@friedbotstudio/create-baseline 0.3.0 → 0.5.0

package/src/cli/tui/meta.js

@@ -0,0 +1,63 @@
+// Domain — branded renderers for the meta commands (--help, --version) and
+// for usage-class errors. In a TTY, the splash marquee (wordmark + brand
+// strip from splash.js) frames the canonical body; in non-TTY the body is
+// emitted unchanged so that piped consumers (`$(cli --version)`,
+// `cli --help | grep ...`) keep working byte-clean.
+
+import { accent, muted, rule, error as errorPaint } from './tokens.js';
+import {
+  renderSplash,
+  renderBrandStrip,
+  renderVersionMarquee,
+  wordmarkFits,
+} from './splash.js';
+
+const DISCOVER_URL = 'https://baseline.friedbotstudio.com/';
+
+export function renderHelp(helpText, _version) {
+  const body = helpText.endsWith('\n') ? helpText : helpText + '\n';
+  if (!process.stdout.isTTY || !wordmarkFits()) {
+    process.stdout.write(body);
+    return;
+  }
+  process.stdout.write(renderSplash({
+    tryLine: 'npx @friedbotstudio/create-baseline ./my-project',
+    discoverUrl: DISCOVER_URL,
+  }));
+  process.stdout.write(body);
+}
+
+export function renderVersion(version) {
+  if (!process.stdout.isTTY) {
+    process.stdout.write(`${version}\n`);
+    return;
+  }
+  if (wordmarkFits()) {
+    process.stdout.write(renderVersionMarquee(version));
+    return;
+  }
+  process.stdout.write(renderBrandStrip({ version }));
+}
+
+// Usage errors always print to stderr (so a `cli ... 2>/dev/null` pipeline
+// can still consume stdout cleanly). In a TTY we wrap the message and the
+// HELP_TEXT body in the same brand banner used by --help, with the error
+// label painted in --mac-red. In non-TTY we emit a plain `Error: <msg>`
+// line followed by the canonical help body — same body, no ANSI.
+export function renderUsageError(msg, helpText, version) {
+  const body = helpText.endsWith('\n') ? helpText : helpText + '\n';
+  if (!process.stderr.isTTY) {
+    process.stderr.write(`Error: ${msg}\n`);
+    process.stderr.write(body);
+    return;
+  }
+  const banner = [
+    '',
+    `  ${errorPaint('Error')}  ${msg}`,
+    `  ${muted(`@friedbotstudio/create-baseline v${version}`)}`,
+    `  ${rule('─'.repeat(48))}`,
+    '',
+  ].join('\n');
+  process.stderr.write(banner + '\n');
+  process.stderr.write(body);
+}

