@friedbotstudio/create-baseline 0.3.0 → 0.5.0

package/README.md

@@ -37,11 +37,11 @@ A discipline layer for Claude Code. Hooks at every tool boundary, a workflow tha
 > [!IMPORTANT]
 > **Install in one line:** `npx @friedbotstudio/create-baseline ./your-project`
 >
-> The CLI fetches the published package, runs the install, and leaves your project with `.claude/`, `CLAUDE.md`, `docs/init/seed.md`, and `.mcp.json`. Re-run with `--merge` to bring an existing install forward; with `--dry-run` to preview without writing; with `doctor` to report drift.
+> The CLI fetches the published package, runs the install, and leaves your project with `.claude/`, `CLAUDE.md`, `docs/init/seed.md`, and `.mcp.json`. Re-run with the `upgrade` subcommand to bring an existing install forward (interactive in a TTY, batch-mode in CI). Add `--dry-run` to preview, and run `doctor` to report drift (pass `--json` for machine output).
 
 ## What this is
 
-The Claude Code Baseline is a repository overlay shipped via `npx @friedbotstudio/create-baseline ./target`. It installs **22 hooks** at Claude's tool boundaries, **36 skills** organised into nine categories, **1 subagent** for parallel work in isolated worktrees, an **11-phase workflow** from intake to commit, and **3 user-typed consent gates** that Claude cannot forge.
+The Claude Code Baseline is a repository overlay shipped via `npx @friedbotstudio/create-baseline ./target`. It installs **22 hooks** at Claude's tool boundaries, **37 skills** organised into nine categories, **1 subagent** for parallel work in isolated worktrees, an **11-phase workflow** from intake to commit, and **3 user-typed consent gates** that Claude cannot forge.
 
 Every soft engineering rule a team usually repeats every session — *don't push, don't `--amend`, don't self-approve specs, don't skip phases, don't mock internal modules* — becomes a structural guarantee because the hooks run **outside Claude's tool boundary**. Claude cannot disable a hook with a flag, cannot write a consent marker, cannot reorder the phases without an explicit exception that triage records on disk.
 
@@ -94,12 +94,14 @@ npx @friedbotstudio/create-baseline ./your-project
 # Force-overwrite an existing install (interactive — type 'overwrite')
 npx @friedbotstudio/create-baseline ./your-project --overwrite
 
-# Three-way merge against a previously-installed baseline:
+# Upgrade an existing install against a newer baseline version.
+# In a TTY, each customised file becomes a keep-mine / take-theirs / abort
+# prompt. In CI / piped stdout, reproduces the prior --merge behaviour:
 #   - adds new baseline files
 #   - refreshes baseline files the user has not touched
 #   - preserves user-customised files (exit 3 if any)
 #   - removes baseline files the upstream removed (only if untouched locally)
-npx @friedbotstudio/create-baseline ./your-project --merge
+npx @friedbotstudio/create-baseline upgrade ./your-project
 
 # Preview without writing anything
 npx @friedbotstudio/create-baseline ./your-project --dry-run
@@ -124,6 +126,10 @@ npx @friedbotstudio/create-baseline doctor ./your-project
 # Strict mode — print TAMPERED: shipped vs observed sha256 for every
 # customised file and exit 1 on any drift.
 npx @friedbotstudio/create-baseline doctor ./your-project --strict
+
+# JSON mode — emit the structured report on stdout for CI parsers.
+# Same exit codes; honours --strict.
+npx @friedbotstudio/create-baseline doctor ./your-project --json
 ```
 
 ## Quickstart

package/bin/cli.js

@@ -2,12 +2,12 @@
 import { parseArgs } from 'node:util';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, resolve } from 'node:path';
-import { readFile } from 'node:fs/promises';
+import { readFile, readdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 
 import * as io from '../src/cli/io.js';
 import { scanSentinels } from '../src/cli/conflict.js';
-import { freshInstall, forceInstall } from '../src/cli/install.js';
+import { freshInstall, forceInstall, COPY_EXCLUDE } from '../src/cli/install.js';
 import { threeWayMerge } from '../src/cli/merge.js';
 import { loadManifest, buildManifestFromDir } from '../src/cli/manifest.js';
 import { fetchPlantumlIfMissing, FETCH_OUTCOMES } from '../src/cli/plantuml.js';
@@ -17,18 +17,24 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const PKG_ROOT = resolve(__dirname, '..');
 
 const HELP_TEXT = `Usage:
-  create-baseline <target> [options]      install/merge the baseline
+  create-baseline <target> [options]      install the baseline
+  create-baseline upgrade [target]        three-way merge against an installed baseline
   create-baseline doctor [target]         report drift in an installed target
 
 Materializes the Claude Code baseline (.claude/, CLAUDE.md, .mcp.json,
 docs/init/seed.md, plus vendored LICENSE/NOTICE) into <target>.
