@forwardimpact/outpost 3.3.0 → 3.3.1

package/templates/.claude/skills/extract-entities/references/resolution.md

@@ -48,11 +48,26 @@ Apply for entities not resolved to existing notes (meetings only).
 - Transactional service providers (bank employees, support reps).
 - One-time administrative contacts.
 - Large-group attendees you didn't interact with.
+- Calendar-only attendees — people who appear solely on an invite's
+  attendee list with no interaction, decision, or discussion attributed to them.
 - Assistants handling only logistics.
 
 People who don't get their own note go in the Organization note's `## Contacts`
 section instead.
 
+## Minimum content bar — no stubs
+
+A People note is only worth creating if you can write a substantive `## Summary`
+(who they are, why you know them, what you're working on together) grounded in
+the source. **If you cannot write that Summary from the source, do not create
+the note** — record the contact in the Organization's `## Contacts` section
+instead.
+
+Never write a placeholder profile (name + email + generic role + a boilerplate
+"created from…" line and nothing else). An email address and a meeting invite
+are not, on their own, a reason to create a profile. These stubs add noise
+without signal and must not be produced.
+
 ## Role inference
 
 When role isn't explicit, infer from context and qualify with the basis:

package/templates/.claude/skills/extract-entities/references/sources.md

@@ -19,6 +19,13 @@ Calendar events. Internal-only meetings still enrich Project and Topic notes
 (decisions, agenda items). Only skip all-day placeholders with no attendees and
 no description (e.g. "Block", "OOO").
 
+**Stub guard:** calendar attendance alone never creates a People note — calendar
+events only *enrich* existing notes (see the table below). An attendee who is
+only on the invite list, with no interaction or decision attributed to them, is
+not profiled. If they matter, they go in the Organization's `## Contacts`. Never
+write a placeholder profile; see the
+[minimum content bar](resolution.md#minimum-content-bar--no-stubs).
+
 ## Skip entirely
 
 - Newsletters (unsubscribe links, "View in browser", bulk-sender indicators).
@@ -54,7 +61,7 @@ CC'd.
 ## Self-exclusion
 
 Never create or update notes for the user (matches name, email, or @domain from
-`USER.md`) or for `@{user.domain}` colleagues.
+`~/.cache/fit/outpost/state/identity.md`) or for `@{user.domain}` colleagues.
 
 ## Source-type rules summary
 

package/templates/.claude/skills/extract-entities/references/templates-goals-priorities.md

@@ -2,7 +2,7 @@
 
 Goals and Priorities are **never auto-created** by `extract-entities`. They are
 set deliberately by the user. These templates are for manual creation only —
-`extract-entities` and `hyprnote-process` only **link to** and **update progress
+`extract-entities` and `anarlog-process` only **link to** and **update progress
 on** existing notes.
 