package/src/cli/tui/splash.js

@@ -0,0 +1,111 @@
+// Domain — branded splash surfaces for the CLI. Renders a chunky pixel-art
+// "BASELINE" wordmark in three bands of FBS orange (bevel: shadow / mid /
+// highlight / mid / shadow) so the marquee surfaces (--help, --version,
+// no-arg landing) share a single visual identity. Slimmer brand strip is
+// reused by install / upgrade intros and inside the usage-error renderer.
+//
+// All renderers degrade cleanly when stdout is not a TTY or NO_COLOR is set
+// (paintRGB short-circuits to plain text). When the terminal is narrower
+// than the wordmark, callers should fall through to the plain banner via
+// `wordmarkFits(width)` instead of letting the glyphs wrap.
+
+import { paintRGB, PALETTE, accent, muted } from './tokens.js';
+
+// ANSI-Shadow style block-letter wordmark for "BASELINE". 5 rows × ~60 cols.
+// Kept as raw strings (not paint-wrapped) so renderWordmark can apply a
+// per-row shade. Trailing spaces matter — they're part of the glyph shape.
+const WORDMARK = [
+  '██████   █████  ███████ ███████ ██      ██ ███    ██ ███████',
+  '██   ██ ██   ██ ██      ██      ██      ██ ████   ██ ██     ',
+  '██████  ███████ ███████ █████   ██      ██ ██ ██  ██ █████  ',
+  '██   ██ ██   ██      ██ ██      ██      ██ ██  ██ ██ ██     ',
+  '██████  ██   ██ ███████ ███████ ███████ ██ ██   ████ ███████',
+];
+
+// Outline trace — mirrors the bottom row of the wordmark using the upper
+// one-eighth block (▔) so it visually kisses the base of every letter,
+// producing the subtle "letters are sitting on a baseline" shadow from
+// the skills.sh reference. Painted in accentShadow so it reads as a
+// trace, not a fifth band of the letter body.
+const WORDMARK_OUTLINE = WORDMARK[4].replace(/█/g, '▔');
+
+// Bevel banding: dim → mid → bright → mid → dim. Produces the chiseled
+// pixel-art look of the skills.sh reference (substituting FBS oranges for
+// the reference's grayscale palette).
+const SHADES = [
+  PALETTE.accentShadow,
+  PALETTE.accent,
+  PALETTE.accentLight,
+  PALETTE.accent,
+  PALETTE.accentShadow,
+];
+
+const WORDMARK_WIDTH = Math.max(...WORDMARK.map((row) => row.length));
+
+export const SPLASH_COMMANDS = Object.freeze([
+  ['$ npx @friedbotstudio/create-baseline <target>', 'Install the baseline'],
+  ['$ npx @friedbotstudio/create-baseline upgrade',  'Three-way merge upgrade'],
+  ['$ npx @friedbotstudio/create-baseline doctor',   'Drift report'],
+]);
+
+// `process.stdout.columns` is 0 (not undefined) under `script(1)` and some
+// CI ptys; treat any falsy value as "unknown, assume wide enough" so the
+// marquee renders rather than silently degrading to the plain banner.
+export function wordmarkFits(columns) {
+  const cols = columns ?? process.stdout.columns;
+  if (!cols) return true;
+  return cols >= WORDMARK_WIDTH;
+}
+
+export function renderWordmark() {
+  const bands = WORDMARK.map((row, i) => paintRGB(SHADES[i], row));
+  bands.push(paintRGB(PALETTE.accentShadow, WORDMARK_OUTLINE));
+  return bands.join('\n');
+}
+
+// Full marquee splash. Used by --help in TTY and the no-arg landing. The
+// version is intentionally NOT rendered here — `--version` already surfaces
+// it via renderVersionMarquee, and embedding it in the splash would force
+// docs-site screenshots to re-render every release.
+export function renderSplash({ tagline, tryLine, discoverUrl } = {}) {
+  const lines = [
+    '',
+    `${muted('▲')} ${muted('~/')} ${muted('npx @friedbotstudio/create-baseline@latest')}`,
+    '',
+    renderWordmark(),
+    '',
+    muted(tagline ?? 'The Claude Code baseline — hooks, skills, MCP, governance.'),
+    '',
+  ];
+  for (const [cmd, desc] of SPLASH_COMMANDS) {
+    const left = `  ${cmd}`;
+    lines.push(`${left.padEnd(54)}${muted(desc)}`);
+  }
+  if (tryLine) {
+    lines.push('');
+    lines.push(`${muted('try:')} ${tryLine}`);
+  }
+  if (discoverUrl) {
+    lines.push('');
+    lines.push(`${muted('Discover more at')} ${discoverUrl}`);
+  }
+  lines.push('');
+  lines.push(`${muted('▲')} ${muted('~/')}`);
+  lines.push('');
+  return lines.join('\n');
+}
+
+// Slim two-line brand strip. Used by install / upgrade intros, --version,
+// and the top of the usage-error renderer. Cheap and width-safe (~32 cols).
+export function renderBrandStrip({ version, subtitle } = {}) {
+  const left = `${accent('▲ BASELINE')}`;
+  const right = version ? `  ${muted(`v${version}`)}` : '';
+  const sub = subtitle ? `\n  ${muted(subtitle)}` : '';
+  return ['', `${left}${right}${sub}`, ''].join('\n');
+}
+
+// --version flourish: the wordmark + a version line. Wider than the strip;
+// callers should fall back to renderBrandStrip when the terminal is narrow.
+export function renderVersionMarquee(version) {
+  return ['', renderWordmark(), '', `  ${muted(`v${version}`)}`, ''].join('\n');
+}