 
-Modes:
+Install modes:
   (default)        Fresh install. Refuses if any sentinel path already present.
   --force          Overwrite unconditionally (requires typing 'overwrite' in TTY).
-  --merge          Three-way merge against existing .baseline-manifest.json.
-                   Prunes baseline files removed upstream that the user hadn't
-                   touched; customized stale files are preserved (exit 3).
+  --dry-run        Print intended actions without writing.
+
+Upgrade:
+  Replaces the prior --merge flag. Reads <target>/.claude/.baseline-manifest.json
+  and runs a three-way merge against the shipped template. Prunes baseline files
+  removed upstream that the user hadn't touched; customized-stale files are
+  preserved (exit 3) — or interactively resolved when stdout is a TTY (keep
+  mine / take theirs / abort).
   --dry-run        Print intended actions without writing.
 
 Doctor:
@@ -38,6 +44,8 @@ Doctor:
   --strict          Promote customized to exit 1 and prefix tampered paths
                     with "TAMPERED:" with shipped vs observed sha256. Detects
                     post-install supply-chain tampering of the baseline tree.
+  --json            Emit the structured report as JSON to stdout instead of
+                    the text renderer. Honours --strict; same exit codes.
 
 PlantUML jar (~19 MB, fetched at install time from upstream):
   --no-plantuml       Skip the jar download entirely.
@@ -54,12 +62,24 @@ Misc:
 
 Exit codes:
   0  success / clean doctor
-  1  user abort, conflict-without-force/merge, or doctor reports missing files
-  2  argv error, non-TTY where TTY required, or doctor finds no manifest
-  3  --merge had skipped customizations (or stale-customized prunes)
+  1  user abort, conflict-without-force, doctor reports missing files, or upgrade aborted
+  2  argv error, non-TTY where TTY required, doctor finds no manifest, or --merge passed
+  3  upgrade had skipped customizations (or stale-customized prunes)
   4  --require-plantuml fetch failure
 `;
 
+const OPTIONS = {
+  help: { type: 'boolean', short: 'h' },
+  version: { type: 'boolean' },
+  force: { type: 'boolean' },
+  'dry-run': { type: 'boolean' },
+  'no-plantuml': { type: 'boolean' },
+  'require-plantuml': { type: 'boolean' },
+  'with-npmrc': { type: 'boolean' },
+  strict: { type: 'boolean' },
+  json: { type: 'boolean' },
+};
+
 async function readPackageVersion() {
   try {
     const pkg = JSON.parse(await readFile(join(PKG_ROOT, 'package.json'), 'utf8'));
@@ -77,16 +97,175 @@ function getTemplateDir() {
   throw new Error(`Template directory not found at ${candidate}. Run \`npm run build\` (or rely on prepack).`);
 }
 
-function listShippedFiles(templateDir) {
-  const files = [];
-  const walk = (dir, base) => {
-    for (const entry of require('node:fs').readdirSync(dir, { withFileTypes: true })) {
-      const full = join(dir, entry.name);
-      if (entry.isDirectory()) walk(full, base);
-      else if (entry.isFile()) files.push(full.slice(base.length + 1).split(require('node:path').sep).join('/'));
+async function listShippedFiles(templateDir) {
+  const out = [];
+  await walkFiles(templateDir, templateDir, out);
+  // COPY_EXCLUDE was used to keep the legacy `manifest.json` at the template
+  // root from being copied to the consumer target root. The manifest now
+  // ships at `.claude/manifest.json` so no path-level exclusion is needed;
+  // COPY_EXCLUDE is currently empty but the filter stays so future entries
+  // (e.g., dev-only artifacts that accidentally leak into obj/template) can
+  // be added in one place. See src/cli/install.js → COPY_EXCLUDE.
+  return out.filter((p) => !COPY_EXCLUDE.includes(p));
+}
+
+async function walkFiles(dir, base, acc) {
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) await walkFiles(full, base, acc);
+    else if (entry.isFile()) acc.push(full.slice(base.length + 1).split('/').join('/'));
+  }
+}
+
+// Renders a usage error and the canonical HELP_TEXT through the branded TUI
+// when stderr is a TTY, falling back to plain `Error: <msg>` + help body
+// otherwise. Every non-success exit from `main()` flows through here so the
+// user always sees usage guidance alongside the failure.
