@friedbotstudio/create-baseline 0.8.0 → 0.8.1

package/obj/template/.claude/hooks/git_commit_guard.mjs

@@ -10,7 +10,7 @@
 //          --abbrev-ref HEAD`. Detached HEAD ("HEAD") → DENY explicitly.
 //        - On a branch matched by project.json → git.protected_branches
 //          (or when that key is null/absent → every branch protected),
-//          commits require fresh commit_consent (300s) and pushes require
+//          commits require fresh commit_consent (900s) and pushes require
 //          fresh push_consent (300s).
 //        - When git.branch_pattern is set and the current branch does NOT
 //          match the regex, commits are denied with the pattern surfaced.
@@ -179,7 +179,7 @@ function handleBash(cmd) {
 
   // Protected — require the matching consent token.
   if (isCommit) {
-    validateConsentToken(`${STATE_DIR}/commit_consent`, '.consent.commit_ttl_seconds', 300, 'Git Commit Guard', '/grant-commit');
+    validateConsentToken(`${STATE_DIR}/commit_consent`, '.consent.commit_ttl_seconds', 900, 'Git Commit Guard', '/grant-commit');
   } else {
     validateConsentToken(`${STATE_DIR}/push_consent`, '.consent.push_ttl_seconds', 300, 'Git Commit Guard', '/grant-push');
   }

package/obj/template/.claude/manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest_version": 3,
-  "generated_at": "2026-05-22T13:30:10.925Z",
+  "generated_at": "2026-05-22T15:13:25.707Z",
   "files": {
     ".claude/agents/swarm-worker.md": {
       "sha256": "1735a220f268c9765cb22e0567b728803f2edd7776cbde51dd017a9f062ae41f",
@@ -55,7 +55,7 @@
       "tier": "MECHANICAL"
     },
     ".claude/hooks/git_commit_guard.mjs": {
-      "sha256": "95449912110be43635c8130f06ff87d851fc0ebec89fda17b3290671710dfbf6",
+      "sha256": "dbea846f2e11a68054a902ee37ac2f11383fdfc9abff33fa2bdec0f4c373f610",
       "tier": "MECHANICAL"
     },
     ".claude/hooks/harness_continuation.sh": {
@@ -203,7 +203,7 @@
       "tier": "MECHANICAL"
     },
     ".claude/project.json": {
-      "sha256": "a81f9c1341a15831fe8dd558e376dfe38d5fd938aac6291a4c59529637a8d2c7",
+      "sha256": "752fe71917e2d0c38e756427af8ca0a01efe096cc633dced2f870edfc878c495",
       "tier": "NEVER_TOUCH"
     },
     ".claude/schemas/workflow-track.v1.json": {
@@ -227,7 +227,7 @@
       "tier": "MECHANICAL"
     },
     ".claude/skills/audit-baseline/audit.sh": {
-      "sha256": "6d799ea8b567ecf91757fa142f72795b1da0b4d8443e54b4d233dad5b98b5dab",
+      "sha256": "68011b46a05473237b9d1ce3d6c9c6d760b460e3416a749b2738504fbde6ab4f",
       "tier": "MECHANICAL"
     },
     ".claude/skills/audit-baseline/tests/fixtures/_pending_opener_only.md": {
@@ -267,7 +267,7 @@
       "tier": "MECHANICAL"
     },
     ".claude/skills/changelog/changelog.mjs": {
-      "sha256": "662ae8142ea55c70375e45d874f97b40bcb85b0d6e5378393be56aba1b254eee",
+      "sha256": "a00e9aae5d660424588a37774d13d44625012506e128cf51bb9198b9c9c518dd",
       "tier": "MECHANICAL"
     },
     ".claude/skills/changelog/classifier.mjs": {
@@ -279,7 +279,7 @@
       "tier": "MECHANICAL"
     },
     ".claude/skills/changelog/tests/consent-expired_test.sh": {
-      "sha256": "60351d32cb544af33a6929f898411e43d20ec258f620ebc08179754a74811cf1",
+      "sha256": "da950772c5f6938c81b7c2667d1807b0da838e1f8ea00d64970d2251692b7b87",
       "tier": "MECHANICAL"
     },
     ".claude/skills/changelog/tests/golden-path_test.sh": {
@@ -843,7 +843,7 @@
       "tier": "SEMANTIC"
     },
     "docs/init/seed.md": {
-      "sha256": "7c64057392b39289edf123e3395b67b8605c28b9ab35c102c9469f6974047c78",
+      "sha256": "d1c33da767f4311d1f1c5efc98157b5c09a0b80331d7992f0ca66ec48a6ee08d",
       "tier": "SEMANTIC"
     }
   },
@@ -889,5 +889,5 @@
       "verify": "baseline"
     }
   },
-  "build_id": "gha-26290648827"
+  "build_id": "gha-26295896640"
 }