package/src/cli/tui/tokens.js

@@ -0,0 +1,45 @@
+// Foundation — ANSI brand-color helpers for the TUI presentation layer.
+// Translates Friedbot Studio's oklch tokens (site-src/assets/site.css :root) to
+// 24-bit truecolor escape sequences. Respects NO_COLOR (https://no-color.org)
+// and skips emission when stdout is not a TTY.
+
+const NO_COLOR = process.env.NO_COLOR !== undefined && process.env.NO_COLOR !== '';
+
+// oklch -> approximate sRGB hex used in the rendered docs site:
+//   --accent-shadow oklch(35% 0.15 41.5)   ~ #7a2907   (dark band of the wordmark bevel)
+//   --accent       oklch(55.8% 0.187 41.5) ~ #c2410c   (orange-700)
+//   --accent-light oklch(70.3% 0.187 41.5) ~ #ea6a25   (orange-500)
+//   --muted        oklch(45% 0.026 257)    ~ #6b7280
+//   --cli-success  oklch(70% 0.15 145)     ~ #4ade80
+//   --warn         oklch(58% 0.13 60)      ~ #d97706
+//   --mac-red      oklch(70% 0.21 24)      ~ #ef4444
+//   --rule         oklch(89% 0.013 257)    ~ #d1d5db
+const RGB = {
+  accentShadow: [122, 41, 7],
+  accent: [194, 65, 12],
+  accentLight: [234, 106, 37],
+  muted: [107, 114, 128],
+  success: [74, 222, 128],
+  warn: [217, 119, 6],
+  error: [239, 68, 68],
+  rule: [209, 213, 219],
+};
+
+// Exposed for the splash wordmark, which paints individual rows in their own
+// shade. All other UI tokens funnel through the named helpers below.
+export function paintRGB(rgb, text) {
+  if (NO_COLOR || !process.stdout.isTTY) return text;
+  const [r, g, b] = rgb;
+  return `\x1b[38;2;${r};${g};${b}m${text}\x1b[0m`;
+}
+
+export const PALETTE = Object.freeze(RGB);
+
+export const accentShadow = (text) => paintRGB(RGB.accentShadow, text);
+export const accent = (text) => paintRGB(RGB.accent, text);
+export const accentLight = (text) => paintRGB(RGB.accentLight, text);
+export const muted = (text) => paintRGB(RGB.muted, text);
+export const success = (text) => paintRGB(RGB.success, text);
+export const warn = (text) => paintRGB(RGB.warn, text);
+export const error = (text) => paintRGB(RGB.error, text);
+export const rule = (text) => paintRGB(RGB.rule, text);