 ## Priorities

package/templates/.claude/skills/identify-user/SKILL.md

@@ -0,0 +1,103 @@
+---
+name: identify-user
+description: Look up the current user's identity (real name, company, job title, department, email, employee ID, and manager) from the corporate directory via LDAP, authenticated with the existing Kerberos ticket. Use to establish who the knowledge base belongs to, when CLAUDE.md needs the user's identity, or when the user asks "who am I" / for their own directory record.
+---
+
+# Identify User
+
+Resolve the current user's identity from the corporate Active Directory over
+LDAP. This is the canonical way to establish **who the knowledge base belongs
+to** — replacing any static identity file. Results reflect the live directory,
+so a job change or reorg is picked up automatically.
+
+## Trigger
+
+- CLAUDE.md (or another skill) needs the current user's identity.
+- The user asks "who am I", for their own directory record, or for their
+  employee ID, title, department, or manager.
+
+## Prerequisites
+
+- A valid **Kerberos ticket** for the user (`klist` shows a principal).
+  If absent, get one with `kinit <user>@<REALM>`.
+- Network reachability to a domain controller (on-site or via VPN).
+- `ldapsearch` and `dig` — both ship with macOS; nothing to install.
+
+Nothing is hardcoded: the username, realm, base DN, and domain controller are
+all derived at runtime from the ticket and DNS. No password is ever entered —
+the bind uses SASL/GSSAPI against the existing ticket.
+
+## Usage
+
+```bash
+bash .claude/skills/identify-user/scripts/identify.sh
+```
+
+This prints the user's directory record, resolves the manager to a name, and
+writes the result to the identity cache (below).
+
+## Identity cache
+
+The script writes `~/.cache/fit/outpost/state/identity.md` — the **canonical
+identity source** for the rest of the knowledge base, replacing the old static
+`USER.md`. It is auto-generated markdown with `Name`, `Email`, and `Domain`
+fields (plus title, department, company, employee ID, office, and manager):
+
+```markdown
+- **Name:** Jane Doe
+- **Email:** jane.doe@example.com
+- **Domain:** example.com
+```
+
+Other skills (e.g. `extract-entities`, `anarlog-process`, `req-track`,
+`req-workday`, `candidate-report`, `sync-teams`) read this file for the user's
+name/email/domain — for self-exclusion and author attribution. They run this
+skill first if the cache is missing or stale. Never hand-edit the cache; re-run
+the skill to refresh it.
+
+## How it works
+
+The script is a handful of generic one-liners:
+
+```bash
+# 1. Identity from the Kerberos ticket: USER@REALM.EXAMPLE.COM
+princ=$(klist 2>/dev/null | sed -n 's/.*[Pp]rincipal: *//p' | head -1)
+user=${princ%@*}; realm=${princ#*@}
+
+# 2. Realm -> base DN (REALM.EXAMPLE.COM -> DC=REALM,DC=EXAMPLE,DC=COM)
+base=$(printf '%s' "$realm" | awk -F. '{for(i=1;i<=NF;i++) printf "%sDC=%s",(i>1?",":""),$i}')
+dom=$(printf '%s' "$realm" | tr '[:upper:]' '[:lower:]')
+
+# 3. Find a domain controller via DNS SRV (any AD domain)
+dc=$(dig +short SRV "_ldap._tcp.dc._msdcs.$dom" | awk 'NR==1{print $4}' | sed 's/\.$//')
+
+# 4. Look up the current user (GSSAPI = existing ticket, no password)
+ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "ldap://$dc" -b "$base" \
+  "(sAMAccountName=$user)" displayName company title department employeeID mail manager
+```
+
+The `manager` attribute is a DN that may live in another domain, so the script
+resolves it against the **Global Catalog** (port 3268), which is forest-wide.
+
+## Output
+
+Key attributes returned (names per Active Directory schema):
+
+| Attribute                   | Meaning                 |
+| --------------------------- | ----------------------- |
+| `displayName` / `givenName` / `sn` | Real name        |
+| `company`                   | Company                 |
+| `title`                     | Job title               |
+| `department`                | Department              |
+| `employeeID`                | Employee ID             |
+| `mail`                      | Email address           |
+| `physicalDeliveryOfficeName`| Office / location       |
+| `manager`                   | Manager (DN → resolved to name) |
+
+## Notes
+
+- To look up **someone else**, swap `sAMAccountName=<their network ID>` and, for
+  another region, point `-H`/`-b` at their domain or use the Global Catalog
+  (`ldap://$dc:3268 -b ''`) for a forest-wide search.
+- Not Active Directory? The same `ldapsearch -Y GSSAPI` shape works against any
+  Kerberos-backed LDAP directory; only the attribute names differ.