package/obj/template/.claude/project.json

@@ -184,7 +184,7 @@
     }
   },
   "consent": {
-    "commit_ttl_seconds": 300,
+    "commit_ttl_seconds": 900,
     "gate_marker_ttl_seconds": 120,
     "push_ttl_seconds": 300
   },

package/obj/template/.claude/skills/audit-baseline/audit.sh

@@ -224,13 +224,17 @@ check_names("agents names match seed §4.2",   EXPECTED_AGENTS,   add_agents,
 # Skills canonical set comes from manifest.owners.skills (built by
 # scripts/build-manifest.mjs at release time). Falls back to disk_baseline_skills
 # when the manifest is missing (e.g., first audit before initial build).
+# Unlike hooks/agents/commands, the skills `disk_*` is `disk_baseline_skills`
+# (filtered to `owner: baseline`), so `add_skills` (project additions, which are
+# user/third-party by design) cannot be passed in here — they'd false-FAIL.
+# Per CLAUDE.md Article XI #5.
 _manifest_for_skills = load_manifest()
 if _manifest_for_skills is None:
     _canonical_skills = disk_baseline_skills
 else:
     _canonical_skills = set((_manifest_for_skills.get("owners") or {}).get("skills", {}).keys()) \
                         or disk_baseline_skills
-check_names("skills names match seed §4.3",   _canonical_skills, add_skills,   disk_baseline_skills)
+check_names("skills names match seed §4.3",   _canonical_skills, set(),        disk_baseline_skills)
 check_names("commands names match seed §4.4", EXPECTED_COMMANDS, set(),        disk_commands)
 
 # ---------- skill ownership (per-file hash drift + frontmatter validation) ----------
@@ -349,11 +353,23 @@ else:
 # The src/ tree mirrors the canonical paths with a `.template` suffix so
 # `npx @friedbotstudio/create-baseline` can discover and overlay deterministically.
 src_dir = root / "src"
+# Consumer-mode detection: the CLI overlay ships .claude/manifest.json into
+# every consumer project; src/ exists only in the baseline-dev repo as the
+# overlay source. Manifest present + src/ absent ⇒ legitimate consumer install
+# ⇒ skip the src/ checks instead of false-FAIL'ing. Per CLAUDE.md Appendix A.
+consumer_manifest = (root / ".claude" / "manifest.json").is_file()
 if not src_dir.is_dir():
-    add("src templates: directory", "FAIL", "missing src/")
+    if consumer_manifest:
+        add("src templates: directory", "PASS",
+            "consumer install (manifest present, src/ absent) — src/ checks skipped")
+    else:
+        add("src templates: directory", "FAIL", "missing src/")
+    _SKIP_SRC = True
 else:
     add("src templates: directory", "PASS", "")
+    _SKIP_SRC = False
 
+if not _SKIP_SRC:
     # CLAUDE.template.md — must exist and read as constitution-voice (or, in
     # the pre-Stage-2 transitional shape, at least the user-voice lede). The
     # test below tolerates either: dogfood-leak fails hard; constitutional
@@ -630,12 +646,13 @@ else:
     add("CLAUDE.md: Article X.2 present", "FAIL",
         "missing `### X.2 Design-task routing` heading — Article X.2 is the structural seam between design-ui and impeccable")
 
-template_claude = read_text("src/CLAUDE.template.md")
-if "### X.2 Design-task routing" in template_claude:
-    add("src/CLAUDE.template.md: Article X.2 mirrors", "PASS", "")
-else:
-    add("src/CLAUDE.template.md: Article X.2 mirrors", "FAIL",
-        "src template does not contain Article X.2 — template-drift will fail")
+if not _SKIP_SRC:
+    template_claude = read_text("src/CLAUDE.template.md")
+    if "### X.2 Design-task routing" in template_claude:
+        add("src/CLAUDE.template.md: Article X.2 mirrors", "PASS", "")
+    else:
+        add("src/CLAUDE.template.md: Article X.2 mirrors", "FAIL",
+            "src template does not contain Article X.2 — template-drift will fail")
 
 design_ui_skill = read_text(".claude/skills/design-ui/SKILL.md")
 if re.search(r'^description:.*orchestrat', design_ui_skill, re.MULTILINE | re.IGNORECASE):

package/obj/template/.claude/skills/changelog/changelog.mjs

@@ -20,7 +20,7 @@ import { previewProjectedVersion } from './version-preview.mjs';
 import { writeState } from './state-writer.mjs';
 import { appendUnderUnreleased } from './unreleased-writer.mjs';
 