package/src/cli/tui/upgrade.js

@@ -0,0 +1,119 @@
+// Domain — branded upgrade flow with interactive per-file conflict resolution.
+// Plan/apply split:
+//   1. dry-run threeWayMerge → enumerate SKIP_CUSTOMIZED conflicts
+//   2. prompt the user once per conflict
+//   3. on cancel/abort: bail before any write
+//   4. on resolve: real threeWayMerge with onSkipCustomized backed by the Map
+
+import * as clackModule from '@clack/prompts';
+import { existsSync } from 'node:fs';
+import { readdir, readFile } from 'node:fs/promises';
+import { join, relative, sep } from 'node:path';
+import { threeWayMerge, ACTION_KINDS } from '../merge.js';
+import { loadManifest, buildManifestFromDir } from '../manifest.js';
+import { COPY_EXCLUDE } from '../install.js';
+import { renderBrandStrip } from './splash.js';
+
+const SUCCESS = 0;
+const ERR_ABORT = 1;
+const ERR_NO_MANIFEST = 2;
+const ERR_DIVERGENCE = 3;
+
+const CHOICE_OPTIONS = [
+  { value: 'keep-mine', label: 'Keep mine', hint: 'preserve target file as-is' },
+  { value: 'take-theirs', label: 'Take theirs', hint: 'overwrite with new baseline' },
+  { value: 'abort', label: 'Abort', hint: 'exit without changes' },
+];
+
+export async function run({ target, opts = {}, prompts = clackModule } = {}) {
+  if (!target || typeof target !== 'string') {
+    throw new Error('tui.upgrade.run requires a non-empty string target');
+  }
+  if (!opts.templateDir) {
+    throw new Error('tui.upgrade.run requires opts.templateDir');
+  }
+
+  const manifestPath = join(target, '.claude/.baseline-manifest.json');
+  if (!existsSync(manifestPath)) {
+    prompts.log.error(`No baseline manifest at ${manifestPath}. Run a fresh install first.`);
+    return ERR_NO_MANIFEST;
+  }
+
+  const version = await readPackageVersion();
+  process.stdout.write(renderBrandStrip({ version, subtitle: 'upgrade' }));
+  prompts.intro('create-baseline upgrade');
+
+  const { oldManifest, newManifest } = await loadManifests(opts.templateDir, manifestPath);
+  const dryReport = await threeWayMerge(opts.templateDir, target, oldManifest, newManifest, { dryRun: true });
+  const conflicts = dryReport.actions.filter((a) => a.kind === ACTION_KINDS.SKIP_CUSTOMIZED);
+
+  const choices = new Map();
+  for (const conflict of conflicts) {
+    const choice = await prompts.select({
+      message: `${conflict.path} has been customized — choose:`,
+      options: CHOICE_OPTIONS,
+    });
+    if (prompts.isCancel(choice) || choice === 'abort') {
+      prompts.cancel('Upgrade aborted; tree unchanged.');
+      return ERR_ABORT;
+    }
+    choices.set(conflict.path, choice);
+  }
+
+  if (opts.dryRun) {
+    for (const action of dryReport.actions) {
+      prompts.log.info(`${action.kind.padEnd(24)} ${action.path}`);
+    }
+    prompts.outro('Dry run complete; no changes written.');
+    return SUCCESS;
+  }
+
+  const onSkipCustomized = (rel) => choices.get(rel) ?? 'keep-mine';
+  const finalReport = await threeWayMerge(opts.templateDir, target, oldManifest, newManifest, { onSkipCustomized });
+
+  const applied = finalReport.actions.filter((a) => isApplied(a.kind)).length;
+  const skipped = finalReport.actions.filter((a) => a.kind === ACTION_KINDS.SKIP_CUSTOMIZED).length;
+  prompts.outro(`Applied ${applied}; ${skipped} skipped.`);
+  return finalReport.exitCode === 3 ? ERR_DIVERGENCE : SUCCESS;
+}
+
+function isApplied(kind) {
+  return (
+    kind === ACTION_KINDS.ADD ||
+    kind === ACTION_KINDS.OVERWRITE ||
+    kind === ACTION_KINDS.PRUNE ||
+    kind === ACTION_KINDS.SPECIAL_MERGE ||
+    kind === ACTION_KINDS.NEVER_TOUCH_ADD
+  );
+}
+
+async function loadManifests(templateDir, manifestPath) {
+  const oldManifest = await loadManifest(manifestPath);
+  const tplFiles = await listShippedFiles(templateDir);
+  const newManifest = await buildManifestFromDir(templateDir, tplFiles);
+  return { oldManifest, newManifest };
+}
+
+async function readPackageVersion() {
+  try {
+    const url = new URL('../../../package.json', import.meta.url);
+    const pkg = JSON.parse(await readFile(url, 'utf8'));
+    return pkg.version || '0.0.0';
+  } catch {
+    return '0.0.0';
+  }
+}
+
+async function listShippedFiles(root, base = root, acc = []) {
+  for (const entry of await readdir(root, { withFileTypes: true })) {
+    const full = join(root, entry.name);
+    if (entry.isDirectory()) await listShippedFiles(full, base, acc);
+    else if (entry.isFile()) acc.push(relative(base, full).split(sep).join('/'));
+  }
+  // COPY_EXCLUDE (single source of truth in install.js) now lists no paths —
+  // the shipped manifest moved into `.claude/manifest.json` so the recursive
+  // walk picks it up at the same path the consumer expects. The filter stays
+  // for forward-compat; if a future path needs to be kept out of the merge,
+  // add it to install.js → COPY_EXCLUDE in one place.
+  return acc.filter((p) => !COPY_EXCLUDE.includes(p));
+}

