries = readdirSync(dir, { withFileTypes: true }); } catch { /* nothing installed here yet */ }
+  for (const entry of entries) {
+    // Symlinks included, deliberately. rsc installs a catalog skill AS a symlink into `.rsc/skills/`
+    // and a hand-written one is a real directory, so the entry type is itself a provenance signal —
+    // and skipping symlinks would have made the frontmatter check below dead code that still looked
+    // like it worked. It did: a mutant that removed the check passed every test until this line was
+    // fixed. Both signals are read now, and the frontmatter is the one that decides.
+    if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
+    const md = join(dir, entry.name, 'SKILL.md');
+    if (!existsSync(md)) continue;
+    let origin = null;
+    try {
+      const head = readFileSync(md, 'utf8').slice(0, 2048);
+      origin = (/^origin:\s*(\S+)\s*$/m.exec(head) || [])[1] || null;
+    } catch { continue; }
+    if (origin !== CATALOG_ORIGIN) present.push(entry.name);
+  }
+  // Declared-but-absent stays meaningful for anyone who did fill the list by hand, and it is the
+  // only half a derivation cannot cover: a file that is gone cannot describe itself.
+  const missing = declared.filter((name) => !existsSync(paths.skillDir(name)));
+  return { present: present.sort(), missing, declared };
+}
+
 export function doctor({ target, home, cwd }) {
   const root = cwd || process.cwd();
   const paths = targetPaths(target, home, cwd);
@@ -134,6 +191,11 @@ export function doctor({ target, home, cwd }) {
       latest: backups[0]?.id || null,
     },
     contextBudget: contextBudget({ target, home, cwd }),
+    // The worktree cleanup's trigger is a git hook, and `.git/hooks/` is not cloned. So a repo can
+    // carry a perfectly healthy harness and still never clean up, on every machine but the one that
+    // ran the installer. Reported, never nagged about: `repair` is what puts it back (P6).
+    worktreeCleanup: worktreeCleanupStatus(root),
+    ownSkills: ownSkillsIn(paths, readProjectManifest(root)?.ownSkills || []),
     sello: selloStatus(root),
     // Whether this harness has a design identity at all. `design` has always DECLARED that it
     // stops without one; until lib/design-identity.js nothing checked it (P2). Reported here,
@@ -383,6 +445,18 @@ export function contextBudget({ target, home = homedir(), cwd = process.cwd() }
     });
   }
   const drift = divergence({ cwd, target, home });
+  // A separate finding, not a fourth clause of the one below: that one says this checkout
+  // is behind its own team, and the fix is to align with the declaration. This one says the
+  // declaration itself is behind the catalog, so aligning with it changes nothing. Folded
+  // together, the report would name the right skill and the wrong reason.
+  if (drift.floorMissing?.length) {
+    findings.push({
+      id: 'floor-missing',
+      severity: 'high',
+      summary: `.rsc.json predates a skill the catalog now requires: ${drift.floorMissing.join(', ')}. The always-on body routes work to it, so that route currently answers nowhere.`,
+      action: 'Run `npx @ericrisco/rsc sync` — it adds what the catalog requires and touches nothing else.',
+    });
+  }
   if (drift.missing.length || drift.extra.length || drift.ownMissing.length) {
     // The day-two case: a teammate changed the harness and this checkout has not caught
     // up. Reported always, even after someone declines to align — the divergence does not

package/scripts/install-apply.js

@@ -10,6 +10,7 @@ import {
   resolveAgentNames, agentByName, allAgentNames, readDeveloperTier,
 } from '../targets/agents.js';
 import { readState, writeState } from './lib/state.js';
+import { withDefaultSkillFloor } from './lib/default-skill-floor.js';
 import { readManifest, writeManifest } from './lib/manifest-file.js';
 import { createBackup } from './lib/backups.js';
 import {
@@ -241,6 +242,23 @@ export async function applyInstall({ skillIds = [], agentIds = [], target, home,
   mkdirSync(dirname(versionFile(cwd)), { recursive: true });
   writeFileSync(versionFile(cwd), CLI_VERSION + '\n');
   recordInManifest({ cwd, target, skillIds, agentIds, onboarding });
+  // The worktree cleanup's trigger. It lives in `.git/hooks/`, which is NOT cloned, so it has to be
+  // (re)written by every operation that touches a user's repo — install, sync and repair all land
+  // here. Target-agnostic on purpose: it is a git hook, not an assistant hook, and a cleanup that
+  // only worked for one of the sixteen assistants would be a cleanup nobody could rely on. The
+  // reaper travels with it for the same reason; until now only the Claude adapter materialized it,
+  // although `managedPathsForInstall` has always declared it for every target.
+  // Only where the accepted plan governs code hooks. An operations harness — company, research,
+  // content — declares a narrower set of paths, and writing a git hook it never agreed to would be
+  // acting outside the plan the user accepted (P4). Caught by the onboarding route-inventory gate,
+  // which is exactly the kind of catch that justifies its existence.
+  try {
+    if (policy?.codeHooks === false) throw new Error('code hooks not governed by the accepted plan');
+    mkdirSync(join(cwd, '.rsc'), { recursive: true });
+    cpSync(join(ROOT, 'targets', 'worktree-reaper.mjs'), join(cwd, '.rsc', 'worktree-reaper.mjs'));
+    const { installMergeHook } = await import('../targets/worktree-reaper.mjs');
+    if (existsSync(join(cwd, '.git'))) installMergeHook(cwd);
+  } catch { /* a project without git, or a read-only .git: the cleanup simply does not arm here */ }
   ignoreLocalState(cwd, target);
   return { ...state, backup };
 }
@@ -512,7 +530,21 @@ export async function syncInstalled({ target, home, cwd = process.cwd(), dryRun
   const ids = Object.keys(state.skills || {});
   const manifest = readManifest(cwd);
   const governedSkills = manifest?.onboarding?.plan?.policy?.skills;
-  const declared = governedSkills || (ids.length ? ids : (manifest?.skills || []));
+  // The accepted plan is a FLOOR, not a ceiling. Reading it as the whole declaration is what deleted
+  // users' skills: `add` recorded the new skill in `manifest.skills` — the living list — and sync
+  // then rebuilt from a governed list that predated it and pruned the difference, recursively.
+  // Reported by a user and reproduced 2026-09-17. The receipt stays untouched, because it is
+  // hash-checked against what the user accepted and is not a log of what happened since.
+  const declaredRaw = governedSkills
+    ? [...new Set([...governedSkills, ...(manifest?.skills || [])])].sort()
+    : (ids.length ? ids : (manifest?.skills || []));
+  // A declaration is frozen at the moment it was written, so a skill the catalog later makes
+  // mandatory never reaches an existing harness: `add` and `install` apply the floor, sync did
+  // not, and sync is the only one an upgrade runs. 2.0.0 shipped the three-lane decisor inside
+  // `suggest` — already declared, so already upgraded — routing ordinary work to an `ftd` that
+  // sync had no reason to fetch. Applied only to a harness that already declares something: a
+  // directory declaring nothing is not a harness missing its floor.
+  const declared = declaredRaw.length ? withDefaultSkillFloor(declaredRaw) : declaredRaw;
   const declaredAgents = state.explicitAgents?.length ? state.explicitAgents : (manifest?.agents || []);
   if (!declared.length && !declaredAgents.length) return dryRun ? { dryRun: true, synced: [], syncedAgents: [], paths: [] } : { synced: [], syncedAgents: [], backup: null };
   if (dryRun) {