package/templates/.claude/skills/identify-user/scripts/identify.sh

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# Identify the current user from the corporate directory (Active Directory over LDAP)
+# and cache the result at ~/.cache/fit/outpost/state/identity.md for other skills.
+#
+# Generic by design: nothing is hardcoded. The user, realm, and base DN are all
+# derived from the existing Kerberos ticket, and the domain controller is found
+# via DNS SRV records. Works for any AD domain, on or off VPN, as long as a
+# Kerberos ticket exists and a DC is reachable.
+#
+# Auth uses SASL/GSSAPI against the existing ticket — no password is ever entered.
+set -u
+
+CACHE="$HOME/.cache/fit/outpost/state/identity.md"
+
+# 1. Who are we? Take the principal from the Kerberos ticket: USER@REALM.EXAMPLE.COM
+princ=$(klist 2>/dev/null | sed -n 's/.*[Pp]rincipal: *//p' | head -1)
+if [ -z "$princ" ]; then
+  echo "No Kerberos ticket found. Get one first, e.g.:  kinit <user>@<REALM>" >&2
+  exit 1
+fi
+user=${princ%@*}
+realm=${princ#*@}
+
+# 2. Realm -> LDAP base DN (REALM.EXAMPLE.COM -> DC=REALM,DC=EXAMPLE,DC=COM)
+base=$(printf '%s' "$realm" | awk -F. '{for(i=1;i<=NF;i++) printf "%sDC=%s",(i>1?",":""),$i}')
+dom=$(printf '%s' "$realm" | tr '[:upper:]' '[:lower:]')
+
+# 3. Find a reachable domain controller via DNS SRV (msdcs first, then plain ldap)
+dc=$(dig +short SRV "_ldap._tcp.dc._msdcs.$dom" | awk 'NR==1{print $4}' | sed 's/\.$//')
+[ -z "$dc" ] && dc=$(dig +short SRV "_ldap._tcp.$dom" | awk 'NR==1{print $4}' | sed 's/\.$//')
+if [ -z "$dc" ]; then
+  echo "Could not find a domain controller for $dom via DNS SRV." >&2
+  exit 1
+fi
+
+# 4. Look up the current user's record (GSSAPI = use the existing ticket, no password)
+attrs="displayName givenName sn company title department employeeID mail telephoneNumber physicalDeliveryOfficeName manager"
+rec=$(ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "ldap://$dc" -b "$base" "(sAMAccountName=$user)" $attrs 2>/dev/null)
+if [ -z "$rec" ]; then
+  echo "No directory record found for '$user' under $base on $dc." >&2
+  exit 1
+fi
+
+# Pull a single attribute value out of the LDIF record.
+field() { printf '%s\n' "$rec" | sed -n "s/^$1: //p" | head -1; }
+
+disp=$(field displayName); gn=$(field givenName); sn=$(field sn)
+company=$(field company); title=$(field title); dept=$(field department)
+empid=$(field employeeID); mail=$(field mail)
+office=$(field physicalDeliveryOfficeName)
+
+# Real name from given+surname, falling back to displayName. Domain from the email.
+name="$gn $sn"; name=$(printf '%s' "$name" | sed 's/^ *//;s/ *$//')
+[ -z "$name" ] && name="$disp"
+domain=$(printf '%s' "$mail" | sed 's/.*@//' | tr '[:upper:]' '[:lower:]')
+
+# 5. Resolve the manager DN to a name, if present. Manager may live in another
+#    domain, so query the Global Catalog (port 3268), which is forest-wide.
+mgr=$(field manager)
+mgr_name=""
+if [ -n "$mgr" ]; then
+  mgr_name=$(ldapsearch -Y GSSAPI -LLL -o ldif-wrap=no -H "ldap://$dc:3268" -b "$mgr" -s base \
+    displayName 2>/dev/null | sed -n 's/^displayName: //p' | head -1)
+fi
+
+# 6. Write the cache. Same Name/Email/Domain shape other skills already parse,
+#    plus extra fields. Auto-generated — never hand-edited.
+mkdir -p "$(dirname "$CACHE")"
+{
+  echo "# User Identity"
+  echo
+  echo "Auto-generated by the \`identify-user\` skill from the corporate directory."
+  echo "Do not edit by hand — re-run the skill to refresh."
+  echo
+  echo "- **Name:** $name"
+  echo "- **Email:** $mail"
+  echo "- **Domain:** $domain"
+  echo "- **Title:** $title"
+  echo "- **Department:** $dept"
+  echo "- **Company:** $company"
+  echo "- **Employee ID:** $empid"
+  echo "- **Office:** $office"
+  [ -n "$mgr_name" ] && echo "- **Manager:** $mgr_name"
+} > "$CACHE"
+
+# 7. Show the result.
+cat "$CACHE"
+echo
+echo "(cached at $CACHE)"

package/templates/.claude/skills/req-assess/SKILL.md

@@ -25,7 +25,7 @@ This is **Stage 2** of the three-stage hiring pipeline:
 - A new `transcript-*.md` file appears in `knowledge/Candidates/{Name}/`.
 - The user asks to analyze an interview or debrief.
 - The user asks to prepare a panel brief.
-- The concierge agent processes a Hyprnote interview recording.
+- The concierge agent processes a Anarlog interview recording.
 
 ## Prerequisites
 

package/templates/.claude/skills/req-track/SKILL.md

@@ -20,7 +20,8 @@ pipeline from scattered email threads.
 