package/src/seed.template.md

@@ -11,7 +11,7 @@
 
 **Mandatory binding language.** Each numbered section (§) below specifies a binding requirement for the baseline. Implementations SHALL conform; `CLAUDE.md` Articles SHALL reference the corresponding §; project amendments (per `CLAUDE.md` Art. X) SHALL NOT contradict any § here.
 
-The baseline turns soft engineering rules (no unauthorized commits, no stubs, no mocks of internal code, no self-approved specs) into structural guarantees enforced by write-boundary hooks. Eleven workflow phases plus one stripped-down chore track (skips TDD; runs verify + archive mandatorily, simplify/integrate/document conditionally), seventeen write/run-boundary guards plus four lifecycle hooks plus one input-boundary hook (twenty-two hook scripts total — twenty `.sh` + two `.mjs` after the JS-port pilot), thirty-six skills, one subagent, and four consent gates. Decisions live in main context; the lone subagent (`swarm-worker`) executes pre-decided recipes in parallel worktrees during `/swarm-dispatch`. Every artifact is archived; every third-party API is looked up against live docs. Project memory accumulates across sessions in `.claude/memory/` — auto-extracted by a Stop hook, curated in main context via `/memory-flush`, self-healing via re-verification.
+The baseline turns soft engineering rules (no unauthorized commits, no stubs, no mocks of internal code, no self-approved specs) into structural guarantees enforced by write-boundary hooks. Eleven workflow phases plus one stripped-down chore track (skips TDD; runs verify + archive mandatorily, simplify/integrate/document conditionally), seventeen write/run-boundary guards plus four lifecycle hooks plus one input-boundary hook (twenty-two hook scripts total — twenty `.sh` + two `.mjs` after the JS-port pilot), thirty-seven skills, one subagent, and four consent gates. Decisions live in main context; the lone subagent (`swarm-worker`) executes pre-decided recipes in parallel worktrees during `/swarm-dispatch`. Every artifact is archived; every third-party API is looked up against live docs. Project memory accumulates across sessions in `.claude/memory/` — auto-extracted by a Stop hook, curated in main context via `/memory-flush`, self-healing via re-verification.
 
 ---
 
@@ -110,7 +110,7 @@ Applies to every language. Mappings for TSX, Node, Python, Go, Rust ship inside
 │   │   └── lib/common.sh       # shared helpers
 │   ├── agents/                 # 1 subagent: swarm-worker (rendered from src/agents/swarm-worker.template.md)
 │   ├── commands/               # 5 consent/bootstrap gates (user-only — structurally)
-│   ├── skills/                 # 36 skills: artifact (4) + phases (10) + workers (5) + spec helpers (4) + orchestration (3) + memory (1) + shared globals (7) + audit (1) + alt tracks (1)
+│   ├── skills/                 # 37 skills: artifact (4) + phases (11) + workers (5) + spec helpers (4) + orchestration (3) + memory (1) + shared globals (7) + audit (1) + alt tracks (1)
 │   ├── memory/                 # project memory: 7 canonical files + _pending.md (gitignored body) + README.md
 │   └── state/                  # runtime: workflow.json, approvals, swarm plans, verdicts, logs
 ├── src/                        # pristine ship-time templates (overlay source for `npx @friedbotstudio/create-baseline`)
@@ -181,7 +181,7 @@ The baseline ships exactly one subagent. The architectural reason: subagents los
 
 **Automated re-rendering by `/init-project`.** Step 6.4 re-renders `swarm-worker.md` from the template, driven by the recommender's `additions.swarm_worker_skills`. The recommender does **not** propose new subagent types — only stack-skill additions for the existing worker. Specialization happens via skills loaded into the worker's context, not via parallel agent personas; new decision-making roles belong in skills, which run in main context.
 