package/scripts/lib/default-skill-floor.js

@@ -4,7 +4,12 @@
 // `orient` and `suggest` are runtime always-on. `bro` is installed by default
 // but remains conditionally loaded: its description routes human-language asks
 // without paying for its body on unrelated turns.
-export const DEFAULT_SKILL_FLOOR = Object.freeze(['orient', 'suggest', 'bro']);
+//
+// `ftd` joined in 2.0.1 by the same criterion as `suggest`: the always-on decisor
+// routes ordinary work to `../ftd/SKILL.md`, so a harness without it has a default
+// lane that points at nothing. Membership of every profile was not enough — a
+// declaration written before the skill existed never gains it (see `syncInstalled`).
+export const DEFAULT_SKILL_FLOOR = Object.freeze(['orient', 'suggest', 'bro', 'ftd']);
 
 export function withDefaultSkillFloor(skillIds = []) {
   return [...new Set([...DEFAULT_SKILL_FLOOR, ...skillIds])];

package/scripts/lib/divergence.js

@@ -2,6 +2,7 @@ import { readManifest } from './manifest-file.js';
 import { readState } from './state.js';
 import { targetPaths } from '../../targets/index.js';
 import { existsSync } from 'node:fs';
+import { DEFAULT_SKILL_FLOOR } from './default-skill-floor.js';
 
 // What the team declared versus what is on this machine.
 //
@@ -15,10 +16,13 @@ import { existsSync } from 'node:fs';
 //   ownMissing — declared team skill, absent from the repo. Aligning says so and writes
 //                nothing: it comes from the repo, not from us.
 //   extra      — installed BY RSC, no longer declared.
+//   floorMissing — a skill the catalog makes mandatory that this declaration predates.
+//                Not drift between teammates: drift between the harness and the catalog,
+//                and the only bucket that survives everyone running the same `git pull`.
 // A hand-written skill that nobody declared is in none of them. Not declaring is a valid
 // way to keep things of your own, not an oversight to correct.
 export function divergence({ cwd = process.cwd(), target, home } = {}) {
-  const empty = { missing: [], extra: [], ownMissing: [] };
+  const empty = { missing: [], extra: [], ownMissing: [], floorMissing: [] };
   const manifest = readManifest(cwd);
   if (!manifest) return empty;
 
@@ -29,5 +33,8 @@ export function divergence({ cwd = process.cwd(), target, home } = {}) {
     missing: (manifest.skills || []).filter((id) => !installed.has(id)),
     extra: [...installed].filter((id) => !(manifest.skills || []).includes(id)),
     ownMissing: (manifest.ownSkills || []).filter((name) => !existsSync(paths.skillDir(name))),
+    // Read off the declaration, not off the disk: a skill installed by hand into a harness
+    // that still does not declare it is one sync away from being pruned again.
+    floorMissing: DEFAULT_SKILL_FLOOR.filter((id) => !(manifest.skills || []).includes(id)),
   };
 }

package/scripts/lib/domains.js

@@ -5,7 +5,7 @@
 
 export const DOMAINS = [
   { title: 'Core & control plane', ids: ['init', 'harness', 'orient', 'suggest', 'bro', 'unslop', 'author-skill', 'sdd-init'] },
-  { title: 'Spec-Driven Development', ids: ['sdd', 'constitution', 'idea-refinement', 'specify', 'clarify', 'plan', 'tasks', 'analyze', 'decision-challenge', 'implement', 'source-grounded-development', 'verify', 'review', 'simplify-code', 'ship', 'debug', 'worktrees', 'parallel'] },
+  { title: 'Spec-Driven Development', ids: ['ftd', 'sdd', 'constitution', 'idea-refinement', 'specify', 'clarify', 'plan', 'tasks', 'analyze', 'decision-challenge', 'implement', 'source-grounded-development', 'verify', 'review', 'simplify-code', 'ship', 'debug', 'worktrees', 'parallel'] },
   { title: 'Run a business', ids: ['finance-ops', 'invoicing', 'bookkeeping', 'pricing', 'sales-pipeline', 'lead-gen', 'cold-outreach', 'proposals', 'contracts', 'customer-support', 'client-onboarding', 'retention', 'hiring', 'people-ops', 'inventory', 'logistics-ops', 'procurement', 'meeting-notes', 'sop-builder', 'project-ops'] },
   { title: 'Raise & model money', ids: ['pitch-deck', 'investor-materials', 'financial-model', 'fundraising', 'unit-economics', 'grants'] },
   { title: 'Legal, privacy & compliance', ids: ['gdpr-privacy', 'terms-conditions', 'compliance', 'data-policy', 'ip-trademark'] },