+async function usageError(msg) {
+  const version = await readPackageVersion();
+  const meta = await import('../src/cli/tui/meta.js');
+  meta.renderUsageError(msg, HELP_TEXT, version);
+}
+
+// Translates Node's parseArgs error noise into a short, branded message.
+// Node emits e.g. `Unknown option '--upgrade'. To specify a positional ...`
+// which leaks library implementation detail; we collapse it and, where we
+// can identify the user's likely intent (typing `--upgrade` for the
+// `upgrade` subcommand), we hint at the correct shape.
+function friendlyParseArgsMessage(rawMessage) {
+  const firstLine = (rawMessage || '').split('\n')[0];
+  if (/Unknown option ['"]?--upgrade['"]?/.test(firstLine)) {
+    return 'Did you mean `create-baseline upgrade <target>`? `upgrade` is a subcommand, not a flag.';
+  }
+  if (/Unknown option ['"]?--doctor['"]?/.test(firstLine)) {
+    return 'Did you mean `create-baseline doctor <target>`? `doctor` is a subcommand, not a flag.';
+  }
+  const unknown = /Unknown option ['"]?([^'"]+?)['"]?(?:\.|$)/.exec(firstLine);
+  if (unknown) return `Unknown option '${unknown[1]}'.`;
+  return firstLine;
+}
+
+async function dispatchInstall(target, values, templateDir) {
+  const dryRun = !!values['dry-run'];
+  if (process.stdout.isTTY && !values.force && !dryRun) {
+    return await runBrandedInstall(target, values, templateDir);
+  }
+  return await runPlainInstall(target, values, templateDir);
+}
+
+async function runBrandedInstall(target, values, templateDir) {
+  const tui = await import('../src/cli/tui/install.js');
+  return tui.run({
+    target,
+    opts: {
+      templateDir,
+      noPlantuml: !!values['no-plantuml'],
+      requirePlantuml: !!values['require-plantuml'],
+      withNpmrc: !!values['with-npmrc'],
+    },
+  });
+}
+
+async function runPlainInstall(target, values, templateDir) {
+  const dryRun = !!values['dry-run'];
+  if (values.force) {
+    if (!process.stdin.isTTY) {
+      await usageError('--force requires an interactive TTY for the confirmation prompt');
+      return 2;
     }
-  };
-  return files;
+    if (!dryRun) {
+      const answer = await io.ask("type 'overwrite' to proceed: ");
+      if (answer.toLowerCase() !== 'overwrite') {
+        await usageError('confirmation declined');
+        return 1;
+      }
+    }
+  }
+
+  try {
+    if (values.force) {
+      if (dryRun) io.log(`Would force-install into ${target}`);
+      else await forceInstall(templateDir, target, { withNpmrc: !!values['with-npmrc'] });
+    } else {
+      if (dryRun) io.log(`Would fresh-install into ${target}`);
+      else await freshInstall(templateDir, target, { withNpmrc: !!values['with-npmrc'] });
+    }
+  } catch (err) {
+    await usageError(`install failed: ${err.message}`);
+    return 1;
+  }
+
+  if (!dryRun) {
+    const plantumlExit = await fetchPlantumlPlain(target, values);
+    if (plantumlExit !== 0) return plantumlExit;
+    io.log(`Installed manifest version 1 to ${target}.`);
+    io.log(`Pin via "@friedbotstudio/create-baseline@<exact-version>" in your bootstrap docs.`);
+  }
+  return 0;
+}
+
+async function fetchPlantumlPlain(target, values) {
+  const result = await fetchPlantumlIfMissing(target, {
+    noPlantuml: values['no-plantuml'],
+    requirePlantuml: values['require-plantuml'],
+  });
+  if (result.outcome === FETCH_OUTCOMES.WARNED_NETWORK_FAILURE
+      || result.outcome === FETCH_OUTCOMES.WARNED_HASH_MISMATCH) {
+    io.warn(`PlantUML jar fetch failed (${result.reason}); install continued. Retry with --require-plantuml or set system plantuml on PATH.`);
+    return 0;
+  }
+  if (result.outcome === FETCH_OUTCOMES.ERRORED_REQUIRE_PLANTUML) {
+    await usageError(`--require-plantuml: ${result.reason}`);
+    return 4;
+  }
+  return 0;
+}
+
+async function dispatchUpgrade(target, values, templateDir) {
+  const manifestPath = join(target, '.claude/.baseline-manifest.json');
+  if (!existsSync(manifestPath)) {
+    await usageError(`No baseline manifest at ${manifestPath}. Run a fresh install first.`);
+    return 2;
+  }
+  if (process.stdout.isTTY) {
+    const tui = await import('../src/cli/tui/upgrade.js');
+    return tui.run({
+      target,
+      opts: { templateDir, dryRun: !!values['dry-run'] },