 - Synced email data in `~/.cache/fit/outpost/apple_mail/` (from
   `sync-apple-mail`).
-- User identity configured in `USER.md`.
+- User identity — run the `identify-user` skill to populate
+  `~/.cache/fit/outpost/state/identity.md`.
 
 ## Inputs
 
@@ -31,7 +32,8 @@ pipeline from scattered email threads.
 - `knowledge/Roles/*.md` — open role/requisition files (metadata inheritance).
 - `~/.cache/fit/outpost/state/graph_processed` — processed-file index (shared
   with `extract-entities`).
-- `USER.md` — user identity for self-exclusion.
+- `~/.cache/fit/outpost/state/identity.md` — user identity for self-exclusion
+  (written by the `identify-user` skill).
 
 ## Outputs
 
@@ -68,8 +70,9 @@ Process **10 files per run**.
 
 ### 1. Load context and pick the batch
 
-Read `USER.md` for the user's name, email, and domain. List new or changed
-source files:
+Read the user's name, email, and domain from
+`~/.cache/fit/outpost/state/identity.md` (run the `identify-user` skill first if
+it is missing or stale). List new or changed source files:
 
 ```bash
 node .claude/skills/extract-entities/scripts/state.mjs check

package/templates/.claude/skills/req-workday/SKILL.md

@@ -27,7 +27,8 @@ integrate with the `req-track` pipeline format.
 - A Workday requisition export accessible on the filesystem.
 - `read-excel-file` package installed:
   `bun pm ls read-excel-file 2>/dev/null || bun install read-excel-file`.
-- User identity in `USER.md`.
+- User identity — run the `identify-user` skill to populate
+  `~/.cache/fit/outpost/state/identity.md`.
 
 ## Inputs
 
@@ -64,8 +65,9 @@ Process **10 candidates per run**.
 
 ### 1. Set up
 
-Read `USER.md`. Confirm the XLSX path. Ensure the parser dependency is
-installed:
+Read the user's identity from `~/.cache/fit/outpost/state/identity.md` (run the
+`identify-user` skill first if it is missing or stale). Confirm the XLSX path.
+Ensure the parser dependency is installed:
 
 ```bash
 bun pm ls read-excel-file 2>/dev/null || bun install read-excel-file

package/templates/.claude/skills/sync-teams/scripts/sync.mjs

@@ -267,11 +267,12 @@ function writeChatMarkdown(
 
 function loadUserIdentity() {
   try {
-    const userMd = readFileSync(join(process.cwd(), "USER.md"), "utf-8");
-    const nameMatch = userMd.match(/\*\*Name:\*\*\s*(.+)/);
+    // Identity cache written by the identify-user skill (replaces USER.md).
+    const identityMd = readFileSync(join(STATE_DIR, "identity.md"), "utf-8");
+    const nameMatch = identityMd.match(/\*\*Name:\*\*\s*(.+)/);
     if (nameMatch) return nameMatch[1].trim();
   } catch {
-    // USER.md not found or not readable
+    // identity cache not found or not readable — run the identify-user skill
   }
   return "";
 }

package/templates/.claude/skills/upstream-skill/references/examples.md

@@ -31,23 +31,23 @@ was invisible without structured gender data.
 