package/scripts/lib/onboarding.js

@@ -181,8 +181,24 @@ export function buildOnboardingPlan(record, evidence) {
   if (/database|persistence|persistencia|base de datos/.test(goal)) goalSignals.push('persistence');
   if (/integration|integración|webhook|third-party|tercero/.test(goal)) goalSignals.push('external-integrations');
   const complexitySignals = [...new Set([...(evidence.complexitySignals || []), ...goalSignals])].sort();
-  const needsSdd = isSoftware && (normalized.softwareScope !== 'small' || complexitySignals.length > 0);
-  const profile = needsSdd ? 'core' : 'minimal';
+  // One harness. WHICH SKILLS you get no longer depends on a prediction nobody can make at minute
+  // zero — the kind of project, and how big the work will turn out to be. The old default installed
+  // eight skills and none of the ten phases the always-on layer routes work to, so the first real
+  // request of every new install stopped to install what the harness had just demanded.
+  //
+  // What still depends on this being a code project is the machinery that EXECUTES: subagents, code
+  // hooks and the gitmoji guard. A company-ops workspace has no git to hook and no diff to review,
+  // and writing those anyway is acting outside the plan the user accepted (P4) — the onboarding
+  // route-inventory gate refuses it, which is how this boundary was found rather than guessed.
+  const profile = 'core';
+  const codeProject = isSoftware;
+  const needsSdd = codeProject;
+  // Installed is not the same as practised, and conflating them is how "everyone gets the chain"
+  // turns into "everyone is told they are missing a constitution". The skills ship with every
+  // harness so the chain is always reachable; the FLOOR — the artifacts a project is expected to
+  // actually have — keeps asking the question it always asked: is this code, and is the work big
+  // enough that the chain will really be run here?
+  const practisesSdd = isSoftware && (normalized.softwareScope !== 'small' || complexitySignals.length > 0);
   const catalog = loadManifest();
   const catalogIds = new Set(catalog.skills.map((skill) => skill.id));
   const detectedSkills = (evidence.stacks || []).filter((stack) => catalogIds.has(stack));
@@ -210,11 +226,14 @@ export function buildOnboardingPlan(record, evidence) {
   const declared = (readManifest(evidence.root ?? process.cwd())?.skills ?? [])
     .filter((id) => catalogIds.has(id) && !inAnyProfile.has(id));
   const skills = [...new Set([...skillsForProfile(catalog, profile), ...detectedSkills, ...declared])].sort();
-  const baseAgents = needsSdd;
-  const hooks = needsSdd;
+  const baseAgents = practisesSdd;
+  const hooks = practisesSdd;
   const agents = baseAgents ? resolveAgentNames(skills, []).sort() : [];
   const gitmojiGuard = hooks && normalized.targets.includes('claude');
-  const decisions = skills.map((id) => detectedSkills.includes(id)
+  // `sdd` is installed everywhere now, but its DECISION is about practice, not presence — so where
+  // the chain is not practised the explicit `deferred` entry below must be the only one, or the
+  // generic "installed → selected" mapping would shadow it and `reassess` would see nothing to watch.
+  const decisions = skills.filter((id) => practisesSdd || id !== 'sdd').map((id) => detectedSkills.includes(id)
     ? selected(id, 'skill', `Detected ${id} evidence inside the selected project root.`, 'workspace-evidence')
     : selected(id, 'skill', needsSdd
       ? (id === 'sdd' && complexitySignals.length
@@ -227,7 +246,11 @@ export function buildOnboardingPlan(record, evidence) {
     { type: 'complexity-added', atLeast: 1 },
     { type: 'manifest-with-implementation' },
   ];
-  if (!needsSdd) decisions.push(deferred('sdd', 'workflow', isSoftware
+  // Deferred means "not practised here yet", NOT "not installed". The skills ship with every harness
+  // so the chain is always one request away; this decision is what `reassess` watches, and what the
+  // floor reads. Collapsing the two would have deleted reassess's reason to exist as a side effect
+  // of an installer change, which is not a decision an installer change gets to make.
+  if (!practisesSdd) decisions.push(deferred('sdd', 'workflow', isSoftware
     ? 'The software scope is small, so specification overhead is not justified yet.'
     : 'SDD applies to substantial software work, which is not the declared project purpose.', sddTriggers, softwareTriggers));
   if (baseAgents) {
@@ -251,7 +274,7 @@ export function buildOnboardingPlan(record, evidence) {
     baseAgents,
     agents,
     alwaysOn: true,
-    codeHooks: needsSdd,
+    codeHooks: practisesSdd,
     gitmojiGuard,
     memory: true,
     context7: false,
@@ -274,8 +297,7 @@ export function buildOnboardingPlan(record, evidence) {
   const floorPaths = [
     '01-TOOLS/_TEMPLATE/',
     '02-DOCS/wiki/harness/',
-    ...(decisions.some((decision) => decision.id === 'sdd' && decision.state === 'selected')
-      ? ['02-DOCS/wiki/sdd/constitution.md'] : []),
+    ...(practisesSdd ? ['02-DOCS/wiki/sdd/constitution.md'] : []),
   ].sort();
   return {
     schemaVersion: 1,

package/scripts/rsc.js

@@ -556,6 +556,27 @@ async function guardCollisions(targets, ids) {
   return confirm('Replace them anyway?');
 }
 
+// The governed list that `sync` reads lives INSIDE the onboarding receipt, not in `manifest.skills`.
+// Updating one without the other is what deleted users' skills: `add` installed a skill and recorded
+// it in `manifest.skills`, `sync` then read a governed list that predated the install, and pruned
+// everything absent from it — recursively. Reported by a user, reproduced 2026-09-17: nine declared
+// skills against eight governed, visible in the manifest before sync was even run.
+//
+// So the two travel together, always. Any command that changes what is installed carries both, and
+// `applyInstall` persists the receipt rather than conserving the stale one.
+function governedBy(receipt, skills) {
+  // The receipt is hash-checked against the plan the user accepted, so its policy is NOT a place to
+  // record what happened afterwards: rewriting `plan.policy.skills` made every install report "the
+  // receipt does not match its accepted plan id", which is the integrity check doing its job.
+  //
+  // An earlier fix for the reported data loss did exactly that, and it was wrong — the right place
+  // was never `add`, it was `sync`, which treated the accepted plan as the only declaration and
+  // pruned everything absent from it. The policy still travels for hooks and agents; what must not
+  // travel is a rewritten receipt.
+  if (!receipt) return { policy: undefined, onboarding: undefined };
+  return { policy: { ...receipt.plan.policy, skills }, onboarding: undefined };
+}
+
 async function main() {
   // One resolution for every command, doctor included: `doctor` used to resolve on its
   // own and could report a different assistant than the one just installed into.
@@ -600,24 +621,43 @@ async function main() {
       const currentManifest = readManifest();
       const receipt = currentManifest?.onboarding;
       const maintainedIds = receipt ? [...new Set([...(currentManifest.skills || []), ...(receipt.plan.policy.skills || []), ...ids])].sort() : ids;
-      const policy = receipt ? { ...receipt.plan.policy, skills: maintainedIds } : undefined;
-      for (const t of targets) await applyInstall({ skillIds: maintainedIds, agentIds: selected.agents, target: t, policy });
+      const { policy, onboarding } = governedBy(receipt, maintainedIds);
+      for (const t of targets) await applyInstall({ skillIds: maintainedIds, agentIds: selected.agents, target: t, policy, onboarding });
       markMaintenanceDrift(`add ${requested.join(',')}`);
       say(`✅ Installed for ${targets.join(', ')}: ${requested.join(', ')}`);
       return void say('   ↻ Reload/restart your assistant so the new skill activates.');
     }
     case 'install': {
+      // Before the harness check on purpose: an obsolete flag is an argument error, and telling
+      // someone to run onboarding first when what they actually typed no longer exists sends them
+      // down the wrong path. There is one harness now, so there is nothing to choose. A flag that
+      // silently stops meaning what it used to is worse than one that is gone — a script would keep
+      // passing `--profile minimal` and keep believing it installed eight skills. Refused, with what
+      // replaced it (P6).
+      if (flag('profile')) {
+        say('⚠️  `--profile` no longer exists: rsc installs one harness — the always-on layer, the FTD lane and the SDD chain.');
+        say('    Everything else still arrives on demand: `npx @ericrisco/rsc add <id>`.');
+        return;
+      }
       if (!hasDeclaredHarness()) return onboardingRequired(onboardingInput(targets));
-      const profile = flag('profile') || 'minimal';
       const without = argv.filter((a, i) => argv[i - 1] === '--without');
-      let ids = skillsForProfile(loadManifest(), profile);
+      let ids = skillsForProfile(loadManifest(), 'core');
       ids = withDefaultSkillFloor(ids).filter((id) => !without.includes(id));
       if (!argv.includes('--force') && !(await guardCollisions(targets, ids))) return;
       const receipt = readManifest()?.onboarding;
-      const policy = receipt ? { ...receipt.plan.policy, skills: ids } : undefined;
-      for (const t of targets) await applyInstall({ skillIds: ids, target: t, policy });
-      markMaintenanceDrift(`install ${profile}`);
-      say(`✅ Profile '${profile}' installed for ${targets.join(', ')} (${ids.length} skills)`);
+      // Deliberately NOT persisting the receipt here, unlike `add` above. `install --profile` REPLACES
+      // the set rather than adding to it, so writing it back would overwrite what the accepted plan
+      // declared with whatever profile was just named — measured: `install --profile minimal` after an
+      // SDD onboarding erased the SDD chain from the governed list, and the floor check then reported
+      // nothing pending. Unioning instead would leave `install` pruning to the profile while the
+      // governed list asked for more, and `sync` putting them back: churn.
+      // Now that profiles are gone this set IS the harness, so persisting it no longer overwrites a
+      // narrower accepted plan with a wider guess: they are the same set. The desync `add` had is
+      // therefore closed here too.
+      const { policy, onboarding } = governedBy(receipt, ids);
+      for (const t of targets) await applyInstall({ skillIds: ids, target: t, policy, onboarding });
+      markMaintenanceDrift('install harness');
+      say(`✅ Harness installed for ${targets.join(', ')} (${ids.length} skills)`);
       printAgentHandoff();
       return;
     }