+    });
+  }
+  return await runPlainUpgrade(target, values, templateDir, manifestPath);
+}
+
+async function runPlainUpgrade(target, values, templateDir, manifestPath) {
+  const oldManifest = await loadManifest(manifestPath);
+  const tplFiles = await listShippedFiles(templateDir);
+  const newManifest = await buildManifestFromDir(templateDir, tplFiles);
+  if (values['dry-run']) {
+    io.log(`Would upgrade ${tplFiles.length} files into ${target}`);
+    return 0;
+  }
+  const report = await threeWayMerge(templateDir, target, oldManifest, newManifest);
+  for (const action of report.actions) {
+    io.log(`${action.kind.padEnd(24)} ${action.path}`);
+  }
+  return report.exitCode;
+}
+
+async function dispatchDoctor(positionals, values) {
+  const target = resolve(positionals[1] ?? '.');
+  const report = await runDoctor(target, { strict: !!values.strict });
+  if (values.json) {
+    io.log(JSON.stringify(report));
+    return report.exitCode;
+  }
+  if (process.stdout.isTTY) {
+    const tui = await import('../src/cli/tui/doctor.js');
+    tui.render(report);
+  } else {
+    process.stdout.write(formatReport(report));
+  }
+  return report.exitCode;
 }
 
 async function main(argv) {
@@ -94,157 +273,103 @@ async function main(argv) {
   try {
     parsed = parseArgs({
       args: argv.slice(2),
-      options: {
-        help: { type: 'boolean', short: 'h' },
-        version: { type: 'boolean' },
-        force: { type: 'boolean' },
-        merge: { type: 'boolean' },
-        'dry-run': { type: 'boolean' },
-        'no-plantuml': { type: 'boolean' },
-        'require-plantuml': { type: 'boolean' },
-        'with-npmrc': { type: 'boolean' },
-        strict: { type: 'boolean' },
-      },
+      options: OPTIONS,
       strict: true,
       allowPositionals: true,
     });
   } catch (err) {
-    io.error(err.message);
+    if (/--merge/.test(err.message)) {
+      await usageError('--merge has been removed; use `create-baseline upgrade <target>` instead.');
+      return 2;
+    }
+    await usageError(friendlyParseArgsMessage(err.message));
     return 2;
   }
 
   const { values, positionals } = parsed;
 
   if (values.help) {
-    io.log(HELP_TEXT);
+    const version = await readPackageVersion();
+    if (process.stdout.isTTY) {
+      const meta = await import('../src/cli/tui/meta.js');
+      meta.renderHelp(HELP_TEXT, version);
+    } else {
+      io.log(HELP_TEXT);
+    }
     return 0;
   }
   if (values.version) {
-    io.log(await readPackageVersion());
+    const version = await readPackageVersion();
+    if (process.stdout.isTTY) {
+      const meta = await import('../src/cli/tui/meta.js');
+      meta.renderVersion(version);
+    } else {
+      io.log(version);
+    }
     return 0;
   }
 
-  // `doctor` subcommand: read-only drift check against an installed target's manifest.
   if (positionals[0] === 'doctor') {
-    const target = resolve(positionals[1] ?? '.');
-    const report = await runDoctor(target, { strict: !!values.strict });
-    io.log(formatReport(report));
-    return report.exitCode;
+    return await dispatchDoctor(positionals, values);
   }
 
-  if (values.force && values.merge) {
-    io.error('--force and --merge are mutually exclusive');
-    return 2;
+  if (positionals[0] === 'upgrade') {
+    const target = resolve(positionals[1] ?? '.');
+    let templateDir;
+    try {
+      templateDir = getTemplateDir();
+    } catch (err) {
+      await usageError(err.message);
+      return 2;
+    }
+    return await dispatchUpgrade(target, values, templateDir);
   }
+
   if (values['no-plantuml'] && values['require-plantuml']) {
-    io.error('--no-plantuml and --require-plantuml are mutually exclusive');
+    await usageError('--no-plantuml and --require-plantuml are mutually exclusive');
     return 2;
   }
   if (positionals.length === 0) {
-    io.error('missing required <target> argument');
-    io.error(HELP_TEXT);
+    // TTY landing: render the branded splash (skills.sh-style marquee) so the
+    // empty invocation reads as "here's what this tool does" instead of an
+    // angry error. Non-TTY keeps the strict error+help+exit-2 contract so
+    // scripts and CI still detect the missing argument.