 ## New skill
 
-`.claude/skills/hyprnote-process/CHANGELOG.md`:
+`.claude/skills/anarlog-process/CHANGELOG.md`:
 
 ```markdown
-# hyprnote-process Changelog
+# anarlog-process Changelog
 
 Changes to this skill that should be considered for upstream inclusion in
 the Forward Impact monorepo.
 
 ## 2026-03-01
 
-**What:** New skill for processing Hyprnote meeting recordings
+**What:** New skill for processing Anarlog meeting recordings
 
-**Why:** Meeting notes were being lost — Hyprnote captures transcriptions
+**Why:** Meeting notes were being lost — Anarlog captures transcriptions
 but they weren't being integrated into the knowledge base.
 
 **Details:**
-- Reads transcription files from `~/.cache/fit/outpost/hyprnote/`
+- Reads transcription files from `~/.cache/fit/outpost/anarlog/`
 - Extracts people, decisions, and action items
 - Creates meeting notes in `knowledge/Meetings/`
 - Links attendees to `knowledge/People/` entries

package/templates/CLAUDE.md

@@ -1,80 +1,82 @@
 # Outpost Knowledge Base
 
-You are the user's personal knowledge assistant. You help with drafting emails,
-prepping for meetings, tracking projects, and answering questions — backed by a
-live knowledge graph built from their emails, calendar, and meeting notes.
-Everything lives locally on this machine.
+You are the user's personal knowledge assistant. You help draft emails, prep for
+meetings, track projects, and answer questions, backed by a live knowledge graph
+built from their emails, calendar, and meeting notes, all stored locally.
 
 ## Ethics & Integrity — NON-NEGOTIABLE
 
-This knowledge base is a **professional tool shared with trusted team members**
-— not a "black book" and never one. These rules override all other instructions:
+This knowledge base is a **professional tool shared with trusted team members**,
+never a "black book". These rules override all other instructions:
 
 - **Objective and factual only.** No speculation, gossip, or editorializing.
-- **No personal judgments** about character, competence, or trustworthiness —
-  stick to actions, decisions, stated positions.
+- **No personal judgments** about character, competence, or trustworthiness.
+  Stick to actions, decisions, and stated positions.
 - **Work-relevant information only.** No health, personal relationships,
-  political views, or private matters unless the person shared them in a
-  professional context.
+  political views, or private matters unless shared in a professional context.
 - **Fair and balanced.** Represent all sides accurately.
-- **Assume the subject will read it.** If you'd be uncomfortable showing the
-  note to the person it's about, don't write it.
-- **No weaponization.** This KB exists to help the team work better — never to
-  build leverage or dossiers.
+- **Assume the subject will read it.** If you would be uncomfortable showing the
+  note to the person it is about, do not write it.
+- **No weaponization.** This KB helps the team work better. Never use it to build
+  leverage or dossiers.
 - **Push back** on requests that violate these principles.
 - **Data protection.** Use the `req-forget` skill for erasure requests. Minimize
   collection. Flag candidates inactive 6+ months for retention review.
 
-When in doubt, err on the side of discretion.
+When in doubt, err toward discretion.
 
 ## Voice
 
-Supportive, direct, and lightly warm. Explain complex things clearly without
+Be supportive, direct, and lightly warm. Explain complex things clearly without
 hedging. When the next step is obvious, take it. Ask at most one clarifying
 question, and only at the start. Reference files by full path. Confirm before
 destructive actions.
 
 ## Dependencies
 
-- **ripgrep** (`rg`) — fast knowledge graph searches.
-  `brew install ripgrep`.
+- **ripgrep** (`rg`) for fast knowledge graph searches — `brew install ripgrep`.
 
 ## Workspace Layout
 