package/skills/ftd/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: ftd
+description: "Use for ordinary authorised change — the default lane once the decisor has ruled out a question and not selected the chain. Keeps one feature document per feature in 02-DOCS holding intent, scope, checklist, evidence and next step, checks tasks off only against observed proof, and branches when the work writes code. NOT the ten-phase chain (that is `sdd`), NOT the classification itself (that is the decisor in `suggest`), NOT a request for information, which writes nothing."
+tags: [ftd, lane, default, feature-document, evidence]
+recommends: [worktrees, debug, verify]
+profiles: [minimal, core, full]
+origin: risco
+---
+
+# FTD — Fast-Track Development
+
+The lane ordinary work takes. Not a lighter methodology: the **same** discipline about evidence with
+none of the coordination the ten-phase chain exists to buy. One document instead of five, written
+because the work might be interrupted, not because somebody has to approve it first.
+
+You are here because the decisor in `../suggest/SKILL.md` ruled that this turn authorises a change
+and did not select `../sdd/SKILL.md`. If it is still a question, you are in the wrong place: go back
+and answer it.
+
+## Why this lane exists
+
+The constitution's seventh principle has said it from the start: *«la fricción es proporcional al
+riesgo. Silencio para lo trivial, ceremonia solo donde el fallo es caro. Un sistema que molesta en el
+80% inofensivo acaba apagado, y apagado no protege el 20% que importa.»*
+
+The harness spent a long time contradicting it — every request that sounded like building went
+through ten phases. This lane is that principle finally implemented, not a new idea.
+
+## The feature document
+
+One per feature, in the workspace wiki under `02-DOCS/wiki/ftd/<slug>.md`. **Never inside the code
+repository**: whoever clones it should get code, not somebody else's notes in progress.
+
+It is written **before the first change**, not after, and it holds exactly this:
+
+```markdown
+# <feature>
+
+## Intent          — what changes, and why it is worth doing
+## Scope           — what is in, and what is explicitly not
+## Checklist       — one line per task, each with what would prove it done
+## Evidence        — the observed output per completed task
+## Next            — the single next step, so an interruption costs nothing
+```
+
+No decision journal, no phase records, no approvals. If a decision was meaningful, one line of
+rationale goes next to the task it belongs to.
+
+**The checkbox is not the proof.** A task is checked off when its stated check has been *observed* —
+the test output, the command's result, the page rendering. A task whose check was skipped, failed or
+could not run is recorded as such, honestly. The tenth principle applies here exactly as it does in
+the chain: a result asserted without evidence is treated as not done.
+
+## Isolation
+
+If the work writes code, it runs on a branch — never on the default branch, so `origin` and the local
+tree stay clean. **No worktree**: this lane is short enough that setting one up and tearing it down
+costs more than it protects. Work that only touches documentation, the wiki or configuration needs no
+branch at all.
+
+`../worktrees/SKILL.md` owns the isolation mechanics if you need them. Once the branch lands, the
+cleanup is automatic and you do not run anything.
+
+## Growing out of the lane
+
+A feature that turns out to need the chain is **promoted, not restarted**: the feature document
+becomes the input to `../specify/SKILL.md`, and no completed work is discarded. Promotion happens for
+the same reason the chain is ever entered — durable artifacts would remove a substantial ambiguity —
+and never because the work turned out to be big.
+
+## Anti-patterns → STOP
+
+| If you're about to… | Reality / Fix |
+| --- | --- |
+| Skip the document because the change is small | The document is what survives an interruption. Write it, keep it short. |
+| Check a task off because you believe it works | Observed proof or it is not done (P10). Record the check you could not run. |
+| Write the document into the code repository | It belongs in `02-DOCS`. A clone should get code, not notes. |
+| Open a worktree "to be safe" | That is the chain's ceremony arriving through the back door (P7). |
+| Escalate to the chain because the change is large | Size never selects it. Only unresolved ambiguity that artifacts would settle. |
+| Produce a spec, plan or task artifact here | Those are the chain's. This lane has one document. |
+
+## See Also
+
+- `../suggest/SKILL.md` — the decisor that routed here, and the other two lanes.
+- `../sdd/SKILL.md` — the ten-phase chain, for when artifacts genuinely earn their cost.
+- `../verify/SKILL.md` — the evidence gate, when this lane's checks need the full battery.
+- `../debug/SKILL.md` — a failure to reproduce before fixing; comes back here afterwards.
+
+## Orientación (siempre)
+
+Cierra cada turno con el **bloque-brújula** (📍 dónde estás · ✅ qué hiciste · 🧭 por qué · ➡️ siguiente,
+terminando en pregunta), calibrado al dial de `02-DOCS/wiki/harness/user-profile.md`. Nunca termines
+en seco. Protocolo completo: skill `orient`.