+    if (process.stdout.isTTY) {
+      const splash = await import('../src/cli/tui/splash.js');
+      process.stdout.write(splash.renderSplash({
+        tryLine: 'npx @friedbotstudio/create-baseline ./my-project',
+        discoverUrl: 'https://baseline.friedbotstudio.com/',
+      }));
+      return 0;
+    }
+    await usageError('missing required <target> argument');
     return 2;
   }
   if (positionals.length > 1) {
-    io.error(`unexpected positional arguments: ${positionals.slice(1).join(', ')}`);
+    await usageError(`unexpected positional arguments: ${positionals.slice(1).join(', ')}`);
     return 2;
   }
 
   const target = resolve(positionals[0]);
-  const dryRun = !!values['dry-run'];
-
   let templateDir;
   try {
     templateDir = getTemplateDir();
   } catch (err) {
-    io.error(err.message);
+    await usageError(err.message);
     return 2;
   }
 
   const sentinels = await scanSentinels(target);
   const hasConflict = sentinels.length > 0;
-
-  if (hasConflict && !values.force && !values.merge) {
-    io.error(`existing baseline detected at ${target}: ${sentinels.join(', ')}`);
-    io.error('pass --force to overwrite or --merge to three-way merge');
+  if (hasConflict && !values.force) {
+    await usageError(
+      `existing baseline detected at ${target}: ${sentinels.join(', ')}. ` +
+        'Pass --force to overwrite or use `create-baseline upgrade <target>` to three-way merge.'
+    );
     return 1;
   }
 
-  if (values.force) {
-    if (!process.stdin.isTTY) {
-      io.error('--force requires an interactive TTY for the confirmation prompt');
-      return 2;
-    }
-    if (!dryRun) {
-      const answer = await io.ask("type 'overwrite' to proceed: ");
-      if (answer.toLowerCase() !== 'overwrite') {
-        io.error('confirmation declined');
-        return 1;
-      }
-    }
-  }
-
-  if (values.merge) {
-    if (!process.stdin.isTTY && !dryRun) {
-      io.error('--merge requires an interactive TTY for the confirmation prompt');
-      return 2;
-    }
-    if (!dryRun) {
-      const answer = await io.ask("type 'merge' to proceed: ");
-      if (answer.toLowerCase() !== 'merge') {
-        io.error('confirmation declined');
-        return 1;
-      }
-    }
-  }
-
-  let exitCode = 0;
-  try {
-    if (values.merge) {
-      const oldManifest = await loadManifest(join(target, '.claude/.baseline-manifest.json'));
-      const tplFiles = listShippedFiles(templateDir);
-      const newManifest = await buildManifestFromDir(templateDir, tplFiles);
-      if (dryRun) {
-        io.log(`Would merge ${tplFiles.length} files into ${target}`);
-      } else {
-        const report = await threeWayMerge(templateDir, target, oldManifest, newManifest);
-        for (const a of report.actions) {
-          io.log(`${a.kind.padEnd(24)} ${a.path}`);
-        }
-        exitCode = report.exitCode;
-      }
-    } else if (values.force) {
-      if (dryRun) io.log(`Would force-install into ${target}`);
-      else await forceInstall(templateDir, target, { withNpmrc: !!values['with-npmrc'] });
-    } else {
-      if (dryRun) io.log(`Would fresh-install into ${target}`);
-      else await freshInstall(templateDir, target, { withNpmrc: !!values['with-npmrc'] });
-    }
-  } catch (err) {
-    io.error(`install failed: ${err.message}`);
-    return 1;
-  }
-
-  if (!dryRun) {
-    const fetchResult = await fetchPlantumlIfMissing(target, {
-      noPlantuml: values['no-plantuml'],