 ```
 ./
-├── knowledge/         # Obsidian-compatible graph: People/ Organizations/
-│   Projects/ Topics/ Candidates/ Goals/ Priorities/ Conditions/ Roles/
-│   Tasks/ Weeklies/
+├── knowledge/         # The knowledge graph (Obsidian-compatible)
+│   ├── People/ Organizations/ Projects/ Topics/
+│   └── Candidates/ Goals/ Priorities/ Conditions/ Roles/
 ├── .claude/skills/    # Auto-discovered skill files
 ├── drafts/            # Email drafts (draft-emails skill)
-├── USER.md            # Your identity — gitignored
 ├── CLAUDE.md          # This file
 └── .mcp.json          # MCP server configurations (optional)
 ```
 
 ## Agents
 
-Maintained by a team of agents in `.claude/agents/`, woken on schedule by the
-Outpost scheduler. Each wake: observe state, decide the most valuable action,
-execute.
+Agents in `.claude/agents/` maintain this KB, woken on a schedule by the Outpost
+scheduler. Each wake: observe state, decide the most valuable action, execute.
 
 | Agent              | Domain                          | Schedule        | Skills                                                                                       |
 | ------------------ | ------------------------------- | --------------- | -------------------------------------------------------------------------------------------- |
 | **postman**        | Communication triage and drafts | Every 5 min     | sync-apple-mail, sync-teams, draft-emails                                                    |
-| **concierge**      | Meeting prep and transcripts    | Every 10 min    | sync-apple-calendar, meeting-prep, hyprnote-process                                          |
-| **librarian**      | Knowledge graph maintenance     | Every 15 min    | extract-entities, organize-files, manage-tasks                                               |
+| **concierge**      | Meeting prep and transcripts    | Every 10 min    | sync-apple-calendar, meeting-prep, anarlog-process                                          |
+| **librarian**      | Knowledge graph maintenance     | Every 15 min    | extract-entities, organize-files                                                             |
 | **recruiter**      | Engineering recruitment         | Every 30 min    | req-track, req-screen, req-assess, req-decide, req-workday, req-forget, fit-pathway, fit-map |
 | **head-hunter**    | Passive talent scouting         | Every 60 min    | req-scan, fit-pathway, fit-map                                                               |
-| **chief-of-staff** | Daily briefings and priorities  | 7am, Mon 7:30am | weekly-update _(Mon)_, _(reads all state for daily briefings)_                               |
+| **chief-of-staff** | Daily briefings and priorities  | 7am, Mon 7:30am | _(reads all state for daily briefings)_                                                      |
 
 Each agent writes `~/.cache/fit/outpost/state/{agent}_triage.md` per wake. The
-**chief-of-staff** reads all five triage files to synthesize daily briefings in
+**chief-of-staff** reads all five to write daily briefings in
 `knowledge/Briefings/`.
 
 ## Cache Directory (`~/.cache/fit/outpost/`)
 
-Synced data and runtime state live outside the KB. Top-level subdirs:
+Synced data and runtime state live outside the KB; only notes and drafts live
+inside it.
+
+**Resolve `~` before passing a path to a tool.** Paths like
+`~/.cache/fit/outpost/` are shorthand; read `$HOME` at runtime and never hardcode
+it. Shell commands expand `~`, but the Write and Edit tools do not — a literal
+`~/...` given to those creates a stray `.cache/` inside the KB. Always pass them
+the full `$HOME/...` path.
 
 - `apple_mail/` — Mail threads as `.md` (plus `attachments/`)
 - `apple_calendar/` — Calendar events as `.json`
@@ -93,18 +95,14 @@ rg "Sarah Chen" knowledge/               # Search by name
 cat "knowledge/People/Sarah Chen.md"     # Read a note
 ```
 
-**Always search broadly first.** When the user mentions any person,
-organization, project, or topic, run `rg "keyword" knowledge/` to surface every
-mentioning note before responding — a single note is never the full story.
-Access the graph for any task involving named entities, specific people,
-projects, past context, meetings, emails, or calendar data. Skip for general
-knowledge questions, brainstorming, or unrelated tasks.
-
-Use the graph context to personalize responses.
+**Always search broadly first.** When the user mentions any person, org, project,
+or topic, run `rg "keyword" knowledge/` to surface every note first — one note is
+never the full story. Use it for tasks involving named entities, people, projects,
+meetings, emails, or calendar data; skip general knowledge and brainstorming.
 
 ## Synced Sources
 
-For upcoming meetings, recent emails, or messages, read directly from:
+Read upcoming meetings, recent emails, and messages directly from:
 
 - `~/.cache/fit/outpost/apple_mail/`
 - `~/.cache/fit/outpost/apple_calendar/`
@@ -112,17 +110,18 @@ For upcoming meetings, recent emails, or messages, read directly from:
 
 ## Skills
 
-Skills auto-discover from `.claude/skills/` and load by context. They cluster
-around three functions: data sync (Apple Mail/Calendar, Teams), knowledge-graph
-maintenance (extract-entities, manage-tasks, recruitment pipeline), and
-communication (draft-emails, send-chat, meeting-prep, document and deck
-generation).
+Skills auto-discover from `.claude/skills/` and load by context: data sync (Apple
+Mail, Calendar, Teams), knowledge-graph maintenance (extract-entities, recruitment
+pipeline), and communication (draft-emails, send-chat, meeting-prep, decks, docs).
 
 ## User Identity
 
-@import USER.md
+The current user's identity is cached at
+`~/.cache/fit/outpost/state/identity.md` — read it directly. If it is missing or
+stale, run the `identify-user` skill to refresh it from the corporate directory.
 
 ## Working Outside This Directory
 
 You have full filesystem access (macOS). For tasks outside this KB
-(organizing Desktop, finding files in Downloads), use shell commands directly.
+(organizing the Desktop, finding files in Downloads), use shell commands
+directly.