package/skills/ftd/evals/cases.yaml

@@ -0,0 +1,66 @@
+skill: ftd
+
+# Cases for FTD — Fast-Track Development, the lane ordinary authorised change takes.
+# FTD keeps ONE feature document per feature in 02-DOCS (intent, scope, checklist,
+# evidence, next step), checks tasks off only against observed proof, and branches when
+# the work writes code. It is NOT the ten-phase chain (sdd), NOT the classification
+# itself (the decisor lives in the always-on suggest body), and NOT a request for
+# information — those write nothing at all.
+
+should_trigger:
+  - prompt: "Añade exportación a CSV usando los filtros del informe que ya existen."
+    why: "An outcome asked for plainly: the change is authorised, understood, and no durable spec would settle anything the code does not. This is the default lane, entered without ceremony."
+
+  - prompt: "Rename the users table across every call site that touches it — there are about forty."
+    why: "Large and mechanical. Size is exactly what must NOT escalate to the chain; forty call sites carry no unresolved design question, so it stays here with one feature document."
+
+  - prompt: "Bump the dependency and fix whatever breaks."
+    why: "Authorised, open-ended in effort but not in intent. The feature document exists so an interruption mid-way costs nothing, which is the whole reason this lane writes one."
+
+  - prompt: "Migra los tres endpoints al nuevo formato de respuesta y deja constancia de lo que has comprobado."
+    why: "Multiple coordinated steps plus an explicit ask for evidence — the checklist-with-observed-proof shape this skill owns, without any phase handoffs."
+
+  - prompt: "Arregla el typo del botón de guardar."
+    why: "Trivial and authorised. Still this lane: the document is short, but the lane is the same, and the boundary is authorisation rather than size."
+
+should_not_trigger:
+  - prompt: "¿Por qué el login tarda tanto en producción?"
+    route_to: "debug"
+    why: "A question about a failure, with nothing authorising a change. Investigation writes nothing; if it becomes a fix, debug reproduces the cause first."
+
+  - prompt: "Compare Postgres and SQLite for this workload and recommend one."
+    route_to: "suggest"
+    why: "Information only. The decisor's read-only lane answers and creates no artifact — a recommendation is not permission to implement it."
+
+  - prompt: "No tengo claro si los permisos van por rol o por recurso, y afecta al esquema, a la API y a la UI."
+    route_to: "specify"
+    why: "A substantial unresolved ambiguity that durable spec/plan/tasks would settle. The harness proposes the chain here; only an explicit request or an accepted proposal enters it."
+
+  - prompt: "Quiero especificar bien el sistema de permisos antes de tocar nada."
+    route_to: "specify"
+    why: "The chain requested by name. Explicit selection always wins over the decisor's default."
+
+  - prompt: "Revisa este diff y dime si tiene bugs."
+    route_to: "code-review"
+    why: "Reading a finished diff for defects is a review, not a change. Nothing here authorises writing, so no feature document is created."
+
+capability:
+  - scenario: "A developer at accompaniment level L2 says: 'Añade exportación a CSV usando los filtros del informe que ya existen.' Show how the lane runs from the first word to delivery."
+    must_include:
+      - "Names the lane out loud in one line before acting, as the decisor requires — this is FTD, not a question and not the chain"
+      - "Creates one feature document at 02-DOCS/wiki/ftd/<slug>.md BEFORE the first change, and says which document it created and how many tasks it holds"
+      - "Writes the document into the workspace wiki, never into the code repository, so whoever clones the repo gets code and not somebody's notes in progress"
+      - "Keeps the document to intent, scope, checklist, evidence and next step — no spec, no plan, no tasks artifact, no decision journal"
+      - "States for each checklist item what would prove it done, before doing it"
+      - "Opens a branch because the work writes code, and explicitly does NOT open a worktree"
+      - "Checks a task off only after observing its stated check, and records a check that failed, was skipped or could not run rather than omitting it (P10)"
+      - "Does not escalate to the ten-phase chain on the basis of size, file count or perceived risk"
+      - "Closes by reporting the verified outcome, every failed or pending check, and the single next step"
+
+  - scenario: "Mid-way through the same work, the developer says the requirement has changed: the export must also respect a date range that does not exist in the current filters. Show how the lane absorbs it."
+    must_include:
+      - "Revises the existing feature document rather than starting a second one, preserving completed work that is still valid"
+      - "Adds the genuinely new tasks, and reopens any invalidated task with the reason written next to it"
+      - "Distinguishes a change the user authorised from a finding the agent made — a finding alone never expands scope"
+      - "Considers promotion to the chain only if durable artifacts would settle a substantial ambiguity, and says so rather than escalating because the work grew"
+      - "If promoted, carries the feature document into specify as input instead of discarding the work already done"

package/skills/ftd/evals/routing.json

@@ -0,0 +1,24 @@
+{
+  "about": "Fixture corpus for the three-lane decisor. The decisor is prose and judgement — chosen deliberately over deterministic signals — so this corpus is the mechanism that makes it checkable (P2). Scored by the behaviour eval, not by npm test; what npm test checks is that the corpus stays honest: every lane represented, every case reasoned, and the cases this lane exists because of still present.",
+  "lanes": {
+    "answer": "information only; writes nothing, creates no artifact",
+    "ftd": "authorised change, ordinary; one feature document",
+    "sdd": "the ten-phase chain, by explicit request or accepted proposal only"
+  },
+  "cases": [
+    { "request": "¿Por qué el login tarda tanto en producción?", "expect": "answer", "why": "investigation; nothing authorises a change" },
+    { "request": "Compare Postgres and SQLite for this workload and recommend one", "expect": "answer", "why": "comparison and a recommendation are information, not a mandate" },
+    { "request": "Revisa este diff y dime si tiene bugs", "expect": "answer", "why": "review is read-only even though it is about code that changes" },
+    { "request": "Audita la seguridad de la capa de autenticación", "expect": "answer", "why": "audit; a finding is not permission to fix it" },
+    { "request": "¿Y si añadiéramos exportación a CSV?", "expect": "answer", "why": "thinking aloud about a feature is not a request to build it; ask before building" },
+    { "request": "Propón cómo estructurarías el módulo de pagos", "expect": "answer", "why": "proposal-only; the old gate would have started the chain here" },
+    { "request": "Añade exportación a CSV usando los filtros del informe que ya existen", "expect": "ftd", "why": "an outcome asked for plainly: authorised, understood, no ambiguity artifacts would settle" },
+    { "request": "Arregla el typo del botón de guardar", "expect": "ftd", "why": "trivial and authorised; one document, no ceremony" },
+    { "request": "Renombra la tabla de usuarios en las 40 llamadas que la usan", "expect": "ftd", "why": "large and mechanical: size alone must never select the chain" },
+    { "request": "Sube la versión de la dependencia y arregla lo que rompa", "expect": "ftd", "why": "authorised change with no unresolved design question" },
+    { "request": "Migra los tres endpoints al nuevo formato de respuesta", "expect": "ftd", "why": "many files, but nothing a spec would settle that the code does not" },
+    { "request": "Quiero especificar bien el sistema de permisos antes de tocar nada", "expect": "sdd", "why": "explicit request for the chain" },
+    { "request": "Vamos a hacer una spec de esto", "expect": "sdd", "why": "explicit request, stated in the user's own words" },
+    { "request": "No tengo claro si los permisos van por rol o por recurso, y afecta al esquema, a la API y a la UI", "expect": "sdd", "why": "propose the chain: durable artifacts would settle a substantial ambiguity, and only an accepted proposal enters it" }
+  ]
+}