-      requirePlantuml: values['require-plantuml'],
-    });
-    if (fetchResult.outcome === FETCH_OUTCOMES.WARNED_NETWORK_FAILURE
-        || fetchResult.outcome === FETCH_OUTCOMES.WARNED_HASH_MISMATCH) {
-      io.warn(`PlantUML jar fetch failed (${fetchResult.reason}); install continued. Retry with --require-plantuml or set system plantuml on PATH.`);
-    } else if (fetchResult.outcome === FETCH_OUTCOMES.ERRORED_REQUIRE_PLANTUML) {
-      io.error(`--require-plantuml: ${fetchResult.reason}`);
-      return 4;
-    }
-  }
-
-  if (!dryRun && exitCode === 0) {
-    io.log(`Installed manifest version 1 to ${target}.`);
-    io.log(`Pin via "@friedbotstudio/create-baseline@<exact-version>" in your bootstrap docs.`);
-  }
-
-  return exitCode;
+  return await dispatchInstall(target, values, templateDir);
 }
 
 main(process.argv).then((code) => { process.exit(code); }).catch((err) => {

package/obj/template/{manifest.json → .claude/manifest.json}

@@ -1,6 +1,6 @@
 {
   "manifest_version": 2,
-  "generated_at": "2026-05-17T19:24:12.190Z",
+  "generated_at": "2026-05-20T09:13:44.485Z",
   "files": {
     ".claude/agents/swarm-worker.md": "1735a220f268c9765cb22e0567b728803f2edd7776cbde51dd017a9f062ae41f",
     ".claude/bin/LICENSE": "a8dcf2775ab71a58c7d4cc935e3a8e9974e87bb7d6082ee25ef52f8140be8e07",
@@ -56,7 +56,7 @@
     ".claude/skills/archive/SKILL.md": "5174e8b72ab1e830912c231052d1e535023d58f0808434fe1d4abce305b80318",
     ".claude/skills/archive/archive.sh": "29f5b3c8870d0665ce624c6d1b5770f691f1d19f82a201767d5685fc3b0a0b58",
     ".claude/skills/audit-baseline/SKILL.md": "86e9955a99ade89074571320b2b9b0780bc033d201968f62edcca35d9e25f7cb",
-    ".claude/skills/audit-baseline/audit.sh": "8b8a7db4db2aba0e0dd9948e4472feabe568e06a5f4e752c10dcd3da655bedf3",
+    ".claude/skills/audit-baseline/audit.sh": "bd95803bc27cc398564e6df1b89521ead94f3cff458b50497e78fefcced2958e",
     ".claude/skills/audit-baseline/tests/fixtures/_pending_opener_only.md": "9c64d7ef0b3be48b3e87acd89f9ac638db956f2c7cc5adf569d9d97d16f18163",
     ".claude/skills/audit-baseline/tests/fixtures/preamble_full_empty_body.md": "b757223c9b4954882b7f4ac828de7d83a105f74ba0cdf0951fbbe19c07ae892d",
     ".claude/skills/audit-baseline/tests/fixtures/preamble_full_with_entries.md": "9fcd049b006a7474d182a04420df6b3af08e3b6777a2ec5b4031d661ba2f4c82",
@@ -65,6 +65,19 @@
     ".claude/skills/audit-baseline/tests/preamble_check_test.sh": "73239378e51528c37f7843ff540ddfed2cd0ee1b8259589bc7cdaefd71424d95",
     ".claude/skills/brd/SKILL.md": "260e5d18396de21b6842ad0bc5fe74b0e124f3c2e2a4ac2867eeb543c7c2c0a3",
     ".claude/skills/brd/template.md": "be4095b4bed70fcebc821ad92b0217db4fee1afb9a341a9e704d2c1869ec6f43",
+    ".claude/skills/changelog/SKILL.md": "2a305b04be3fb44dd9766fae0344725600c2269276d5fe9496d068cebcc4969c",
+    ".claude/skills/changelog/changelog.mjs": "662ae8142ea55c70375e45d874f97b40bcb85b0d6e5378393be56aba1b254eee",
+    ".claude/skills/changelog/classifier.mjs": "e17cd4dacb48b5ebf3addd2f651e8e2465c10aa51958c11c9272faff32e379f2",
+    ".claude/skills/changelog/state-writer.mjs": "a773f14eb1d7d990f64eb54f70720451db279954ea5cbd025ca15f1a8d39449d",
+    ".claude/skills/changelog/tests/consent-expired_test.sh": "60351d32cb544af33a6929f898411e43d20ec258f620ebc08179754a74811cf1",
+    ".claude/skills/changelog/tests/golden-path_test.sh": "1ef7cdaae2dbeea25f7165b182e4b2cc80e69f3cc918089552145421fcc35d26",