-### §4.3 Skills (36)
+### §4.3 Skills (37)
 
 Each at `.claude/skills/<name>/SKILL.md`, frontmatter `name` + `description`, plus optional `template.md` (artifact skills) or helper scripts.
 
@@ -516,7 +516,7 @@ Seed-level requirement: no stale workflow artifacts in the working tree after co
 
 **Step 4:** Write `src/agents/swarm-worker.template.md` (canonical-body store, per §4.2) — the only subagent template. Then render `.claude/agents/swarm-worker.md` from it with default tokens. The template carries four tokens — `{{NAME}}`, `{{DESCRIPTION}}`, `{{SKILLS}}`, `{{ROLE_LINE}}`. Default `SKILLS` is the YAML list block `  - scenario\n  - implement` (the worker's two mandatory sub-skills). Render-parity holds at this stage. `/init-project` later re-renders the worker with stack-aware tokens when the recommender flags stack-specific skills to preload via `additions.swarm_worker_skills`.
 
-**Step 5:** Write `.claude/skills/` for the 36 skills (§4.3) — 28 workflow/worker/orchestration/memory/alt-track skills you author plus 7 shared globals plus 1 audit skill. The breakdown: artifact drafting (4) + workflow phases (10) + phase workers (5: `scenario`, `implement`, `verify`, `prose`, `design-ui`) + spec helpers (4: `spec-lint`, `spec-render`, `spec-diagram-review`, `spec-traceability-review`) + orchestration (3: `harness`, `swarm-plan`, `swarm-dispatch`) + memory (1: `memory-flush`) + shared globals (7: `claude-automation-recommender`, `code-structure`, `humanizer`, `documentation`, `technical-tutorials`, `copywriting`, `impeccable`) + drift defender (1: `audit-baseline`) + alternate tracks (1: `chore`). The vendored `claude-automation-recommender` (Apache 2.0, from `claude-code-setup`), the writing/quality globals, and the design global ship unchanged with their licenses intact. Artifact skills (intake, brd, spec, rca) each ship a `template.md`. Helper scripts: swarm-plan gets `validate.sh`, swarm-dispatch gets `swarm_merge.sh`, spec-render gets `render.sh`, spec-lint gets `lint.sh`, archive gets `archive.sh`, audit-baseline gets `audit.sh`. All helper scripts `chmod +x`.
+**Step 5:** Write `.claude/skills/` for the 37 skills (§4.3) — 29 workflow/worker/orchestration/memory/alt-track skills you author (the +1 over 28 is the `changelog` Phase 11.5 skill) plus 7 shared globals plus 1 audit skill. The breakdown: artifact drafting (4) + workflow phases (10) + phase workers (5: `scenario`, `implement`, `verify`, `prose`, `design-ui`) + spec helpers (4: `spec-lint`, `spec-render`, `spec-diagram-review`, `spec-traceability-review`) + orchestration (3: `harness`, `swarm-plan`, `swarm-dispatch`) + memory (1: `memory-flush`) + shared globals (7: `claude-automation-recommender`, `code-structure`, `humanizer`, `documentation`, `technical-tutorials`, `copywriting`, `impeccable`) + drift defender (1: `audit-baseline`) + alternate tracks (1: `chore`). The vendored `claude-automation-recommender` (Apache 2.0, from `claude-code-setup`), the writing/quality globals, and the design global ship unchanged with their licenses intact. Artifact skills (intake, brd, spec, rca) each ship a `template.md`. Helper scripts: swarm-plan gets `validate.sh`, swarm-dispatch gets `swarm_merge.sh`, spec-render gets `render.sh`, spec-lint gets `lint.sh`, archive gets `archive.sh`, audit-baseline gets `audit.sh`. All helper scripts `chmod +x`.
 
 **Step 6:** Write `.claude/commands/*.md` for the 4 gates (§4.4). All carry `disable-model-invocation: true` as belt-and-braces; structural user-only is enforced by their directory.
 