package/skills/ship/SKILL.md

@@ -116,16 +116,18 @@ Stacked PR / feature-track support still fits inside the three landing options:
 git switch main && git pull --ff-only
 git merge --no-ff feature/<slug> -m "feat: <what shipped> (<spec-slug>)"   # no AI trailer
 git push origin main
-npx @ericrisco/rsc worktrees reap <path-of-this-feature-worktree>   # by name: this one, not all of them
+# the merge above already retired the worktree and its branch: post-merge does it
 git branch -d feature/<slug> 2>/dev/null || true   # no worktree involved? then the branch alone
 git push origin --delete feature/<slug> 2>/dev/null || true
 ```
 
 Use `--no-ff` so the feature is one legible merge commit tied to the spec. Confirm the trunk still builds after the merge if the repo has a local gate (defer the actual run to `verify`).
 
-**Name the path.** Bare `worktrees reap` retires *every* worktree that currently qualifies, which is not what landing one branch means — with `parallel` running two streams, it is how shipping A deletes B. Pass the path of the worktree this branch lived in; capture it before you switch, since you are usually standing in it (`WT=$(pwd)`).
+**You no longer run the cleanup; you check that it ran.** A `post-merge` hook retires the worktree and its branch the moment the work lands, on both landing paths — the local merge above and the `pull --ff-only` after a forge merge. It removes only what the reaper already classifies as safe, so anything holding unsaved work survives with its reason, exactly as before.
 
-Naming a path selects it, it does not accept the risk of removing it: a worktree holding anything unsaved is still refused, with the reason. Add `--confirm` only after the user has seen that reason and said yes. Run it from anywhere — it finds the main checkout itself.
+This used to be an instruction in this paragraph, and it was skipped on both features that reached it. That is why it is a hook now: an instruction at the end of a long phase is the least reliable place to put a step that matters (P1).
+
+If something did survive, it survived *for a reason* — read it rather than forcing it: `npx @ericrisco/rsc worktrees` lists what is left and why. `worktrees reap <path>` still exists for the backlog and for anything the hook deliberately refused; name the path, because bare `reap` retires every worktree that qualifies and with `parallel` running two streams that is how shipping A deletes B. Naming a path selects it, it does not accept the risk: add `--confirm` only after the user has seen the reason and said yes.
 
 ### Option 2 — pull request
 
@@ -163,7 +165,7 @@ Implements `02-DOCS/wiki/sdd/specs/<slug>.md`. <the user-facing reason>
 
 Then either let the gate run (team/CI) or self-merge once green: `gh pr merge --squash --delete-branch` (or `--merge` to preserve the history). Squash when the branch history is noisy; preserve when each commit is meaningful.
 
-Once it is merged, pull the trunk and reap the one you landed — `git switch main && git pull --ff-only && npx @ericrisco/rsc worktrees reap "$WT"`. A squashed pull request is exactly the case the reaper judges by content rather than by commit identity, so it is recognised as landed; the local branch is kept, because git will not delete a squashed branch safely and while it exists the work is recoverable.
+Once it is merged, pull the trunk — `git switch main && git pull --ff-only` — and the cleanup rides along with that pull: `post-merge` fires on a fast-forward too, verified. A squashed pull request is exactly the case the reaper judges by content rather than by commit identity, so it is recognised as landed; the local branch is kept, because git will not delete a squashed branch safely and while it exists the work is recoverable.
 
 For stacked PRs, create each PR against the previous branch or against a feature-track branch, with bodies that name their dependency:
 

package/skills/suggest/SKILL.md

@@ -12,7 +12,7 @@ origin: risco
 Your body is injected at the start of **every** session and again after every compaction, so you
 are the one piece guaranteed to be present before any other skill is matched. Two jobs, in order:
 
-1. **Route feature intent into SDD** before any code is written.
+1. **Classify every turn into one of three lanes** before anything is written.
 2. **Keep the session equipped** — spot the skill the task needs but the user does not have.
 
 Everything below is what only this layer can do. The method behind each rule lives in the skill that
@@ -20,34 +20,31 @@ owns it; this is the pointer, not the manual.
 
 ---
 
-## 1. Routing: feature intent goes through SDD first
+## 1. The decisor: classify the turn before acting
 
-The moment someone wants something to **exist or behave differently** — build, add, change,
-integrate, "it should also…", "¿y si…?", in any language — route the turn to `specify` before any
-code is written. No skill outranks this. The stack and builder skills that match the same request
-(`nextjs`, `react`, `fastapi`, `flutter`, `go`, `postgresdb`, `building-agents`, `design`,
-`chatbot`, `course-builder`, `marketing`…) run **inside** the chain, after the plan is approved —
-matching strongly is not a reason to skip ahead.
+Every turn takes one of three lanes, and you name the one you took in a line.
 
-Two exceptions, and say out loud when you take one:
+**Answer** — the request asks for information: explain, compare, investigate, audit, review,
+recommend. Read-only: write nothing, create no artifact, delegate no writer. Asking you to *think
+about* building something is still this lane; only asking to build authorises it. When change
+intent is ambiguous, ask one question and stay here — ambiguity slows the lane, never raises it.
 
-- a genuinely one-line, low-risk change (typo, copy tweak, config bump, non-breaking bump) — just do it;
-- a bug fix restoring intended behaviour — that is `debug`, then resume.
+**FTD — Fast-Track Development** — the request authorises a change. The default for ordinary work,
+entered without ceremony. One feature document per feature in `02-DOCS`: intent, scope, checklist,
+evidence, next step. Tasks are checked off against observed proof, never intention. A branch if it
+writes code, none if it only touches docs, wiki or config; never a worktree. → `../ftd/SKILL.md`.
 
-When you cannot tell, choose `specify`. A skipped spec is where drift hides.
+**SDD** — the ten-phase chain, unchanged, and **never entered by the harness alone**. Propose it only
+when durable spec/plan/tasks would remove a *substantial* ambiguity — a test of usefulness, not of
+size — and enter it only on explicit request or an accepted proposal. Size, file count and perceived
+risk never select it. → `../sdd/SKILL.md`.
 
-Judge the **meaning**, not the wording: the trigger is semantic, so it holds in any language,
-including ones with no example here. A URL plus a description of desired behaviour is a feature
-request. If the user engaged **SDD autopilot**, that one consent covers the whole run — advance
-through the phases without re-asking.
+Judge the **meaning**, not the wording: the trigger is semantic in any language. A bug fix restoring
+intended behaviour is `debug`. Autopilot consent covers a whole run — advance without re-asking.
 
-If `specify` / `sdd` are not installed, offer to add them (§2) before routing.
-When `.rsc.json` records SDD as deferred, first run `npx @ericrisco/rsc@latest reassess`.
-Stay silent on `RSC_REASSESSMENT_NO_CHANGE`. If it reports new evidence, explain what changed and
-show the new plan command; SDD still needs a newly accepted plan id and is never added silently.
-
-Method, phase map and full decision table: `../sdd/SKILL.md`. On Claude Code this rule also arrives
-as a per-turn hook; the brevity here is deduplication, not relaxation.
+Lane's skill missing? Offer it (§2) first. SDD recorded as deferred in `.rsc.json`? Run
+`npx @ericrisco/rsc@latest reassess`; silent on `RSC_REASSESSMENT_NO_CHANGE`, and on new evidence
+show the plan command — SDD still needs a newly accepted plan id, never added silently.
 
 ---
 

package/skills/worktrees/SKILL.md

@@ -90,19 +90,31 @@ universal fallback and is exactly what the native tool does under the hood.
 | You have… | Create | Leave intact | Discard |
 | --- | --- | --- | --- |
 | A native worktree tool (`EnterWorktree`-style) | enter, named for the feature slug; the session's working directory moves into the isolated checkout | exit with `keep` — worktree and branch stay on disk for later | exit with `remove` — deletes both when the work is done or abandoned |
-| Plain git only | `git worktree add -b feat/<slug> …` | leave the dir; it persists | `git worktree remove` + `git branch -d` |
+| Plain git only | `git worktree add -b feat/<slug> .worktrees/<slug>` | leave the dir; it persists until its work lands | `git worktree remove` + `git branch -d` |
 
 Removing a worktree that holds uncommitted or unmerged work must be an explicit, confirmed choice,
 never a silent cleanup: refuse the silent path and confirm the discard with the user, quoting what
 would be lost.
 
+**You do not have to remember to clean up.** Once the work lands on the trunk, a `post-merge` hook
+retires the worktree and its branch on its own — it removes only what the reaper already classifies
+as safe, and anything holding unsaved work is refused exactly as it is above. Nothing to run, and
+nothing to remember: the previous version of this skill asked an agent to remember, and it was
+skipped on both features that reached that point.
+
 ```bash
 # from the repo root, default branch up to date
 git fetch origin
-git worktree add -b feat/<slug> ../<repo>-<slug> origin/<default-branch>
-# work happens in ../<repo>-<slug>; the main checkout is untouched
+git worktree add -b feat/<slug> .worktrees/<slug> origin/<default-branch>
+# work happens in .worktrees/<slug>; the main checkout is untouched
 ```
 
+**Inside the repo, always — never a sibling.** `.worktrees/` is already gitignored by the harness,
+the reaper already recognises it as its own, and the difference matters after the work lands: a
+sibling directory sits outside the tree, so it survives every cleanup of the repository and stops
+being visible to whoever would retire it. Two of them accumulated here before this was written down.
+Deleting the repo should delete its worktrees with it.
+
 ```bash
 # branch-only path (the degenerate case: no separate directory needed)
 git switch -c feat/<slug> origin/<default-branch>