+    ".claude/skills/changelog/tests/idempotent-reentry_test.sh": "af11b08744ab3743989f9ae8017b6f01a32373971f072c233ce28741783f5de0",
+    ".claude/skills/changelog/tests/keepachangelog-unreleased-preserved_test.mjs": "981e1831893449667b1460b13b9ef9275cc3bd23b22cd6a3cfa3d56d239ed0ad",
+    ".claude/skills/changelog/tests/non-git-shortcircuit_test.sh": "ec5760c8790a3cd5cb21e93bd1742a4f30115f0e4e4829a8f765fecb4ddba5f4",
+    ".claude/skills/changelog/tests/preview-only_test.sh": "b30a6c4b94a1cb87596af317f460c57c62ecde257dcd81447932564ce9e542d2",
+    ".claude/skills/changelog/tests/run.sh": "55ba1d59d67f3e43b07fae08a7059c4e04cfe963a09a2367528d509e748f3116",
+    ".claude/skills/changelog/unreleased-writer.mjs": "a03d9080317e2fc9c4895b7b8c68efc2ab90497a9265091f5981859cda3d6885",
+    ".claude/skills/changelog/version-preview.mjs": "3843093b08b5407012e53d601fa6d3d4d3ddc04ae4911d0e5ad015622585c67f",
     ".claude/skills/chore/SKILL.md": "3479c4ef4c7706928b54ed89678c3526c790e2aeb629674bd60e5a9e4b90d80d",
     ".claude/skills/claude-automation-recommender/LICENSE": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
     ".claude/skills/claude-automation-recommender/NOTICE": "2076093d5af61a10b585562e3b40fd76ce178c56e5eebde93efdc08b3c6bb81a",
@@ -75,7 +88,7 @@
     ".claude/skills/claude-automation-recommender/references/skills-reference.md": "b4b57d953526a07146d5757ca5332034b9b4b4eeba839e4bb08111398c94556f",
     ".claude/skills/claude-automation-recommender/references/subagent-templates.md": "7f9a107d8619ff96fea07d5a17da31b269cec0ee343e5a9ff643c0d6cb4ba944",
     ".claude/skills/code-structure/SKILL.md": "4fa79beb83f9171e973cd2373af12f007aeaf95d156edf3a8e7cf3e9c2c22ace",
-    ".claude/skills/commit/SKILL.md": "27efe44a50096be2a00e6ee2e7e4d7b158b3f0e8ed3bf18d65d5f03c02d0f8d1",
+    ".claude/skills/commit/SKILL.md": "7f22653ae6832a5fc5631774f78d3feabe47c5b21c5925ae8a77e656bbac1b9c",
     ".claude/skills/copywriting/LICENSE": "3d015bf779e8f6f4b9366e0862c0d560aa60979bbe8d90426cede05528dc5390",
     ".claude/skills/copywriting/NOTICE": "ffd65b16660e4e9cbf42c5ff9bdf67b482815ebedfb515bedb65c6eb54930a15",
     ".claude/skills/copywriting/SKILL.md": "4631aae3a65204a1dac89fbe7606481b867b30ae3f64482d337c1e6bd5b4c902",
@@ -108,7 +121,7 @@
     ".claude/skills/google-analytics/references/reporting.md": "37cb7cfd1dd547e86a41664ffe13893ef138194a2288d1a2c43c9195e8ec609f",
     ".claude/skills/google-analytics/references/setup.md": "26743b72341a5658e73c1f070b924de0f11b1681af06164cb13c19f2047a1087",
     ".claude/skills/google-analytics/references/user-tracking.md": "5a945df2a575291c6b35d24830b497915c82a843a93ee133577f1deda93f6d75",
-    ".claude/skills/harness/SKILL.md": "84c4498e51b9e1c098ddaa99e7b150ab015b8e5c341a2e57300dbafe812acf4d",
+    ".claude/skills/harness/SKILL.md": "af7cf374013d881d216462ccba353747e1727f670bd9b1c45b089ffde247d67a",
     ".claude/skills/humanizer/LICENSE": "5dd2bb7cb6b254edd93a87718efbfef8b81c8ef90e3f9180f06723683d7733a3",
     ".claude/skills/humanizer/NOTICE": "5bdb69381ab078e7fbb5fb910f10253baa6fe9dabb88143c6f613959e131cbb3",
     ".claude/skills/humanizer/SKILL.md": "398beef0cabe34df435972a13fb9ef21be74d942f93321b220a5dd393d554e40",
@@ -211,17 +224,18 @@
     ".claude/skills/technical-tutorials/references/audience-context.md": "7e00189e72d7a87a0cf59f8302aa4adad26222d3bbd14ddb498515f137a32775",
     ".claude/skills/technical-tutorials/references/audience-example.md": "610f559f691de5169f672e8f69b72fd44790e5e3f894cebb7e644c3331db419c",