@@ -591,9 +591,9 @@ Until `/init-project` runs, this section stays empty. Once populated, every fiel
 
 ## §17 — Skill provenance and the baseline manifest
 
-A skill at `.claude/skills/<slug>/SKILL.md` is **baseline-owned** iff its YAML frontmatter declares `owner: baseline`. Baseline-owned skills are those that ship with the baseline; every other skill on disk — those without an `owner:` field, or those declaring `owner: user` — is user/third-party and out-of-scope of baseline audit checks. Absence-of-`owner` is the deliberate default so a project that already has its own skills can install the baseline without annotating any of those files. The build script `scripts/build-manifest.mjs` reads each `owner:` value at release time and emits the canonical baseline-skill set into `obj/template/manifest.json` under `owners.skills` (a JSON object mapping slug → `"baseline"`). The CLI mirrors this manifest verbatim to `<target>/.claude/.baseline-manifest.json` on `freshInstall`/`forceInstall`/`merge`.
+A skill at `.claude/skills/<slug>/SKILL.md` is **baseline-owned** iff its YAML frontmatter declares `owner: baseline`. Baseline-owned skills are those that ship with the baseline; every other skill on disk — those without an `owner:` field, or those declaring `owner: user` — is user/third-party and out-of-scope of baseline audit checks. Absence-of-`owner` is the deliberate default so a project that already has its own skills can install the baseline without annotating any of those files. The build script `scripts/build-manifest.mjs` reads each `owner:` value at release time and emits the canonical baseline-skill set into the shipped manifest at `obj/template/.claude/manifest.json` under `owners.skills` (a JSON object mapping slug → `"baseline"`). The recursive install copies the manifest into the consumer target at `<target>/.claude/manifest.json` (same in-tree path, no special-case). The CLI separately writes `<target>/.claude/.baseline-manifest.json` post-install on `freshInstall`/`forceInstall`/`merge` — that file is the runtime snapshot of the target's actual on-disk hashes, consumed by `doctor` and `upgrade`. The two files coexist by design: the shipped manifest is frozen at release time and carries `owners.skills`; the runtime manifest is generated at install time and is hash-only.
 
-The audit at `.claude/skills/audit-baseline/audit.sh` consumes `manifest.owners.skills` as the canonical baseline-skill enumeration (replacing the previous hard-coded `EXPECTED_SKILLS` set). For every baseline-owned skill, the audit re-derives sha256 hashes from `manifest.files` and compares against on-disk content; a mismatch is reported as `hash mismatch at <path>` against the named slug. A baseline skill present in the manifest but absent from disk is reported as `baseline skill missing`. A SKILL.md whose `owner:` field is present but carries an invalid value (anything other than `baseline` or `user`) is reported as `invalid owner=<value>`. SKILL.md files without an `owner:` field are treated as user/third-party and silently skipped — they are excluded from the baseline count, the names-match check, and the hash-drift check, so installing the baseline into a project that already has its own skills never breaks the audit.
+The audit at `.claude/skills/audit-baseline/audit.sh` consumes `manifest.owners.skills` as the canonical baseline-skill enumeration (replacing the previous hard-coded `EXPECTED_SKILLS` set). It reads the manifest from `<root>/.claude/manifest.json` first (consumer projects) and falls back to `<root>/obj/template/.claude/manifest.json` (the baseline dev repo where `npm run build` writes the manifest). For every baseline-owned skill, the audit re-derives sha256 hashes from `manifest.files` and compares against on-disk content; a mismatch is reported as `hash mismatch at <path>` against the named slug. A baseline skill present in the manifest but absent from disk is reported as `baseline skill missing`. A SKILL.md whose `owner:` field is present but carries an invalid value (anything other than `baseline` or `user`) is reported as `invalid owner=<value>`. SKILL.md files without an `owner:` field are treated as user/third-party and silently skipped — they are excluded from the baseline count, the names-match check, and the hash-drift check, so installing the baseline into a project that already has its own skills never breaks the audit.
 
 The audit also verifies constitutional citation: CLAUDE.md SHALL contain the literal string "Article XI" and a reference to the manifest, and `docs/init/seed.md` SHALL contain "§17" and a manifest reference. Missing citations trigger FAIL with `CLAUDE.md missing Article XI citation` or `seed.md missing §17 citation`.