-const TTL_SECONDS = 300;
+const TTL_SECONDS = 900;
 
 function parseCli() {
   const { values } = parseArgs({

package/obj/template/.claude/skills/changelog/tests/consent-expired_test.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Fixture-based integration test for AC-010: when commit_consent token is
-# stale (older than consent.commit_ttl_seconds, default 300s), the changelog
+# stale (older than consent.commit_ttl_seconds, default 900s), the changelog
 # skill exits non-zero with "consent expired" stderr, does NOT modify
 # CHANGELOG.md, and does NOT write the state file.
 #
@@ -16,7 +16,7 @@ PASS=0; FAIL=0; FAILED=()
 
 fail() { echo "  FAIL: $*"; return 1; }
 
-# Seed a tempdir with a stale commit_consent (epoch = now - 310s).
+# Seed a tempdir with a stale commit_consent (epoch = now - 910s).
 seed_stale_consent_project() {
   local proj="$1" slug="$2"
   mkdir -p "$proj/.claude/state"
@@ -29,8 +29,8 @@ seed_stale_consent_project() {
   echo "stale test" > thing.txt
   git add thing.txt
   git commit -q -m "feat: stale consent path"
-  # Stale token: epoch in the past, beyond 300s default TTL.
-  local stale_epoch; stale_epoch=$(( $(date +%s) - 310 ))
+  # Stale token: epoch in the past, beyond 900s default TTL.
+  local stale_epoch; stale_epoch=$(( $(date +%s) - 910 ))
   echo "$stale_epoch" > "$proj/.claude/state/commit_consent"
   echo "stale" >> "$proj/.claude/state/commit_consent"
   cat > "$proj/.claude/state/workflow.json" <<EOF

package/obj/template/docs/init/seed.md

@@ -531,7 +531,7 @@ Seed-level requirement: no stale workflow artifacts in the working tree after co
 - `artifacts.required_sections.{intake,brd,spec,rca}` — the canonical section lists.
 - `artifacts.required_diagrams.spec` — the six kinds (§4.7).
 - `swarm.max_parallel`, `swarm.isolation: "auto"`, `swarm.min_tasks_worth_swarming: 3`, `swarm.refuse_dirty_tree: true`, `swarm.exempt_path_prefixes`, `swarm.enforced_path_prefixes`.
-- `consent.commit_ttl_seconds: 300`.
+- `consent.commit_ttl_seconds: 900`.
 - `additions.{agents,skills,hooks,mcp_servers,swarm_worker_skills}` — names of every project-adopted addition the recommender emitted (just identifiers, no `command`/`why`/`tokens` payload). `additions.agents` stays empty in this baseline — the recommender does not propose new subagent types. `additions.swarm_worker_skills` lists stack-specific skills the `swarm-worker` template should preload via the `{{SKILLS}}` token at re-render time. `audit.sh` reads this manifest and unions each set with the baseline `EXPECTED_*` sets when checking names; counts are reframed as `"<total> = <baseline> + <project>"` so legitimate additions don't fail drift detection. Default state is five empty arrays.
 - Flip `configured: true`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@friedbotstudio/create-baseline",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Node CLI scaffolder that materializes the Claude Code baseline (hooks, skills, commands, MCP servers, governance docs) into a target project, with branded interactive install / upgrade / doctor flows. Run via `npx @friedbotstudio/create-baseline <target>`.",
   "type": "module",
   "bin": {

package/src/project.template.json

@@ -184,7 +184,7 @@
     }
   },
   "consent": {
-    "commit_ttl_seconds": 300,
+    "commit_ttl_seconds": 900,
     "gate_marker_ttl_seconds": 120,
     "push_ttl_seconds": 300
   },

package/src/seed.template.md

@@ -531,7 +531,7 @@ Seed-level requirement: no stale workflow artifacts in the working tree after co
 - `artifacts.required_sections.{intake,brd,spec,rca}` — the canonical section lists.
 - `artifacts.required_diagrams.spec` — the six kinds (§4.7).
 - `swarm.max_parallel`, `swarm.isolation: "auto"`, `swarm.min_tasks_worth_swarming: 3`, `swarm.refuse_dirty_tree: true`, `swarm.exempt_path_prefixes`, `swarm.enforced_path_prefixes`.
-- `consent.commit_ttl_seconds: 300`.
+- `consent.commit_ttl_seconds: 900`.
 - `additions.{agents,skills,hooks,mcp_servers,swarm_worker_skills}` — names of every project-adopted addition the recommender emitted (just identifiers, no `command`/`why`/`tokens` payload). `additions.agents` stays empty in this baseline — the recommender does not propose new subagent types. `additions.swarm_worker_skills` lists stack-specific skills the `swarm-worker` template should preload via the `{{SKILLS}}` token at re-render time. `audit.sh` reads this manifest and unions each set with the baseline `EXPECTED_*` sets when checking names; counts are reframed as `"<total> = <baseline> + <project>"` so legitimate additions don't fail drift detection. Default state is five empty arrays.
 - Flip `configured: true`.