     ".claude/skills/technical-tutorials/references/audience-template.md": "9e8da0e05544df3961d75fb3a7b1d6374b6a1c129ac2fc9862dc111b5a75e433",
-    ".claude/skills/triage/SKILL.md": "9416c9de58e3dbf8c3bcac4d6e258c9a8e9c38083bd75a35937eaae16b82b0db",
+    ".claude/skills/triage/SKILL.md": "499f82a26d77c60af827dd89a7fcb3eae0cd903e34c70740c297bc260aeed38e",
     ".claude/skills/verify/SKILL.md": "fcddba67cf7f3623fc8f8ae142303b16b9db0c9fc1652bc920e16c56fe4c7864",
     ".mcp.json": "8ebb7966045486187bbdf9bac643e690c4fbc7a9a70a8345e3665ba72fa19b96",
-    "CLAUDE.md": "27d7cd145d1ba2a1b9dcc006e0ff3faa1af6c1a92f7d935c4a7eafa87accefc4",
-    "docs/init/seed.md": "437a05e448f639f5214edda0dc155d9e2f7b5e88b2866333e6639e75ff8822ab"
+    "CLAUDE.md": "1d87311fa1b177944afe69f060b0ddd31359e5391445034d10dc51ced1503ada",
+    "docs/init/seed.md": "63f3a0c09895f2040f7fdc188cb0e759bd6a47d615759ec7c83671798504a71d"
   },
   "owners": {
     "skills": {
       "archive": "baseline",
       "audit-baseline": "baseline",
       "brd": "baseline",
+      "changelog": "baseline",
       "chore": "baseline",
       "claude-automation-recommender": "baseline",
       "code-structure": "baseline",
@@ -257,5 +271,5 @@
       "verify": "baseline"
     }
   },
-  "build_id": "gha-26000362681"
+  "build_id": "gha-26153025904"
 }

package/obj/template/.claude/skills/audit-baseline/audit.sh

@@ -49,18 +49,25 @@ EXPECTED_AGENTS = {
     # from main context; they never make decisions.
     "swarm-worker",
 }
-# Skill provenance comes from the shipped manifest at obj/template/manifest.json.
+# Skill provenance comes from the shipped manifest. Two possible locations,
+# tried in order:
+#   1. <root>/.claude/manifest.json — present in consumer projects after the
+#      CLI installs the baseline (the recursive cp puts it there directly).
+#   2. <root>/obj/template/.claude/manifest.json — present in the baseline
+#      dev repo, where `npm run build` writes the manifest before publishing.
 # The build (scripts/build-manifest.mjs) reads owner: frontmatter from every
 # .claude/skills/<slug>/SKILL.md and emits the canonical baseline-skill set as
 # manifest.owners.skills. See CLAUDE.md Article XI and seed.md §17.
 def load_manifest():
-    path = root / "obj/template/manifest.json"
-    if not path.exists():
-        return None
-    try:
-        return json.loads(path.read_text(encoding="utf-8"))
-    except Exception:
-        return None
+    for rel in (".claude/manifest.json", "obj/template/.claude/manifest.json"):
+        path = root / rel
+        if not path.exists():
+            continue
+        try:
+            return json.loads(path.read_text(encoding="utf-8"))
+        except Exception:
+            return None
+    return None
 
 def read_skill_owner(slug):
     p = root / f".claude/skills/{slug}/SKILL.md"
@@ -245,7 +252,7 @@ def check_skill_ownership():
     # Manifest-driven baseline-skill presence + per-file hash check.
     manifest = load_manifest()
     if manifest is None:
-        add("skill ownership: manifest", "WARN", "obj/template/manifest.json missing — run npm run build")
+        add("skill ownership: manifest", "WARN", ".claude/manifest.json (or obj/template/.claude/manifest.json) missing — run npm run build")
         return
     owners_skills = (manifest.get("owners") or {}).get("skills", {}) or {}
     files_map = manifest.get("files") or {}