package/targets/hook-once.mjs

@@ -89,18 +89,19 @@ export function claimOnce(key, { dir = markerDir(), windowMs = 30_000, now = Dat
 // The SDD gate text lives here, not inline in userprompt-gate.mjs, so it has exactly one
 // definition: the hook emits it and `rsc doctor` measures it from the same constant. Anything
 // that reports a byte count for text it does not own drifts the moment the text changes.
-export const SDD_GATE_TEXT = `===== rsc SDD new-feature gate (highest precedence) =====
-Before acting on this turn: if the user wants to BUILD, ADD, or CHANGE a feature — in
-ANY language, judged by intent, not by keywords — you MUST route it through SDD via
-\`specify\` FIRST. No feature code is written by ANY skill (stack skills included —
-nextjs/react/fastapi/flutter/go/postgresdb/building-agents/design — and any builder skill
-such as chatbot/course-builder/marketing) until a spec AND a plan exist and the user has
-approved them. No skill outranks this gate.
-- Unclear / in-between? -> \`specify\` (the safe default; a skipped spec is where drift hides).
-- One-line / low-risk change, or a bug fix restoring intended behaviour? -> skip the chain,
-  do it, and say so out loud.
-Full gate + decision table live in the always-on \`suggest\` body; method in \`sdd\`.
-=========================================================
+export const SDD_GATE_TEXT = `===== rsc lane decisor (highest precedence) =====
+Classify this turn before acting, and name the lane in one line.
+- Asks for information — explain, compare, audit, review, propose? -> Answer.
+  Write nothing and create no artifact. Change intent unclear -> ask one
+  question and stay read-only; ambiguity slows the lane, it never raises it.
+- Authorises a change? -> FTD (Fast-Track Development). One feature document,
+  tasks checked off only against observed proof, a branch if it writes code.
+- SDD, the ten-phase chain, is never entered by the harness alone. Propose it
+  only when durable spec/plan/tasks would remove a substantial ambiguity, and
+  enter it only on an explicit request or an accepted proposal. Size, file
+  count and risk never select it.
+Method: \`ftd\` · chain: \`sdd\` · full decisor in the always-on \`suggest\` body.
+=================================================
 `;
 
 /**

package/targets/worktree-reaper.mjs

@@ -16,7 +16,7 @@
 //
 // Imported by `.rsc/session-start.mjs` (the sweep) and by `scripts/rsc.js` (`rsc worktrees`), so the
 // rule exists once and both entry points cannot drift apart. Same shape as `sello.mjs`.
-import { existsSync, realpathSync } from 'node:fs';
+import { existsSync, realpathSync, mkdirSync, readFileSync, writeFileSync, renameSync, chmodSync } from 'node:fs';
 import { join, resolve, dirname, basename, relative, sep } from 'node:path';
 import { spawnSync } from 'node:child_process';
 
@@ -365,6 +365,106 @@ export function reapWorktree(root, targetPath, { confirmed = false } = {}) {
  * README.md", judged that a nuisance, confirmed, and the confirmation landed on a `production.env`
  * the message never mentioned. The module knew. It just did not say.
  */
+/**
+ * The unattended half: remove what classification already called `safe`, and nothing else.
+ *
+ * `sweep` offers and never acts, on purpose — there is a human reading it. This runs from a git hook
+ * the moment work lands, where there is nobody to ask, so the two verdicts that would have become a
+ * question become a refusal instead. It adds NO judgement of its own: the judgement is the dangerous
+ * part, it is written above, and it is already tested in both directions.
+ *
+ * Two properties its caller depends on, both load-bearing:
+ *  - it never throws. The caller is git, mid-merge. A throw here would turn a cleanup into a failed
+ *    merge, which is a far worse bug than the one this fixes.
+ *  - it is silent when there is nothing to do, so the common merge prints nothing.
+ */
+export function autoReap(root) {
+  const result = { reaped: [], skipped: [], disabled: false };
+  try {
+    if (!isCleanupEnabled(root)) {
+      result.disabled = true;
+      return result;
+    }
+    for (const candidate of classifyWorktrees(root)) {
+      // Not the protection, and it must not be mistaken for one: `reapWorktree` refuses an `ask`
+      // on its own, and that refusal is the gate — mutation-tested by 18b and 23. Verified here on
+      // 2026-09-17 by removing this line: every test still passed. It stays because skipping early
+      // avoids re-classifying the whole repository once per candidate, and because the recorded
+      // reason is then the verdict itself rather than a message written for a human to read.
+      if (candidate.verdict !== 'safe') {
+        result.skipped.push({ path: candidate.path, reason: candidate.reasons.join(', ') || candidate.verdict });
+        continue;
+      }
+      const out = reapWorktree(root, candidate.path);
+      if (out.removed) result.reaped.push(candidate.path);
+      else result.skipped.push({ path: candidate.path, reason: out.reason });
+    }
+  } catch (err) {
+    // Swallowed deliberately, and recorded rather than discarded: the merge must survive whatever
+    // went wrong in here, but a silent failure that leaves no trace is how this rots unnoticed.
+    result.skipped.push({ path: root, reason: `cleanup could not run: ${err.message}` });
+  }
+  return result;
+}
+
+export const HOOK_MARKER = '# rsc-managed worktree cleanup (post-merge) v1';
+
+// Every branch exits 0. That is the whole contract with git: this hook runs in the middle of
+// somebody's merge, and a cleanup that can turn a good merge into a failed one is a worse bug than
+// the accumulation it exists to fix. Missing node, missing reaper, broken reaper, unreadable repo —
+// all of them are "do nothing", never "fail".
+const HOOK_BODY = `#!/bin/sh
+${'# rsc-managed worktree cleanup (post-merge) v1'}
+# Retires worktrees whose work has just landed. Installed by rsc; safe to delete.
+# Turn it off for this project with: .rsc/.no-worktree-cleanup
+hook_dir=$(dirname "$0")
+if [ -x "$hook_dir/post-merge.rsc-local" ]; then
+  "$hook_dir/post-merge.rsc-local" "$@" || true
+fi
+root=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0
+[ -f "$root/.rsc/worktree-reaper.mjs" ] || exit 0
+command -v node >/dev/null 2>&1 || exit 0
+node "$root/.rsc/worktree-reaper.mjs" "$root" auto 2>/dev/null || true
+exit 0
+`;
+
+/**
+ * Install the trigger. The judgement has existed and been tested for a while; what never existed was
+ * something that runs it at the moment work lands. `post-merge` is that moment, and it covers both
+ * of ship's landing paths — a local `merge --no-ff` and the `pull --ff-only` after a forge merge.
+ *
+ * A hook lives in `.git/hooks/`, which is not cloned. So this is called on install AND on repair,
+ * and `doctor` reports its absence: a trigger nobody re-installs is a trigger that quietly stops
+ * existing on every machine but the one that ran the installer.
+ *
+ * Somebody else's post-merge is moved aside and chained, never overwritten. Husky and lefthook put
+ * real work in there, and eating it to install a convenience would be indefensible.
+ */
+export function installMergeHook(root) {
+  try {
+    const dir = join(real(root), '.git', 'hooks');
+    const hook = join(dir, 'post-merge');
+    mkdirSync(dir, { recursive: true });
+    if (existsSync(hook)) {
+      const current = readFileSync(hook, 'utf8');
+      if (current.includes(HOOK_MARKER)) {
+        // Already ours. Rewrite so an older body converges, but never chain ourselves behind
+        // ourselves — repair runs this repeatedly and stacking would run the cleanup N times.
+        writeFileSync(hook, HOOK_BODY);
+        chmodSync(hook, 0o755);
+        return { installed: true, chained: existsSync(join(dir, 'post-merge.rsc-local')) };
+      }
+      renameSync(hook, join(dir, 'post-merge.rsc-local'));
+      chmodSync(join(dir, 'post-merge.rsc-local'), 0o755);
+    }
+    writeFileSync(hook, HOOK_BODY);
+    chmodSync(hook, 0o755);
+    return { installed: true, chained: existsSync(join(dir, 'post-merge.rsc-local')) };
+  } catch (err) {
+    return { installed: false, reason: err.message };
+  }
+}
+
 export function refusal(candidate) {
   const d = candidate.details || {};
   const parts = (candidate.reasons || []).map((reason) => {
@@ -441,7 +541,11 @@ export function summarize(candidate, root) {
 if (process.argv[1] && resolve(process.argv[1]) === resolve(new URL(import.meta.url).pathname)) {
   const root = resolve(process.argv[2] || process.cwd());
   const candidates = classifyWorktrees(root).filter((c) => c.verdict !== 'skip');
-  if (process.argv[3] === 'reap') {
+  if (process.argv[3] === 'auto') {
+    // The unattended entry point, called by the post-merge hook. Prints only what it actually did.
+    const out = autoReap(root);
+    for (const p of out.reaped) process.stdout.write(`rsc: retired worktree ${p}\n`);
+  } else if (process.argv[3] === 'reap') {
     const one = process.argv[4];
     const targets = one ? [resolve(one)] : candidates.filter((c) => c.verdict === 'safe').map((c) => c.path);
     for (const t of targets) {